542 files changed, 13977 insertions, 7143 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 80998958cf45..119d58db8342 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -385,8 +385,8 @@ config ACPI_CUSTOM_METHOD
           to override that restriction).
 
 config ACPI_BGRT
-        tristate "Boottime Graphics Resource Table support"
-        default n
+        bool "Boottime Graphics Resource Table support"
+        depends on EFI
         help
           This driver adds support for exposing the ACPI Boottime Graphics
           Resource Table, which allows the operating system to obtain
diff --git a/drivers/acpi/bgrt.c b/drivers/acpi/bgrt.c
index 6680df36b963..be6039958545 100644
--- a/drivers/acpi/bgrt.c
+++ b/drivers/acpi/bgrt.c
@@ -1,5 +1,6 @@
 /*
  * Copyright 2012 Red Hat, Inc <mjg@redhat.com>
+ * Copyright 2012 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -11,20 +12,10 @@
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/sysfs.h>
-#include <linux/io.h>
-#include <acpi/acpi.h>
-#include <acpi/acpi_bus.h>
+#include <linux/efi-bgrt.h>
 
-static struct acpi_table_bgrt *bgrt_tab;
 static struct kobject *bgrt_kobj;
 
-struct bmp_header {
-        u16 id;
-        u32 size;
-} __attribute ((packed));
-
-static struct bmp_header bmp_header;
-
 static ssize_t show_version(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
@@ -63,18 +54,7 @@ static DEVICE_ATTR(yoffset, S_IRUGO, show_yoffset, NULL);
 static ssize_t show_image(struct file *file, struct kobject *kobj,
                struct bin_attribute *attr, char *buf, loff_t off, size_t count)
 {
-        int size = attr->size;
-        void __iomem *image = attr->private;
-
-        if (off >= size) {
-                count = 0;
-        } else {
-                if (off + count > size)
-                        count = size - off;
-
-                memcpy_fromio(buf, image+off, count);
-        }
-
+        memcpy(buf, attr->private + off, count);
         return count;
 }
 
@@ -101,45 +81,18 @@ static struct attribute_group bgrt_attribute_group = {
 
 static int __init bgrt_init(void)
 {
-        acpi_status status;
         int ret;
-        void __iomem *bgrt;
 
-        if (acpi_disabled)
-                return -ENODEV;
-
-        status = acpi_get_table("BGRT", 0,
-                                (struct acpi_table_header **)&bgrt_tab);
-
-        if (ACPI_FAILURE(status))
+        if (!bgrt_image)
                 return -ENODEV;
 
         sysfs_bin_attr_init(&image_attr);
-
-        bgrt = ioremap(bgrt_tab->image_address, sizeof(struct bmp_header));
-
-        if (!bgrt) {
-                ret = -EINVAL;
-                goto out_err;
-        }
-
-        memcpy_fromio(&bmp_header, bgrt, sizeof(bmp_header));
-        image_attr.size = bmp_header.size;
-        iounmap(bgrt);
-
-        image_attr.private = ioremap(bgrt_tab->image_address, image_attr.size);
-
-        if (!image_attr.private) {
-                ret = -EINVAL;
-                goto out_err;
-        }
-
+        image_attr.private = bgrt_image;
+        image_attr.size = bgrt_image_size;
 
         bgrt_kobj = kobject_create_and_add("bgrt", acpi_kobj);
-        if (!bgrt_kobj) {
-                ret = -EINVAL;
-                goto out_iounmap;
-        }
+        if (!bgrt_kobj)
+                return -EINVAL;
 
         ret = sysfs_create_group(bgrt_kobj, &bgrt_attribute_group);
         if (ret)
@@ -155,22 +108,11 @@ out_group:
         sysfs_remove_group(bgrt_kobj, &bgrt_attribute_group);
 out_kobject:
         kobject_put(bgrt_kobj);
-out_iounmap:
-        iounmap(image_attr.private);
-out_err:
         return ret;
 }
 
-static void __exit bgrt_exit(void)
-{
-        iounmap(image_attr.private);
-        sysfs_remove_group(bgrt_kobj, &bgrt_attribute_group);
-        sysfs_remove_bin_file(bgrt_kobj, &image_attr);
-}
-
 module_init(bgrt_init);
-module_exit(bgrt_exit);
 
-MODULE_AUTHOR("Matthew Garrett");
+MODULE_AUTHOR("Matthew Garrett, Josh Triplett <josh@joshtriplett.org>");
 MODULE_DESCRIPTION("BGRT boot graphic support");
 MODULE_LICENSE("GPL");
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 9628652e080c..e0596954290b 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -237,6 +237,16 @@ static int __acpi_bus_get_power(struct acpi_device *device, int *state)
         } else if (result == ACPI_STATE_D3_HOT) {
                 result = ACPI_STATE_D3;
         }
+
+        /*
+         * If we were unsure about the device parent's power state up to this
+         * point, the fact that the device is in D0 implies that the parent has
+         * to be in D0 too.
+         */
+        if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
+            && result == ACPI_STATE_D0)
+                device->parent->power.state = ACPI_STATE_D0;
+
         *state = result;
 
  out:
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fc1803414629..40e38a06ba85 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -107,6 +107,7 @@ struct acpi_power_resource {
 
         /* List of devices relying on this power resource */
         struct acpi_power_resource_device *devices;
+        struct mutex devices_lock;
 };
 
 static struct list_head acpi_power_resource_list;
@@ -225,7 +226,6 @@ static void acpi_power_on_device(struct acpi_power_managed_device *device)
 
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
-        struct acpi_power_resource_device *device_list = resource->devices;
         acpi_status status = AE_OK;
 
         status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
@@ -238,19 +238,15 @@ static int __acpi_power_on(struct acpi_power_resource *resource)
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Power resource [%s] turned on\n",
                           resource->name));
 
-        while (device_list) {
-                acpi_power_on_device(device_list->device);
-
-                device_list = device_list->next;
-        }
-
         return 0;
 }
 
 static int acpi_power_on(acpi_handle handle)
 {
         int result = 0;
+        bool resume_device = false;
         struct acpi_power_resource *resource = NULL;
+        struct acpi_power_resource_device *device_list;
 
         result = acpi_power_get_context(handle, &resource);
         if (result)
@@ -266,10 +262,25 @@ static int acpi_power_on(acpi_handle handle)
                 result = __acpi_power_on(resource);
                 if (result)
                         resource->ref_count--;
+                else
+                        resume_device = true;
         }
 
         mutex_unlock(&resource->resource_lock);
 
+        if (!resume_device)
+                return result;
+
+        mutex_lock(&resource->devices_lock);
+
+        device_list = resource->devices;
+        while (device_list) {
+                acpi_power_on_device(device_list->device);
+                device_list = device_list->next;
+        }
+
+        mutex_unlock(&resource->devices_lock);
+
         return result;
 }
 
@@ -355,7 +366,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
         if (acpi_power_get_context(res_handle, &resource))
                 return;
 
-        mutex_lock(&resource->resource_lock);
+        mutex_lock(&resource->devices_lock);
         prev = NULL;
         curr = resource->devices;
         while (curr) {
@@ -372,7 +383,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
                 prev = curr;
                 curr = curr->next;
         }
-        mutex_unlock(&resource->resource_lock);
+        mutex_unlock(&resource->devices_lock);
 }
 
 /* Unlink dev from all power resources in _PR0 */
@@ -414,10 +425,10 @@ static int __acpi_power_resource_register_device(
 
         power_resource_device->device = powered_device;
 
-        mutex_lock(&resource->resource_lock);
+        mutex_lock(&resource->devices_lock);
         power_resource_device->next = resource->devices;
         resource->devices = power_resource_device;
-        mutex_unlock(&resource->resource_lock);
+        mutex_unlock(&resource->devices_lock);
 
         return 0;
 }
@@ -462,7 +473,7 @@ int acpi_power_resource_register_device(struct device *dev, acpi_handle handle)
         return ret;
 
 no_power_resource:
-        printk(KERN_WARNING PREFIX "Invalid Power Resource to register!");
+        printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");
         return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(acpi_power_resource_register_device);
@@ -721,6 +732,7 @@ static int acpi_power_add(struct acpi_device *device)
 
         resource->device = device;
         mutex_init(&resource->resource_lock);
+        mutex_init(&resource->devices_lock);
         strcpy(resource->name, device->pnp.bus_id);
         strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 50d5dea0ff59..7862d17976b7 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -268,6 +268,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
           PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },
+        /* JMicron 362B and 362C have an AHCI function with IDE class code */
+        { PCI_VDEVICE(JMICRON, 0x2362), board_ahci_ign_iferr },
+        { PCI_VDEVICE(JMICRON, 0x236f), board_ahci_ign_iferr },
 
         /* ATI */
         { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 */
@@ -393,6 +396,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
         { PCI_DEVICE(0x1b4b, 0x917a),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
+        { PCI_DEVICE(0x1b4b, 0x9192),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
         { PCI_DEVICE(0x1b4b, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
 
@@ -400,7 +405,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
 
         /* Asmedia */
-        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci },   /* ASM1060 */
+        { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
+        { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
         /* Generic, PCI class code for AHCI */
         { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index a89734621e51..5b6b1d8e6cc0 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -16,12 +16,14 @@
 #include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/irqdomain.h>
+#include <linux/pm_runtime.h>
 #include <linux/slab.h>
 
 #include "internal.h"
 
 struct regmap_irq_chip_data {
         struct mutex lock;
+        struct irq_chip irq_chip;
 
         struct regmap *map;
         const struct regmap_irq_chip *chip;
@@ -59,6 +61,14 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
         struct regmap_irq_chip_data *d = irq_data_get_irq_chip_data(data);
         struct regmap *map = d->map;
         int i, ret;
+        u32 reg;
+
+        if (d->chip->runtime_pm) {
+                ret = pm_runtime_get_sync(map->dev);
+                if (ret < 0)
+                        dev_err(map->dev, "IRQ sync failed to resume: %d\n",
+                                ret);
+        }
 
         /*
          * If there's been a change in the mask write it back to the
@@ -66,15 +76,22 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
          * suppress pointless writes.
          */
         for (i = 0; i < d->chip->num_regs; i++) {
-                ret = regmap_update_bits(d->map, d->chip->mask_base +
-                                                (i * map->reg_stride *
-                                                d->irq_reg_stride),
+                reg = d->chip->mask_base +
+                        (i * map->reg_stride * d->irq_reg_stride);
+                if (d->chip->mask_invert)
+                        ret = regmap_update_bits(d->map, reg,
+                                         d->mask_buf_def[i], ~d->mask_buf[i]);
+                else
+                        ret = regmap_update_bits(d->map, reg,
                                          d->mask_buf_def[i], d->mask_buf[i]);
                 if (ret != 0)
                         dev_err(d->map->dev, "Failed to sync masks in %x\n",
-                                d->chip->mask_base + (i * map->reg_stride));
+                                reg);
         }
 
+        if (d->chip->runtime_pm)
+                pm_runtime_put(map->dev);
+
         /* If we've changed our wakeup count propagate it to the parent */
         if (d->wake_count < 0)
                 for (i = d->wake_count; i < 0; i++)
@@ -128,8 +145,7 @@ static int regmap_irq_set_wake(struct irq_data *data, unsigned int on)
         return 0;
 }
 
-static struct irq_chip regmap_irq_chip = {
-        .name                   = "regmap",
+static const struct irq_chip regmap_irq_chip = {
         .irq_bus_lock           = regmap_irq_lock,
         .irq_bus_sync_unlock    = regmap_irq_sync_unlock,
         .irq_disable            = regmap_irq_disable,
@@ -144,6 +160,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
         struct regmap *map = data->map;
         int ret, i;
         bool handled = false;
+        u32 reg;
+
+        if (chip->runtime_pm) {
+                ret = pm_runtime_get_sync(map->dev);
+                if (ret < 0) {
+                        dev_err(map->dev, "IRQ thread failed to resume: %d\n",
+                                ret);
+                        return IRQ_NONE;
+                }
+        }
 
         /*
          * Ignore masked IRQs and ack if we need to; we ack early so
@@ -160,20 +186,20 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
                 if (ret != 0) {
                         dev_err(map->dev, "Failed to read IRQ status: %d\n",
                                         ret);
+                        if (chip->runtime_pm)
+                                pm_runtime_put(map->dev);
                         return IRQ_NONE;
                 }
 
                 data->status_buf[i] &= ~data->mask_buf[i];
 
                 if (data->status_buf[i] && chip->ack_base) {
-                        ret = regmap_write(map, chip->ack_base +
-                                                (i * map->reg_stride *
-                                                data->irq_reg_stride),
-                                           data->status_buf[i]);
+                        reg = chip->ack_base +
+                                (i * map->reg_stride * data->irq_reg_stride);
+                        ret = regmap_write(map, reg, data->status_buf[i]);
                         if (ret != 0)
                                 dev_err(map->dev, "Failed to ack 0x%x: %d\n",
-                                        chip->ack_base + (i * map->reg_stride),
-                                        ret);
+                                        reg, ret);
                 }
         }
 
@@ -185,6 +211,9 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
                 }
         }
 
+        if (chip->runtime_pm)
+                pm_runtime_put(map->dev);
+
         if (handled)
                 return IRQ_HANDLED;
         else
@@ -197,7 +226,7 @@ static int regmap_irq_map(struct irq_domain *h, unsigned int virq,
         struct regmap_irq_chip_data *data = h->host_data;
 
         irq_set_chip_data(virq, data);
-        irq_set_chip_and_handler(virq, &regmap_irq_chip, handle_edge_irq);
+        irq_set_chip(virq, &data->irq_chip);
         irq_set_nested_thread(virq, 1);
 
         /* ARM needs us to explicitly flag the IRQ as valid
@@ -238,6 +267,7 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
         struct regmap_irq_chip_data *d;
         int i;
         int ret = -ENOMEM;
+        u32 reg;
 
         for (i = 0; i < chip->num_irqs; i++) {
                 if (chip->irqs[i].reg_offset % map->reg_stride)
@@ -284,6 +314,13 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                         goto err_alloc;
         }
 
+        d->irq_chip = regmap_irq_chip;
+        d->irq_chip.name = chip->name;
+        if (!chip->wake_base) {
+                d->irq_chip.irq_set_wake = NULL;
+                d->irq_chip.flags |= IRQCHIP_MASK_ON_SUSPEND |
+                                     IRQCHIP_SKIP_SET_WAKE;
+        }
         d->irq = irq;
         d->map = map;
         d->chip = chip;
@@ -303,16 +340,37 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
         /* Mask all the interrupts by default */
         for (i = 0; i < chip->num_regs; i++) {
                 d->mask_buf[i] = d->mask_buf_def[i];
-                ret = regmap_write(map, chip->mask_base + (i * map->reg_stride
-                                   * d->irq_reg_stride),
-                                   d->mask_buf[i]);
+                reg = chip->mask_base +
+                        (i * map->reg_stride * d->irq_reg_stride);
+                if (chip->mask_invert)
+                        ret = regmap_update_bits(map, reg,
+                                         d->mask_buf[i], ~d->mask_buf[i]);
+                else
+                        ret = regmap_update_bits(map, reg,
+                                         d->mask_buf[i], d->mask_buf[i]);
                 if (ret != 0) {
                         dev_err(map->dev, "Failed to set masks in 0x%x: %d\n",
-                                chip->mask_base + (i * map->reg_stride), ret);
+                                reg, ret);
                         goto err_alloc;
                 }
         }
 
+        /* Wake is disabled by default */
+        if (d->wake_buf) {
+                for (i = 0; i < chip->num_regs; i++) {
+                        d->wake_buf[i] = d->mask_buf_def[i];
+                        reg = chip->wake_base +
+                                (i * map->reg_stride * d->irq_reg_stride);
+                        ret = regmap_update_bits(map, reg, d->wake_buf[i],
+                                                 d->wake_buf[i]);
+                        if (ret != 0) {
+                                dev_err(map->dev, "Failed to set masks in 0x%x: %d\n",
+                                        reg, ret);
+                                goto err_alloc;
+                        }
+                }
+        }
+
         if (irq_base)
                 d->domain = irq_domain_add_legacy(map->dev->of_node,
                                                   chip->num_irqs, irq_base, 0,
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index c241ae2f2f10..52069d29ff12 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -659,13 +659,12 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
  * new cache.  This can be used to restore the cache to defaults or to
  * update the cache configuration to reflect runtime discovery of the
  * hardware.
+ *
+ * No explicit locking is done here, the user needs to ensure that
+ * this function will not race with other calls to regmap.
  */
 int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 {
-        int ret;
-
-        map->lock(map);
-
         regcache_exit(map);
         regmap_debugfs_exit(map);
 
@@ -681,11 +680,7 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
         map->cache_bypass = false;
         map->cache_only = false;
 
-        ret = regcache_init(map, config);
-
-        map->unlock(map);
-
-        return ret;
+        return regcache_init(map, config);
 }
 EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index de0435e63b02..887f68f6d79a 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -35,6 +35,7 @@ new_skb(ulong len)
                 skb_reset_mac_header(skb);
                 skb_reset_network_header(skb);
                 skb->protocol = __constant_htons(ETH_P_AOE);
+                skb_checksum_none_assert(skb);
         }
         return skb;
 }
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 38aa6dda6b81..da3311129a0c 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,
                                 }
                         break;
                         case CMD_PROTOCOL_ERR:
+                                cmd->result = DID_ERROR << 16;
                                 dev_warn(&h->pdev->dev,
                                         "%p has protocol error\n", c);
                         break;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a8fddeb3d638..f946d31d6917 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -1148,11 +1148,15 @@ static bool mtip_pause_ncq(struct mtip_port *port,
         reply = port->rxfis + RX_FIS_D2H_REG;
         task_file_data = readl(port->mmio+PORT_TFDATA);
 
-        if ((task_file_data & 1) || (fis->command == ATA_CMD_SEC_ERASE_UNIT))
+        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+                clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
+
+        if ((task_file_data & 1))
                 return false;
 
         if (fis->command == ATA_CMD_SEC_ERASE_PREP) {
                 set_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+                set_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
                 port->ic_pause_timer = jiffies;
                 return true;
         } else if ((fis->command == ATA_CMD_DOWNLOAD_MICRO) &&
@@ -1900,7 +1904,7 @@ static int exec_drive_command(struct mtip_port *port, u8 *command,
         int rv = 0, xfer_sz = command[3];
 
         if (xfer_sz) {
-                if (user_buffer)
+                if (!user_buffer)
                         return -EFAULT;
 
                 buf = dmam_alloc_coherent(&port->dd->pdev->dev,
@@ -2043,7 +2047,7 @@ static void mtip_set_timeout(struct host_to_dev_fis *fis, unsigned int *timeout)
                 *timeout = 240000; /* 4 minutes */
                 break;
         case ATA_CMD_STANDBYNOW1:
-                *timeout = 10000;  /* 10 seconds */
+                *timeout = 120000;  /* 2 minutes */
                 break;
         case 0xF7:
         case 0xFA:
@@ -2588,9 +2592,6 @@ static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
         if (!len || size)
                 return 0;
 
-        if (size < 0)
-                return -EINVAL;
-
         size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
@@ -2660,9 +2661,6 @@ static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
         if (!len || size)
                 return 0;
 
-        if (size < 0)
-                return -EINVAL;
-
         size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                         dd->port->flags);
         size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
@@ -3214,8 +3212,8 @@ static int mtip_hw_init(struct driver_data *dd)
                                 "Unable to check write protect progress\n");
         else
                 dev_info(&dd->pdev->dev,
-                                "Write protect progress: %d%% (%d blocks)\n",
-                                attr242.cur, attr242.data);
+                                "Write protect progress: %u%% (%u blocks)\n",
+                                attr242.cur, le32_to_cpu(attr242.data));
         return rv;
 
 out3:
@@ -3619,6 +3617,10 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
                         bio_endio(bio, -ENODATA);
                         return;
                 }
+                if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))) {
+                        bio_endio(bio, -ENODATA);
+                        return;
+                }
         }
 
         if (unlikely(!bio_has_data(bio))) {
@@ -4168,7 +4170,13 @@ static void mtip_pci_shutdown(struct pci_dev *pdev)
 
 /* Table of device ids supported by this driver. */
 static DEFINE_PCI_DEVICE_TABLE(mtip_pci_tbl) = {
-        {  PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320S_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P325M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P425M_DEVICE_ID) },
         { 0 }
 };
 
@@ -4199,12 +4207,12 @@ static int __init mtip_init(void)
 {
         int error;
 
-        printk(KERN_INFO MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
+        pr_info(MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
 
         /* Allocate a major block device number to use with this driver. */
         error = register_blkdev(0, MTIP_DRV_NAME);
         if (error <= 0) {
-                printk(KERN_ERR "Unable to register block device (%d)\n",
+                pr_err("Unable to register block device (%d)\n",
                 error);
                 return -EBUSY;
         }
@@ -4213,7 +4221,7 @@ static int __init mtip_init(void)
         if (!dfs_parent) {
                 dfs_parent = debugfs_create_dir("rssd", NULL);
                 if (IS_ERR_OR_NULL(dfs_parent)) {
-                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        pr_warn("Error creating debugfs parent\n");
                         dfs_parent = NULL;
                 }
         }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index f51fc23d17bb..18627a1d04c5 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -76,7 +76,13 @@
 
 /* Micron Vendor ID & P320x SSD Device ID */
 #define PCI_VENDOR_ID_MICRON    0x1344
-#define P320_DEVICE_ID          0x5150
+#define P320H_DEVICE_ID         0x5150
+#define P320M_DEVICE_ID         0x5151
+#define P320S_DEVICE_ID         0x5152
+#define P325M_DEVICE_ID         0x5153
+#define P420H_DEVICE_ID         0x5160
+#define P420M_DEVICE_ID         0x5161
+#define P425M_DEVICE_ID         0x5163
 
 /* Driver name and version strings */
 #define MTIP_DRV_NAME           "mtip32xx"
@@ -131,10 +137,12 @@ enum {
         MTIP_PF_SVC_THD_STOP_BIT    = 8,
 
         /* below are bit numbers in 'dd_flag' defined in driver_data */
+        MTIP_DDF_SEC_LOCK_BIT       = 0,
         MTIP_DDF_REMOVE_PENDING_BIT = 1,
         MTIP_DDF_OVER_TEMP_BIT      = 2,
         MTIP_DDF_WRITE_PROTECT_BIT  = 3,
         MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
+                                (1 << MTIP_DDF_SEC_LOCK_BIT) | \
                                 (1 << MTIP_DDF_OVER_TEMP_BIT) | \
                                 (1 << MTIP_DDF_WRITE_PROTECT_BIT)),
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index d07c9f7fded6..0c03411c59eb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -449,6 +449,14 @@ static void nbd_clear_que(struct nbd_device *nbd)
                 req->errors++;
                 nbd_end_request(req);
         }
+
+        while (!list_empty(&nbd->waiting_queue)) {
+                req = list_entry(nbd->waiting_queue.next, struct request,
+                                 queuelist);
+                list_del_init(&req->queuelist);
+                req->errors++;
+                nbd_end_request(req);
+        }
 }
 
 
@@ -598,6 +606,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd->file = NULL;
                 nbd_clear_que(nbd);
                 BUG_ON(!list_empty(&nbd->queue_head));
+                BUG_ON(!list_empty(&nbd->waiting_queue));
                 if (file)
                         fput(file);
                 return 0;
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index c95ca0f8ff84..931769e133e5 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -79,6 +79,7 @@ struct nvme_dev {
         char serial[20];
         char model[40];
         char firmware_rev[8];
+        u32 max_hw_sectors;
 };
 
 /*
@@ -835,15 +836,15 @@ static int nvme_identify(struct nvme_dev *dev, unsigned nsid, unsigned cns,
 }
 
 static int nvme_get_features(struct nvme_dev *dev, unsigned fid,
-                                unsigned dword11, dma_addr_t dma_addr)
+                                unsigned nsid, dma_addr_t dma_addr)
 {
         struct nvme_command c;
 
         memset(&c, 0, sizeof(c));
         c.features.opcode = nvme_admin_get_features;
+        c.features.nsid = cpu_to_le32(nsid);
         c.features.prp1 = cpu_to_le64(dma_addr);
         c.features.fid = cpu_to_le32(fid);
-        c.features.dword11 = cpu_to_le32(dword11);
 
         return nvme_submit_admin_cmd(dev, &c, NULL);
 }
@@ -862,11 +863,51 @@ static int nvme_set_features(struct nvme_dev *dev, unsigned fid,
         return nvme_submit_admin_cmd(dev, &c, result);
 }
 
+/**
+ * nvme_cancel_ios - Cancel outstanding I/Os
+ * @queue: The queue to cancel I/Os on
+ * @timeout: True to only cancel I/Os which have timed out
+ */
+static void nvme_cancel_ios(struct nvme_queue *nvmeq, bool timeout)
+{
+        int depth = nvmeq->q_depth - 1;
+        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
+        unsigned long now = jiffies;
+        int cmdid;
+
+        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
+                void *ctx;
+                nvme_completion_fn fn;
+                static struct nvme_completion cqe = {
+                        .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1,
+                };
+
+                if (timeout && !time_after(now, info[cmdid].timeout))
+                        continue;
+                dev_warn(nvmeq->q_dmadev, "Cancelling I/O %d\n", cmdid);
+                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
+                fn(nvmeq->dev, ctx, &cqe);
+        }
+}
+
+static void nvme_free_queue_mem(struct nvme_queue *nvmeq)
+{
+        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
+                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
+        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
+                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
+        kfree(nvmeq);
+}
+
 static void nvme_free_queue(struct nvme_dev *dev, int qid)
 {
         struct nvme_queue *nvmeq = dev->queues[qid];
         int vector = dev->entry[nvmeq->cq_vector].vector;
 
+        spin_lock_irq(&nvmeq->q_lock);
+        nvme_cancel_ios(nvmeq, false);
+        spin_unlock_irq(&nvmeq->q_lock);
+
         irq_set_affinity_hint(vector, NULL);
         free_irq(vector, nvmeq);
 
@@ -876,18 +917,15 @@ static void nvme_free_queue(struct nvme_dev *dev, int qid)
                 adapter_delete_cq(dev, qid);
         }
 
-        dma_free_coherent(nvmeq->q_dmadev, CQ_SIZE(nvmeq->q_depth),
-                                (void *)nvmeq->cqes, nvmeq->cq_dma_addr);
-        dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth),
-                                        nvmeq->sq_cmds, nvmeq->sq_dma_addr);
-        kfree(nvmeq);
+        nvme_free_queue_mem(nvmeq);
 }
 
 static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
                                                         int depth, int vector)
 {
         struct device *dmadev = &dev->pci_dev->dev;
-        unsigned extra = (depth / 8) + (depth * sizeof(struct nvme_cmd_info));
+        unsigned extra = DIV_ROUND_UP(depth, 8) + (depth *
+                                                sizeof(struct nvme_cmd_info));
         struct nvme_queue *nvmeq = kzalloc(sizeof(*nvmeq) + extra, GFP_KERNEL);
         if (!nvmeq)
                 return NULL;
@@ -975,7 +1013,7 @@ static __devinit struct nvme_queue *nvme_create_queue(struct nvme_dev *dev,
 
 static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
 {
-        int result;
+        int result = 0;
         u32 aqa;
         u64 cap;
         unsigned long timeout;
@@ -1005,17 +1043,22 @@ static int __devinit nvme_configure_admin_queue(struct nvme_dev *dev)
         timeout = ((NVME_CAP_TIMEOUT(cap) + 1) * HZ / 2) + jiffies;
         dev->db_stride = NVME_CAP_STRIDE(cap);
 
-        while (!(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
+        while (!result && !(readl(&dev->bar->csts) & NVME_CSTS_RDY)) {
                 msleep(100);
                 if (fatal_signal_pending(current))
-                        return -EINTR;
+                        result = -EINTR;
                 if (time_after(jiffies, timeout)) {
                         dev_err(&dev->pci_dev->dev,
                                 "Device not ready; aborting initialisation\n");
-                        return -ENODEV;
+                        result = -ENODEV;
                 }
         }
 
+        if (result) {
+                nvme_free_queue_mem(nvmeq);
+                return result;
+        }
+
         result = queue_request_irq(dev, nvmeq, "nvme admin");
         dev->queues[0] = nvmeq;
         return result;
@@ -1037,6 +1080,8 @@ static struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
         offset = offset_in_page(addr);
         count = DIV_ROUND_UP(offset + length, PAGE_SIZE);
         pages = kcalloc(count, sizeof(*pages), GFP_KERNEL);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
 
         err = get_user_pages_fast(addr, count, 1, pages);
         if (err < count) {
@@ -1146,14 +1191,13 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
         return status;
 }
 
-static int nvme_user_admin_cmd(struct nvme_ns *ns,
+static int nvme_user_admin_cmd(struct nvme_dev *dev,
                                         struct nvme_admin_cmd __user *ucmd)
 {
-        struct nvme_dev *dev = ns->dev;
         struct nvme_admin_cmd cmd;
         struct nvme_command c;
         int status, length;
-        struct nvme_iod *iod;
+        struct nvme_iod *uninitialized_var(iod);
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -1204,7 +1248,7 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
         case NVME_IOCTL_ID:
                 return ns->ns_id;
         case NVME_IOCTL_ADMIN_CMD:
-                return nvme_user_admin_cmd(ns, (void __user *)arg);
+                return nvme_user_admin_cmd(ns->dev, (void __user *)arg);
         case NVME_IOCTL_SUBMIT_IO:
                 return nvme_submit_io(ns, (void __user *)arg);
         default:
@@ -1218,26 +1262,6 @@ static const struct block_device_operations nvme_fops = {
         .compat_ioctl   = nvme_ioctl,
 };
 
-static void nvme_timeout_ios(struct nvme_queue *nvmeq)
-{
-        int depth = nvmeq->q_depth - 1;
-        struct nvme_cmd_info *info = nvme_cmd_info(nvmeq);
-        unsigned long now = jiffies;
-        int cmdid;
-
-        for_each_set_bit(cmdid, nvmeq->cmdid_data, depth) {
-                void *ctx;
-                nvme_completion_fn fn;
-                static struct nvme_completion cqe = { .status = cpu_to_le16(NVME_SC_ABORT_REQ) << 1, };
-
-                if (!time_after(now, info[cmdid].timeout))
-                        continue;
-                dev_warn(nvmeq->q_dmadev, "Timing out I/O %d\n", cmdid);
-                ctx = cancel_cmdid(nvmeq, cmdid, &fn);
-                fn(nvmeq->dev, ctx, &cqe);
-        }
-}
-
 static void nvme_resubmit_bios(struct nvme_queue *nvmeq)
 {
         while (bio_list_peek(&nvmeq->sq_cong)) {
@@ -1269,7 +1293,7 @@ static int nvme_kthread(void *data)
                                 spin_lock_irq(&nvmeq->q_lock);
                                 if (nvme_process_cq(nvmeq))
                                         printk("process_cq did something\n");
-                                nvme_timeout_ios(nvmeq);
+                                nvme_cancel_ios(nvmeq, true);
                                 nvme_resubmit_bios(nvmeq);
                                 spin_unlock_irq(&nvmeq->q_lock);
                         }
@@ -1339,6 +1363,9 @@ static struct nvme_ns *nvme_alloc_ns(struct nvme_dev *dev, int nsid,
         ns->disk = disk;
         lbaf = id->flbas & 0xf;
         ns->lba_shift = id->lbaf[lbaf].ds;
+        blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
+        if (dev->max_hw_sectors)
+                blk_queue_max_hw_sectors(ns->queue, dev->max_hw_sectors);
 
         disk->major = nvme_major;
         disk->minors = NVME_MINORS;
@@ -1383,7 +1410,7 @@ static int set_queue_count(struct nvme_dev *dev, int count)
 
 static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
 {
-        int result, cpu, i, nr_io_queues, db_bar_size;
+        int result, cpu, i, nr_io_queues, db_bar_size, q_depth;
 
         nr_io_queues = num_online_cpus();
         result = set_queue_count(dev, nr_io_queues);
@@ -1429,9 +1456,10 @@ static int __devinit nvme_setup_io_queues(struct nvme_dev *dev)
                 cpu = cpumask_next(cpu, cpu_online_mask);
         }
 
+        q_depth = min_t(int, NVME_CAP_MQES(readq(&dev->bar->cap)) + 1,
+                                                                NVME_Q_DEPTH);
         for (i = 0; i < nr_io_queues; i++) {
-                dev->queues[i + 1] = nvme_create_queue(dev, i + 1,
-                                                        NVME_Q_DEPTH, i);
+                dev->queues[i + 1] = nvme_create_queue(dev, i + 1, q_depth, i);
                 if (IS_ERR(dev->queues[i + 1]))
                         return PTR_ERR(dev->queues[i + 1]);
                 dev->queue_count++;
@@ -1480,6 +1508,10 @@ static int __devinit nvme_dev_add(struct nvme_dev *dev)
         memcpy(dev->serial, ctrl->sn, sizeof(ctrl->sn));
         memcpy(dev->model, ctrl->mn, sizeof(ctrl->mn));
         memcpy(dev->firmware_rev, ctrl->fr, sizeof(ctrl->fr));
+        if (ctrl->mdts) {
+                int shift = NVME_CAP_MPSMIN(readq(&dev->bar->cap)) + 12;
+                dev->max_hw_sectors = 1 << (ctrl->mdts + shift - 9);
+        }
 
         id_ns = mem;
         for (i = 1; i <= nn; i++) {
@@ -1523,8 +1555,6 @@ static int nvme_dev_remove(struct nvme_dev *dev)
         list_del(&dev->node);
         spin_unlock(&dev_list_lock);
 
-        /* TODO: wait all I/O finished or cancel them */
-
         list_for_each_entry_safe(ns, next, &dev->namespaces, list) {
                 list_del(&ns->list);
                 del_gendisk(ns->disk);
@@ -1560,15 +1590,33 @@ static void nvme_release_prp_pools(struct nvme_dev *dev)
         dma_pool_destroy(dev->prp_small_pool);
 }
 
-/* XXX: Use an ida or something to let remove / add work correctly */
-static void nvme_set_instance(struct nvme_dev *dev)
+static DEFINE_IDA(nvme_instance_ida);
+
+static int nvme_set_instance(struct nvme_dev *dev)
 {
-        static int instance;
-        dev->instance = instance++;
+        int instance, error;
+
+        do {
+                if (!ida_pre_get(&nvme_instance_ida, GFP_KERNEL))
+                        return -ENODEV;
+
+                spin_lock(&dev_list_lock);
+                error = ida_get_new(&nvme_instance_ida, &instance);
+                spin_unlock(&dev_list_lock);
+        } while (error == -EAGAIN);
+
+        if (error)
+                return -ENODEV;
+
+        dev->instance = instance;
+        return 0;
 }
 
 static void nvme_release_instance(struct nvme_dev *dev)
 {
+        spin_lock(&dev_list_lock);
+        ida_remove(&nvme_instance_ida, dev->instance);
+        spin_unlock(&dev_list_lock);
 }
 
 static int __devinit nvme_probe(struct pci_dev *pdev,
@@ -1601,7 +1649,10 @@ static int __devinit nvme_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, dev);
         dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
-        nvme_set_instance(dev);
+        result = nvme_set_instance(dev);
+        if (result)
+                goto disable;
+
         dev->entry[0].vector = pdev->irq;
 
         result = nvme_setup_prp_pools(dev);
@@ -1704,15 +1755,17 @@ static struct pci_driver nvme_driver = {
 
 static int __init nvme_init(void)
 {
-        int result = -EBUSY;
+        int result;
 
         nvme_thread = kthread_run(nvme_kthread, NULL, "nvme");
         if (IS_ERR(nvme_thread))
                 return PTR_ERR(nvme_thread);
 
-        nvme_major = register_blkdev(nvme_major, "nvme");
-        if (nvme_major <= 0)
+        result = register_blkdev(nvme_major, "nvme");
+        if (result < 0)
                 goto kill_kthread;
+        else if (result > 0)
+                nvme_major = result;
 
         result = pci_register_driver(&nvme_driver);
         if (result)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 9917943a3572..54a55f03115d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -246,13 +246,12 @@ static int rbd_open(struct block_device *bdev, fmode_t mode)
 {
         struct rbd_device *rbd_dev = bdev->bd_disk->private_data;
 
-        rbd_get_dev(rbd_dev);
-
-        set_device_ro(bdev, rbd_dev->read_only);
-
         if ((mode & FMODE_WRITE) && rbd_dev->read_only)
                 return -EROFS;
 
+        rbd_get_dev(rbd_dev);
+        set_device_ro(bdev, rbd_dev->read_only);
+
         return 0;
 }
 
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 73f196ca713f..c6decb901e5e 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pending_req *req)
                 invcount++;
         }
 
-        ret = gnttab_unmap_refs(unmap, pages, invcount, false);
+        ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
         BUG_ON(ret);
 }
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 11f36e502136..fc2de5528dcc 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -86,6 +86,7 @@ static struct usb_device_id ath3k_table[] = {
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C) },
+        { USB_DEVICE(0x0489, 0xE036) },
 
         { }     /* Terminating entry */
 };
@@ -109,6 +110,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
 
         { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index cef3bac1a543..654e248763ef 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -52,6 +52,9 @@ static struct usb_device_id btusb_table[] = {
         /* Generic Bluetooth USB device */
         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+        /* Apple-specific (Broadcom) devices */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+
         /* Broadcom SoftSailing reporting vendor specific */
         { USB_DEVICE(0x0a5c, 0x21e1) },
 
@@ -94,16 +97,14 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0489, 0xe042) },
-        { USB_DEVICE(0x0a5c, 0x21e3) },
-        { USB_DEVICE(0x0a5c, 0x21e6) },
-        { USB_DEVICE(0x0a5c, 0x21e8) },
-        { USB_DEVICE(0x0a5c, 0x21f3) },
-        { USB_DEVICE(0x0a5c, 0x21f4) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         /* Foxconn - Hon Hai */
         { USB_DEVICE(0x0489, 0xe033) },
 
+        /*Broadcom devices with vendor specific id */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+
         { }     /* Terminating entry */
 };
 
@@ -141,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 
         /* Broadcom BCM2035 */
         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 5869ea387054..72ce247a0e8d 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -1,4 +1,5 @@
 # common clock types
+obj-$(CONFIG_HAVE_CLK)          += clk-devres.o
 obj-$(CONFIG_CLKDEV_LOOKUP)     += clkdev.o
 obj-$(CONFIG_COMMON_CLK)        += clk.o clk-fixed-rate.o clk-gate.o \
                                    clk-mux.o clk-divider.o clk-fixed-factor.o
diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c
new file mode 100644
index 000000000000..8f571548870f
--- /dev/null
+++ b/drivers/clk/clk-devres.c
@@ -0,0 +1,55 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/export.h>
+#include <linux/gfp.h>
+
+static void devm_clk_release(struct device *dev, void *res)
+{
+        clk_put(*(struct clk **)res);
+}
+
+struct clk *devm_clk_get(struct device *dev, const char *id)
+{
+        struct clk **ptr, *clk;
+
+        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+
+        clk = clk_get(dev, id);
+        if (!IS_ERR(clk)) {
+                *ptr = clk;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+
+        return clk;
+}
+EXPORT_SYMBOL(devm_clk_get);
+
+static int devm_clk_match(struct device *dev, void *res, void *data)
+{
+        struct clk **c = res;
+        if (!c || !*c) {
+                WARN_ON(!c || !*c);
+                return 0;
+        }
+        return *c == data;
+}
+
+void devm_clk_put(struct device *dev, struct clk *clk)
+{
+        int ret;
+
+        ret = devres_release(dev, devm_clk_release, devm_clk_match, clk);
+
+        WARN_ON(ret);
+}
+EXPORT_SYMBOL(devm_clk_put);
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index d423c9bdd71a..442a31363873 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -171,51 +171,6 @@ void clk_put(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_put);
 
-static void devm_clk_release(struct device *dev, void *res)
-{
-        clk_put(*(struct clk **)res);
-}
-
-struct clk *devm_clk_get(struct device *dev, const char *id)
-{
-        struct clk **ptr, *clk;
-
-        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
-        if (!ptr)
-                return ERR_PTR(-ENOMEM);
-
-        clk = clk_get(dev, id);
-        if (!IS_ERR(clk)) {
-                *ptr = clk;
-                devres_add(dev, ptr);
-        } else {
-                devres_free(ptr);
-        }
-
-        return clk;
-}
-EXPORT_SYMBOL(devm_clk_get);
-
-static int devm_clk_match(struct device *dev, void *res, void *data)
-{
-        struct clk **c = res;
-        if (!c || !*c) {
-                WARN_ON(!c || !*c);
-                return 0;
-        }
-        return *c == data;
-}
-
-void devm_clk_put(struct device *dev, struct clk *clk)
-{
-        int ret;
-
-        ret = devres_destroy(dev, devm_clk_release, devm_clk_match, clk);
-
-        WARN_ON(ret);
-}
-EXPORT_SYMBOL(devm_clk_put);
-
 void clkdev_add(struct clk_lookup *cl)
 {
         mutex_lock(&clocks_mutex);
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index d53cd0afc200..6a78073c3808 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -35,3 +35,8 @@ config CLKSRC_DBX500_PRCMU_SCHED_CLOCK
         default y
         help
           Use the always on PRCMU Timer as sched_clock
+
+config CLKSRC_ARM_GENERIC
+        def_bool y if ARM64
+        help
+          This option enables support for the ARM generic timer.
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index b65d0c56ab35..65919901a301 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -13,3 +13,4 @@ obj-$(CONFIG_DW_APB_TIMER)	+= dw_apb_timer.o
 obj-$(CONFIG_DW_APB_TIMER_OF)   += dw_apb_timer_of.o
 obj-$(CONFIG_CLKSRC_DBX500_PRCMU)       += clksrc-dbx500-prcmu.o
 obj-$(CONFIG_ARMADA_370_XP_TIMER)       += time-armada-370-xp.o
+obj-$(CONFIG_CLKSRC_ARM_GENERIC)        += arm_generic.o
diff --git a/drivers/clocksource/arm_generic.c b/drivers/clocksource/arm_generic.c
new file mode 100644
index 000000000000..c4d9f9566c64
--- /dev/null
+++ b/drivers/clocksource/arm_generic.c
@@ -0,0 +1,232 @@
+/*
+ * Generic timers support
+ *
+ * Copyright (C) 2012 ARM Ltd.
+ * Author: Marc Zyngier <marc.zyngier@arm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/smp.h>
+#include <linux/cpu.h>
+#include <linux/jiffies.h>
+#include <linux/interrupt.h>
+#include <linux/clockchips.h>
+#include <linux/of_irq.h>
+#include <linux/io.h>
+
+#include <clocksource/arm_generic.h>
+
+#include <asm/arm_generic.h>
+
+static u32 arch_timer_rate;
+static u64 sched_clock_mult __read_mostly;
+static DEFINE_PER_CPU(struct clock_event_device, arch_timer_evt);
+static int arch_timer_ppi;
+
+static irqreturn_t arch_timer_handle_irq(int irq, void *dev_id)
+{
+        struct clock_event_device *evt = dev_id;
+        unsigned long ctrl;
+
+        ctrl = arch_timer_reg_read(ARCH_TIMER_REG_CTRL);
+        if (ctrl & ARCH_TIMER_CTRL_ISTATUS) {
+                ctrl |= ARCH_TIMER_CTRL_IMASK;
+                arch_timer_reg_write(ARCH_TIMER_REG_CTRL, ctrl);
+                evt->event_handler(evt);
+                return IRQ_HANDLED;
+        }
+
+        return IRQ_NONE;
+}
+
+static void arch_timer_stop(void)
+{
+        unsigned long ctrl;
+
+        ctrl = arch_timer_reg_read(ARCH_TIMER_REG_CTRL);
+        ctrl &= ~ARCH_TIMER_CTRL_ENABLE;
+        arch_timer_reg_write(ARCH_TIMER_REG_CTRL, ctrl);
+}
+
+static void arch_timer_set_mode(enum clock_event_mode mode,
+                                struct clock_event_device *clk)
+{
+        switch (mode) {
+        case CLOCK_EVT_MODE_UNUSED:
+        case CLOCK_EVT_MODE_SHUTDOWN:
+                arch_timer_stop();
+                break;
+        default:
+                break;
+        }
+}
+
+static int arch_timer_set_next_event(unsigned long evt,
+                                     struct clock_event_device *unused)
+{
+        unsigned long ctrl;
+
+        ctrl = arch_timer_reg_read(ARCH_TIMER_REG_CTRL);
+        ctrl |= ARCH_TIMER_CTRL_ENABLE;
+        ctrl &= ~ARCH_TIMER_CTRL_IMASK;
+
+        arch_timer_reg_write(ARCH_TIMER_REG_TVAL, evt);
+        arch_timer_reg_write(ARCH_TIMER_REG_CTRL, ctrl);
+
+        return 0;
+}
+
+static void __cpuinit arch_timer_setup(struct clock_event_device *clk)
+{
+        /* Let's make sure the timer is off before doing anything else */
+        arch_timer_stop();
+
+        clk->features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_C3STOP;
+        clk->name = "arch_sys_timer";
+        clk->rating = 400;
+        clk->set_mode = arch_timer_set_mode;
+        clk->set_next_event = arch_timer_set_next_event;
+        clk->irq = arch_timer_ppi;
+        clk->cpumask = cpumask_of(smp_processor_id());
+
+        clockevents_config_and_register(clk, arch_timer_rate,
+                                        0xf, 0x7fffffff);
+
+        enable_percpu_irq(clk->irq, 0);
+
+        /* Ensure the physical counter is visible to userspace for the vDSO. */
+        arch_counter_enable_user_access();
+}
+
+static void __init arch_timer_calibrate(void)
+{
+        if (arch_timer_rate == 0) {
+                arch_timer_reg_write(ARCH_TIMER_REG_CTRL, 0);
+                arch_timer_rate = arch_timer_reg_read(ARCH_TIMER_REG_FREQ);
+
+                /* Check the timer frequency. */
+                if (arch_timer_rate == 0)
+                        panic("Architected timer frequency is set to zero.\n"
+                              "You must set this in your .dts file\n");
+        }
+
+        /* Cache the sched_clock multiplier to save a divide in the hot path. */
+
+        sched_clock_mult = NSEC_PER_SEC / arch_timer_rate;
+
+        pr_info("Architected local timer running at %u.%02uMHz.\n",
+                 arch_timer_rate / 1000000, (arch_timer_rate / 10000) % 100);
+}
+
+static cycle_t arch_counter_read(struct clocksource *cs)
+{
+        return arch_counter_get_cntpct();
+}
+
+static struct clocksource clocksource_counter = {
+        .name   = "arch_sys_counter",
+        .rating = 400,
+        .read   = arch_counter_read,
+        .mask   = CLOCKSOURCE_MASK(56),
+        .flags  = (CLOCK_SOURCE_IS_CONTINUOUS | CLOCK_SOURCE_VALID_FOR_HRES),
+};
+
+int read_current_timer(unsigned long *timer_value)
+{
+        *timer_value = arch_counter_get_cntpct();
+        return 0;
+}
+
+unsigned long long notrace sched_clock(void)
+{
+        return arch_counter_get_cntvct() * sched_clock_mult;
+}
+
+static int __cpuinit arch_timer_cpu_notify(struct notifier_block *self,
+                                           unsigned long action, void *hcpu)
+{
+        int cpu = (long)hcpu;
+        struct clock_event_device *clk = per_cpu_ptr(&arch_timer_evt, cpu);
+
+        switch(action) {
+        case CPU_STARTING:
+        case CPU_STARTING_FROZEN:
+                arch_timer_setup(clk);
+                break;
+
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                pr_debug("arch_timer_teardown disable IRQ%d cpu #%d\n",
+                         clk->irq, cpu);
+                disable_percpu_irq(clk->irq);
+                arch_timer_set_mode(CLOCK_EVT_MODE_UNUSED, clk);
+                break;
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata arch_timer_cpu_nb = {
+        .notifier_call = arch_timer_cpu_notify,
+};
+
+static const struct of_device_id arch_timer_of_match[] __initconst = {
+        { .compatible = "arm,armv8-timer" },
+        {},
+};
+
+int __init arm_generic_timer_init(void)
+{
+        struct device_node *np;
+        int err;
+        u32 freq;
+
+        np = of_find_matching_node(NULL, arch_timer_of_match);
+        if (!np) {
+                pr_err("arch_timer: can't find DT node\n");
+                return -ENODEV;
+        }
+
+        /* Try to determine the frequency from the device tree or CNTFRQ */
+        if (!of_property_read_u32(np, "clock-frequency", &freq))
+                arch_timer_rate = freq;
+        arch_timer_calibrate();
+
+        arch_timer_ppi = irq_of_parse_and_map(np, 0);
+        pr_info("arch_timer: found %s irq %d\n", np->name, arch_timer_ppi);
+
+        err = request_percpu_irq(arch_timer_ppi, arch_timer_handle_irq,
+                                 np->name, &arch_timer_evt);
+        if (err) {
+                pr_err("arch_timer: can't register interrupt %d (%d)\n",
+                       arch_timer_ppi, err);
+                return err;
+        }
+
+        clocksource_register_hz(&clocksource_counter, arch_timer_rate);
+
+        /* Calibrate the delay loop directly */
+        lpj_fine = arch_timer_rate / HZ;
+
+        /* Immediately configure the timer on the boot CPU */
+        arch_timer_setup(per_cpu_ptr(&arch_timer_evt, smp_processor_id()));
+
+        register_cpu_notifier(&arch_timer_cpu_nb);
+
+        return 0;
+}
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index c0e816468e30..1a40935c85fd 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -35,7 +35,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/cpumask.h>
-#include <linux/sched.h>        /* for current / set_cpus_allowed() */
 #include <linux/io.h>
 #include <linux/delay.h>
 
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,
         return res;
 }
 
-/* Driver entry point to switch to the target frequency */
-static int powernowk8_target(struct cpufreq_policy *pol,
-                unsigned targfreq, unsigned relation)
+struct powernowk8_target_arg {
+        struct cpufreq_policy           *pol;
+        unsigned                        targfreq;
+        unsigned                        relation;
+};
+
+static long powernowk8_target_fn(void *arg)
 {
-        cpumask_var_t oldmask;
+        struct powernowk8_target_arg *pta = arg;
+        struct cpufreq_policy *pol = pta->pol;
+        unsigned targfreq = pta->targfreq;
+        unsigned relation = pta->relation;
         struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
         u32 checkfid;
         u32 checkvid;
         unsigned int newstate;
-        int ret = -EIO;
+        int ret;
 
         if (!data)
                 return -EINVAL;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpufreq_policy *pol,
         checkfid = data->currfid;
         checkvid = data->currvid;
 
-        /* only run on specific CPU from here on. */
-        /* This is poor form: use a workqueue or smp_call_function_single */
-        if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
-                return -ENOMEM;
-
-        cpumask_copy(oldmask, tsk_cpus_allowed(current));
-        set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
-
-        if (smp_processor_id() != pol->cpu) {
-                printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
-                goto err_out;
-        }
-
         if (pending_bit_stuck()) {
                 printk(KERN_ERR PFX "failing targ, change pending bit set\n");
-                goto err_out;
+                return -EIO;
         }
 
         pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
                 pol->cpu, targfreq, pol->min, pol->max, relation);
 
         if (query_current_values_with_pending_wait(data))
-                goto err_out;
+                return -EIO;
 
         if (cpu_family != CPU_HW_PSTATE) {
                 pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
 
         if (cpufreq_frequency_table_target(pol, data->powernow_table,
                                 targfreq, relation, &newstate))
-                goto err_out;
+                return -EIO;
 
         mutex_lock(&fidvid_mutex);
 
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                 ret = transition_frequency_fidvid(data, newstate);
         if (ret) {
                 printk(KERN_ERR PFX "transition frequency failed\n");
-                ret = 1;
                 mutex_unlock(&fidvid_mutex);
-                goto err_out;
+                return 1;
         }
         mutex_unlock(&fidvid_mutex);
 
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                                 data->powernow_table[newstate].index);
         else
                 pol->cur = find_khz_freq_from_fid(data->currfid);
-        ret = 0;
 
-err_out:
-        set_cpus_allowed_ptr(current, oldmask);
-        free_cpumask_var(oldmask);
-        return ret;
+        return 0;
+}
+
+/* Driver entry point to switch to the target frequency */
+static int powernowk8_target(struct cpufreq_policy *pol,
+                unsigned targfreq, unsigned relation)
+{
+        struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
+                                             .relation = relation };
+
+        /*
+         * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
+         * that we're bound to the current CPU and pol->cpu stays online.
+         */
+        if (smp_processor_id() == pol->cpu)
+                return powernowk8_target_fn(&pta);
+        else
+                return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 
 /* Driver entry point to verify the policy and range of frequencies */
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 002888185f17..d216cd3cc569 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -120,3 +120,4 @@ u32 gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
 
         return ret;
 }
+EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 3934fcc4e00b..17d6958342e7 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -168,9 +168,9 @@ static void atc_desc_put(struct at_dma_chan *atchan, struct at_desc *desc)
 }
 
 /**
- * atc_desc_chain - build chain adding a descripor
- * @first: address of first descripor of the chain
- * @prev: address of previous descripor of the chain
+ * atc_desc_chain - build chain adding a descriptor
+ * @first: address of first descriptor of the chain
+ * @prev: address of previous descriptor of the chain
  * @desc: descriptor to queue
  *
  * Called from prep_* functions
@@ -661,7 +661,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                         flags);
 
         if (unlikely(!atslave || !sg_len)) {
-                dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
+                dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
                 return NULL;
         }
 
@@ -689,6 +689,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
                         mem = sg_dma_address(sg);
                         len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                         mem_width = 2;
                         if (unlikely(mem & 3 || len & 3))
                                 mem_width = 0;
@@ -724,6 +729,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
                         mem = sg_dma_address(sg);
                         len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                         mem_width = 2;
                         if (unlikely(mem & 3 || len & 3))
                                 mem_width = 0;
@@ -757,6 +767,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
 err_desc_get:
         dev_err(chan2dev(chan), "not enough descriptors available\n");
+err:
         atc_desc_put(atchan, first);
         return NULL;
 }
@@ -785,7 +796,7 @@ err_out:
 }
 
 /**
- * atc_dma_cyclic_fill_desc - Fill one period decriptor
+ * atc_dma_cyclic_fill_desc - Fill one period descriptor
  */
 static int
 atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index c64917ec313d..bb02fd981afb 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -1118,7 +1118,7 @@ fail:
  * @chan: channel
  * @dma_addr: DMA mapped address of the buffer
  * @buf_len: length of the buffer (in bytes)
- * @period_len: lenght of a single period
+ * @period_len: length of a single period
  * @dir: direction of the operation
  * @context: operation context (ignored)
  *
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 8f84761f98ba..094437b9d823 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1015,7 +1015,7 @@ static irqreturn_t fsldma_chan_irq(int irq, void *data)
         /*
          * Programming Error
          * The DMA_INTERRUPT async_tx is a NULL transfer, which will
-         * triger a PE interrupt.
+         * trigger a PE interrupt.
          */
         if (stat & FSL_DMA_SR_PE) {
                 chan_dbg(chan, "irq: Programming Error INT\n");
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 5084975d793c..54f580bb993c 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -572,8 +572,8 @@ static void imxdma_tasklet(unsigned long data)
         if (desc->desc.callback)
                 desc->desc.callback(desc->desc.callback_param);
 
-        /* If we are dealing with a cyclic descriptor keep it on ld_active
-         * and dont mark the descripor as complete.
+        /* If we are dealing with a cyclic descriptor, keep it on ld_active
+         * and dont mark the descriptor as complete.
          * Only in non-cyclic cases it would be marked as complete
          */
         if (imxdma_chan_is_doing_cyclic(imxdmac))
diff --git a/drivers/dma/intel_mid_dma.c b/drivers/dma/intel_mid_dma.c
index 222e907bfaaa..02b21d7d38e5 100644
--- a/drivers/dma/intel_mid_dma.c
+++ b/drivers/dma/intel_mid_dma.c
@@ -427,7 +427,7 @@ DMA engine callback Functions*/
  * intel_mid_dma_tx_submit -    callback to submit DMA transaction
  * @tx: dma engine descriptor
  *
- * Submit the DMA trasaction for this descriptor, start if ch idle
+ * Submit the DMA transaction for this descriptor, start if ch idle
  */
 static dma_cookie_t intel_mid_dma_tx_submit(struct dma_async_tx_descriptor *tx)
 {
diff --git a/drivers/dma/intel_mid_dma_regs.h b/drivers/dma/intel_mid_dma_regs.h
index 1bfa9268feaf..17b42192ea58 100644
--- a/drivers/dma/intel_mid_dma_regs.h
+++ b/drivers/dma/intel_mid_dma_regs.h
@@ -168,9 +168,9 @@ union intel_mid_dma_cfg_hi {
  * @active_list: current active descriptors
  * @queue: current queued up descriptors
  * @free_list: current free descriptors
- * @slave: dma slave struture
- * @descs_allocated: total number of decsiptors allocated
- * @dma: dma device struture pointer
+ * @slave: dma slave structure
+ * @descs_allocated: total number of descriptors allocated
+ * @dma: dma device structure pointer
  * @busy: bool representing if ch is busy (active txn) or not
  * @in_use: bool representing if ch is in use or not
  * @raw_tfr: raw trf interrupt received
diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h
index 60e675455b6a..d2ff3fda0b18 100644
--- a/drivers/dma/ioat/hw.h
+++ b/drivers/dma/ioat/hw.h
@@ -22,7 +22,6 @@
 #define _IOAT_HW_H_
 
 /* PCI Configuration Space Values */
-#define IOAT_PCI_VID            0x8086
 #define IOAT_MMIO_BAR           0
 
 /* CB device ID's */
@@ -31,9 +30,6 @@
 #define IOAT_PCI_DID_SCNB       0x65FF
 #define IOAT_PCI_DID_SNB        0x402F
 
-#define IOAT_PCI_RID            0x00
-#define IOAT_PCI_SVID           0x8086
-#define IOAT_PCI_SID            0x8086
 #define IOAT_VER_1_2            0x12    /* Version 1.2 */
 #define IOAT_VER_2_0            0x20    /* Version 2.0 */
 #define IOAT_VER_3_0            0x30    /* Version 3.0 */
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index e4feba6b03c0..5d3bbcd279b4 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -522,7 +522,7 @@ enum desc_status {
         /* In the DMAC pool */
         FREE,
         /*
-         * Allocted to some channel during prep_xxx
+         * Allocated to some channel during prep_xxx
          * Also may be sitting on the work_list.
          */
         PREP,
@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id, struct pl330_req *r)
                 goto xfer_exit;
         }
 
-        /* Prefer Secure Channel */
-        if (!_manager_ns(thrd))
-                r->cfg->nonsecure = 0;
-        else
-                r->cfg->nonsecure = 1;
 
         /* Use last settings, if not provided */
-        if (r->cfg)
+        if (r->cfg) {
+                /* Prefer Secure Channel */
+                if (!_manager_ns(thrd))
+                        r->cfg->nonsecure = 0;
+                else
+                        r->cfg->nonsecure = 1;
+
                 ccr = _prepare_ccr(r->cfg);
-        else
+        } else {
                 ccr = readl(regs + CC(thrd->id));
+        }
 
         /* If this req doesn't have valid xfer settings */
         if (!_is_valid(ccr)) {
@@ -2928,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
 
         pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+        if (!pdmac->peripherals) {
+                ret = -ENOMEM;
+                dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
+                goto probe_err5;
+        }
 
         for (i = 0; i < num_chan; i++) {
                 pch = &pdmac->peripherals[i];
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index ced98826684a..f72348d0bc41 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -4446,7 +4446,7 @@ static int __devinit ppc440spe_adma_probe(struct platform_device *ofdev)
                 ret = -ENOMEM;
                 goto err_dma_alloc;
         }
-        dev_dbg(&ofdev->dev, "allocted descriptor pool virt 0x%p phys 0x%llx\n",
+        dev_dbg(&ofdev->dev, "allocated descriptor pool virt 0x%p phys 0x%llx\n",
                 adev->dma_desc_pool_virt, (u64)adev->dma_desc_pool);
 
         regs = ioremap(res.start, resource_size(&res));
diff --git a/drivers/dma/ste_dma40_ll.h b/drivers/dma/ste_dma40_ll.h
index 51e8e5396e9b..6d47373f3f58 100644
--- a/drivers/dma/ste_dma40_ll.h
+++ b/drivers/dma/ste_dma40_ll.h
@@ -202,7 +202,7 @@
 /* LLI related structures */
 
 /**
- * struct d40_phy_lli - The basic configration register for each physical
+ * struct d40_phy_lli - The basic configuration register for each physical
  * channel.
  *
  * @reg_cfg: The configuration register.
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 616d90bcb3a4..d5dc9da7f99f 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -199,6 +199,36 @@ void *edac_align_ptr(void **p, unsigned size, int n_elems)
         return (void *)(((unsigned long)ptr) + align - r);
 }
 
+static void _edac_mc_free(struct mem_ctl_info *mci)
+{
+        int i, chn, row;
+        struct csrow_info *csr;
+        const unsigned int tot_dimms = mci->tot_dimms;
+        const unsigned int tot_channels = mci->num_cschannel;
+        const unsigned int tot_csrows = mci->nr_csrows;
+
+        if (mci->dimms) {
+                for (i = 0; i < tot_dimms; i++)
+                        kfree(mci->dimms[i]);
+                kfree(mci->dimms);
+        }
+        if (mci->csrows) {
+                for (row = 0; row < tot_csrows; row++) {
+                        csr = mci->csrows[row];
+                        if (csr) {
+                                if (csr->channels) {
+                                        for (chn = 0; chn < tot_channels; chn++)
+                                                kfree(csr->channels[chn]);
+                                        kfree(csr->channels);
+                                }
+                                kfree(csr);
+                        }
+                }
+                kfree(mci->csrows);
+        }
+        kfree(mci);
+}
+
 /**
  * edac_mc_alloc: Allocate and partially fill a struct mem_ctl_info structure
  * @mc_num:             Memory controller number
@@ -413,24 +443,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         return mci;
 
 error:
-        if (mci->dimms) {
-                for (i = 0; i < tot_dimms; i++)
-                        kfree(mci->dimms[i]);
-                kfree(mci->dimms);
-        }
-        if (mci->csrows) {
-                for (chn = 0; chn < tot_channels; chn++) {
-                        csr = mci->csrows[chn];
-                        if (csr) {
-                                for (chn = 0; chn < tot_channels; chn++)
-                                        kfree(csr->channels[chn]);
-                                kfree(csr);
-                        }
-                        kfree(mci->csrows[i]);
-                }
-                kfree(mci->csrows);
-        }
-        kfree(mci);
+        _edac_mc_free(mci);
 
         return NULL;
 }
@@ -445,6 +458,14 @@ void edac_mc_free(struct mem_ctl_info *mci)
 {
         edac_dbg(1, "\n");
 
+        /* If we're not yet registered with sysfs free only what was allocated
+         * in edac_mc_alloc().
+         */
+        if (!device_is_registered(&mci->dev)) {
+                _edac_mc_free(mci);
+                return;
+        }
+
         /* the mci instance is freed here, when the sysfs object is dropped */
         edac_unregister_sysfs(mci);
 }
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index 47180a08edad..b6653a6fc5d5 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -391,7 +391,7 @@ static int i3200_probe1(struct pci_dev *pdev, int dev_idx)
                 for (j = 0; j < nr_channels; j++) {
                         struct dimm_info *dimm = csrow->channels[j]->dimm;
 
-                        dimm->nr_pages = nr_pages / nr_channels;
+                        dimm->nr_pages = nr_pages;
                         dimm->grain = nr_pages << PAGE_SHIFT;
                         dimm->mtype = MEM_DDR2;
                         dimm->dtype = DEV_UNKNOWN;
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 39c63757c2a1..6a49dd00b81b 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1012,6 +1012,10 @@ static void handle_channel(struct i5000_pvt *pvt, int slot, int channel,
                         /* add the number of COLUMN bits */
                         addrBits += MTR_DIMM_COLS_ADDR_BITS(mtr);
 
+                        /* Dual-rank memories have twice the size */
+                        if (dinfo->dual_rank)
+                                addrBits++;
+
                         addrBits += 6;  /* add 64 bits per DIMM */
                         addrBits -= 20; /* divide by 2^^20 */
                         addrBits -= 3;  /* 8 bits per bytes */
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index f3b1f9fafa4b..5715b7c2c517 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -513,7 +513,8 @@ static int get_dimm_config(struct mem_ctl_info *mci)
 {
         struct sbridge_pvt *pvt = mci->pvt_info;
         struct dimm_info *dimm;
-        int i, j, banks, ranks, rows, cols, size, npages;
+        unsigned i, j, banks, ranks, rows, cols, npages;
+        u64 size;
         u32 reg;
         enum edac_type mode;
         enum mem_type mtype;
@@ -585,10 +586,10 @@ static int get_dimm_config(struct mem_ctl_info *mci)
                                 cols = numcol(mtr);
 
                                 /* DDR3 has 8 I/O banks */
-                                size = (rows * cols * banks * ranks) >> (20 - 3);
+                                size = ((u64)rows * cols * banks * ranks) >> (20 - 3);
                                 npages = MiB_TO_PAGES(size);
 
-                                edac_dbg(0, "mc#%d: channel %d, dimm %d, %d Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+                                edac_dbg(0, "mc#%d: channel %d, dimm %d, %Ld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
                                          pvt->sbridge_dev->mc, i, j,
                                          size, npages,
                                          banks, ranks, rows, cols);
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 427a289f32a5..6c19833ed2d0 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -434,6 +434,11 @@ static int __devinit arizona_extcon_probe(struct platform_device *pdev)
         regmap_update_bits(arizona->regmap, ARIZONA_JACK_DETECT_ANALOGUE,
                            ARIZONA_JD1_ENA, ARIZONA_JD1_ENA);
 
+        ret = regulator_allow_bypass(info->micvdd, true);
+        if (ret != 0)
+                dev_warn(arizona->dev, "Failed to set MICVDD to bypass: %d\n",
+                         ret);
+
         pm_runtime_put(&pdev->dev);
 
         return 0;
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 920a609b2c35..38f9e52f358b 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -669,13 +669,18 @@ static int __devinit max77693_muic_probe(struct platform_device *pdev)
         }
         info->dev = &pdev->dev;
         info->max77693 = max77693;
-        info->max77693->regmap_muic = regmap_init_i2c(info->max77693->muic,
-                                         &max77693_muic_regmap_config);
-        if (IS_ERR(info->max77693->regmap_muic)) {
-                ret = PTR_ERR(info->max77693->regmap_muic);
-                dev_err(max77693->dev,
-                        "failed to allocate register map: %d\n", ret);
-                goto err_regmap;
+        if (info->max77693->regmap_muic)
+                dev_dbg(&pdev->dev, "allocate register map\n");
+        else {
+                info->max77693->regmap_muic = devm_regmap_init_i2c(
+                                                info->max77693->muic,
+                                                &max77693_muic_regmap_config);
+                if (IS_ERR(info->max77693->regmap_muic)) {
+                        ret = PTR_ERR(info->max77693->regmap_muic);
+                        dev_err(max77693->dev,
+                                "failed to allocate register map: %d\n", ret);
+                        goto err_regmap;
+                }
         }
         platform_set_drvdata(pdev, info);
         mutex_init(&info->mutex);
diff --git a/drivers/gpio/gpio-lpc32xx.c b/drivers/gpio/gpio-lpc32xx.c
index 8a420f13905e..ed94b4ea72e9 100644
--- a/drivers/gpio/gpio-lpc32xx.c
+++ b/drivers/gpio/gpio-lpc32xx.c
@@ -308,6 +308,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p012(group, pin, value);
         __set_gpio_dir_p012(group, pin, 0);
 
         return 0;
@@ -318,6 +319,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 {
         struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+        __set_gpio_level_p3(group, pin, value);
         __set_gpio_dir_p3(group, pin, 0);
 
         return 0;
@@ -326,6 +328,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
 static int lpc32xx_gpio_dir_out_always(struct gpio_chip *chip, unsigned pin,
         int value)
 {
+        struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
+
+        __set_gpo_level_p3(group, pin, value);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index d0c4574ef49c..36164806b9d4 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -193,6 +193,9 @@ static const struct file_operations ast_fops = {
         .mmap = ast_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .read = drm_read,
 };
 
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 7282c081fb53..a712cafcfa1d 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -841,7 +841,7 @@ int ast_cursor_init(struct drm_device *dev)
 
         ast->cursor_cache = obj;
         ast->cursor_cache_gpu_addr = gpu_addr;
-        DRM_ERROR("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
+        DRM_DEBUG_KMS("pinned cursor cache at %llx\n", ast->cursor_cache_gpu_addr);
         return 0;
 fail:
         return ret;
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index 7053140c6596..b83a2d7ddd1a 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations cirrus_driver_fops = {
         .unlocked_ioctl = drm_ioctl,
         .mmap = cirrus_mmap,
         .poll = drm_poll,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .fasync = drm_fasync,
 };
 static struct drm_driver driver = {
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 7f5096763b7d..59a26e577b57 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -36,6 +36,6 @@ config DRM_EXYNOS_VIDI
 
 config DRM_EXYNOS_G2D
         bool "Exynos DRM G2D"
-        depends on DRM_EXYNOS
+        depends on DRM_EXYNOS && !VIDEO_SAMSUNG_S5P_G2D
         help
           Choose this option if you want to use Exynos G2D for DRM.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index 613bf8a5d9b2..ae13febe0eaa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -163,6 +163,12 @@ static void exynos_gem_dmabuf_kunmap(struct dma_buf *dma_buf,
         /* TODO */
 }
 
+static int exynos_gem_dmabuf_mmap(struct dma_buf *dma_buf,
+        struct vm_area_struct *vma)
+{
+        return -ENOTTY;
+}
+
 static struct dma_buf_ops exynos_dmabuf_ops = {
         .map_dma_buf            = exynos_gem_map_dma_buf,
         .unmap_dma_buf          = exynos_gem_unmap_dma_buf,
@@ -170,6 +176,7 @@ static struct dma_buf_ops exynos_dmabuf_ops = {
         .kmap_atomic            = exynos_gem_dmabuf_kmap_atomic,
         .kunmap                 = exynos_gem_dmabuf_kunmap,
         .kunmap_atomic          = exynos_gem_dmabuf_kunmap_atomic,
+        .mmap                   = exynos_gem_dmabuf_mmap,
         .release                = exynos_dmabuf_release,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index ebacec6f1e48..d07071937453 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -160,7 +160,6 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
         if (!file_priv)
                 return -ENOMEM;
 
-        drm_prime_init_file_private(&file->prime);
         file->driver_priv = file_priv;
 
         return exynos_drm_subdrv_open(dev, file);
@@ -184,7 +183,6 @@ static void exynos_drm_preclose(struct drm_device *dev,
                         e->base.destroy(&e->base);
                 }
         }
-        drm_prime_destroy_file_private(&file->prime);
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
         exynos_drm_subdrv_close(dev, file);
@@ -241,6 +239,9 @@ static const struct file_operations exynos_drm_driver_fops = {
         .poll           = drm_poll,
         .read           = drm_read,
         .unlocked_ioctl = drm_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .release        = drm_release,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a68d2b313f03..b19cd93e7047 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -831,11 +831,6 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to find registers\n");
-                ret = -ENOENT;
-                goto err_clk;
-        }
 
         ctx->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!ctx->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index d2d88f22a037..1065e90d0919 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -129,7 +129,6 @@ struct g2d_runqueue_node {
 struct g2d_data {
         struct device                   *dev;
         struct clk                      *gate_clk;
-        struct resource                 *regs_res;
         void __iomem                    *regs;
         int                             irq;
         struct workqueue_struct         *g2d_workq;
@@ -751,7 +750,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         struct exynos_drm_subdrv *subdrv;
         int ret;
 
-        g2d = kzalloc(sizeof(*g2d), GFP_KERNEL);
+        g2d = devm_kzalloc(&pdev->dev, sizeof(*g2d), GFP_KERNEL);
         if (!g2d) {
                 dev_err(dev, "failed to allocate driver data\n");
                 return -ENOMEM;
@@ -759,10 +758,8 @@ static int __devinit g2d_probe(struct platform_device *pdev)
 
         g2d->runqueue_slab = kmem_cache_create("g2d_runqueue_slab",
                         sizeof(struct g2d_runqueue_node), 0, 0, NULL);
-        if (!g2d->runqueue_slab) {
-                ret = -ENOMEM;
-                goto err_free_mem;
-        }
+        if (!g2d->runqueue_slab)
+                return -ENOMEM;
 
         g2d->dev = dev;
 
@@ -794,38 +791,26 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         pm_runtime_enable(dev);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "failed to get I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
 
-        g2d->regs_res = request_mem_region(res->start, resource_size(res),
-                                           dev_name(dev));
-        if (!g2d->regs_res) {
-                dev_err(dev, "failed to request I/O memory\n");
-                ret = -ENOENT;
-                goto err_put_clk;
-        }
-
-        g2d->regs = ioremap(res->start, resource_size(res));
+        g2d->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!g2d->regs) {
                 dev_err(dev, "failed to remap I/O memory\n");
                 ret = -ENXIO;
-                goto err_release_res;
+                goto err_put_clk;
         }
 
         g2d->irq = platform_get_irq(pdev, 0);
         if (g2d->irq < 0) {
                 dev_err(dev, "failed to get irq\n");
                 ret = g2d->irq;
-                goto err_unmap_base;
+                goto err_put_clk;
         }
 
-        ret = request_irq(g2d->irq, g2d_irq_handler, 0, "drm_g2d", g2d);
+        ret = devm_request_irq(&pdev->dev, g2d->irq, g2d_irq_handler, 0,
+                                                                "drm_g2d", g2d);
         if (ret < 0) {
                 dev_err(dev, "irq request failed\n");
-                goto err_unmap_base;
+                goto err_put_clk;
         }
 
         platform_set_drvdata(pdev, g2d);
@@ -838,7 +823,7 @@ static int __devinit g2d_probe(struct platform_device *pdev)
         ret = exynos_drm_subdrv_register(subdrv);
         if (ret < 0) {
                 dev_err(dev, "failed to register drm g2d device\n");
-                goto err_free_irq;
+                goto err_put_clk;
         }
 
         dev_info(dev, "The exynos g2d(ver %d.%d) successfully probed\n",
@@ -846,13 +831,6 @@ static int __devinit g2d_probe(struct platform_device *pdev)
 
         return 0;
 
-err_free_irq:
-        free_irq(g2d->irq, g2d);
-err_unmap_base:
-        iounmap(g2d->regs);
-err_release_res:
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
 err_put_clk:
         pm_runtime_disable(dev);
         clk_put(g2d->gate_clk);
@@ -862,8 +840,6 @@ err_destroy_workqueue:
         destroy_workqueue(g2d->g2d_workq);
 err_destroy_slab:
         kmem_cache_destroy(g2d->runqueue_slab);
-err_free_mem:
-        kfree(g2d);
         return ret;
 }
 
@@ -873,24 +849,18 @@ static int __devexit g2d_remove(struct platform_device *pdev)
 
         cancel_work_sync(&g2d->runqueue_work);
         exynos_drm_subdrv_unregister(&g2d->subdrv);
-        free_irq(g2d->irq, g2d);
 
         while (g2d->runqueue_node) {
                 g2d_free_runqueue_node(g2d, g2d->runqueue_node);
                 g2d->runqueue_node = g2d_get_runqueue_node(g2d);
         }
 
-        iounmap(g2d->regs);
-        release_resource(g2d->regs_res);
-        kfree(g2d->regs_res);
-
         pm_runtime_disable(&pdev->dev);
         clk_put(g2d->gate_clk);
 
         g2d_fini_cmdlist(g2d);
         destroy_workqueue(g2d->g2d_workq);
         kmem_cache_destroy(g2d->runqueue_slab);
-        kfree(g2d);
 
         return 0;
 }
@@ -924,7 +894,7 @@ static int g2d_resume(struct device *dev)
 }
 #endif
 
-SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
+static SIMPLE_DEV_PM_OPS(g2d_pm_ops, g2d_suspend, g2d_resume);
 
 struct platform_driver g2d_driver = {
         .probe          = g2d_probe,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index f9efde40c097..a38051c95ec4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -122,7 +122,7 @@ fail:
                 __free_page(pages[i]);
 
         drm_free_large(pages);
-        return ERR_PTR(PTR_ERR(p));
+        return ERR_CAST(p);
 }
 
 static void exynos_gem_put_pages(struct drm_gem_object *obj,
@@ -662,7 +662,7 @@ int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
          */
 
         args->pitch = args->width * ((args->bpp + 7) / 8);
-        args->size = PAGE_ALIGN(args->pitch * args->height);
+        args->size = args->pitch * args->height;
 
         exynos_gem_obj = exynos_drm_gem_create(dev, args->flags, args->size);
         if (IS_ERR(exynos_gem_obj))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 8ffcdf8b9e22..3fdf0b65f47e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -345,7 +345,7 @@ static int __devinit exynos_drm_hdmi_probe(struct platform_device *pdev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
         if (!ctx) {
                 DRM_LOG_KMS("failed to alloc common hdmi context.\n");
                 return -ENOMEM;
@@ -371,7 +371,6 @@ static int __devexit exynos_drm_hdmi_remove(struct platform_device *pdev)
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         exynos_drm_subdrv_unregister(&ctx->subdrv);
-        kfree(ctx);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index b89829e5043a..e1f94b746bd7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -29,7 +29,6 @@ static const uint32_t formats[] = {
         DRM_FORMAT_XRGB8888,
         DRM_FORMAT_ARGB8888,
         DRM_FORMAT_NV12,
-        DRM_FORMAT_NV12M,
         DRM_FORMAT_NV12MT,
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index bb1550c4dd57..537027a74fd5 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -633,7 +633,7 @@ static int __devinit vidi_probe(struct platform_device *pdev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
                 return -ENOMEM;
 
@@ -673,8 +673,6 @@ static int __devexit vidi_remove(struct platform_device *pdev)
                 ctx->raw_edid = NULL;
         }
 
-        kfree(ctx);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 409e2ec1207c..a6aea6f3ea1a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2172,7 +2172,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
 
         DRM_DEBUG_KMS("HDMI resource init\n");
 
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
 
         /* get clocks, power */
         res->hdmi = clk_get(dev, "hdmi");
@@ -2204,7 +2204,7 @@ static int __devinit hdmi_resources_init(struct hdmi_context *hdata)
         clk_set_parent(res->sclk_hdmi, res->sclk_pixel);
 
         res->regul_bulk = kzalloc(ARRAY_SIZE(supply) *
-                sizeof res->regul_bulk[0], GFP_KERNEL);
+                sizeof(res->regul_bulk[0]), GFP_KERNEL);
         if (!res->regul_bulk) {
                 DRM_ERROR("failed to get memory for regulators\n");
                 goto fail;
@@ -2243,7 +2243,7 @@ static int hdmi_resources_cleanup(struct hdmi_context *hdata)
                 clk_put(res->sclk_hdmi);
         if (!IS_ERR_OR_NULL(res->hdmi))
                 clk_put(res->hdmi);
-        memset(res, 0, sizeof *res);
+        memset(res, 0, sizeof(*res));
 
         return 0;
 }
@@ -2312,11 +2312,6 @@ static int __devinit hdmi_probe(struct platform_device *pdev)
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                DRM_ERROR("failed to find registers\n");
-                ret = -ENOENT;
-                goto err_resource;
-        }
 
         hdata->regs = devm_request_and_ioremap(&pdev->dev, res);
         if (!hdata->regs) {
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 30fcc12f81dd..25b97d5e5fcb 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -236,11 +236,11 @@ static inline void vp_filter_set(struct mixer_resources *res,
 static void vp_default_filter(struct mixer_resources *res)
 {
         vp_filter_set(res, VP_POLY8_Y0_LL,
-                filter_y_horiz_tap8, sizeof filter_y_horiz_tap8);
+                filter_y_horiz_tap8, sizeof(filter_y_horiz_tap8));
         vp_filter_set(res, VP_POLY4_Y0_LL,
-                filter_y_vert_tap4, sizeof filter_y_vert_tap4);
+                filter_y_vert_tap4, sizeof(filter_y_vert_tap4));
         vp_filter_set(res, VP_POLY4_C0_LL,
-                filter_cr_horiz_tap4, sizeof filter_cr_horiz_tap4);
+                filter_cr_horiz_tap4, sizeof(filter_cr_horiz_tap4));
 }
 
 static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable)
diff --git a/drivers/gpu/drm/gma500/oaktrail_device.c b/drivers/gpu/drm/gma500/oaktrail_device.c
index 0f9b7db80f6b..cf49ba5a54bf 100644
--- a/drivers/gpu/drm/gma500/oaktrail_device.c
+++ b/drivers/gpu/drm/gma500/oaktrail_device.c
@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                 .pos = DSPAPOS,
                 .surf = DSPASURF,
                 .addr = MRST_DSPABASE,
+                .base = MRST_DSPABASE,
                 .status = PIPEASTAT,
                 .linoff = DSPALINOFF,
                 .tileoff = DSPATILEOFF,
@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
                 .pos = DSPBPOS,
                 .surf = DSPBSURF,
                 .addr = DSPBBASE,
+                .base = DSPBBASE,
                 .status = PIPEBSTAT,
                 .linoff = DSPBLINOFF,
                 .tileoff = DSPBTILEOFF,
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 57d892eaaa6e..463ec6871fe9 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -115,6 +115,9 @@ static const struct file_operations i810_buffer_fops = {
         .unlocked_ioctl = drm_ioctl,
         .mmap = i810_mmap_buffers,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
index f9924ad04d09..48cfcca2b350 100644
--- a/drivers/gpu/drm/i810/i810_drv.c
+++ b/drivers/gpu/drm/i810/i810_drv.c
@@ -51,6 +51,9 @@ static const struct file_operations i810_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9cf7dfe022b9..914c0dfabe60 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1587,6 +1587,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         spin_lock_init(&dev_priv->irq_lock);
         spin_lock_init(&dev_priv->error_lock);
         spin_lock_init(&dev_priv->rps_lock);
+        spin_lock_init(&dev_priv->dpio_lock);
 
         if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
                 dev_priv->num_pipe = 3;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 489e2b162b27..274d25de521e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3242,7 +3242,8 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
 {
         int ret;
 
-        BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
+        if (WARN_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
+                return -EBUSY;
 
         if (obj->gtt_space != NULL) {
                 if ((alignment && obj->gtt_offset & (alignment - 1)) ||
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 8a3828528b9d..5249640cce13 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2700,9 +2700,6 @@ void intel_irq_init(struct drm_device *dev)
                         dev->driver->irq_handler = i8xx_irq_handler;
                         dev->driver->irq_uninstall = i8xx_irq_uninstall;
                 } else if (INTEL_INFO(dev)->gen == 3) {
-                        /* IIR "flip pending" means done if this bit is set */
-                        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
-
                         dev->driver->irq_preinstall = i915_irq_preinstall;
                         dev->driver->irq_postinstall = i915_irq_postinstall;
                         dev->driver->irq_uninstall = i915_irq_uninstall;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2dfa6cf4886b..c040aee1341c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1376,7 +1376,8 @@ static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
              "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & DP_PORT_EN) == 0
+             && (val & DP_PIPEB_SELECT),
              "IBX PCH dp port still using transcoder B\n");
 }
 
@@ -1388,7 +1389,8 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
              "PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 
-        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & SDVO_PIPE_B_SELECT),
+        WARN(HAS_PCH_IBX(dev_priv->dev) && (val & PORT_ENABLE) == 0
+             && (val & SDVO_PIPE_B_SELECT),
              "IBX PCH hdmi port still using transcoder B\n");
 }
 
@@ -4189,12 +4191,6 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
         POSTING_READ(DPLL(pipe));
         udelay(150);
 
-        I915_WRITE(DPLL(pipe), dpll);
-
-        /* Wait for the clocks to stabilize. */
-        POSTING_READ(DPLL(pipe));
-        udelay(150);
-
         /* The LVDS pin pair needs to be on before the DPLLs are enabled.
          * This is an exception to the general rule that mode_set doesn't turn
          * things on.
@@ -4202,6 +4198,12 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
         if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
                 intel_update_lvds(crtc, clock, adjusted_mode);
 
+        I915_WRITE(DPLL(pipe), dpll);
+
+        /* Wait for the clocks to stabilize. */
+        POSTING_READ(DPLL(pipe));
+        udelay(150);
+
         /* The pixel multiplier can only be updated once the
          * DPLL is enabled and the clocks are stable.
          *
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a6c426afaa7a..ace757af9133 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2533,14 +2533,10 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                         break;
         }
 
-        intel_dp_i2c_init(intel_dp, intel_connector, name);
-
         /* Cache some DPCD data in the eDP case */
         if (is_edp(intel_dp)) {
-                bool ret;
                 struct edp_power_seq    cur, vbt;
                 u32 pp_on, pp_off, pp_div;
-                struct edid *edid;
 
                 pp_on = I915_READ(PCH_PP_ON_DELAYS);
                 pp_off = I915_READ(PCH_PP_OFF_DELAYS);
@@ -2591,6 +2587,13 @@ intel_dp_init(struct drm_device *dev, int output_reg)
 
                 DRM_DEBUG_KMS("backlight on delay %d, off delay %d\n",
                               intel_dp->backlight_on_delay, intel_dp->backlight_off_delay);
+        }
+
+        intel_dp_i2c_init(intel_dp, intel_connector, name);
+
+        if (is_edp(intel_dp)) {
+                bool ret;
+                struct edid *edid;
 
                 ironlake_edp_panel_vdd_on(intel_dp);
                 ret = intel_dp_get_dpcd(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 98f602427eb8..12dc3308ab8c 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -609,7 +609,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
         u32 temp;
         u32 enable_bits = SDVO_ENABLE;
 
-        if (intel_hdmi->has_audio)
+        if (intel_hdmi->has_audio || mode != DRM_MODE_DPMS_ON)
                 enable_bits |= SDVO_AUDIO_ENABLE;
 
         temp = I915_READ(intel_hdmi->sdvox_reg);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 3df4f5fa892a..e019b2369861 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -162,19 +162,12 @@ static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
         return val;
 }
 
-u32 intel_panel_get_max_backlight(struct drm_device *dev)
+static u32 _intel_panel_get_max_backlight(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 max;
 
         max = i915_read_blc_pwm_ctl(dev_priv);
-        if (max == 0) {
-                /* XXX add code here to query mode clock or hardware clock
-                 * and program max PWM appropriately.
-                 */
-                pr_warn_once("fixme: max PWM is zero\n");
-                return 1;
-        }
 
         if (HAS_PCH_SPLIT(dev)) {
                 max >>= 16;
@@ -188,6 +181,22 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                         max *= 0xff;
         }
 
+        return max;
+}
+
+u32 intel_panel_get_max_backlight(struct drm_device *dev)
+{
+        u32 max;
+
+        max = _intel_panel_get_max_backlight(dev);
+        if (max == 0) {
+                /* XXX add code here to query mode clock or hardware clock
+                 * and program max PWM appropriately.
+                 */
+                pr_warn_once("fixme: max PWM is zero\n");
+                return 1;
+        }
+
         DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
         return max;
 }
@@ -424,7 +433,11 @@ int intel_panel_setup_backlight(struct drm_device *dev)
 
         memset(&props, 0, sizeof(props));
         props.type = BACKLIGHT_RAW;
-        props.max_brightness = intel_panel_get_max_backlight(dev);
+        props.max_brightness = _intel_panel_get_max_backlight(dev);
+        if (props.max_brightness == 0) {
+                DRM_ERROR("Failed to get maximum backlight value\n");
+                return -ENODEV;
+        }
         dev_priv->backlight =
                 backlight_device_register("intel_backlight",
                                           &connector->kdev, dev,
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 1881c8c83f0e..ba8a27b1757a 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3672,6 +3672,9 @@ static void gen3_init_clock_gating(struct drm_device *dev)
 
         if (IS_PINEVIEW(dev))
                 I915_WRITE(ECOSKPD, _MASKED_BIT_ENABLE(ECO_GATING_CX_ONLY));
+
+        /* IIR "flip pending" means done if this bit is set */
+        I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
 }
 
 static void i85x_init_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index d81bb0bf2885..123afd357611 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2573,7 +2573,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                 hotplug_mask = intel_sdvo->is_sdvob ?
                         SDVOB_HOTPLUG_INT_STATUS_I915 : SDVOC_HOTPLUG_INT_STATUS_I915;
         }
-        dev_priv->hotplug_supported_mask |= hotplug_mask;
 
         drm_encoder_helper_add(&intel_encoder->base, &intel_sdvo_helper_funcs);
 
@@ -2581,14 +2580,6 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
         if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                 goto err;
 
-        /* Set up hotplug command - note paranoia about contents of reply.
-         * We assume that the hardware is in a sane state, and only touch
-         * the bits we think we understand.
-         */
-        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
-                             &intel_sdvo->hotplug_active, 2);
-        intel_sdvo->hotplug_active[0] &= ~0x3;
-
         if (intel_sdvo_output_setup(intel_sdvo,
                                     intel_sdvo->caps.output_flags) != true) {
                 DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
@@ -2596,6 +2587,12 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                 goto err;
         }
 
+        /* Only enable the hotplug irq if we need it, to work around noisy
+         * hotplug lines.
+         */
+        if (intel_sdvo->hotplug_active[0])
+                dev_priv->hotplug_supported_mask |= hotplug_mask;
+
         intel_sdvo_select_ddc_bus(dev_priv, intel_sdvo, sdvo_reg);
 
         /* Set the input timing to the screen. Assume always input 0. */
diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.c b/drivers/gpu/drm/mgag200/mgag200_drv.c
index ea1024d79974..e5f145d2cb3b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_drv.c
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.c
@@ -84,6 +84,9 @@ static const struct file_operations mgag200_driver_fops = {
         .mmap = mgag200_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .read = drm_read,
 };
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index ff23d88880e5..3ca240b4413d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -179,7 +179,7 @@ nouveau_abi16_ioctl_grobj_alloc(ABI16_IOCTL_ARGS)
                         return 0;
         } else
         if (init->class == 0x906e) {
-                NV_ERROR(dev, "906e not supported yet\n");
+                NV_DEBUG(dev, "906e not supported yet\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 69688ef5cf46..7e16dc5e6467 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -598,7 +598,7 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
         args->size = args->pitch * args->height;
         args->size = roundup(args->size, PAGE_SIZE);
 
-        ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
+        ret = nouveau_gem_new(dev, args->size, 0, NOUVEAU_GEM_DOMAIN_VRAM, 0, 0, &bo);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index f429e6a8ca7a..c399d510b27a 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -22,6 +22,7 @@
  * Authors: Ben Skeggs
  */
 
+#include <linux/dmi.h>
 #include "drmP.h"
 #include "nouveau_drv.h"
 #include "nouveau_hw.h"
@@ -110,11 +111,26 @@ nv50_gpio_isr(struct drm_device *dev)
                 nv_wr32(dev, 0xe074, intr1);
 }
 
+static struct dmi_system_id gpio_reset_ids[] = {
+        {
+                .ident = "Apple Macbook 10,1",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro10,1"),
+                }
+        },
+        { }
+};
+
 int
 nv50_gpio_init(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
 
+        /* initialise gpios and routing to vbios defaults */
+        if (dmi_check_system(gpio_reset_ids))
+                nouveau_gpio_reset(dev);
+
         /* disable, and ack any pending gpio interrupts */
         nv_wr32(dev, 0xe050, 0x00000000);
         nv_wr32(dev, 0xe054, 0xffffffff);
diff --git a/drivers/gpu/drm/nouveau/nvc0_fb.c b/drivers/gpu/drm/nouveau/nvc0_fb.c
index f704e942372e..f376c39310df 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fb.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fb.c
@@ -124,6 +124,7 @@ nvc0_fb_init(struct drm_device *dev)
         priv = dev_priv->engine.fb.priv;
 
         nv_wr32(dev, 0x100c10, priv->r100c10 >> 8);
+        nv_mask(dev, 0x17e820, 0x00100000, 0x00000000); /* NV_PLTCG_INTR_EN */
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvc0_fifo.c b/drivers/gpu/drm/nouveau/nvc0_fifo.c
index 7d85553d518c..cd39eb99f5b1 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fifo.c
@@ -373,7 +373,8 @@ nvc0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nvc0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
index dac525b2994e..8a2fc89b7763 100644
--- a/drivers/gpu/drm/nouveau/nvd0_display.c
+++ b/drivers/gpu/drm/nouveau/nvd0_display.c
@@ -1510,10 +1510,10 @@ nvd0_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *umode,
         case OUTPUT_DP:
                 if (nv_connector->base.display_info.bpc == 6) {
                         nv_encoder->dp.datarate = mode->clock * 18 / 8;
-                        syncs |= 0x00000140;
+                        syncs |= 0x00000002 << 6;
                 } else {
                         nv_encoder->dp.datarate = mode->clock * 24 / 8;
-                        syncs |= 0x00000180;
+                        syncs |= 0x00000005 << 6;
                 }
 
                 if (nv_encoder->dcb->sorconf.link & 1)
diff --git a/drivers/gpu/drm/nouveau/nve0_fifo.c b/drivers/gpu/drm/nouveau/nve0_fifo.c
index e98d144e6eb9..281bece751b6 100644
--- a/drivers/gpu/drm/nouveau/nve0_fifo.c
+++ b/drivers/gpu/drm/nouveau/nve0_fifo.c
@@ -345,7 +345,8 @@ nve0_fifo_isr_subfifo_intr(struct drm_device *dev, int unit)
 static void
 nve0_fifo_isr(struct drm_device *dev)
 {
-        u32 stat = nv_rd32(dev, 0x002100);
+        u32 mask = nv_rd32(dev, 0x002140);
+        u32 stat = nv_rd32(dev, 0x002100) & mask;
 
         if (stat & 0x00000100) {
                 NV_INFO(dev, "PFIFO: unknown status 0x00000100\n");
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 8acb34fd3fd5..8d7e33a0b243 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1182,7 +1182,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
         ring->ready = true;
         radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
 
-        if (radeon_ring_supports_scratch_reg(rdev, ring)) {
+        if (!ring->rptr_save_reg /* not resuming from suspend */
+            && radeon_ring_supports_scratch_reg(rdev, ring)) {
                 r = radeon_scratch_get(rdev, &ring->rptr_save_reg);
                 if (r) {
                         DRM_ERROR("failed to get scratch reg for rptr save (%d).\n", r);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 7b737b9339ad..2a59375dbe52 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -131,7 +131,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
  */
 void radeon_fence_process(struct radeon_device *rdev, int ring)
 {
-        uint64_t seq, last_seq;
+        uint64_t seq, last_seq, last_emitted;
         unsigned count_loop = 0;
         bool wake = false;
 
@@ -158,13 +158,15 @@ void radeon_fence_process(struct radeon_device *rdev, int ring)
          */
         last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
         do {
+                last_emitted = rdev->fence_drv[ring].sync_seq[ring];
                 seq = radeon_fence_read(rdev, ring);
                 seq |= last_seq & 0xffffffff00000000LL;
                 if (seq < last_seq) {
-                        seq += 0x100000000LL;
+                        seq &= 0xffffffff;
+                        seq |= last_emitted & 0xffffffff00000000LL;
                 }
 
-                if (seq == last_seq) {
+                if (seq <= last_seq || seq > last_emitted) {
                         break;
                 }
                 /* If we loop over we don't want to return without
diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
index d31d4cca9a4c..c5a164337bd5 100644
--- a/drivers/gpu/drm/savage/savage_drv.c
+++ b/drivers/gpu/drm/savage/savage_drv.c
@@ -43,6 +43,9 @@ static const struct file_operations savage_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
index 7f119870147c..867dc03000e6 100644
--- a/drivers/gpu/drm/sis/sis_drv.c
+++ b/drivers/gpu/drm/sis/sis_drv.c
@@ -74,6 +74,9 @@ static const struct file_operations sis_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/tdfx/tdfx_drv.c b/drivers/gpu/drm/tdfx/tdfx_drv.c
index 90f6b13acfac..a7f4d6bd1330 100644
--- a/drivers/gpu/drm/tdfx/tdfx_drv.c
+++ b/drivers/gpu/drm/tdfx/tdfx_drv.c
@@ -49,6 +49,9 @@ static const struct file_operations tdfx_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index ba055e9ca007..8d9dc44f1f94 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -69,6 +69,13 @@ static int udl_get_modes(struct drm_connector *connector)
 static int udl_mode_valid(struct drm_connector *connector,
                           struct drm_display_mode *mode)
 {
+        struct udl_device *udl = connector->dev->dev_private;
+        if (!udl->sku_pixel_limit)
+                return 0;
+
+        if (mode->vdisplay * mode->hdisplay > udl->sku_pixel_limit)
+                return MODE_VIRTUAL_Y;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 6e52069894b3..9f84128505bb 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -66,6 +66,9 @@ static const struct file_operations udl_driver_fops = {
         .unlocked_ioctl = drm_ioctl,
         .release = drm_release,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
index e927b4c052f5..af1b914b17e3 100644
--- a/drivers/gpu/drm/via/via_drv.c
+++ b/drivers/gpu/drm/via/via_drv.c
@@ -65,6 +65,9 @@ static const struct file_operations via_driver_fops = {
         .mmap = drm_mmap,
         .poll = drm_poll,
         .fasync = drm_fasync,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
         .llseek = noop_llseek,
 };
 
diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig
index 794ff67c5701..b71bcd0bfbbf 100644
--- a/drivers/gpu/drm/vmwgfx/Kconfig
+++ b/drivers/gpu/drm/vmwgfx/Kconfig
@@ -12,3 +12,11 @@ config DRM_VMWGFX
           This is a KMS enabled DRM driver for the VMware SVGA2
           virtual hardware.
           The compiled module will be called "vmwgfx.ko".
+
+config DRM_VMWGFX_FBCON
+        depends on DRM_VMWGFX
+        bool "Enable framebuffer console under vmwgfx by default"
+        help
+           Choose this option if you are shipping a new vmwgfx
+           userspace driver that supports using the kernel driver.
+
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 4d9edead01ac..ba2c35dbf10e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -182,8 +182,9 @@ static struct pci_device_id vmw_pci_id_list[] = {
         {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
         {0, 0, 0}
 };
+MODULE_DEVICE_TABLE(pci, vmw_pci_id_list);
 
-static int enable_fbdev;
+static int enable_fbdev = IS_ENABLED(CONFIG_DRM_VMWGFX_FBCON);
 
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
@@ -1154,6 +1155,11 @@ static struct drm_driver driver = {
         .open = vmw_driver_open,
         .preclose = vmw_preclose,
         .postclose = vmw_postclose,
+
+        .dumb_create = vmw_dumb_create,
+        .dumb_map_offset = vmw_dumb_map_offset,
+        .dumb_destroy = vmw_dumb_destroy,
+
         .fops = &vmwgfx_driver_fops,
         .name = VMWGFX_DRIVER_NAME,
         .desc = VMWGFX_DRIVER_DESC,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index d0f2c079ee27..29c984ff7f23 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private *dev_priv,
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
 
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args);
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset);
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle);
 /**
  * Overlay control - vmwgfx_overlay.c
  */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index f2fb8f15e2f1..7e0743358dff 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
         }
 
 
-        event = kzalloc(sizeof(event->event), GFP_KERNEL);
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (unlikely(event == NULL)) {
                 DRM_ERROR("Failed to allocate an event.\n");
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 22bf9a21ec71..2c6ffe0e2c07 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1917,3 +1917,76 @@ err_ref:
         vmw_resource_unreference(&res);
         return ret;
 }
+
+
+int vmw_dumb_create(struct drm_file *file_priv,
+                    struct drm_device *dev,
+                    struct drm_mode_create_dumb *args)
+{
+        struct vmw_private *dev_priv = vmw_priv(dev);
+        struct vmw_master *vmaster = vmw_master(file_priv->master);
+        struct vmw_user_dma_buffer *vmw_user_bo;
+        struct ttm_buffer_object *tmp;
+        int ret;
+
+        args->pitch = args->width * ((args->bpp + 7) / 8);
+        args->size = args->pitch * args->height;
+
+        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
+        if (vmw_user_bo == NULL)
+                return -ENOMEM;
+
+        ret = ttm_read_lock(&vmaster->lock, true);
+        if (ret != 0) {
+                kfree(vmw_user_bo);
+                return ret;
+        }
+
+        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
+                              &vmw_vram_sys_placement, true,
+                              &vmw_user_dmabuf_destroy);
+        if (ret != 0)
+                goto out_no_dmabuf;
+
+        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
+        ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
+                                   &vmw_user_bo->base,
+                                   false,
+                                   ttm_buffer_type,
+                                   &vmw_user_dmabuf_release, NULL);
+        if (unlikely(ret != 0))
+                goto out_no_base_object;
+
+        args->handle = vmw_user_bo->base.hash.key;
+
+out_no_base_object:
+        ttm_bo_unref(&tmp);
+out_no_dmabuf:
+        ttm_read_unlock(&vmaster->lock);
+        return ret;
+}
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+                        struct drm_device *dev, uint32_t handle,
+                        uint64_t *offset)
+{
+        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+        struct vmw_dma_buffer *out_buf;
+        int ret;
+
+        ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+        if (ret != 0)
+                return -EINVAL;
+
+        *offset = out_buf->base.addr_space_offset;
+        vmw_dmabuf_unreference(&out_buf);
+        return 0;
+}
+
+int vmw_dumb_destroy(struct drm_file *file_priv,
+                     struct drm_device *dev,
+                     uint32_t handle)
+{
+        return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
+                                         handle, TTM_REF_USAGE);
+}
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index fbf49503508d..2af774ad1060 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -307,7 +307,6 @@ config HID_LOGITECH
 config HID_LOGITECH_DJ
         tristate "Logitech Unifying receivers full support"
         depends on HID_LOGITECH
-        default m
         ---help---
         Say Y if you want support for Logitech Unifying receivers and devices.
         Unifying receivers are capable of pairing up to 6 Logitech compliant
@@ -527,6 +526,14 @@ config HID_PICOLCD_LEDS
         ---help---
           Provide access to PicoLCD's GPO pins via leds class.
 
+config HID_PICOLCD_CIR
+        bool "CIR via RC class" if EXPERT
+        default !EXPERT
+        depends on HID_PICOLCD
+        depends on HID_PICOLCD=RC_CORE || RC_CORE=y
+        ---help---
+          Provide access to PicoLCD's CIR interface via remote control (LIRC).
+
 config HID_PRIMAX
         tristate "Primax non-fully HID-compliant devices"
         depends on USB_HID
@@ -534,6 +541,15 @@ config HID_PRIMAX
         Support for Primax devices that are not fully compliant with the
         HID standard.
 
+config HID_PS3REMOTE
+        tristate "Sony PS3 BD Remote Control"
+        depends on BT_HIDP
+        ---help---
+        Support for the Sony PS3 Blue-ray Disk Remote Control and Logitech
+        Harmony Adapter for PS3, which connect over Bluetooth.
+
+        Support for the 6-axis controllers is provided by HID_SONY.
+
 config HID_ROCCAT
         tristate "Roccat device support"
         depends on USB_HID
@@ -561,7 +577,9 @@ config HID_SONY
         tristate "Sony PS3 controller"
         depends on USB_HID
         ---help---
-        Support for Sony PS3 controller.
+        Support for Sony PS3 6-axis controllers.
+
+        Support for the Sony PS3 BD Remote is provided by HID_PS3REMOTE.
 
 config HID_SPEEDLINK
         tristate "Speedlink VAD Cezanne mouse support"
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index f975485f88b2..5a3690ff9bf2 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -69,7 +69,28 @@ obj-$(CONFIG_HID_PRODIKEYS)	+= hid-prodikeys.o
 obj-$(CONFIG_HID_PANTHERLORD)   += hid-pl.o
 obj-$(CONFIG_HID_PETALYNX)      += hid-petalynx.o
 obj-$(CONFIG_HID_PICOLCD)       += hid-picolcd.o
+hid-picolcd-y                   += hid-picolcd_core.o
+ifdef CONFIG_HID_PICOLCD_FB
+hid-picolcd-y                   += hid-picolcd_fb.o
+endif
+ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+hid-picolcd-y                   += hid-picolcd_backlight.o
+endif
+ifdef CONFIG_HID_PICOLCD_LCD
+hid-picolcd-y                   += hid-picolcd_lcd.o
+endif
+ifdef CONFIG_HID_PICOLCD_LEDS
+hid-picolcd-y                   += hid-picolcd_leds.o
+endif
+ifdef CONFIG_HID_PICOLCD_CIR
+hid-picolcd-y                   += hid-picolcd_cir.o
+endif
+ifdef CONFIG_DEBUG_FS
+hid-picolcd-y                   += hid-picolcd_debugfs.o
+endif
+
 obj-$(CONFIG_HID_PRIMAX)        += hid-primax.o
+obj-$(CONFIG_HID_PS3REMOTE)     += hid-ps3remote.o
 obj-$(CONFIG_HID_ROCCAT)        += hid-roccat.o hid-roccat-common.o \
         hid-roccat-arvo.o hid-roccat-isku.o hid-roccat-kone.o \
         hid-roccat-koneplus.o hid-roccat-kovaplus.o hid-roccat-pyra.o \
diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 902d1dfeb1b5..0a239885e67c 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 585344b6d338..06ebdbb6ea02 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby <jirislaby@gmail.com>
  */
 
diff --git a/drivers/hid/hid-aureal.c b/drivers/hid/hid-aureal.c
index ba64b041b8bf..7968187ddf7b 100644
--- a/drivers/hid/hid-aureal.c
+++ b/drivers/hid/hid-aureal.c
@@ -9,7 +9,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 #include <linux/device.h>
diff --git a/drivers/hid/hid-belkin.c b/drivers/hid/hid-belkin.c
index a1a765a5b08a..a1a5a12c3a6b 100644
--- a/drivers/hid/hid-belkin.c
+++ b/drivers/hid/hid-belkin.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 888ece68a47c..af034d3d9256 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8bcd168fffae..2cd6880b6b17 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -126,7 +126,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 
         if (parser->collection_stack_ptr == HID_COLLECTION_STACK_SIZE) {
                 hid_err(parser->device, "collection stack overflow\n");
-                return -1;
+                return -EINVAL;
         }
 
         if (parser->device->maxcollection == parser->device->collection_size) {
@@ -134,7 +134,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
                                 parser->device->collection_size * 2, GFP_KERNEL);
                 if (collection == NULL) {
                         hid_err(parser->device, "failed to reallocate collection array\n");
-                        return -1;
+                        return -ENOMEM;
                 }
                 memcpy(collection, parser->device->collection,
                         sizeof(struct hid_collection) *
@@ -170,7 +170,7 @@ static int close_collection(struct hid_parser *parser)
 {
         if (!parser->collection_stack_ptr) {
                 hid_err(parser->device, "collection stack underflow\n");
-                return -1;
+                return -EINVAL;
         }
         parser->collection_stack_ptr--;
         return 0;
@@ -374,7 +374,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 
         case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
                 parser->global.report_size = item_udata(item);
-                if (parser->global.report_size > 96) {
+                if (parser->global.report_size > 128) {
                         hid_err(parser->device, "invalid report_size %d\n",
                                         parser->global.report_size);
                         return -1;
@@ -757,6 +757,7 @@ int hid_open_report(struct hid_device *device)
         struct hid_item item;
         unsigned int size;
         __u8 *start;
+        __u8 *buf;
         __u8 *end;
         int ret;
         static int (*dispatch_type[])(struct hid_parser *parser,
@@ -775,12 +776,21 @@ int hid_open_report(struct hid_device *device)
                 return -ENODEV;
         size = device->dev_rsize;
 
+        buf = kmemdup(start, size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
         if (device->driver->report_fixup)
-                start = device->driver->report_fixup(device, start, &size);
+                start = device->driver->report_fixup(device, buf, &size);
+        else
+                start = buf;
 
-        device->rdesc = kmemdup(start, size, GFP_KERNEL);
-        if (device->rdesc == NULL)
+        start = kmemdup(start, size, GFP_KERNEL);
+        kfree(buf);
+        if (start == NULL)
                 return -ENOMEM;
+
+        device->rdesc = start;
         device->rsize = size;
 
         parser = vzalloc(sizeof(struct hid_parser));
@@ -1448,7 +1458,14 @@ void hid_disconnect(struct hid_device *hdev)
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
-/* a list of devices for which there is a specialized driver on HID bus */
+/*
+ * A list of devices for which there is a specialized driver on HID bus.
+ *
+ * Please note that for multitouch devices (driven by hid-multitouch driver),
+ * there is a proper autodetection and autoloading in place (based on presence
+ * of HID_DG_CONTACTID), so those devices don't need to be added to this list,
+ * as we are doing the right thing in hid_scan_usage().
+ */
 static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
@@ -1566,6 +1583,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1627,6 +1645,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
+#if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
@@ -1635,10 +1654,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_SAVU) },
+#endif
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
@@ -1663,6 +1684,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
index 9e43aaca9774..3e159a50dac7 100644
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 01dd9a7daf7a..933fff0fff1f 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -911,15 +911,21 @@ static void hid_dump_input_mapping(struct hid_device *hid, struct seq_file *f)
 
 }
 
-
 static int hid_debug_rdesc_show(struct seq_file *f, void *p)
 {
         struct hid_device *hdev = f->private;
+        const __u8 *rdesc = hdev->rdesc;
+        unsigned rsize = hdev->rsize;
         int i;
 
+        if (!rdesc) {
+                rdesc = hdev->dev_rdesc;
+                rsize = hdev->dev_rsize;
+        }
+
         /* dump HID report descriptor */
-        for (i = 0; i < hdev->rsize; i++)
-                seq_printf(f, "%02x ", hdev->rdesc[i]);
+        for (i = 0; i < rsize; i++)
+                seq_printf(f, "%02x ", rdesc[i]);
         seq_printf(f, "\n\n");
 
         /* dump parsed data and input mappings */
diff --git a/drivers/hid/hid-ezkey.c b/drivers/hid/hid-ezkey.c
index ca1163e9d42d..6540af2871a7 100644
--- a/drivers/hid/hid-ezkey.c
+++ b/drivers/hid/hid-ezkey.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-gyration.c b/drivers/hid/hid-gyration.c
index e88b951cd10d..4442c30ef531 100644
--- a/drivers/hid/hid-gyration.c
+++ b/drivers/hid/hid-gyration.c
@@ -4,7 +4,6 @@
  *  Copyright (c) 1999 Andreas Gal
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2006-2008 Jiri Kosina
  */
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 4e7542151e22..ff295e60059b 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -100,8 +100,7 @@ static void holtekff_send(struct holtekff_device *holtekff,
                 holtekff->field->value[i] = data[i];
         }
 
-        dbg_hid("sending %02x %02x %02x %02x %02x %02x %02x\n", data[0],
-                data[1], data[2], data[3], data[4], data[5], data[6]);
+        dbg_hid("sending %*ph\n", 7, data);
 
         usbhid_submit_report(hid, holtekff->field->report, USB_DIR_OUT);
 }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 1dcb76ff51e3..ca4d83e6e387 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  */
 
 /*
@@ -269,7 +268,11 @@
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA       0x72fa
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302       0x7302
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349       0x7349
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7       0x73f7
 #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001       0xa001
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7224      0x7224
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72D0      0x72d0
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72C4      0x72c4
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
@@ -283,6 +286,9 @@
 #define USB_VENDOR_ID_EMS               0x2006
 #define USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II 0x0118
 
+#define USB_VENDOR_ID_FLATFROG          0x25b5
+#define USB_DEVICE_ID_MULTITOUCH_3200   0x0002
+
 #define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
 
@@ -296,6 +302,9 @@
 #define USB_VENDOR_ID_EZKEY             0x0518
 #define USB_DEVICE_ID_BTC_8193          0x0002
 
+#define USB_VENDOR_ID_FREESCALE         0x15A2
+#define USB_DEVICE_ID_FREESCALE_MX28    0x004F
+
 #define USB_VENDOR_ID_FRUCTEL   0x25B6
 #define USB_DEVICE_ID_GAMETEL_MT_MODE   0x0002
 
@@ -305,6 +314,7 @@
 
 #define USB_VENDOR_ID_GENERAL_TOUCH     0x0dfc
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
+#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS 0x0100
 
 #define USB_VENDOR_ID_GLAB              0x06c2
 #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038
@@ -496,6 +506,7 @@
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
+#define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
 #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD   0xc20a
 #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD        0xc211
 #define USB_DEVICE_ID_LOGITECH_EXTREME_3D       0xc215
@@ -652,7 +663,6 @@
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH              0x3000
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001         0x3001
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008         0x3008
-#define USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN   0x3001
 
 #define USB_VENDOR_ID_ROCCAT            0x1e7d
 #define USB_DEVICE_ID_ROCCAT_ARVO       0x30d4
@@ -683,6 +693,7 @@
 
 #define USB_VENDOR_ID_SONY                      0x054c
 #define USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE       0x024b
+#define USB_DEVICE_ID_SONY_PS3_BDREMOTE         0x0306
 #define USB_DEVICE_ID_SONY_PS3_CONTROLLER       0x0268
 #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER        0x042f
 
@@ -758,6 +769,7 @@
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U    0x0005
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP1062     0x0064
 #define USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850   0x0522
+#define USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60     0x0781
 
 #define USB_VENDOR_ID_UNITEC    0x227d
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0709     0x0709
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 811bfad64609..d917c0d53685 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1154,6 +1154,7 @@ static void report_features(struct hid_device *hid)
 
 int hidinput_connect(struct hid_device *hid, unsigned int force)
 {
+        struct hid_driver *drv = hid->driver;
         struct hid_report *report;
         struct hid_input *hidinput = NULL;
         struct input_dev *input_dev;
@@ -1228,6 +1229,8 @@ int hidinput_connect(struct hid_device *hid, unsigned int force)
                                  * UGCI) cram a lot of unrelated inputs into the
                                  * same interface. */
                                 hidinput->report = report;
+                                if (drv->input_configured)
+                                        drv->input_configured(hid, hidinput);
                                 if (input_register_device(hidinput->input))
                                         goto out_cleanup;
                                 hidinput = NULL;
@@ -1235,8 +1238,12 @@ int hidinput_connect(struct hid_device *hid, unsigned int force)
                 }
         }
 
-        if (hidinput && input_register_device(hidinput->input))
-                goto out_cleanup;
+        if (hidinput) {
+                if (drv->input_configured)
+                        drv->input_configured(hid, hidinput);
+                if (input_register_device(hidinput->input))
+                        goto out_cleanup;
+        }
 
         return 0;
 
diff --git a/drivers/hid/hid-lcpower.c b/drivers/hid/hid-lcpower.c
index c4fe9bd095b7..22bc14abdfa3 100644
--- a/drivers/hid/hid-lcpower.c
+++ b/drivers/hid/hid-lcpower.c
@@ -24,7 +24,7 @@ static int ts_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        if ((usage->hid & HID_USAGE_PAGE) != 0x0ffbc0000)
+        if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
                 return 0;
 
         switch (usage->hid & HID_USAGE) {
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index 77d2df04c97b..cea016e94f43 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -56,9 +56,8 @@ static int tpkbd_input_mapping(struct hid_device *hdev,
 static int tpkbd_features_set(struct hid_device *hdev)
 {
         struct hid_report *report;
-        struct tpkbd_data_pointer *data_pointer;
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
         report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[4];
 
         report->field[0]->value[0]  = data_pointer->press_to_select   ? 0x01 : 0x02;
@@ -77,14 +76,8 @@ static ssize_t pointer_press_to_select_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->press_to_select);
 }
@@ -94,16 +87,10 @@ static ssize_t pointer_press_to_select_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -119,14 +106,8 @@ static ssize_t pointer_dragging_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->dragging);
 }
@@ -136,16 +117,10 @@ static ssize_t pointer_dragging_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -161,14 +136,8 @@ static ssize_t pointer_release_to_select_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->release_to_select);
 }
@@ -178,16 +147,10 @@ static ssize_t pointer_release_to_select_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -203,14 +166,8 @@ static ssize_t pointer_select_right_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->select_right);
 }
@@ -220,16 +177,10 @@ static ssize_t pointer_select_right_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value))
                 return -EINVAL;
         if (value < 0 || value > 1)
@@ -245,14 +196,8 @@ static ssize_t pointer_sensitivity_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
-
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n",
                 data_pointer->sensitivity);
@@ -263,16 +208,10 @@ static ssize_t pointer_sensitivity_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
                 return -EINVAL;
 
@@ -286,14 +225,10 @@ static ssize_t pointer_press_speed_show(struct device *dev,
                 struct device_attribute *attr,
                 char *buf)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        data_pointer = hid_get_drvdata(hdev);
 
         return snprintf(buf, PAGE_SIZE, "%u\n",
                 data_pointer->press_speed);
@@ -304,16 +239,10 @@ static ssize_t pointer_press_speed_store(struct device *dev,
                 const char *buf,
                 size_t count)
 {
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int value;
 
-        hdev = container_of(dev, struct hid_device, dev);
-        if (hdev == NULL)
-                return -ENODEV;
-
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
                 return -EINVAL;
 
@@ -370,15 +299,11 @@ static const struct attribute_group tpkbd_attr_group_pointer = {
 static enum led_brightness tpkbd_led_brightness_get(
                         struct led_classdev *led_cdev)
 {
-        struct device *dev;
-        struct hid_device *hdev;
-        struct tpkbd_data_pointer *data_pointer;
+        struct device *dev = led_cdev->dev->parent;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         int led_nr = 0;
 
-        dev = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (led_cdev == &data_pointer->led_micmute)
                 led_nr = 1;
 
@@ -390,16 +315,12 @@ static enum led_brightness tpkbd_led_brightness_get(
 static void tpkbd_led_brightness_set(struct led_classdev *led_cdev,
                         enum led_brightness value)
 {
-        struct device *dev;
-        struct hid_device *hdev;
+        struct device *dev = led_cdev->dev->parent;
+        struct hid_device *hdev = container_of(dev, struct hid_device, dev);
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
         struct hid_report *report;
-        struct tpkbd_data_pointer *data_pointer;
         int led_nr = 0;
 
-        dev = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         if (led_cdev == &data_pointer->led_micmute)
                 led_nr = 1;
 
@@ -508,17 +429,17 @@ err_free:
 
 static void tpkbd_remove_tp(struct hid_device *hdev)
 {
-        struct tpkbd_data_pointer *data_pointer;
+        struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
 
         sysfs_remove_group(&hdev->dev.kobj,
                         &tpkbd_attr_group_pointer);
 
-        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
-
         led_classdev_unregister(&data_pointer->led_micmute);
         led_classdev_unregister(&data_pointer->led_mute);
 
         hid_set_drvdata(hdev, NULL);
+        kfree(data_pointer->led_micmute.name);
+        kfree(data_pointer->led_mute.name);
         kfree(data_pointer);
 }
 
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index fc37ed6b108c..a2f8e88b9fa2 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2010 Hendrik Iben
  */
@@ -109,7 +108,7 @@ static __u8 dfp_rdesc_fixed[] = {
 static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
                         rdesc[84] == 0x8c && rdesc[85] == 0x02) {
@@ -278,7 +277,7 @@ static int lg_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                   0,  0,  0,  0,  0,183,184,185,186,187,
                 188,189,190,191,192,193,194,  0,  0,  0
         };
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
         unsigned int hid = usage->hid;
 
         if (hdev->product == USB_DEVICE_ID_LOGITECH_RECEIVER &&
@@ -319,7 +318,7 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_BAD_RELATIVE_KEYS) && usage->type == EV_KEY &&
                         (field->flags & HID_MAIN_ITEM_RELATIVE))
@@ -335,13 +334,16 @@ static int lg_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 static int lg_event(struct hid_device *hdev, struct hid_field *field,
                 struct hid_usage *usage, __s32 value)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
 
         if ((drv_data->quirks & LG_INVERT_HWHEEL) && usage->code == REL_HWHEEL) {
                 input_event(field->hidinput->input, usage->type, usage->code,
                                 -value);
                 return 1;
         }
+        if (drv_data->quirks & LG_FF4) {
+                return lg4ff_adjust_input_event(hdev, field, usage, value, drv_data);
+        }
 
         return 0;
 }
@@ -358,7 +360,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return -ENOMEM;
         }
         drv_data->quirks = id->driver_data;
-        
+
         hid_set_drvdata(hdev, (void *)drv_data);
 
         if (drv_data->quirks & LG_NOGET)
@@ -380,7 +382,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
         }
 
         /* Setup wireless link with Logitech Wii wheel */
-        if(hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
+        if (hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) {
                 unsigned char buf[] = { 0x00, 0xAF,  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
                 ret = hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
@@ -416,7 +418,7 @@ err_free:
 
 static void lg_remove(struct hid_device *hdev)
 {
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hdev);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
         if (drv_data->quirks & LG_FF4)
                 lg4ff_deinit(hdev);
 
@@ -476,7 +478,7 @@ static const struct hid_device_id lg_devices[] = {
                 .driver_data = LG_NOGET | LG_FF4 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WII_WHEEL),
                 .driver_data = LG_FF4 },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG ),
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
                 .driver_data = LG_FF },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
                 .driver_data = LG_FF2 },
diff --git a/drivers/hid/hid-lg.h b/drivers/hid/hid-lg.h
index d64cf8d2751e..142ce3f5f055 100644
--- a/drivers/hid/hid-lg.h
+++ b/drivers/hid/hid-lg.h
@@ -25,9 +25,13 @@ static inline int lg3ff_init(struct hid_device *hdev) { return -1; }
 #endif
 
 #ifdef CONFIG_LOGIWHEELS_FF
+int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                             struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data);
 int lg4ff_init(struct hid_device *hdev);
 int lg4ff_deinit(struct hid_device *hdev);
 #else
+static inline int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                                           struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data) { return 0; }
 static inline int lg4ff_init(struct hid_device *hdev) { return -1; }
 static inline int lg4ff_deinit(struct hid_device *hdev) { return -1; }
 #endif
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index f3390ee6105c..d7947c701f30 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -43,6 +43,11 @@
 #define G27_REV_MAJ 0x12
 #define G27_REV_MIN 0x38
 
+#define DFP_X_MIN 0
+#define DFP_X_MAX 16383
+#define DFP_PEDAL_MIN 0
+#define DFP_PEDAL_MAX 255
+
 #define to_hid_device(pdev) container_of(pdev, struct hid_device, dev)
 
 static void hid_lg4ff_set_range_dfp(struct hid_device *hid, u16 range);
@@ -53,6 +58,7 @@ static ssize_t lg4ff_range_store(struct device *dev, struct device_attribute *at
 static DEVICE_ATTR(range, S_IRWXU | S_IRWXG | S_IRWXO, lg4ff_range_show, lg4ff_range_store);
 
 struct lg4ff_device_entry {
+        __u32 product_id;
         __u16 range;
         __u16 min_range;
         __u16 max_range;
@@ -129,26 +135,77 @@ static const struct lg4ff_usb_revision lg4ff_revs[] = {
         {G27_REV_MAJ,  G27_REV_MIN,  &native_g27},      /* G27 */
 };
 
+/* Recalculates X axis value accordingly to currently selected range */
+static __s32 lg4ff_adjust_dfp_x_axis(__s32 value, __u16 range)
+{
+        __u16 max_range;
+        __s32 new_value;
+
+        if (range == 900)
+                return value;
+        else if (range == 200)
+                return value;
+        else if (range < 200)
+                max_range = 200;
+        else
+                max_range = 900;
+
+        new_value = 8192 + mult_frac(value - 8192, max_range, range);
+        if (new_value < 0)
+                return 0;
+        else if (new_value > 16383)
+                return 16383;
+        else
+                return new_value;
+}
+
+int lg4ff_adjust_input_event(struct hid_device *hid, struct hid_field *field,
+                             struct hid_usage *usage, __s32 value, struct lg_drv_data *drv_data)
+{
+        struct lg4ff_device_entry *entry = drv_data->device_props;
+        __s32 new_value = 0;
+
+        if (!entry) {
+                hid_err(hid, "Device properties not found");
+                return 0;
+        }
+
+        switch (entry->product_id) {
+        case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+                switch (usage->code) {
+                case ABS_X:
+                        new_value = lg4ff_adjust_dfp_x_axis(value, entry->range);
+                        input_event(field->hidinput->input, usage->type, usage->code, new_value);
+                        return 1;
+                default:
+                        return 0;
+                }
+        default:
+                return 0;
+        }
+}
+
 static int hid_lg4ff_play(struct input_dev *dev, void *data, struct ff_effect *effect)
 {
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
         int x;
 
-#define CLAMP(x) if (x < 0) x = 0; if (x > 0xff) x = 0xff
+#define CLAMP(x) do { if (x < 0) x = 0; else if (x > 0xff) x = 0xff; } while (0)
 
         switch (effect->type) {
         case FF_CONSTANT:
                 x = effect->u.ramp.start_level + 0x80;  /* 0x80 is no force */
                 CLAMP(x);
-                report->field[0]->value[0] = 0x11;      /* Slot 1 */
-                report->field[0]->value[1] = 0x08;
-                report->field[0]->value[2] = x;
-                report->field[0]->value[3] = 0x80;
-                report->field[0]->value[4] = 0x00;
-                report->field[0]->value[5] = 0x00;
-                report->field[0]->value[6] = 0x00;
+                value[0] = 0x11;        /* Slot 1 */
+                value[1] = 0x08;
+                value[2] = x;
+                value[3] = 0x80;
+                value[4] = 0x00;
+                value[5] = 0x00;
+                value[6] = 0x00;
 
                 usbhid_submit_report(hid, report, USB_DIR_OUT);
                 break;
@@ -163,14 +220,15 @@ static void hid_lg4ff_set_autocenter_default(struct input_dev *dev, u16 magnitud
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
 
-        report->field[0]->value[0] = 0xfe;
-        report->field[0]->value[1] = 0x0d;
-        report->field[0]->value[2] = magnitude >> 13;
-        report->field[0]->value[3] = magnitude >> 13;
-        report->field[0]->value[4] = magnitude >> 8;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xfe;
+        value[1] = 0x0d;
+        value[2] = magnitude >> 13;
+        value[3] = magnitude >> 13;
+        value[4] = magnitude >> 8;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -181,16 +239,16 @@ static void hid_lg4ff_set_autocenter_ffex(struct input_dev *dev, u16 magnitude)
         struct hid_device *hid = input_get_drvdata(dev);
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
         magnitude = magnitude * 90 / 65535;
-        
 
-        report->field[0]->value[0] = 0xfe;
-        report->field[0]->value[1] = 0x03;
-        report->field[0]->value[2] = magnitude >> 14;
-        report->field[0]->value[3] = magnitude >> 14;
-        report->field[0]->value[4] = magnitude;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xfe;
+        value[1] = 0x03;
+        value[2] = magnitude >> 14;
+        value[3] = magnitude >> 14;
+        value[4] = magnitude;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -200,15 +258,17 @@ static void hid_lg4ff_set_range_g25(struct hid_device *hid, u16 range)
 {
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+        __s32 *value = report->field[0]->value;
+
         dbg_hid("G25/G27/DFGT: setting range to %u\n", range);
 
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x81;
-        report->field[0]->value[2] = range & 0x00ff;
-        report->field[0]->value[3] = (range & 0xff00) >> 8;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xf8;
+        value[1] = 0x81;
+        value[2] = range & 0x00ff;
+        value[3] = (range & 0xff00) >> 8;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -219,16 +279,18 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
         int start_left, start_right, full_range;
+        __s32 *value = report->field[0]->value;
+
         dbg_hid("Driving Force Pro: setting range to %u\n", range);
 
         /* Prepare "coarse" limit command */
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x00;      /* Set later */
-        report->field[0]->value[2] = 0x00;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0xf8;
+        value[1] = 0x00;        /* Set later */
+        value[2] = 0x00;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         if (range > 200) {
                 report->field[0]->value[1] = 0x03;
@@ -240,13 +302,13 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 
         /* Prepare "fine" limit command */
-        report->field[0]->value[0] = 0x81;
-        report->field[0]->value[1] = 0x0b;
-        report->field[0]->value[2] = 0x00;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        value[0] = 0x81;
+        value[1] = 0x0b;
+        value[2] = 0x00;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
 
         if (range == 200 || range == 900) {     /* Do not apply any fine limit */
                 usbhid_submit_report(hid, report, USB_DIR_OUT);
@@ -257,11 +319,11 @@ static void hid_lg4ff_set_range_dfp(struct hid_device *hid, __u16 range)
         start_left = (((full_range - range + 1) * 2047) / full_range);
         start_right = 0xfff - start_left;
 
-        report->field[0]->value[2] = start_left >> 4;
-        report->field[0]->value[3] = start_right >> 4;
-        report->field[0]->value[4] = 0xff;
-        report->field[0]->value[5] = (start_right & 0xe) << 4 | (start_left & 0xe);
-        report->field[0]->value[6] = 0xff;
+        value[2] = start_left >> 4;
+        value[3] = start_right >> 4;
+        value[4] = 0xff;
+        value[5] = (start_right & 0xe) << 4 | (start_left & 0xe);
+        value[6] = 0xff;
 
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
@@ -344,14 +406,15 @@ static void lg4ff_set_leds(struct hid_device *hid, __u8 leds)
 {
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
-
-        report->field[0]->value[0] = 0xf8;
-        report->field[0]->value[1] = 0x12;
-        report->field[0]->value[2] = leds;
-        report->field[0]->value[3] = 0x00;
-        report->field[0]->value[4] = 0x00;
-        report->field[0]->value[5] = 0x00;
-        report->field[0]->value[6] = 0x00;
+        __s32 *value = report->field[0]->value;
+
+        value[0] = 0xf8;
+        value[1] = 0x12;
+        value[2] = leds;
+        value[3] = 0x00;
+        value[4] = 0x00;
+        value[5] = 0x00;
+        value[6] = 0x00;
         usbhid_submit_report(hid, report, USB_DIR_OUT);
 }
 
@@ -360,7 +423,7 @@ static void lg4ff_led_set_brightness(struct led_classdev *led_cdev,
 {
         struct device *dev = led_cdev->dev->parent;
         struct hid_device *hid = container_of(dev, struct hid_device, dev);
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hid);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hid);
         struct lg4ff_device_entry *entry;
         int i, state = 0;
 
@@ -395,7 +458,7 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde
 {
         struct device *dev = led_cdev->dev->parent;
         struct hid_device *hid = container_of(dev, struct hid_device, dev);
-        struct lg_drv_data *drv_data = (struct lg_drv_data *)hid_get_drvdata(hid);
+        struct lg_drv_data *drv_data = hid_get_drvdata(hid);
         struct lg4ff_device_entry *entry;
         int i, value = 0;
 
@@ -501,7 +564,7 @@ int lg4ff_init(struct hid_device *hid)
         /* Check if autocentering is available and
          * set the centering force to zero by default */
         if (test_bit(FF_AUTOCENTER, dev->ffbit)) {
-                if(rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN)  /* Formula Force EX expects different autocentering command */
+                if (rev_maj == FFEX_REV_MAJ && rev_min == FFEX_REV_MIN) /* Formula Force EX expects different autocentering command */
                         dev->ff->set_autocenter = hid_lg4ff_set_autocenter_ffex;
                 else
                         dev->ff->set_autocenter = hid_lg4ff_set_autocenter_default;
@@ -524,6 +587,7 @@ int lg4ff_init(struct hid_device *hid)
         }
         drv_data->device_props = entry;
 
+        entry->product_id = lg4ff_devices[i].product_id;
         entry->min_range = lg4ff_devices[i].min_range;
         entry->max_range = lg4ff_devices[i].max_range;
         entry->set_range = lg4ff_devices[i].set_range;
@@ -534,6 +598,18 @@ int lg4ff_init(struct hid_device *hid)
                 return error;
         dbg_hid("sysfs interface created\n");
 
+        /* Set default axes parameters */
+        switch (lg4ff_devices[i].product_id) {
+        case USB_DEVICE_ID_LOGITECH_DFP_WHEEL:
+                dbg_hid("Setting axes parameters for Driving Force Pro\n");
+                input_set_abs_params(dev, ABS_X, DFP_X_MIN, DFP_X_MAX, 0, 0);
+                input_set_abs_params(dev, ABS_Y, DFP_PEDAL_MIN, DFP_PEDAL_MAX, 0, 0);
+                input_set_abs_params(dev, ABS_RZ, DFP_PEDAL_MIN, DFP_PEDAL_MAX, 0, 0);
+                break;
+        default:
+                break;
+        }
+
         /* Set the maximum range to start with */
         entry->range = entry->max_range;
         if (entry->set_range != NULL)
@@ -594,6 +670,8 @@ out:
         return 0;
 }
 
+
+
 int lg4ff_deinit(struct hid_device *hid)
 {
         struct lg4ff_device_entry *entry;
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 4d524b5f52f5..9500f2f3f8fe 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                         size_t count,
                                         unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                 struct dj_report *dj_report)
@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
             SPFUNCTION_DEVICE_LIST_EMPTY) {
                 dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                 return;
         }
 
@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                 return;
         }
 
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
+
         dj_hiddev = hid_allocate_device();
         if (IS_ERR(dj_hiddev)) {
                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -306,6 +314,7 @@ static void delayedwork_callback(struct work_struct *work)
         struct dj_report dj_report;
         unsigned long flags;
         int count;
+        int retval;
 
         dbg_hid("%s\n", __func__);
 
@@ -338,6 +347,25 @@ static void delayedwork_callback(struct work_struct *work)
                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                 break;
         default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                 dbg_hid("%s: unexpected report type\n", __func__);
         }
 }
@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
         if (!djdev) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
         if (dj_device == NULL) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         struct dj_report *dj_report;
         int retval;
 
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
+
         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
         if (!dj_report)
                 return -ENOMEM;
@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         return retval;
 }
 
+
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                           unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
         struct work_struct work;
         struct kfifo notif_fifo;
         spinlock_t lock;
+        bool querying_devices;
 };
 
 struct dj_device {
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 73647266daad..25ddf3e3aec6 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -392,7 +392,7 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
 
         __set_bit(EV_ABS, input->evbit);
 
-        error = input_mt_init_slots(input, 16);
+        error = input_mt_init_slots(input, 16, 0);
         if (error)
                 return error;
         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255 << 2,
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index e5c699b6c6f3..3acdcfcc17df 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
index dedf757781ae..cd3643e06fa6 100644
--- a/drivers/hid/hid-monterey.c
+++ b/drivers/hid/hid-monterey.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 59c8b5c1d2de..3eb02b94fc87 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -51,12 +51,12 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_VALID_IS_INRANGE       (1 << 5)
 #define MT_QUIRK_VALID_IS_CONFIDENCE    (1 << 6)
 #define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE    (1 << 8)
+#define MT_QUIRK_NO_AREA                (1 << 9)
 
 struct mt_slot {
         __s32 x, y, p, w, h;
         __s32 contactid;        /* the device ContactID assigned to this slot */
         bool touch_state;       /* is the touch valid? */
-        bool seen_in_this_frame;/* has this slot been updated */
 };
 
 struct mt_class {
@@ -92,8 +92,9 @@ struct mt_device {
         __u8 touches_by_report; /* how many touches are present in one report:
                                 * 1 means we should use a serial protocol
                                 * > 1 means hybrid (multitouch) protocol */
+        bool serial_maybe;      /* need to check for serial protocol */
         bool curvalid;          /* is the current contact valid? */
-        struct mt_slot *slots;
+        unsigned mt_flags;      /* flags to pass to input-mt */
 };
 
 /* classes of device behavior */
@@ -115,6 +116,9 @@ struct mt_device {
 #define MT_CLS_EGALAX_SERIAL                    0x0104
 #define MT_CLS_TOPSEED                          0x0105
 #define MT_CLS_PANASONIC                        0x0106
+#define MT_CLS_FLATFROG                         0x0107
+#define MT_CLS_GENERALTOUCH_TWOFINGERS          0x0108
+#define MT_CLS_GENERALTOUCH_PWT_TENFINGERS      0x0109
 
 #define MT_DEFAULT_MAXCONTACT   10
 
@@ -134,25 +138,6 @@ static int cypress_compute_slot(struct mt_device *td)
                 return -1;
 }
 
-static int find_slot_from_contactid(struct mt_device *td)
-{
-        int i;
-        for (i = 0; i < td->maxcontacts; ++i) {
-                if (td->slots[i].contactid == td->curdata.contactid &&
-                        td->slots[i].touch_state)
-                        return i;
-        }
-        for (i = 0; i < td->maxcontacts; ++i) {
-                if (!td->slots[i].seen_in_this_frame &&
-                        !td->slots[i].touch_state)
-                        return i;
-        }
-        /* should not occurs. If this happens that means
-         * that the device sent more touches that it says
-         * in the report descriptor. It is ignored then. */
-        return -1;
-}
-
 static struct mt_class mt_classes[] = {
         { .name = MT_CLS_DEFAULT,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP },
@@ -190,7 +175,9 @@ static struct mt_class mt_classes[] = {
                         MT_QUIRK_SLOT_IS_CONTACTID,
                 .sn_move = 2048,
                 .sn_width = 128,
-                .sn_height = 128 },
+                .sn_height = 128,
+                .maxcontacts = 60,
+        },
         { .name = MT_CLS_CYPRESS,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
                         MT_QUIRK_CYPRESS,
@@ -215,7 +202,24 @@ static struct mt_class mt_classes[] = {
         { .name = MT_CLS_PANASONIC,
                 .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP,
                 .maxcontacts = 4 },
+        { .name = MT_CLS_GENERALTOUCH_TWOFINGERS,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_VALID_IS_INRANGE |
+                        MT_QUIRK_SLOT_IS_CONTACTNUMBER,
+                .maxcontacts = 2
+        },
+        { .name = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_SLOT_IS_CONTACTNUMBER,
+                .maxcontacts = 10
+        },
 
+        { .name = MT_CLS_FLATFROG,
+                .quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
+                        MT_QUIRK_NO_AREA,
+                .sn_move = 2048,
+                .maxcontacts = 40,
+        },
         { }
 };
 
@@ -319,24 +323,16 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
         * We need to ignore fields that belong to other collections
         * such as Mouse that might have the same GenericDesktop usages. */
         if (field->application == HID_DG_TOUCHSCREEN)
-                set_bit(INPUT_PROP_DIRECT, hi->input->propbit);
+                td->mt_flags |= INPUT_MT_DIRECT;
         else if (field->application != HID_DG_TOUCHPAD)
                 return 0;
 
-        /* In case of an indirect device (touchpad), we need to add
-         * specific BTN_TOOL_* to be handled by the synaptics xorg
-         * driver.
-         * We also consider that touchscreens providing buttons are touchpads.
+        /*
+         * Model touchscreens providing buttons as touchpads.
          */
         if (field->application == HID_DG_TOUCHPAD ||
-            (usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON ||
-            cls->is_indirect) {
-                set_bit(INPUT_PROP_POINTER, hi->input->propbit);
-                set_bit(BTN_TOOL_FINGER, hi->input->keybit);
-                set_bit(BTN_TOOL_DOUBLETAP, hi->input->keybit);
-                set_bit(BTN_TOOL_TRIPLETAP, hi->input->keybit);
-                set_bit(BTN_TOOL_QUADTAP, hi->input->keybit);
-        }
+            (usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
+                td->mt_flags |= INPUT_MT_POINTER;
 
         /* eGalax devices provide a Digitizer.Stylus input which overrides
          * the correct Digitizers.Finger X/Y ranges.
@@ -353,8 +349,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_POSITION_X);
                         set_abs(hi->input, ABS_MT_POSITION_X, field,
                                 cls->sn_move);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_X, field, cls->sn_move);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -363,8 +357,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_POSITION_Y);
                         set_abs(hi->input, ABS_MT_POSITION_Y, field,
                                 cls->sn_move);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_Y, field, cls->sn_move);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -388,9 +380,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         td->last_field_index = field->index;
                         return 1;
                 case HID_DG_CONTACTID:
-                        if (!td->maxcontacts)
-                                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
-                        input_mt_init_slots(hi->input, td->maxcontacts);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         td->touches_by_report++;
@@ -398,18 +387,21 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 case HID_DG_WIDTH:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_TOUCH_MAJOR);
-                        set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
-                                cls->sn_width);
+                        if (!(cls->quirks & MT_QUIRK_NO_AREA))
+                                set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
+                                        cls->sn_width);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
                 case HID_DG_HEIGHT:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_TOUCH_MINOR);
-                        set_abs(hi->input, ABS_MT_TOUCH_MINOR, field,
-                                cls->sn_height);
-                        input_set_abs_params(hi->input,
+                        if (!(cls->quirks & MT_QUIRK_NO_AREA)) {
+                                set_abs(hi->input, ABS_MT_TOUCH_MINOR, field,
+                                        cls->sn_height);
+                                input_set_abs_params(hi->input,
                                         ABS_MT_ORIENTATION, 0, 1, 0, 0);
+                        }
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -418,9 +410,6 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                         EV_ABS, ABS_MT_PRESSURE);
                         set_abs(hi->input, ABS_MT_PRESSURE, field,
                                 cls->sn_pressure);
-                        /* touchscreen emulation */
-                        set_abs(hi->input, ABS_PRESSURE, field,
-                                cls->sn_pressure);
                         mt_store_field(usage, td, hi);
                         td->last_field_index = field->index;
                         return 1;
@@ -464,7 +453,7 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
         return -1;
 }
 
-static int mt_compute_slot(struct mt_device *td)
+static int mt_compute_slot(struct mt_device *td, struct input_dev *input)
 {
         __s32 quirks = td->mtclass.quirks;
 
@@ -480,42 +469,23 @@ static int mt_compute_slot(struct mt_device *td)
         if (quirks & MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE)
                 return td->curdata.contactid - 1;
 
-        return find_slot_from_contactid(td);
+        return input_mt_get_slot_by_key(input, td->curdata.contactid);
 }
 
 /*
  * this function is called when a whole contact has been processed,
  * so that it can assign it to a slot and store the data there
  */
-static void mt_complete_slot(struct mt_device *td)
+static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
 {
-        td->curdata.seen_in_this_frame = true;
         if (td->curvalid) {
-                int slotnum = mt_compute_slot(td);
-
-                if (slotnum >= 0 && slotnum < td->maxcontacts)
-                        td->slots[slotnum] = td->curdata;
-        }
-        td->num_received++;
-}
+                int slotnum = mt_compute_slot(td, input);
+                struct mt_slot *s = &td->curdata;
 
+                if (slotnum < 0 || slotnum >= td->maxcontacts)
+                        return;
 
-/*
- * this function is called when a whole packet has been received and processed,
- * so that it can decide what to send to the input layer.
- */
-static void mt_emit_event(struct mt_device *td, struct input_dev *input)
-{
-        int i;
-
-        for (i = 0; i < td->maxcontacts; ++i) {
-                struct mt_slot *s = &(td->slots[i]);
-                if ((td->mtclass.quirks & MT_QUIRK_NOT_SEEN_MEANS_UP) &&
-                        !s->seen_in_this_frame) {
-                        s->touch_state = false;
-                }
-
-                input_mt_slot(input, i);
+                input_mt_slot(input, slotnum);
                 input_mt_report_slot_state(input, MT_TOOL_FINGER,
                         s->touch_state);
                 if (s->touch_state) {
@@ -532,24 +502,29 @@ static void mt_emit_event(struct mt_device *td, struct input_dev *input)
                         input_event(input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
                         input_event(input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
                 }
-                s->seen_in_this_frame = false;
-
         }
 
-        input_mt_report_pointer_emulation(input, true);
+        td->num_received++;
+}
+
+/*
+ * this function is called when a whole packet has been received and processed,
+ * so that it can decide what to send to the input layer.
+ */
+static void mt_sync_frame(struct mt_device *td, struct input_dev *input)
+{
+        input_mt_sync_frame(input);
         input_sync(input);
         td->num_received = 0;
 }
 
-
-
 static int mt_event(struct hid_device *hid, struct hid_field *field,
                                 struct hid_usage *usage, __s32 value)
 {
         struct mt_device *td = hid_get_drvdata(hid);
         __s32 quirks = td->mtclass.quirks;
 
-        if (hid->claimed & HID_CLAIMED_INPUT && td->slots) {
+        if (hid->claimed & HID_CLAIMED_INPUT) {
                 switch (usage->hid) {
                 case HID_DG_INRANGE:
                         if (quirks & MT_QUIRK_ALWAYS_VALID)
@@ -602,11 +577,11 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
                 }
 
                 if (usage->hid == td->last_slot_field)
-                        mt_complete_slot(td);
+                        mt_complete_slot(td, field->hidinput->input);
 
                 if (field->index == td->last_field_index
                         && td->num_received >= td->num_expected)
-                        mt_emit_event(td, field->hidinput->input);
+                        mt_sync_frame(td, field->hidinput->input);
 
         }
 
@@ -685,18 +660,45 @@ static void mt_post_parse(struct mt_device *td)
         }
 }
 
+static void mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+
+{
+        struct mt_device *td = hid_get_drvdata(hdev);
+        struct mt_class *cls = &td->mtclass;
+        struct input_dev *input = hi->input;
+
+        /* Only initialize slots for MT input devices */
+        if (!test_bit(ABS_MT_POSITION_X, input->absbit))
+                return;
+
+        if (!td->maxcontacts)
+                td->maxcontacts = MT_DEFAULT_MAXCONTACT;
+
+        mt_post_parse(td);
+        if (td->serial_maybe)
+                mt_post_parse_default_settings(td);
+
+        if (cls->is_indirect)
+                td->mt_flags |= INPUT_MT_POINTER;
+
+        if (cls->quirks & MT_QUIRK_NOT_SEEN_MEANS_UP)
+                td->mt_flags |= INPUT_MT_DROP_UNUSED;
+
+        input_mt_init_slots(input, td->maxcontacts, td->mt_flags);
+
+        td->mt_flags = 0;
+}
+
 static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
         int ret, i;
         struct mt_device *td;
         struct mt_class *mtclass = mt_classes; /* MT_CLS_DEFAULT */
 
-        if (id) {
-                for (i = 0; mt_classes[i].name ; i++) {
-                        if (id->driver_data == mt_classes[i].name) {
-                                mtclass = &(mt_classes[i]);
-                                break;
-                        }
+        for (i = 0; mt_classes[i].name ; i++) {
+                if (id->driver_data == mt_classes[i].name) {
+                        mtclass = &(mt_classes[i]);
+                        break;
                 }
         }
 
@@ -722,6 +724,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 goto fail;
         }
 
+        if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
+                td->serial_maybe = true;
+
         ret = hid_parse(hdev);
         if (ret != 0)
                 goto fail;
@@ -730,20 +735,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (ret)
                 goto fail;
 
-        mt_post_parse(td);
-
-        if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
-                mt_post_parse_default_settings(td);
-
-        td->slots = kzalloc(td->maxcontacts * sizeof(struct mt_slot),
-                                GFP_KERNEL);
-        if (!td->slots) {
-                dev_err(&hdev->dev, "cannot allocate multitouch slots\n");
-                hid_hw_stop(hdev);
-                ret = -ENOMEM;
-                goto fail;
-        }
-
         ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group);
 
         mt_set_maxcontacts(hdev);
@@ -767,6 +758,32 @@ static int mt_reset_resume(struct hid_device *hdev)
         mt_set_input_mode(hdev);
         return 0;
 }
+
+static int mt_resume(struct hid_device *hdev)
+{
+        struct usb_interface *intf;
+        struct usb_host_interface *interface;
+        struct usb_device *dev;
+
+        if (hdev->bus != BUS_USB)
+                return 0;
+
+        intf = to_usb_interface(hdev->dev.parent);
+        interface = intf->cur_altsetting;
+        dev = hid_to_usb_dev(hdev);
+
+        /* Some Elan legacy devices require SET_IDLE to be set on resume.
+         * It should be safe to send it to other devices too.
+         * Tested on 3M, Stantum, Cypress, Zytronic, eGalax, and Elan panels. */
+
+        usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                        HID_REQ_SET_IDLE,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        0, interface->desc.bInterfaceNumber,
+                        NULL, 0, USB_CTRL_SET_TIMEOUT);
+
+        return 0;
+}
 #endif
 
 static void mt_remove(struct hid_device *hdev)
@@ -774,7 +791,6 @@ static void mt_remove(struct hid_device *hdev)
         struct mt_device *td = hid_get_drvdata(hdev);
         sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
         hid_hw_stop(hdev);
-        kfree(td->slots);
         kfree(td);
         hid_set_drvdata(hdev, NULL);
 }
@@ -885,17 +901,37 @@ static const struct hid_device_id mt_devices[] = {
                         USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349) },
         { .driver_data = MT_CLS_EGALAX_SERIAL,
                 MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7) },
+        { .driver_data = MT_CLS_EGALAX_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
                         USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7224) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72D0) },
+        { .driver_data = MT_CLS_EGALAX,
+                HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72C4) },
 
         /* Elo TouchSystems IntelliTouch Plus panel */
         { .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
                 MT_USB_DEVICE(USB_VENDOR_ID_ELO,
                         USB_DEVICE_ID_ELO_TS2515) },
 
+        /* Flatfrog Panels */
+        { .driver_data = MT_CLS_FLATFROG,
+                MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
+                        USB_DEVICE_ID_MULTITOUCH_3200) },
+
         /* GeneralTouch panel */
-        { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTNUMBER,
+        { .driver_data = MT_CLS_GENERALTOUCH_TWOFINGERS,
                 MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
                         USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS) },
+        { .driver_data = MT_CLS_GENERALTOUCH_PWT_TENFINGERS,
+                MT_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH,
+                        USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PWT_TENFINGERS) },
 
         /* Gametel game controller */
         { .driver_data = MT_CLS_DEFAULT,
@@ -1087,11 +1123,13 @@ static struct hid_driver mt_driver = {
         .remove = mt_remove,
         .input_mapping = mt_input_mapping,
         .input_mapped = mt_input_mapped,
+        .input_configured = mt_input_configured,
         .feature_mapping = mt_feature_mapping,
         .usage_table = mt_grabbed_usages,
         .event = mt_event,
 #ifdef CONFIG_PM
         .reset_resume = mt_reset_resume,
+        .resume = mt_resume,
 #endif
 };
 
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9fae2ebdd758..86a969f63292 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -882,10 +882,10 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
         nd->activate_slack = activate_slack;
         nd->act_state = activate_slack;
         nd->deactivate_slack = -deactivate_slack;
-        nd->sensor_logical_width = 0;
-        nd->sensor_logical_height = 0;
-        nd->sensor_physical_width = 0;
-        nd->sensor_physical_height = 0;
+        nd->sensor_logical_width = 1;
+        nd->sensor_logical_height = 1;
+        nd->sensor_physical_width = 1;
+        nd->sensor_physical_height = 1;
 
         hid_set_drvdata(hdev, nd);
 
diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
index f1ea3ff8a98d..4c521de4e7e6 100644
--- a/drivers/hid/hid-petalynx.c
+++ b/drivers/hid/hid-petalynx.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
deleted file mode 100644
index 27c8ebdfad01..000000000000
--- a/drivers/hid/hid-picolcd.c
+++ /dev/null
@@ -1,2748 +0,0 @@
-/***************************************************************************
- *   Copyright (C) 2010 by Bruno Prémont <bonbons@linux-vserver.org>       *
- *                                                                         *
- *   Based on Logitech G13 driver (v0.4)                                   *
- *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
- *                                                                         *
- *   This program is free software: you can redistribute it and/or modify  *
- *   it under the terms of the GNU General Public License as published by  *
- *   the Free Software Foundation, version 2 of the License.               *
- *                                                                         *
- *   This driver is distributed in the hope that it will be useful, but    *
- *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
- *   General Public License for more details.                              *
- *                                                                         *
- *   You should have received a copy of the GNU General Public License     *
- *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
- ***************************************************************************/
-
-#include <linux/hid.h>
-#include <linux/hid-debug.h>
-#include <linux/input.h>
-#include "hid-ids.h"
-#include "usbhid/usbhid.h"
-#include <linux/usb.h>
-
-#include <linux/fb.h>
-#include <linux/vmalloc.h>
-#include <linux/backlight.h>
-#include <linux/lcd.h>
-
-#include <linux/leds.h>
-
-#include <linux/seq_file.h>
-#include <linux/debugfs.h>
-
-#include <linux/completion.h>
-#include <linux/uaccess.h>
-#include <linux/module.h>
-
-#define PICOLCD_NAME "PicoLCD (graphic)"
-
-/* Report numbers */
-#define REPORT_ERROR_CODE      0x10 /* LCD: IN[16]  */
-#define   ERR_SUCCESS            0x00
-#define   ERR_PARAMETER_MISSING  0x01
-#define   ERR_DATA_MISSING       0x02
-#define   ERR_BLOCK_READ_ONLY    0x03
-#define   ERR_BLOCK_NOT_ERASABLE 0x04
-#define   ERR_BLOCK_TOO_BIG      0x05
-#define   ERR_SECTION_OVERFLOW   0x06
-#define   ERR_INVALID_CMD_LEN    0x07
-#define   ERR_INVALID_DATA_LEN   0x08
-#define REPORT_KEY_STATE       0x11 /* LCD: IN[2]   */
-#define REPORT_IR_DATA         0x21 /* LCD: IN[63]  */
-#define REPORT_EE_DATA         0x32 /* LCD: IN[63]  */
-#define REPORT_MEMORY          0x41 /* LCD: IN[63]  */
-#define REPORT_LED_STATE       0x81 /* LCD: OUT[1]  */
-#define REPORT_BRIGHTNESS      0x91 /* LCD: OUT[1]  */
-#define REPORT_CONTRAST        0x92 /* LCD: OUT[1]  */
-#define REPORT_RESET           0x93 /* LCD: OUT[2]  */
-#define REPORT_LCD_CMD         0x94 /* LCD: OUT[63] */
-#define REPORT_LCD_DATA        0x95 /* LCD: OUT[63] */
-#define REPORT_LCD_CMD_DATA    0x96 /* LCD: OUT[63] */
-#define REPORT_EE_READ         0xa3 /* LCD: OUT[63] */
-#define REPORT_EE_WRITE        0xa4 /* LCD: OUT[63] */
-#define REPORT_ERASE_MEMORY    0xb2 /* LCD: OUT[2]  */
-#define REPORT_READ_MEMORY     0xb3 /* LCD: OUT[3]  */
-#define REPORT_WRITE_MEMORY    0xb4 /* LCD: OUT[63] */
-#define REPORT_SPLASH_RESTART  0xc1 /* LCD: OUT[1]  */
-#define REPORT_EXIT_KEYBOARD   0xef /* LCD: OUT[2]  */
-#define REPORT_VERSION         0xf1 /* LCD: IN[2],OUT[1]    Bootloader: IN[2],OUT[1]   */
-#define REPORT_BL_ERASE_MEMORY 0xf2 /*                      Bootloader: IN[36],OUT[4]  */
-#define REPORT_BL_READ_MEMORY  0xf3 /*                      Bootloader: IN[36],OUT[4]  */
-#define REPORT_BL_WRITE_MEMORY 0xf4 /*                      Bootloader: IN[36],OUT[36] */
-#define REPORT_DEVID           0xf5 /* LCD: IN[5], OUT[1]   Bootloader: IN[5],OUT[1]   */
-#define REPORT_SPLASH_SIZE     0xf6 /* LCD: IN[4], OUT[1]   */
-#define REPORT_HOOK_VERSION    0xf7 /* LCD: IN[2], OUT[1]   */
-#define REPORT_EXIT_FLASHER    0xff /*                      Bootloader: OUT[2]         */
-
-#ifdef CONFIG_HID_PICOLCD_FB
-/* Framebuffer
- *
- * The PicoLCD use a Topway LCD module of 256x64 pixel
- * This display area is tiled over 4 controllers with 8 tiles
- * each. Each tile has 8x64 pixel, each data byte representing
- * a 1-bit wide vertical line of the tile.
- *
- * The display can be updated at a tile granularity.
- *
- *       Chip 1           Chip 2           Chip 3           Chip 4
- * +----------------+----------------+----------------+----------------+
- * |     Tile 1     |     Tile 1     |     Tile 1     |     Tile 1     |
- * +----------------+----------------+----------------+----------------+
- * |     Tile 2     |     Tile 2     |     Tile 2     |     Tile 2     |
- * +----------------+----------------+----------------+----------------+
- *                                  ...
- * +----------------+----------------+----------------+----------------+
- * |     Tile 8     |     Tile 8     |     Tile 8     |     Tile 8     |
- * +----------------+----------------+----------------+----------------+
- */
-#define PICOLCDFB_NAME "picolcdfb"
-#define PICOLCDFB_WIDTH (256)
-#define PICOLCDFB_HEIGHT (64)
-#define PICOLCDFB_SIZE (PICOLCDFB_WIDTH * PICOLCDFB_HEIGHT / 8)
-
-#define PICOLCDFB_UPDATE_RATE_LIMIT   10
-#define PICOLCDFB_UPDATE_RATE_DEFAULT  2
-
-/* Framebuffer visual structures */
-static const struct fb_fix_screeninfo picolcdfb_fix = {
-        .id          = PICOLCDFB_NAME,
-        .type        = FB_TYPE_PACKED_PIXELS,
-        .visual      = FB_VISUAL_MONO01,
-        .xpanstep    = 0,
-        .ypanstep    = 0,
-        .ywrapstep   = 0,
-        .line_length = PICOLCDFB_WIDTH / 8,
-        .accel       = FB_ACCEL_NONE,
-};
-
-static const struct fb_var_screeninfo picolcdfb_var = {
-        .xres           = PICOLCDFB_WIDTH,
-        .yres           = PICOLCDFB_HEIGHT,
-        .xres_virtual   = PICOLCDFB_WIDTH,
-        .yres_virtual   = PICOLCDFB_HEIGHT,
-        .width          = 103,
-        .height         = 26,
-        .bits_per_pixel = 1,
-        .grayscale      = 1,
-        .red            = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .green          = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .blue           = {
-                .offset = 0,
-                .length = 1,
-                .msb_right = 0,
-        },
-        .transp         = {
-                .offset = 0,
-                .length = 0,
-                .msb_right = 0,
-        },
-};
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-/* Input device
- *
- * The PicoLCD has an IR receiver header, a built-in keypad with 5 keys
- * and header for 4x4 key matrix. The built-in keys are part of the matrix.
- */
-static const unsigned short def_keymap[] = {
-        KEY_RESERVED,   /* none */
-        KEY_BACK,       /* col 4 + row 1 */
-        KEY_HOMEPAGE,   /* col 3 + row 1 */
-        KEY_RESERVED,   /* col 2 + row 1 */
-        KEY_RESERVED,   /* col 1 + row 1 */
-        KEY_SCROLLUP,   /* col 4 + row 2 */
-        KEY_OK,         /* col 3 + row 2 */
-        KEY_SCROLLDOWN, /* col 2 + row 2 */
-        KEY_RESERVED,   /* col 1 + row 2 */
-        KEY_RESERVED,   /* col 4 + row 3 */
-        KEY_RESERVED,   /* col 3 + row 3 */
-        KEY_RESERVED,   /* col 2 + row 3 */
-        KEY_RESERVED,   /* col 1 + row 3 */
-        KEY_RESERVED,   /* col 4 + row 4 */
-        KEY_RESERVED,   /* col 3 + row 4 */
-        KEY_RESERVED,   /* col 2 + row 4 */
-        KEY_RESERVED,   /* col 1 + row 4 */
-};
-#define PICOLCD_KEYS ARRAY_SIZE(def_keymap)
-
-/* Description of in-progress IO operation, used for operations
- * that trigger response from device */
-struct picolcd_pending {
-        struct hid_report *out_report;
-        struct hid_report *in_report;
-        struct completion ready;
-        int raw_size;
-        u8 raw_data[64];
-};
-
-/* Per device data structure */
-struct picolcd_data {
-        struct hid_device *hdev;
-#ifdef CONFIG_DEBUG_FS
-        struct dentry *debug_reset;
-        struct dentry *debug_eeprom;
-        struct dentry *debug_flash;
-        struct mutex mutex_flash;
-        int addr_sz;
-#endif
-        u8 version[2];
-        unsigned short opmode_delay;
-        /* input stuff */
-        u8 pressed_keys[2];
-        struct input_dev *input_keys;
-        struct input_dev *input_cir;
-        unsigned short keycode[PICOLCD_KEYS];
-
-#ifdef CONFIG_HID_PICOLCD_FB
-        /* Framebuffer stuff */
-        u8 fb_update_rate;
-        u8 fb_bpp;
-        u8 fb_force;
-        u8 *fb_vbitmap;         /* local copy of what was sent to PicoLCD */
-        u8 *fb_bitmap;          /* framebuffer */
-        struct fb_info *fb_info;
-        struct fb_deferred_io fb_defio;
-#endif /* CONFIG_HID_PICOLCD_FB */
-#ifdef CONFIG_HID_PICOLCD_LCD
-        struct lcd_device *lcd;
-        u8 lcd_contrast;
-#endif /* CONFIG_HID_PICOLCD_LCD */
-#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
-        struct backlight_device *backlight;
-        u8 lcd_brightness;
-        u8 lcd_power;
-#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
-#ifdef CONFIG_HID_PICOLCD_LEDS
-        /* LED stuff */
-        u8 led_state;
-        struct led_classdev *led[8];
-#endif /* CONFIG_HID_PICOLCD_LEDS */
-
-        /* Housekeeping stuff */
-        spinlock_t lock;
-        struct mutex mutex;
-        struct picolcd_pending *pending;
-        int status;
-#define PICOLCD_BOOTLOADER 1
-#define PICOLCD_FAILED 2
-#define PICOLCD_READY_FB 4
-};
-
-
-/* Find a given report */
-#define picolcd_in_report(id, dev) picolcd_report(id, dev, HID_INPUT_REPORT)
-#define picolcd_out_report(id, dev) picolcd_report(id, dev, HID_OUTPUT_REPORT)
-
-static struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir)
-{
-        struct list_head *feature_report_list = &hdev->report_enum[dir].report_list;
-        struct hid_report *report = NULL;
-
-        list_for_each_entry(report, feature_report_list, list) {
-                if (report->id == id)
-                        return report;
-        }
-        hid_warn(hdev, "No report with id 0x%x found\n", id);
-        return NULL;
-}
-
-#ifdef CONFIG_DEBUG_FS
-static void picolcd_debug_out_report(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report);
-#define usbhid_submit_report(a, b, c) \
-        do { \
-                picolcd_debug_out_report(hid_get_drvdata(a), a, b); \
-                usbhid_submit_report(a, b, c); \
-        } while (0)
-#endif
-
-/* Submit a report and wait for a reply from device - if device fades away
- * or does not respond in time, return NULL */
-static struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
-                int report_id, const u8 *raw_data, int size)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct picolcd_pending *work;
-        struct hid_report *report = picolcd_out_report(report_id, hdev);
-        unsigned long flags;
-        int i, j, k;
-
-        if (!report || !data)
-                return NULL;
-        if (data->status & PICOLCD_FAILED)
-                return NULL;
-        work = kzalloc(sizeof(*work), GFP_KERNEL);
-        if (!work)
-                return NULL;
-
-        init_completion(&work->ready);
-        work->out_report = report;
-        work->in_report  = NULL;
-        work->raw_size   = 0;
-
-        mutex_lock(&data->mutex);
-        spin_lock_irqsave(&data->lock, flags);
-        for (i = k = 0; i < report->maxfield; i++)
-                for (j = 0; j < report->field[i]->report_count; j++) {
-                        hid_set_field(report->field[i], j, k < size ? raw_data[k] : 0);
-                        k++;
-                }
-        data->pending = work;
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        wait_for_completion_interruptible_timeout(&work->ready, HZ*2);
-        spin_lock_irqsave(&data->lock, flags);
-        data->pending = NULL;
-        spin_unlock_irqrestore(&data->lock, flags);
-        mutex_unlock(&data->mutex);
-        return work;
-}
-
-#ifdef CONFIG_HID_PICOLCD_FB
-/* Send a given tile to PicoLCD */
-static int picolcd_fb_send_tile(struct hid_device *hdev, int chip, int tile)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct hid_report *report1 = picolcd_out_report(REPORT_LCD_CMD_DATA, hdev);
-        struct hid_report *report2 = picolcd_out_report(REPORT_LCD_DATA, hdev);
-        unsigned long flags;
-        u8 *tdata;
-        int i;
-
-        if (!report1 || report1->maxfield != 1 || !report2 || report2->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report1->field[0],  0, chip << 2);
-        hid_set_field(report1->field[0],  1, 0x02);
-        hid_set_field(report1->field[0],  2, 0x00);
-        hid_set_field(report1->field[0],  3, 0x00);
-        hid_set_field(report1->field[0],  4, 0xb8 | tile);
-        hid_set_field(report1->field[0],  5, 0x00);
-        hid_set_field(report1->field[0],  6, 0x00);
-        hid_set_field(report1->field[0],  7, 0x40);
-        hid_set_field(report1->field[0],  8, 0x00);
-        hid_set_field(report1->field[0],  9, 0x00);
-        hid_set_field(report1->field[0], 10,   32);
-
-        hid_set_field(report2->field[0],  0, (chip << 2) | 0x01);
-        hid_set_field(report2->field[0],  1, 0x00);
-        hid_set_field(report2->field[0],  2, 0x00);
-        hid_set_field(report2->field[0],  3,   32);
-
-        tdata = data->fb_vbitmap + (tile * 4 + chip) * 64;
-        for (i = 0; i < 64; i++)
-                if (i < 32)
-                        hid_set_field(report1->field[0], 11 + i, tdata[i]);
-                else
-                        hid_set_field(report2->field[0], 4 + i - 32, tdata[i]);
-
-        usbhid_submit_report(data->hdev, report1, USB_DIR_OUT);
-        usbhid_submit_report(data->hdev, report2, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-/* Translate a single tile*/
-static int picolcd_fb_update_tile(u8 *vbitmap, const u8 *bitmap, int bpp,
-                int chip, int tile)
-{
-        int i, b, changed = 0;
-        u8 tdata[64];
-        u8 *vdata = vbitmap + (tile * 4 + chip) * 64;
-
-        if (bpp == 1) {
-                for (b = 7; b >= 0; b--) {
-                        const u8 *bdata = bitmap + tile * 256 + chip * 8 + b * 32;
-                        for (i = 0; i < 64; i++) {
-                                tdata[i] <<= 1;
-                                tdata[i] |= (bdata[i/8] >> (i % 8)) & 0x01;
-                        }
-                }
-        } else if (bpp == 8) {
-                for (b = 7; b >= 0; b--) {
-                        const u8 *bdata = bitmap + (tile * 256 + chip * 8 + b * 32) * 8;
-                        for (i = 0; i < 64; i++) {
-                                tdata[i] <<= 1;
-                                tdata[i] |= (bdata[i] & 0x80) ? 0x01 : 0x00;
-                        }
-                }
-        } else {
-                /* Oops, we should never get here! */
-                WARN_ON(1);
-                return 0;
-        }
-
-        for (i = 0; i < 64; i++)
-                if (tdata[i] != vdata[i]) {
-                        changed = 1;
-                        vdata[i] = tdata[i];
-                }
-        return changed;
-}
-
-/* Reconfigure LCD display */
-static int picolcd_fb_reset(struct picolcd_data *data, int clear)
-{
-        struct hid_report *report = picolcd_out_report(REPORT_LCD_CMD, data->hdev);
-        int i, j;
-        unsigned long flags;
-        static const u8 mapcmd[8] = { 0x00, 0x02, 0x00, 0x64, 0x3f, 0x00, 0x64, 0xc0 };
-
-        if (!report || report->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        for (i = 0; i < 4; i++) {
-                for (j = 0; j < report->field[0]->maxusage; j++)
-                        if (j == 0)
-                                hid_set_field(report->field[0], j, i << 2);
-                        else if (j < sizeof(mapcmd))
-                                hid_set_field(report->field[0], j, mapcmd[j]);
-                        else
-                                hid_set_field(report->field[0], j, 0);
-                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        }
-
-        data->status |= PICOLCD_READY_FB;
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        if (data->fb_bitmap) {
-                if (clear) {
-                        memset(data->fb_vbitmap, 0, PICOLCDFB_SIZE);
-                        memset(data->fb_bitmap, 0, PICOLCDFB_SIZE*data->fb_bpp);
-                }
-                data->fb_force = 1;
-        }
-
-        /* schedule first output of framebuffer */
-        if (data->fb_info)
-                schedule_delayed_work(&data->fb_info->deferred_work, 0);
-
-        return 0;
-}
-
-/* Update fb_vbitmap from the screen_base and send changed tiles to device */
-static void picolcd_fb_update(struct picolcd_data *data)
-{
-        int chip, tile, n;
-        unsigned long flags;
-
-        if (!data)
-                return;
-
-        spin_lock_irqsave(&data->lock, flags);
-        if (!(data->status & PICOLCD_READY_FB)) {
-                spin_unlock_irqrestore(&data->lock, flags);
-                picolcd_fb_reset(data, 0);
-        } else {
-                spin_unlock_irqrestore(&data->lock, flags);
-        }
-
-        /*
-         * Translate the framebuffer into the format needed by the PicoLCD.
-         * See display layout above.
-         * Do this one tile after the other and push those tiles that changed.
-         *
-         * Wait for our IO to complete as otherwise we might flood the queue!
-         */
-        n = 0;
-        for (chip = 0; chip < 4; chip++)
-                for (tile = 0; tile < 8; tile++)
-                        if (picolcd_fb_update_tile(data->fb_vbitmap,
-                                        data->fb_bitmap, data->fb_bpp, chip, tile) ||
-                                data->fb_force) {
-                                n += 2;
-                                if (!data->fb_info->par)
-                                        return; /* device lost! */
-                                if (n >= HID_OUTPUT_FIFO_SIZE / 2) {
-                                        usbhid_wait_io(data->hdev);
-                                        n = 0;
-                                }
-                                picolcd_fb_send_tile(data->hdev, chip, tile);
-                        }
-        data->fb_force = false;
-        if (n)
-                usbhid_wait_io(data->hdev);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_fillrect(struct fb_info *info,
-                const struct fb_fillrect *rect)
-{
-        if (!info->par)
-                return;
-        sys_fillrect(info, rect);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_copyarea(struct fb_info *info,
-                const struct fb_copyarea *area)
-{
-        if (!info->par)
-                return;
-        sys_copyarea(info, area);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/* Stub to call the system default and update the image on the picoLCD */
-static void picolcd_fb_imageblit(struct fb_info *info, const struct fb_image *image)
-{
-        if (!info->par)
-                return;
-        sys_imageblit(info, image);
-
-        schedule_delayed_work(&info->deferred_work, 0);
-}
-
-/*
- * this is the slow path from userspace. they can seek and write to
- * the fb. it's inefficient to do anything less than a full screen draw
- */
-static ssize_t picolcd_fb_write(struct fb_info *info, const char __user *buf,
-                size_t count, loff_t *ppos)
-{
-        ssize_t ret;
-        if (!info->par)
-                return -ENODEV;
-        ret = fb_sys_write(info, buf, count, ppos);
-        if (ret >= 0)
-                schedule_delayed_work(&info->deferred_work, 0);
-        return ret;
-}
-
-static int picolcd_fb_blank(int blank, struct fb_info *info)
-{
-        if (!info->par)
-                return -ENODEV;
-        /* We let fb notification do this for us via lcd/backlight device */
-        return 0;
-}
-
-static void picolcd_fb_destroy(struct fb_info *info)
-{
-        struct picolcd_data *data = info->par;
-        u32 *ref_cnt = info->pseudo_palette;
-        int may_release;
-
-        info->par = NULL;
-        if (data)
-                data->fb_info = NULL;
-        fb_deferred_io_cleanup(info);
-
-        ref_cnt--;
-        mutex_lock(&info->lock);
-        (*ref_cnt)--;
-        may_release = !*ref_cnt;
-        mutex_unlock(&info->lock);
-        if (may_release) {
-                vfree((u8 *)info->fix.smem_start);
-                framebuffer_release(info);
-        }
-}
-
-static int picolcd_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
-{
-        __u32 bpp      = var->bits_per_pixel;
-        __u32 activate = var->activate;
-
-        /* only allow 1/8 bit depth (8-bit is grayscale) */
-        *var = picolcdfb_var;
-        var->activate = activate;
-        if (bpp >= 8) {
-                var->bits_per_pixel = 8;
-                var->red.length     = 8;
-                var->green.length   = 8;
-                var->blue.length    = 8;
-        } else {
-                var->bits_per_pixel = 1;
-                var->red.length     = 1;
-                var->green.length   = 1;
-                var->blue.length    = 1;
-        }
-        return 0;
-}
-
-static int picolcd_set_par(struct fb_info *info)
-{
-        struct picolcd_data *data = info->par;
-        u8 *tmp_fb, *o_fb;
-        if (!data)
-                return -ENODEV;
-        if (info->var.bits_per_pixel == data->fb_bpp)
-                return 0;
-        /* switch between 1/8 bit depths */
-        if (info->var.bits_per_pixel != 1 && info->var.bits_per_pixel != 8)
-                return -EINVAL;
-
-        o_fb   = data->fb_bitmap;
-        tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
-        if (!tmp_fb)
-                return -ENOMEM;
-
-        /* translate FB content to new bits-per-pixel */
-        if (info->var.bits_per_pixel == 1) {
-                int i, b;
-                for (i = 0; i < PICOLCDFB_SIZE; i++) {
-                        u8 p = 0;
-                        for (b = 0; b < 8; b++) {
-                                p <<= 1;
-                                p |= o_fb[i*8+b] ? 0x01 : 0x00;
-                        }
-                        tmp_fb[i] = p;
-                }
-                memcpy(o_fb, tmp_fb, PICOLCDFB_SIZE);
-                info->fix.visual = FB_VISUAL_MONO01;
-                info->fix.line_length = PICOLCDFB_WIDTH / 8;
-        } else {
-                int i;
-                memcpy(tmp_fb, o_fb, PICOLCDFB_SIZE);
-                for (i = 0; i < PICOLCDFB_SIZE * 8; i++)
-                        o_fb[i] = tmp_fb[i/8] & (0x01 << (7 - i % 8)) ? 0xff : 0x00;
-                info->fix.visual = FB_VISUAL_DIRECTCOLOR;
-                info->fix.line_length = PICOLCDFB_WIDTH;
-        }
-
-        kfree(tmp_fb);
-        data->fb_bpp      = info->var.bits_per_pixel;
-        return 0;
-}
-
-/* Do refcounting on our FB and cleanup per worker if FB is
- * closed after unplug of our device
- * (fb_release holds info->lock and still touches info after
- *  we return so we can't release it immediately.
- */
-struct picolcd_fb_cleanup_item {
-        struct fb_info *info;
-        struct picolcd_fb_cleanup_item *next;
-};
-static struct picolcd_fb_cleanup_item *fb_pending;
-static DEFINE_SPINLOCK(fb_pending_lock);
-
-static void picolcd_fb_do_cleanup(struct work_struct *data)
-{
-        struct picolcd_fb_cleanup_item *item;
-        unsigned long flags;
-
-        do {
-                spin_lock_irqsave(&fb_pending_lock, flags);
-                item = fb_pending;
-                fb_pending = item ? item->next : NULL;
-                spin_unlock_irqrestore(&fb_pending_lock, flags);
-
-                if (item) {
-                        u8 *fb = (u8 *)item->info->fix.smem_start;
-                        /* make sure we do not race against fb core when
-                         * releasing */
-                        mutex_lock(&item->info->lock);
-                        mutex_unlock(&item->info->lock);
-                        framebuffer_release(item->info);
-                        vfree(fb);
-                }
-        } while (item);
-}
-
-static DECLARE_WORK(picolcd_fb_cleanup, picolcd_fb_do_cleanup);
-
-static int picolcd_fb_open(struct fb_info *info, int u)
-{
-        u32 *ref_cnt = info->pseudo_palette;
-        ref_cnt--;
-
-        (*ref_cnt)++;
-        return 0;
-}
-
-static int picolcd_fb_release(struct fb_info *info, int u)
-{
-        u32 *ref_cnt = info->pseudo_palette;
-        ref_cnt--;
-
-        (*ref_cnt)++;
-        if (!*ref_cnt) {
-                unsigned long flags;
-                struct picolcd_fb_cleanup_item *item = (struct picolcd_fb_cleanup_item *)ref_cnt;
-                item--;
-                spin_lock_irqsave(&fb_pending_lock, flags);
-                item->next = fb_pending;
-                fb_pending = item;
-                spin_unlock_irqrestore(&fb_pending_lock, flags);
-                schedule_work(&picolcd_fb_cleanup);
-        }
-        return 0;
-}
-
-/* Note this can't be const because of struct fb_info definition */
-static struct fb_ops picolcdfb_ops = {
-        .owner        = THIS_MODULE,
-        .fb_destroy   = picolcd_fb_destroy,
-        .fb_open      = picolcd_fb_open,
-        .fb_release   = picolcd_fb_release,
-        .fb_read      = fb_sys_read,
-        .fb_write     = picolcd_fb_write,
-        .fb_blank     = picolcd_fb_blank,
-        .fb_fillrect  = picolcd_fb_fillrect,
-        .fb_copyarea  = picolcd_fb_copyarea,
-        .fb_imageblit = picolcd_fb_imageblit,
-        .fb_check_var = picolcd_fb_check_var,
-        .fb_set_par   = picolcd_set_par,
-};
-
-
-/* Callback from deferred IO workqueue */
-static void picolcd_fb_deferred_io(struct fb_info *info, struct list_head *pagelist)
-{
-        picolcd_fb_update(info->par);
-}
-
-static const struct fb_deferred_io picolcd_fb_defio = {
-        .delay = HZ / PICOLCDFB_UPDATE_RATE_DEFAULT,
-        .deferred_io = picolcd_fb_deferred_io,
-};
-
-
-/*
- * The "fb_update_rate" sysfs attribute
- */
-static ssize_t picolcd_fb_update_rate_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        unsigned i, fb_update_rate = data->fb_update_rate;
-        size_t ret = 0;
-
-        for (i = 1; i <= PICOLCDFB_UPDATE_RATE_LIMIT; i++)
-                if (ret >= PAGE_SIZE)
-                        break;
-                else if (i == fb_update_rate)
-                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "[%u] ", i);
-                else
-                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "%u ", i);
-        if (ret > 0)
-                buf[min(ret, (size_t)PAGE_SIZE)-1] = '\n';
-        return ret;
-}
-
-static ssize_t picolcd_fb_update_rate_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        int i;
-        unsigned u;
-
-        if (count < 1 || count > 10)
-                return -EINVAL;
-
-        i = sscanf(buf, "%u", &u);
-        if (i != 1)
-                return -EINVAL;
-
-        if (u > PICOLCDFB_UPDATE_RATE_LIMIT)
-                return -ERANGE;
-        else if (u == 0)
-                u = PICOLCDFB_UPDATE_RATE_DEFAULT;
-
-        data->fb_update_rate = u;
-        data->fb_defio.delay = HZ / data->fb_update_rate;
-        return count;
-}
-
-static DEVICE_ATTR(fb_update_rate, 0666, picolcd_fb_update_rate_show,
-                picolcd_fb_update_rate_store);
-
-/* initialize Framebuffer device */
-static int picolcd_init_framebuffer(struct picolcd_data *data)
-{
-        struct device *dev = &data->hdev->dev;
-        struct fb_info *info = NULL;
-        int i, error = -ENOMEM;
-        u8 *fb_vbitmap = NULL;
-        u8 *fb_bitmap  = NULL;
-        u32 *palette;
-
-        fb_bitmap = vmalloc(PICOLCDFB_SIZE*8);
-        if (fb_bitmap == NULL) {
-                dev_err(dev, "can't get a free page for framebuffer\n");
-                goto err_nomem;
-        }
-
-        fb_vbitmap = kmalloc(PICOLCDFB_SIZE, GFP_KERNEL);
-        if (fb_vbitmap == NULL) {
-                dev_err(dev, "can't alloc vbitmap image buffer\n");
-                goto err_nomem;
-        }
-
-        data->fb_update_rate = PICOLCDFB_UPDATE_RATE_DEFAULT;
-        data->fb_defio = picolcd_fb_defio;
-        /* The extra memory is:
-         * - struct picolcd_fb_cleanup_item
-         * - u32 for ref_count
-         * - 256*u32 for pseudo_palette
-         */
-        info = framebuffer_alloc(257 * sizeof(u32) + sizeof(struct picolcd_fb_cleanup_item), dev);
-        if (info == NULL) {
-                dev_err(dev, "failed to allocate a framebuffer\n");
-                goto err_nomem;
-        }
-
-        palette  = info->par + sizeof(struct picolcd_fb_cleanup_item);
-        *palette = 1;
-        palette++;
-        for (i = 0; i < 256; i++)
-                palette[i] = i > 0 && i < 16 ? 0xff : 0;
-        info->pseudo_palette = palette;
-        info->fbdefio = &data->fb_defio;
-        info->screen_base = (char __force __iomem *)fb_bitmap;
-        info->fbops = &picolcdfb_ops;
-        info->var = picolcdfb_var;
-        info->fix = picolcdfb_fix;
-        info->fix.smem_len   = PICOLCDFB_SIZE*8;
-        info->fix.smem_start = (unsigned long)fb_bitmap;
-        info->par = data;
-        info->flags = FBINFO_FLAG_DEFAULT;
-
-        data->fb_vbitmap = fb_vbitmap;
-        data->fb_bitmap  = fb_bitmap;
-        data->fb_bpp     = picolcdfb_var.bits_per_pixel;
-        error = picolcd_fb_reset(data, 1);
-        if (error) {
-                dev_err(dev, "failed to configure display\n");
-                goto err_cleanup;
-        }
-        error = device_create_file(dev, &dev_attr_fb_update_rate);
-        if (error) {
-                dev_err(dev, "failed to create sysfs attributes\n");
-                goto err_cleanup;
-        }
-        fb_deferred_io_init(info);
-        data->fb_info    = info;
-        error = register_framebuffer(info);
-        if (error) {
-                dev_err(dev, "failed to register framebuffer\n");
-                goto err_sysfs;
-        }
-        /* schedule first output of framebuffer */
-        data->fb_force = 1;
-        schedule_delayed_work(&info->deferred_work, 0);
-        return 0;
-
-err_sysfs:
-        fb_deferred_io_cleanup(info);
-        device_remove_file(dev, &dev_attr_fb_update_rate);
-err_cleanup:
-        data->fb_vbitmap = NULL;
-        data->fb_bitmap  = NULL;
-        data->fb_bpp     = 0;
-        data->fb_info    = NULL;
-
-err_nomem:
-        framebuffer_release(info);
-        vfree(fb_bitmap);
-        kfree(fb_vbitmap);
-        return error;
-}
-
-static void picolcd_exit_framebuffer(struct picolcd_data *data)
-{
-        struct fb_info *info = data->fb_info;
-        u8 *fb_vbitmap = data->fb_vbitmap;
-
-        if (!info)
-                return;
-
-        info->par = NULL;
-        device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
-        unregister_framebuffer(info);
-        data->fb_vbitmap = NULL;
-        data->fb_bitmap  = NULL;
-        data->fb_bpp     = 0;
-        data->fb_info    = NULL;
-        kfree(fb_vbitmap);
-}
-
-#define picolcd_fbinfo(d) ((d)->fb_info)
-#else
-static inline int picolcd_fb_reset(struct picolcd_data *data, int clear)
-{
-        return 0;
-}
-static inline int picolcd_init_framebuffer(struct picolcd_data *data)
-{
-        return 0;
-}
-static inline void picolcd_exit_framebuffer(struct picolcd_data *data)
-{
-}
-#define picolcd_fbinfo(d) NULL
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
-/*
- * backlight class device
- */
-static int picolcd_get_brightness(struct backlight_device *bdev)
-{
-        struct picolcd_data *data = bl_get_data(bdev);
-        return data->lcd_brightness;
-}
-
-static int picolcd_set_brightness(struct backlight_device *bdev)
-{
-        struct picolcd_data *data = bl_get_data(bdev);
-        struct hid_report *report = picolcd_out_report(REPORT_BRIGHTNESS, data->hdev);
-        unsigned long flags;
-
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return -ENODEV;
-
-        data->lcd_brightness = bdev->props.brightness & 0x0ff;
-        data->lcd_power      = bdev->props.power;
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->lcd_power == FB_BLANK_UNBLANK ? data->lcd_brightness : 0);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-static int picolcd_check_bl_fb(struct backlight_device *bdev, struct fb_info *fb)
-{
-        return fb && fb == picolcd_fbinfo((struct picolcd_data *)bl_get_data(bdev));
-}
-
-static const struct backlight_ops picolcd_blops = {
-        .update_status  = picolcd_set_brightness,
-        .get_brightness = picolcd_get_brightness,
-        .check_fb       = picolcd_check_bl_fb,
-};
-
-static int picolcd_init_backlight(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct backlight_device *bdev;
-        struct backlight_properties props;
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported BRIGHTNESS report");
-                return -EINVAL;
-        }
-
-        memset(&props, 0, sizeof(props));
-        props.type = BACKLIGHT_RAW;
-        props.max_brightness = 0xff;
-        bdev = backlight_device_register(dev_name(dev), dev, data,
-                        &picolcd_blops, &props);
-        if (IS_ERR(bdev)) {
-                dev_err(dev, "failed to register backlight\n");
-                return PTR_ERR(bdev);
-        }
-        bdev->props.brightness     = 0xff;
-        data->lcd_brightness       = 0xff;
-        data->backlight            = bdev;
-        picolcd_set_brightness(bdev);
-        return 0;
-}
-
-static void picolcd_exit_backlight(struct picolcd_data *data)
-{
-        struct backlight_device *bdev = data->backlight;
-
-        data->backlight = NULL;
-        if (bdev)
-                backlight_device_unregister(bdev);
-}
-
-static inline int picolcd_resume_backlight(struct picolcd_data *data)
-{
-        if (!data->backlight)
-                return 0;
-        return picolcd_set_brightness(data->backlight);
-}
-
-#ifdef CONFIG_PM
-static void picolcd_suspend_backlight(struct picolcd_data *data)
-{
-        int bl_power = data->lcd_power;
-        if (!data->backlight)
-                return;
-
-        data->backlight->props.power = FB_BLANK_POWERDOWN;
-        picolcd_set_brightness(data->backlight);
-        data->lcd_power = data->backlight->props.power = bl_power;
-}
-#endif /* CONFIG_PM */
-#else
-static inline int picolcd_init_backlight(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_backlight(struct picolcd_data *data)
-{
-}
-static inline int picolcd_resume_backlight(struct picolcd_data *data)
-{
-        return 0;
-}
-static inline void picolcd_suspend_backlight(struct picolcd_data *data)
-{
-}
-#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
-
-#ifdef CONFIG_HID_PICOLCD_LCD
-/*
- * lcd class device
- */
-static int picolcd_get_contrast(struct lcd_device *ldev)
-{
-        struct picolcd_data *data = lcd_get_data(ldev);
-        return data->lcd_contrast;
-}
-
-static int picolcd_set_contrast(struct lcd_device *ldev, int contrast)
-{
-        struct picolcd_data *data = lcd_get_data(ldev);
-        struct hid_report *report = picolcd_out_report(REPORT_CONTRAST, data->hdev);
-        unsigned long flags;
-
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return -ENODEV;
-
-        data->lcd_contrast = contrast & 0x0ff;
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->lcd_contrast);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return 0;
-}
-
-static int picolcd_check_lcd_fb(struct lcd_device *ldev, struct fb_info *fb)
-{
-        return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
-}
-
-static struct lcd_ops picolcd_lcdops = {
-        .get_contrast   = picolcd_get_contrast,
-        .set_contrast   = picolcd_set_contrast,
-        .check_fb       = picolcd_check_lcd_fb,
-};
-
-static int picolcd_init_lcd(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct lcd_device *ldev;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported CONTRAST report");
-                return -EINVAL;
-        }
-
-        ldev = lcd_device_register(dev_name(dev), dev, data, &picolcd_lcdops);
-        if (IS_ERR(ldev)) {
-                dev_err(dev, "failed to register LCD\n");
-                return PTR_ERR(ldev);
-        }
-        ldev->props.max_contrast = 0x0ff;
-        data->lcd_contrast = 0xe5;
-        data->lcd = ldev;
-        picolcd_set_contrast(ldev, 0xe5);
-        return 0;
-}
-
-static void picolcd_exit_lcd(struct picolcd_data *data)
-{
-        struct lcd_device *ldev = data->lcd;
-
-        data->lcd = NULL;
-        if (ldev)
-                lcd_device_unregister(ldev);
-}
-
-static inline int picolcd_resume_lcd(struct picolcd_data *data)
-{
-        if (!data->lcd)
-                return 0;
-        return picolcd_set_contrast(data->lcd, data->lcd_contrast);
-}
-#else
-static inline int picolcd_init_lcd(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_lcd(struct picolcd_data *data)
-{
-}
-static inline int picolcd_resume_lcd(struct picolcd_data *data)
-{
-        return 0;
-}
-#endif /* CONFIG_HID_PICOLCD_LCD */
-
-#ifdef CONFIG_HID_PICOLCD_LEDS
-/**
- * LED class device
- */
-static void picolcd_leds_set(struct picolcd_data *data)
-{
-        struct hid_report *report;
-        unsigned long flags;
-
-        if (!data->led[0])
-                return;
-        report = picolcd_out_report(REPORT_LED_STATE, data->hdev);
-        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
-                return;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, data->led_state);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-}
-
-static void picolcd_led_set_brightness(struct led_classdev *led_cdev,
-                        enum led_brightness value)
-{
-        struct device *dev;
-        struct hid_device *hdev;
-        struct picolcd_data *data;
-        int i, state = 0;
-
-        dev  = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data = hid_get_drvdata(hdev);
-        for (i = 0; i < 8; i++) {
-                if (led_cdev != data->led[i])
-                        continue;
-                state = (data->led_state >> i) & 1;
-                if (value == LED_OFF && state) {
-                        data->led_state &= ~(1 << i);
-                        picolcd_leds_set(data);
-                } else if (value != LED_OFF && !state) {
-                        data->led_state |= 1 << i;
-                        picolcd_leds_set(data);
-                }
-                break;
-        }
-}
-
-static enum led_brightness picolcd_led_get_brightness(struct led_classdev *led_cdev)
-{
-        struct device *dev;
-        struct hid_device *hdev;
-        struct picolcd_data *data;
-        int i, value = 0;
-
-        dev  = led_cdev->dev->parent;
-        hdev = container_of(dev, struct hid_device, dev);
-        data = hid_get_drvdata(hdev);
-        for (i = 0; i < 8; i++)
-                if (led_cdev == data->led[i]) {
-                        value = (data->led_state >> i) & 1;
-                        break;
-                }
-        return value ? LED_FULL : LED_OFF;
-}
-
-static int picolcd_init_leds(struct picolcd_data *data, struct hid_report *report)
-{
-        struct device *dev = &data->hdev->dev;
-        struct led_classdev *led;
-        size_t name_sz = strlen(dev_name(dev)) + 8;
-        char *name;
-        int i, ret = 0;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
-                        report->field[0]->report_size != 8) {
-                dev_err(dev, "unsupported LED_STATE report");
-                return -EINVAL;
-        }
-
-        for (i = 0; i < 8; i++) {
-                led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
-                if (!led) {
-                        dev_err(dev, "can't allocate memory for LED %d\n", i);
-                        ret = -ENOMEM;
-                        goto err;
-                }
-                name = (void *)(&led[1]);
-                snprintf(name, name_sz, "%s::GPO%d", dev_name(dev), i);
-                led->name = name;
-                led->brightness = 0;
-                led->max_brightness = 1;
-                led->brightness_get = picolcd_led_get_brightness;
-                led->brightness_set = picolcd_led_set_brightness;
-
-                data->led[i] = led;
-                ret = led_classdev_register(dev, data->led[i]);
-                if (ret) {
-                        data->led[i] = NULL;
-                        kfree(led);
-                        dev_err(dev, "can't register LED %d\n", i);
-                        goto err;
-                }
-        }
-        return 0;
-err:
-        for (i = 0; i < 8; i++)
-                if (data->led[i]) {
-                        led = data->led[i];
-                        data->led[i] = NULL;
-                        led_classdev_unregister(led);
-                        kfree(led);
-                }
-        return ret;
-}
-
-static void picolcd_exit_leds(struct picolcd_data *data)
-{
-        struct led_classdev *led;
-        int i;
-
-        for (i = 0; i < 8; i++) {
-                led = data->led[i];
-                data->led[i] = NULL;
-                if (!led)
-                        continue;
-                led_classdev_unregister(led);
-                kfree(led);
-        }
-}
-
-#else
-static inline int picolcd_init_leds(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        return 0;
-}
-static inline void picolcd_exit_leds(struct picolcd_data *data)
-{
-}
-static inline int picolcd_leds_set(struct picolcd_data *data)
-{
-        return 0;
-}
-#endif /* CONFIG_HID_PICOLCD_LEDS */
-
-/*
- * input class device
- */
-static int picolcd_raw_keypad(struct picolcd_data *data,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        /*
-         * Keypad event
-         * First and second data bytes list currently pressed keys,
-         * 0x00 means no key and at most 2 keys may be pressed at same time
-         */
-        int i, j;
-
-        /* determine newly pressed keys */
-        for (i = 0; i < size; i++) {
-                unsigned int key_code;
-                if (raw_data[i] == 0)
-                        continue;
-                for (j = 0; j < sizeof(data->pressed_keys); j++)
-                        if (data->pressed_keys[j] == raw_data[i])
-                                goto key_already_down;
-                for (j = 0; j < sizeof(data->pressed_keys); j++)
-                        if (data->pressed_keys[j] == 0) {
-                                data->pressed_keys[j] = raw_data[i];
-                                break;
-                        }
-                input_event(data->input_keys, EV_MSC, MSC_SCAN, raw_data[i]);
-                if (raw_data[i] < PICOLCD_KEYS)
-                        key_code = data->keycode[raw_data[i]];
-                else
-                        key_code = KEY_UNKNOWN;
-                if (key_code != KEY_UNKNOWN) {
-                        dbg_hid(PICOLCD_NAME " got key press for %u:%d",
-                                        raw_data[i], key_code);
-                        input_report_key(data->input_keys, key_code, 1);
-                }
-                input_sync(data->input_keys);
-key_already_down:
-                continue;
-        }
-
-        /* determine newly released keys */
-        for (j = 0; j < sizeof(data->pressed_keys); j++) {
-                unsigned int key_code;
-                if (data->pressed_keys[j] == 0)
-                        continue;
-                for (i = 0; i < size; i++)
-                        if (data->pressed_keys[j] == raw_data[i])
-                                goto key_still_down;
-                input_event(data->input_keys, EV_MSC, MSC_SCAN, data->pressed_keys[j]);
-                if (data->pressed_keys[j] < PICOLCD_KEYS)
-                        key_code = data->keycode[data->pressed_keys[j]];
-                else
-                        key_code = KEY_UNKNOWN;
-                if (key_code != KEY_UNKNOWN) {
-                        dbg_hid(PICOLCD_NAME " got key release for %u:%d",
-                                        data->pressed_keys[j], key_code);
-                        input_report_key(data->input_keys, key_code, 0);
-                }
-                input_sync(data->input_keys);
-                data->pressed_keys[j] = 0;
-key_still_down:
-                continue;
-        }
-        return 1;
-}
-
-static int picolcd_raw_cir(struct picolcd_data *data,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        /* Need understanding of CIR data format to implement ... */
-        return 1;
-}
-
-static int picolcd_check_version(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct picolcd_pending *verinfo;
-        int ret = 0;
-
-        if (!data)
-                return -ENODEV;
-
-        verinfo = picolcd_send_and_wait(hdev, REPORT_VERSION, NULL, 0);
-        if (!verinfo) {
-                hid_err(hdev, "no version response from PicoLCD\n");
-                return -ENODEV;
-        }
-
-        if (verinfo->raw_size == 2) {
-                data->version[0] = verinfo->raw_data[1];
-                data->version[1] = verinfo->raw_data[0];
-                if (data->status & PICOLCD_BOOTLOADER) {
-                        hid_info(hdev, "PicoLCD, bootloader version %d.%d\n",
-                                 verinfo->raw_data[1], verinfo->raw_data[0]);
-                } else {
-                        hid_info(hdev, "PicoLCD, firmware version %d.%d\n",
-                                 verinfo->raw_data[1], verinfo->raw_data[0]);
-                }
-        } else {
-                hid_err(hdev, "confused, got unexpected version response from PicoLCD\n");
-                ret = -EINVAL;
-        }
-        kfree(verinfo);
-        return ret;
-}
-
-/*
- * Reset our device and wait for answer to VERSION request
- */
-static int picolcd_reset(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        struct hid_report *report = picolcd_out_report(REPORT_RESET, hdev);
-        unsigned long flags;
-        int error;
-
-        if (!data || !report || report->maxfield != 1)
-                return -ENODEV;
-
-        spin_lock_irqsave(&data->lock, flags);
-        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
-                data->status |= PICOLCD_BOOTLOADER;
-
-        /* perform the reset */
-        hid_set_field(report->field[0], 0, 1);
-        usbhid_submit_report(hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        picolcd_resume_lcd(data);
-        picolcd_resume_backlight(data);
-#ifdef CONFIG_HID_PICOLCD_FB
-        if (data->fb_info)
-                schedule_delayed_work(&data->fb_info->deferred_work, 0);
-#endif /* CONFIG_HID_PICOLCD_FB */
-
-        picolcd_leds_set(data);
-        return 0;
-}
-
-/*
- * The "operation_mode" sysfs attribute
- */
-static ssize_t picolcd_operation_mode_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                return snprintf(buf, PAGE_SIZE, "[bootloader] lcd\n");
-        else
-                return snprintf(buf, PAGE_SIZE, "bootloader [lcd]\n");
-}
-
-static ssize_t picolcd_operation_mode_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        struct hid_report *report = NULL;
-        size_t cnt = count;
-        int timeout = data->opmode_delay;
-        unsigned long flags;
-
-        if (cnt >= 3 && strncmp("lcd", buf, 3) == 0) {
-                if (data->status & PICOLCD_BOOTLOADER)
-                        report = picolcd_out_report(REPORT_EXIT_FLASHER, data->hdev);
-                buf += 3;
-                cnt -= 3;
-        } else if (cnt >= 10 && strncmp("bootloader", buf, 10) == 0) {
-                if (!(data->status & PICOLCD_BOOTLOADER))
-                        report = picolcd_out_report(REPORT_EXIT_KEYBOARD, data->hdev);
-                buf += 10;
-                cnt -= 10;
-        }
-        if (!report)
-                return -EINVAL;
-
-        while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
-                cnt--;
-        if (cnt != 0)
-                return -EINVAL;
-
-        spin_lock_irqsave(&data->lock, flags);
-        hid_set_field(report->field[0], 0, timeout & 0xff);
-        hid_set_field(report->field[0], 1, (timeout >> 8) & 0xff);
-        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
-        spin_unlock_irqrestore(&data->lock, flags);
-        return count;
-}
-
-static DEVICE_ATTR(operation_mode, 0644, picolcd_operation_mode_show,
-                picolcd_operation_mode_store);
-
-/*
- * The "operation_mode_delay" sysfs attribute
- */
-static ssize_t picolcd_operation_mode_delay_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-
-        return snprintf(buf, PAGE_SIZE, "%hu\n", data->opmode_delay);
-}
-
-static ssize_t picolcd_operation_mode_delay_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct picolcd_data *data = dev_get_drvdata(dev);
-        unsigned u;
-        if (sscanf(buf, "%u", &u) != 1)
-                return -EINVAL;
-        if (u > 30000)
-                return -EINVAL;
-        else
-                data->opmode_delay = u;
-        return count;
-}
-
-static DEVICE_ATTR(operation_mode_delay, 0644, picolcd_operation_mode_delay_show,
-                picolcd_operation_mode_delay_store);
-
-
-#ifdef CONFIG_DEBUG_FS
-/*
- * The "reset" file
- */
-static int picolcd_debug_reset_show(struct seq_file *f, void *p)
-{
-        if (picolcd_fbinfo((struct picolcd_data *)f->private))
-                seq_printf(f, "all fb\n");
-        else
-                seq_printf(f, "all\n");
-        return 0;
-}
-
-static int picolcd_debug_reset_open(struct inode *inode, struct file *f)
-{
-        return single_open(f, picolcd_debug_reset_show, inode->i_private);
-}
-
-static ssize_t picolcd_debug_reset_write(struct file *f, const char __user *user_buf,
-                size_t count, loff_t *ppos)
-{
-        struct picolcd_data *data = ((struct seq_file *)f->private_data)->private;
-        char buf[32];
-        size_t cnt = min(count, sizeof(buf)-1);
-        if (copy_from_user(buf, user_buf, cnt))
-                return -EFAULT;
-
-        while (cnt > 0 && (buf[cnt-1] == ' ' || buf[cnt-1] == '\n'))
-                cnt--;
-        buf[cnt] = '\0';
-        if (strcmp(buf, "all") == 0) {
-                picolcd_reset(data->hdev);
-                picolcd_fb_reset(data, 1);
-        } else if (strcmp(buf, "fb") == 0) {
-                picolcd_fb_reset(data, 1);
-        } else {
-                return -EINVAL;
-        }
-        return count;
-}
-
-static const struct file_operations picolcd_debug_reset_fops = {
-        .owner    = THIS_MODULE,
-        .open     = picolcd_debug_reset_open,
-        .read     = seq_read,
-        .llseek   = seq_lseek,
-        .write    = picolcd_debug_reset_write,
-        .release  = single_release,
-};
-
-/*
- * The "eeprom" file
- */
-static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        struct picolcd_pending *resp;
-        u8 raw_data[3];
-        ssize_t ret = -EIO;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x0ff)
-                return 0;
-
-        /* prepare buffer with info about what we want to read (addr & len) */
-        raw_data[0] = *off & 0xff;
-        raw_data[1] = (*off >> 8) & 0xff;
-        raw_data[2] = s < 20 ? s : 20;
-        if (*off + raw_data[2] > 0xff)
-                raw_data[2] = 0x100 - *off;
-        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_READ, raw_data,
-                        sizeof(raw_data));
-        if (!resp)
-                return -EIO;
-
-        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
-                /* successful read :) */
-                ret = resp->raw_data[2];
-                if (ret > s)
-                        ret = s;
-                if (copy_to_user(u, resp->raw_data+3, ret))
-                        ret = -EFAULT;
-                else
-                        *off += ret;
-        } /* anything else is some kind of IO error */
-
-        kfree(resp);
-        return ret;
-}
-
-static ssize_t picolcd_debug_eeprom_write(struct file *f, const char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        struct picolcd_pending *resp;
-        ssize_t ret = -EIO;
-        u8 raw_data[23];
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x0ff)
-                return -ENOSPC;
-
-        memset(raw_data, 0, sizeof(raw_data));
-        raw_data[0] = *off & 0xff;
-        raw_data[1] = (*off >> 8) & 0xff;
-        raw_data[2] = min((size_t)20, s);
-        if (*off + raw_data[2] > 0xff)
-                raw_data[2] = 0x100 - *off;
-
-        if (copy_from_user(raw_data+3, u, min((u8)20, raw_data[2])))
-                return -EFAULT;
-        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_WRITE, raw_data,
-                        sizeof(raw_data));
-
-        if (!resp)
-                return -EIO;
-
-        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
-                /* check if written data matches */
-                if (memcmp(raw_data, resp->raw_data, 3+raw_data[2]) == 0) {
-                        *off += raw_data[2];
-                        ret = raw_data[2];
-                }
-        }
-        kfree(resp);
-        return ret;
-}
-
-/*
- * Notes:
- * - read/write happens in chunks of at most 20 bytes, it's up to userspace
- *   to loop in order to get more data.
- * - on write errors on otherwise correct write request the bytes
- *   that should have been written are in undefined state.
- */
-static const struct file_operations picolcd_debug_eeprom_fops = {
-        .owner    = THIS_MODULE,
-        .open     = simple_open,
-        .read     = picolcd_debug_eeprom_read,
-        .write    = picolcd_debug_eeprom_write,
-        .llseek   = generic_file_llseek,
-};
-
-/*
- * The "flash" file
- */
-/* record a flash address to buf (bounds check to be done by caller) */
-static int _picolcd_flash_setaddr(struct picolcd_data *data, u8 *buf, long off)
-{
-        buf[0] = off & 0xff;
-        buf[1] = (off >> 8) & 0xff;
-        if (data->addr_sz == 3)
-                buf[2] = (off >> 16) & 0xff;
-        return data->addr_sz == 2 ? 2 : 3;
-}
-
-/* read a given size of data (bounds check to be done by caller) */
-static ssize_t _picolcd_flash_read(struct picolcd_data *data, int report_id,
-                char __user *u, size_t s, loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[4];
-        ssize_t ret = 0;
-        int len_off, err = -EIO;
-
-        while (s > 0) {
-                err = -EIO;
-                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-                raw_data[len_off] = s > 32 ? 32 : s;
-                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off+1);
-                if (!resp || !resp->in_report)
-                        goto skip;
-                if (resp->in_report->id == REPORT_MEMORY ||
-                        resp->in_report->id == REPORT_BL_READ_MEMORY) {
-                        if (memcmp(raw_data, resp->raw_data, len_off+1) != 0)
-                                goto skip;
-                        if (copy_to_user(u+ret, resp->raw_data+len_off+1, raw_data[len_off])) {
-                                err = -EFAULT;
-                                goto skip;
-                        }
-                        *off += raw_data[len_off];
-                        s    -= raw_data[len_off];
-                        ret  += raw_data[len_off];
-                        err   = 0;
-                }
-skip:
-                kfree(resp);
-                if (err)
-                        return ret > 0 ? ret : err;
-        }
-        return ret;
-}
-
-static ssize_t picolcd_debug_flash_read(struct file *f, char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x05fff)
-                return 0;
-        if (*off + s > 0x05fff)
-                s = 0x06000 - *off;
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                return _picolcd_flash_read(data, REPORT_BL_READ_MEMORY, u, s, off);
-        else
-                return _picolcd_flash_read(data, REPORT_READ_MEMORY, u, s, off);
-}
-
-/* erase block aligned to 64bytes boundary */
-static ssize_t _picolcd_flash_erase64(struct picolcd_data *data, int report_id,
-                loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[3];
-        int len_off;
-        ssize_t ret = -EIO;
-
-        if (*off & 0x3f)
-                return -EINVAL;
-
-        len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-        resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off);
-        if (!resp || !resp->in_report)
-                goto skip;
-        if (resp->in_report->id == REPORT_MEMORY ||
-                resp->in_report->id == REPORT_BL_ERASE_MEMORY) {
-                if (memcmp(raw_data, resp->raw_data, len_off) != 0)
-                        goto skip;
-                ret = 0;
-        }
-skip:
-        kfree(resp);
-        return ret;
-}
-
-/* write a given size of data (bounds check to be done by caller) */
-static ssize_t _picolcd_flash_write(struct picolcd_data *data, int report_id,
-                const char __user *u, size_t s, loff_t *off)
-{
-        struct picolcd_pending *resp;
-        u8 raw_data[36];
-        ssize_t ret = 0;
-        int len_off, err = -EIO;
-
-        while (s > 0) {
-                err = -EIO;
-                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
-                raw_data[len_off] = s > 32 ? 32 : s;
-                if (copy_from_user(raw_data+len_off+1, u, raw_data[len_off])) {
-                        err = -EFAULT;
-                        break;
-                }
-                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data,
-                                len_off+1+raw_data[len_off]);
-                if (!resp || !resp->in_report)
-                        goto skip;
-                if (resp->in_report->id == REPORT_MEMORY ||
-                        resp->in_report->id == REPORT_BL_WRITE_MEMORY) {
-                        if (memcmp(raw_data, resp->raw_data, len_off+1+raw_data[len_off]) != 0)
-                                goto skip;
-                        *off += raw_data[len_off];
-                        s    -= raw_data[len_off];
-                        ret  += raw_data[len_off];
-                        err   = 0;
-                }
-skip:
-                kfree(resp);
-                if (err)
-                        break;
-        }
-        return ret > 0 ? ret : err;
-}
-
-static ssize_t picolcd_debug_flash_write(struct file *f, const char __user *u,
-                size_t s, loff_t *off)
-{
-        struct picolcd_data *data = f->private_data;
-        ssize_t err, ret = 0;
-        int report_erase, report_write;
-
-        if (s == 0)
-                return -EINVAL;
-        if (*off > 0x5fff)
-                return -ENOSPC;
-        if (s & 0x3f)
-                return -EINVAL;
-        if (*off & 0x3f)
-                return -EINVAL;
-
-        if (data->status & PICOLCD_BOOTLOADER) {
-                report_erase = REPORT_BL_ERASE_MEMORY;
-                report_write = REPORT_BL_WRITE_MEMORY;
-        } else {
-                report_erase = REPORT_ERASE_MEMORY;
-                report_write = REPORT_WRITE_MEMORY;
-        }
-        mutex_lock(&data->mutex_flash);
-        while (s > 0) {
-                err = _picolcd_flash_erase64(data, report_erase, off);
-                if (err)
-                        break;
-                err = _picolcd_flash_write(data, report_write, u, 64, off);
-                if (err < 0)
-                        break;
-                ret += err;
-                *off += err;
-                s -= err;
-                if (err != 64)
-                        break;
-        }
-        mutex_unlock(&data->mutex_flash);
-        return ret > 0 ? ret : err;
-}
-
-/*
- * Notes:
- * - concurrent writing is prevented by mutex and all writes must be
- *   n*64 bytes and 64-byte aligned, each write being preceded by an
- *   ERASE which erases a 64byte block.
- *   If less than requested was written or an error is returned for an
- *   otherwise correct write request the next 64-byte block which should
- *   have been written is in undefined state (mostly: original, erased,
- *   (half-)written with write error)
- * - reading can happen without special restriction
- */
-static const struct file_operations picolcd_debug_flash_fops = {
-        .owner    = THIS_MODULE,
-        .open     = simple_open,
-        .read     = picolcd_debug_flash_read,
-        .write    = picolcd_debug_flash_write,
-        .llseek   = generic_file_llseek,
-};
-
-
-/*
- * Helper code for HID report level dumping/debugging
- */
-static const char *error_codes[] = {
-        "success", "parameter missing", "data_missing", "block readonly",
-        "block not erasable", "block too big", "section overflow",
-        "invalid command length", "invalid data length",
-};
-
-static void dump_buff_as_hex(char *dst, size_t dst_sz, const u8 *data,
-                const size_t data_len)
-{
-        int i, j;
-        for (i = j = 0; i < data_len && j + 3 < dst_sz; i++) {
-                dst[j++] = hex_asc[(data[i] >> 4) & 0x0f];
-                dst[j++] = hex_asc[data[i] & 0x0f];
-                dst[j++] = ' ';
-        }
-        if (j < dst_sz) {
-                dst[j--] = '\0';
-                dst[j] = '\n';
-        } else
-                dst[j] = '\0';
-}
-
-static void picolcd_debug_out_report(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report)
-{
-        u8 raw_data[70];
-        int raw_size = (report->size >> 3) + 1;
-        char *buff;
-#define BUFF_SZ 256
-
-        /* Avoid unnecessary overhead if debugfs is disabled */
-        if (list_empty(&hdev->debug_list))
-                return;
-
-        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
-        if (!buff)
-                return;
-
-        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
-                        report->id, raw_size);
-        hid_debug_event(hdev, buff);
-        if (raw_size + 5 > sizeof(raw_data)) {
-                kfree(buff);
-                hid_debug_event(hdev, " TOO BIG\n");
-                return;
-        } else {
-                raw_data[0] = report->id;
-                hid_output_report(report, raw_data);
-                dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
-                hid_debug_event(hdev, buff);
-        }
-
-        switch (report->id) {
-        case REPORT_LED_STATE:
-                /* 1 data byte with GPO state */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LED_STATE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tGPO state: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_BRIGHTNESS:
-                /* 1 data byte with brightness */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_BRIGHTNESS", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tBrightness: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_CONTRAST:
-                /* 1 data byte with contrast */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_CONTRAST", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tContrast: 0x%02x\n", raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_RESET:
-                /* 2 data bytes with reset duration in ms */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_RESET", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tDuration: 0x%02x%02x (%dms)\n",
-                                raw_data[2], raw_data[1], raw_data[2] << 8 | raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_LCD_CMD:
-                /* 63 data bytes with LCD commands */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO: format decoding */
-                break;
-        case REPORT_LCD_DATA:
-                /* 63 data bytes with LCD data */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                /* TODO: format decoding */
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_LCD_CMD_DATA:
-                /* 63 data bytes with LCD commands and data */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_LCD_CMD", report->id, raw_size-1);
-                /* TODO: format decoding */
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EE_READ:
-                /* 3 data bytes with read area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EE_READ", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EE_WRITE:
-                /* 3+1..20 data bytes with write area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EE_WRITE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                if (raw_data[3] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tNo data\n");
-                } else if (raw_data[3] + 4 <= raw_size) {
-                        snprintf(buff, BUFF_SZ, "\tData: ");
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_ERASE_MEMORY:
-        case REPORT_BL_ERASE_MEMORY:
-                /* 3 data bytes with pointer inside erase block */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_ERASE_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_READ_MEMORY:
-        case REPORT_BL_READ_MEMORY:
-                /* 4 data bytes with read area description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_READ_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_WRITE_MEMORY:
-        case REPORT_BL_WRITE_MEMORY:
-                /* 4+1..32 data bytes with write adrea description */
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_WRITE_MEMORY", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[3] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[3] + 4 <= raw_size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[4] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[4] + 5 <= raw_size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_RESTART:
-                /* TODO */
-                break;
-        case REPORT_EXIT_KEYBOARD:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_EXIT_KEYBOARD", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
-                                raw_data[1] | (raw_data[2] << 8),
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_VERSION:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_DEVID:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_DEVID", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_SIZE:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_SPLASH_SIZE", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_HOOK_VERSION:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_HOOK_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_EXIT_FLASHER:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
-                                raw_data[1] | (raw_data[2] << 8),
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        default:
-                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
-                        "<unknown>", report->id, raw_size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        }
-        wake_up_interruptible(&hdev->debug_wait);
-        kfree(buff);
-}
-
-static void picolcd_debug_raw_event(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report,
-                u8 *raw_data, int size)
-{
-        char *buff;
-
-#define BUFF_SZ 256
-        /* Avoid unnecessary overhead if debugfs is disabled */
-        if (!hdev->debug_events)
-                return;
-
-        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
-        if (!buff)
-                return;
-
-        switch (report->id) {
-        case REPORT_ERROR_CODE:
-                /* 2 data bytes with affected report and error code */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_ERROR_CODE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[2] < ARRAY_SIZE(error_codes))
-                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x (%s) in reply to report 0x%02x\n",
-                                        raw_data[2], error_codes[raw_data[2]], raw_data[1]);
-                else
-                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x in reply to report 0x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_KEY_STATE:
-                /* 2 data bytes with key state */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_KEY_STATE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[1] == 0)
-                        snprintf(buff, BUFF_SZ, "\tNo key pressed\n");
-                else if (raw_data[2] == 0)
-                        snprintf(buff, BUFF_SZ, "\tOne key pressed: 0x%02x (%d)\n",
-                                        raw_data[1], raw_data[1]);
-                else
-                        snprintf(buff, BUFF_SZ, "\tTwo keys pressed: 0x%02x (%d), 0x%02x (%d)\n",
-                                        raw_data[1], raw_data[1], raw_data[2], raw_data[2]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_IR_DATA:
-                /* Up to 20 byes of IR scancode data */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_IR_DATA", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                if (raw_data[1] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tUnexpectedly 0 data length\n");
-                        hid_debug_event(hdev, buff);
-                } else if (raw_data[1] + 1 <= size) {
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n\tIR Data: ",
-                                        raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+2, raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tOverflowing data length: %d\n",
-                                        raw_data[1]-1);
-                        hid_debug_event(hdev, buff);
-                }
-                break;
-        case REPORT_EE_DATA:
-                /* Data buffer in response to REPORT_EE_READ or REPORT_EE_WRITE */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_EE_DATA", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                hid_debug_event(hdev, buff);
-                if (raw_data[3] == 0) {
-                        snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        hid_debug_event(hdev, buff);
-                } else if (raw_data[3] + 4 <= size) {
-                        snprintf(buff, BUFF_SZ, "\tData: ");
-                        hid_debug_event(hdev, buff);
-                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                } else {
-                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        hid_debug_event(hdev, buff);
-                }
-                break;
-        case REPORT_MEMORY:
-                /* Data buffer in response to REPORT_READ_MEMORY or REPORT_WRTIE_MEMORY */
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                switch (data->addr_sz) {
-                case 2:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
-                                        raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[3] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[3] + 4 <= size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                case 3:
-                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
-                                        raw_data[3], raw_data[2], raw_data[1]);
-                        hid_debug_event(hdev, buff);
-                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
-                        hid_debug_event(hdev, buff);
-                        if (raw_data[4] == 0) {
-                                snprintf(buff, BUFF_SZ, "\tNo data\n");
-                        } else if (raw_data[4] + 5 <= size) {
-                                snprintf(buff, BUFF_SZ, "\tData: ");
-                                hid_debug_event(hdev, buff);
-                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
-                        } else {
-                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
-                        }
-                        break;
-                default:
-                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
-                }
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_VERSION:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_VERSION", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
-                                raw_data[2], raw_data[1]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_BL_ERASE_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_ERASE_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_BL_READ_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_READ_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_BL_WRITE_MEMORY:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_BL_WRITE_MEMORY", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                /* TODO */
-                break;
-        case REPORT_DEVID:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_DEVID", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tSerial: 0x%02x%02x%02x%02x\n",
-                                raw_data[1], raw_data[2], raw_data[3], raw_data[4]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tType: 0x%02x\n",
-                                raw_data[5]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_SPLASH_SIZE:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_SPLASH_SIZE", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tTotal splash space: %d\n",
-                                (raw_data[2] << 8) | raw_data[1]);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tUsed splash space: %d\n",
-                                (raw_data[4] << 8) | raw_data[3]);
-                hid_debug_event(hdev, buff);
-                break;
-        case REPORT_HOOK_VERSION:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "REPORT_HOOK_VERSION", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
-                                raw_data[1], raw_data[2]);
-                hid_debug_event(hdev, buff);
-                break;
-        default:
-                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
-                        "<unknown>", report->id, size-1);
-                hid_debug_event(hdev, buff);
-                break;
-        }
-        wake_up_interruptible(&hdev->debug_wait);
-        kfree(buff);
-}
-
-static void picolcd_init_devfs(struct picolcd_data *data,
-                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
-                struct hid_report *flash_r, struct hid_report *flash_w,
-                struct hid_report *reset)
-{
-        struct hid_device *hdev = data->hdev;
-
-        mutex_init(&data->mutex_flash);
-
-        /* reset */
-        if (reset)
-                data->debug_reset = debugfs_create_file("reset", 0600,
-                                hdev->debug_dir, data, &picolcd_debug_reset_fops);
-
-        /* eeprom */
-        if (eeprom_r || eeprom_w)
-                data->debug_eeprom = debugfs_create_file("eeprom",
-                        (eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
-                        hdev->debug_dir, data, &picolcd_debug_eeprom_fops);
-
-        /* flash */
-        if (flash_r && flash_r->maxfield == 1 && flash_r->field[0]->report_size == 8)
-                data->addr_sz = flash_r->field[0]->report_count - 1;
-        else
-                data->addr_sz = -1;
-        if (data->addr_sz == 2 || data->addr_sz == 3) {
-                data->debug_flash = debugfs_create_file("flash",
-                        (flash_w ? S_IWUSR : 0) | (flash_r ? S_IRUSR : 0),
-                        hdev->debug_dir, data, &picolcd_debug_flash_fops);
-        } else if (flash_r || flash_w)
-                hid_warn(hdev, "Unexpected FLASH access reports, please submit rdesc for review\n");
-}
-
-static void picolcd_exit_devfs(struct picolcd_data *data)
-{
-        struct dentry *dent;
-
-        dent = data->debug_reset;
-        data->debug_reset = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        dent = data->debug_eeprom;
-        data->debug_eeprom = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        dent = data->debug_flash;
-        data->debug_flash = NULL;
-        if (dent)
-                debugfs_remove(dent);
-        mutex_destroy(&data->mutex_flash);
-}
-#else
-static inline void picolcd_debug_raw_event(struct picolcd_data *data,
-                struct hid_device *hdev, struct hid_report *report,
-                u8 *raw_data, int size)
-{
-}
-static inline void picolcd_init_devfs(struct picolcd_data *data,
-                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
-                struct hid_report *flash_r, struct hid_report *flash_w,
-                struct hid_report *reset)
-{
-}
-static inline void picolcd_exit_devfs(struct picolcd_data *data)
-{
-}
-#endif /* CONFIG_DEBUG_FS */
-
-/*
- * Handle raw report as sent by device
- */
-static int picolcd_raw_event(struct hid_device *hdev,
-                struct hid_report *report, u8 *raw_data, int size)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        unsigned long flags;
-        int ret = 0;
-
-        if (!data)
-                return 1;
-
-        if (report->id == REPORT_KEY_STATE) {
-                if (data->input_keys)
-                        ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
-        } else if (report->id == REPORT_IR_DATA) {
-                if (data->input_cir)
-                        ret = picolcd_raw_cir(data, report, raw_data+1, size-1);
-        } else {
-                spin_lock_irqsave(&data->lock, flags);
-                /*
-                 * We let the caller of picolcd_send_and_wait() check if the
-                 * report we got is one of the expected ones or not.
-                 */
-                if (data->pending) {
-                        memcpy(data->pending->raw_data, raw_data+1, size-1);
-                        data->pending->raw_size  = size-1;
-                        data->pending->in_report = report;
-                        complete(&data->pending->ready);
-                }
-                spin_unlock_irqrestore(&data->lock, flags);
-        }
-
-        picolcd_debug_raw_event(data, hdev, report, raw_data, size);
-        return 1;
-}
-
-#ifdef CONFIG_PM
-static int picolcd_suspend(struct hid_device *hdev, pm_message_t message)
-{
-        if (PMSG_IS_AUTO(message))
-                return 0;
-
-        picolcd_suspend_backlight(hid_get_drvdata(hdev));
-        dbg_hid(PICOLCD_NAME " device ready for suspend\n");
-        return 0;
-}
-
-static int picolcd_resume(struct hid_device *hdev)
-{
-        int ret;
-        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
-        return 0;
-}
-
-static int picolcd_reset_resume(struct hid_device *hdev)
-{
-        int ret;
-        ret = picolcd_reset(hdev);
-        if (ret)
-                dbg_hid(PICOLCD_NAME " resetting our device failed: %d\n", ret);
-        ret = picolcd_fb_reset(hid_get_drvdata(hdev), 0);
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring framebuffer content failed: %d\n", ret);
-        ret = picolcd_resume_lcd(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring lcd failed: %d\n", ret);
-        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
-        if (ret)
-                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
-        picolcd_leds_set(hid_get_drvdata(hdev));
-        return 0;
-}
-#endif
-
-/* initialize keypad input device */
-static int picolcd_init_keys(struct picolcd_data *data,
-                struct hid_report *report)
-{
-        struct hid_device *hdev = data->hdev;
-        struct input_dev *idev;
-        int error, i;
-
-        if (!report)
-                return -ENODEV;
-        if (report->maxfield != 1 || report->field[0]->report_count != 2 ||
-                        report->field[0]->report_size != 8) {
-                hid_err(hdev, "unsupported KEY_STATE report\n");
-                return -EINVAL;
-        }
-
-        idev = input_allocate_device();
-        if (idev == NULL) {
-                hid_err(hdev, "failed to allocate input device\n");
-                return -ENOMEM;
-        }
-        input_set_drvdata(idev, hdev);
-        memcpy(data->keycode, def_keymap, sizeof(def_keymap));
-        idev->name = hdev->name;
-        idev->phys = hdev->phys;
-        idev->uniq = hdev->uniq;
-        idev->id.bustype = hdev->bus;
-        idev->id.vendor  = hdev->vendor;
-        idev->id.product = hdev->product;
-        idev->id.version = hdev->version;
-        idev->dev.parent = hdev->dev.parent;
-        idev->keycode     = &data->keycode;
-        idev->keycodemax  = PICOLCD_KEYS;
-        idev->keycodesize = sizeof(data->keycode[0]);
-        input_set_capability(idev, EV_MSC, MSC_SCAN);
-        set_bit(EV_REP, idev->evbit);
-        for (i = 0; i < PICOLCD_KEYS; i++)
-                input_set_capability(idev, EV_KEY, data->keycode[i]);
-        error = input_register_device(idev);
-        if (error) {
-                hid_err(hdev, "error registering the input device\n");
-                input_free_device(idev);
-                return error;
-        }
-        data->input_keys = idev;
-        return 0;
-}
-
-static void picolcd_exit_keys(struct picolcd_data *data)
-{
-        struct input_dev *idev = data->input_keys;
-
-        data->input_keys = NULL;
-        if (idev)
-                input_unregister_device(idev);
-}
-
-/* initialize CIR input device */
-static inline int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
-{
-        /* support not implemented yet */
-        return 0;
-}
-
-static inline void picolcd_exit_cir(struct picolcd_data *data)
-{
-}
-
-static int picolcd_probe_lcd(struct hid_device *hdev, struct picolcd_data *data)
-{
-        int error;
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        if (data->version[0] != 0 && data->version[1] != 3)
-                hid_info(hdev, "Device with untested firmware revision, please submit /sys/kernel/debug/hid/%s/rdesc for this device.\n",
-                         dev_name(&hdev->dev));
-
-        /* Setup keypad input device */
-        error = picolcd_init_keys(data, picolcd_in_report(REPORT_KEY_STATE, hdev));
-        if (error)
-                goto err;
-
-        /* Setup CIR input device */
-        error = picolcd_init_cir(data, picolcd_in_report(REPORT_IR_DATA, hdev));
-        if (error)
-                goto err;
-
-        /* Set up the framebuffer device */
-        error = picolcd_init_framebuffer(data);
-        if (error)
-                goto err;
-
-        /* Setup lcd class device */
-        error = picolcd_init_lcd(data, picolcd_out_report(REPORT_CONTRAST, hdev));
-        if (error)
-                goto err;
-
-        /* Setup backlight class device */
-        error = picolcd_init_backlight(data, picolcd_out_report(REPORT_BRIGHTNESS, hdev));
-        if (error)
-                goto err;
-
-        /* Setup the LED class devices */
-        error = picolcd_init_leds(data, picolcd_out_report(REPORT_LED_STATE, hdev));
-        if (error)
-                goto err;
-
-        picolcd_init_devfs(data, picolcd_out_report(REPORT_EE_READ, hdev),
-                        picolcd_out_report(REPORT_EE_WRITE, hdev),
-                        picolcd_out_report(REPORT_READ_MEMORY, hdev),
-                        picolcd_out_report(REPORT_WRITE_MEMORY, hdev),
-                        picolcd_out_report(REPORT_RESET, hdev));
-        return 0;
-err:
-        picolcd_exit_leds(data);
-        picolcd_exit_backlight(data);
-        picolcd_exit_lcd(data);
-        picolcd_exit_framebuffer(data);
-        picolcd_exit_cir(data);
-        picolcd_exit_keys(data);
-        return error;
-}
-
-static int picolcd_probe_bootloader(struct hid_device *hdev, struct picolcd_data *data)
-{
-        int error;
-
-        error = picolcd_check_version(hdev);
-        if (error)
-                return error;
-
-        if (data->version[0] != 1 && data->version[1] != 0)
-                hid_info(hdev, "Device with untested bootloader revision, please submit /sys/kernel/debug/hid/%s/rdesc for this device.\n",
-                         dev_name(&hdev->dev));
-
-        picolcd_init_devfs(data, NULL, NULL,
-                        picolcd_out_report(REPORT_BL_READ_MEMORY, hdev),
-                        picolcd_out_report(REPORT_BL_WRITE_MEMORY, hdev), NULL);
-        return 0;
-}
-
-static int picolcd_probe(struct hid_device *hdev,
-                     const struct hid_device_id *id)
-{
-        struct picolcd_data *data;
-        int error = -ENOMEM;
-
-        dbg_hid(PICOLCD_NAME " hardware probe...\n");
-
-        /*
-         * Let's allocate the picolcd data structure, set some reasonable
-         * defaults, and associate it with the device
-         */
-        data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
-        if (data == NULL) {
-                hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
-                error = -ENOMEM;
-                goto err_no_cleanup;
-        }
-
-        spin_lock_init(&data->lock);
-        mutex_init(&data->mutex);
-        data->hdev = hdev;
-        data->opmode_delay = 5000;
-        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
-                data->status |= PICOLCD_BOOTLOADER;
-        hid_set_drvdata(hdev, data);
-
-        /* Parse the device reports and start it up */
-        error = hid_parse(hdev);
-        if (error) {
-                hid_err(hdev, "device report parse failed\n");
-                goto err_cleanup_data;
-        }
-
-        error = hid_hw_start(hdev, 0);
-        if (error) {
-                hid_err(hdev, "hardware start failed\n");
-                goto err_cleanup_data;
-        }
-
-        error = hid_hw_open(hdev);
-        if (error) {
-                hid_err(hdev, "failed to open input interrupt pipe for key and IR events\n");
-                goto err_cleanup_hid_hw;
-        }
-
-        error = device_create_file(&hdev->dev, &dev_attr_operation_mode_delay);
-        if (error) {
-                hid_err(hdev, "failed to create sysfs attributes\n");
-                goto err_cleanup_hid_ll;
-        }
-
-        error = device_create_file(&hdev->dev, &dev_attr_operation_mode);
-        if (error) {
-                hid_err(hdev, "failed to create sysfs attributes\n");
-                goto err_cleanup_sysfs1;
-        }
-
-        if (data->status & PICOLCD_BOOTLOADER)
-                error = picolcd_probe_bootloader(hdev, data);
-        else
-                error = picolcd_probe_lcd(hdev, data);
-        if (error)
-                goto err_cleanup_sysfs2;
-
-        dbg_hid(PICOLCD_NAME " activated and initialized\n");
-        return 0;
-
-err_cleanup_sysfs2:
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
-err_cleanup_sysfs1:
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
-err_cleanup_hid_ll:
-        hid_hw_close(hdev);
-err_cleanup_hid_hw:
-        hid_hw_stop(hdev);
-err_cleanup_data:
-        kfree(data);
-err_no_cleanup:
-        hid_set_drvdata(hdev, NULL);
-
-        return error;
-}
-
-static void picolcd_remove(struct hid_device *hdev)
-{
-        struct picolcd_data *data = hid_get_drvdata(hdev);
-        unsigned long flags;
-
-        dbg_hid(PICOLCD_NAME " hardware remove...\n");
-        spin_lock_irqsave(&data->lock, flags);
-        data->status |= PICOLCD_FAILED;
-        spin_unlock_irqrestore(&data->lock, flags);
-#ifdef CONFIG_HID_PICOLCD_FB
-        /* short-circuit FB as early as possible in order to
-         * avoid long delays if we host console.
-         */
-        if (data->fb_info)
-                data->fb_info->par = NULL;
-#endif
-
-        picolcd_exit_devfs(data);
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
-        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
-        hid_hw_close(hdev);
-        hid_hw_stop(hdev);
-        hid_set_drvdata(hdev, NULL);
-
-        /* Shortcut potential pending reply that will never arrive */
-        spin_lock_irqsave(&data->lock, flags);
-        if (data->pending)
-                complete(&data->pending->ready);
-        spin_unlock_irqrestore(&data->lock, flags);
-
-        /* Cleanup LED */
-        picolcd_exit_leds(data);
-        /* Clean up the framebuffer */
-        picolcd_exit_backlight(data);
-        picolcd_exit_lcd(data);
-        picolcd_exit_framebuffer(data);
-        /* Cleanup input */
-        picolcd_exit_cir(data);
-        picolcd_exit_keys(data);
-
-        mutex_destroy(&data->mutex);
-        /* Finally, clean up the picolcd data itself */
-        kfree(data);
-}
-
-static const struct hid_device_id picolcd_devices[] = {
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
-        { }
-};
-MODULE_DEVICE_TABLE(hid, picolcd_devices);
-
-static struct hid_driver picolcd_driver = {
-        .name =          "hid-picolcd",
-        .id_table =      picolcd_devices,
-        .probe =         picolcd_probe,
-        .remove =        picolcd_remove,
-        .raw_event =     picolcd_raw_event,
-#ifdef CONFIG_PM
-        .suspend =       picolcd_suspend,
-        .resume =        picolcd_resume,
-        .reset_resume =  picolcd_reset_resume,
-#endif
-};
-
-static int __init picolcd_init(void)
-{
-        return hid_register_driver(&picolcd_driver);
-}
-
-static void __exit picolcd_exit(void)
-{
-        hid_unregister_driver(&picolcd_driver);
-#ifdef CONFIG_HID_PICOLCD_FB
-        flush_work_sync(&picolcd_fb_cleanup);
-        WARN_ON(fb_pending);
-#endif
-}
-
-module_init(picolcd_init);
-module_exit(picolcd_exit);
-MODULE_DESCRIPTION("Minibox graphics PicoLCD Driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-picolcd.h b/drivers/hid/hid-picolcd.h
new file mode 100644
index 000000000000..020cef69f6a1
--- /dev/null
+++ b/drivers/hid/hid-picolcd.h
@@ -0,0 +1,309 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#define PICOLCD_NAME "PicoLCD (graphic)"
+
+/* Report numbers */
+#define REPORT_ERROR_CODE      0x10 /* LCD: IN[16]  */
+#define   ERR_SUCCESS            0x00
+#define   ERR_PARAMETER_MISSING  0x01
+#define   ERR_DATA_MISSING       0x02
+#define   ERR_BLOCK_READ_ONLY    0x03
+#define   ERR_BLOCK_NOT_ERASABLE 0x04
+#define   ERR_BLOCK_TOO_BIG      0x05
+#define   ERR_SECTION_OVERFLOW   0x06
+#define   ERR_INVALID_CMD_LEN    0x07
+#define   ERR_INVALID_DATA_LEN   0x08
+#define REPORT_KEY_STATE       0x11 /* LCD: IN[2]   */
+#define REPORT_IR_DATA         0x21 /* LCD: IN[63]  */
+#define REPORT_EE_DATA         0x32 /* LCD: IN[63]  */
+#define REPORT_MEMORY          0x41 /* LCD: IN[63]  */
+#define REPORT_LED_STATE       0x81 /* LCD: OUT[1]  */
+#define REPORT_BRIGHTNESS      0x91 /* LCD: OUT[1]  */
+#define REPORT_CONTRAST        0x92 /* LCD: OUT[1]  */
+#define REPORT_RESET           0x93 /* LCD: OUT[2]  */
+#define REPORT_LCD_CMD         0x94 /* LCD: OUT[63] */
+#define REPORT_LCD_DATA        0x95 /* LCD: OUT[63] */
+#define REPORT_LCD_CMD_DATA    0x96 /* LCD: OUT[63] */
+#define REPORT_EE_READ         0xa3 /* LCD: OUT[63] */
+#define REPORT_EE_WRITE        0xa4 /* LCD: OUT[63] */
+#define REPORT_ERASE_MEMORY    0xb2 /* LCD: OUT[2]  */
+#define REPORT_READ_MEMORY     0xb3 /* LCD: OUT[3]  */
+#define REPORT_WRITE_MEMORY    0xb4 /* LCD: OUT[63] */
+#define REPORT_SPLASH_RESTART  0xc1 /* LCD: OUT[1]  */
+#define REPORT_EXIT_KEYBOARD   0xef /* LCD: OUT[2]  */
+#define REPORT_VERSION         0xf1 /* LCD: IN[2],OUT[1]    Bootloader: IN[2],OUT[1]   */
+#define REPORT_BL_ERASE_MEMORY 0xf2 /*                      Bootloader: IN[36],OUT[4]  */
+#define REPORT_BL_READ_MEMORY  0xf3 /*                      Bootloader: IN[36],OUT[4]  */
+#define REPORT_BL_WRITE_MEMORY 0xf4 /*                      Bootloader: IN[36],OUT[36] */
+#define REPORT_DEVID           0xf5 /* LCD: IN[5], OUT[1]   Bootloader: IN[5],OUT[1]   */
+#define REPORT_SPLASH_SIZE     0xf6 /* LCD: IN[4], OUT[1]   */
+#define REPORT_HOOK_VERSION    0xf7 /* LCD: IN[2], OUT[1]   */
+#define REPORT_EXIT_FLASHER    0xff /*                      Bootloader: OUT[2]         */
+
+/* Description of in-progress IO operation, used for operations
+ * that trigger response from device */
+struct picolcd_pending {
+        struct hid_report *out_report;
+        struct hid_report *in_report;
+        struct completion ready;
+        int raw_size;
+        u8 raw_data[64];
+};
+
+
+#define PICOLCD_KEYS 17
+
+/* Per device data structure */
+struct picolcd_data {
+        struct hid_device *hdev;
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *debug_reset;
+        struct dentry *debug_eeprom;
+        struct dentry *debug_flash;
+        struct mutex mutex_flash;
+        int addr_sz;
+#endif
+        u8 version[2];
+        unsigned short opmode_delay;
+        /* input stuff */
+        u8 pressed_keys[2];
+        struct input_dev *input_keys;
+#ifdef CONFIG_HID_PICOLCD_CIR
+        struct rc_dev *rc_dev;
+#endif
+        unsigned short keycode[PICOLCD_KEYS];
+
+#ifdef CONFIG_HID_PICOLCD_FB
+        /* Framebuffer stuff */
+        struct fb_info *fb_info;
+#endif /* CONFIG_HID_PICOLCD_FB */
+#ifdef CONFIG_HID_PICOLCD_LCD
+        struct lcd_device *lcd;
+        u8 lcd_contrast;
+#endif /* CONFIG_HID_PICOLCD_LCD */
+#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+        struct backlight_device *backlight;
+        u8 lcd_brightness;
+        u8 lcd_power;
+#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
+#ifdef CONFIG_HID_PICOLCD_LEDS
+        /* LED stuff */
+        u8 led_state;
+        struct led_classdev *led[8];
+#endif /* CONFIG_HID_PICOLCD_LEDS */
+
+        /* Housekeeping stuff */
+        spinlock_t lock;
+        struct mutex mutex;
+        struct picolcd_pending *pending;
+        int status;
+#define PICOLCD_BOOTLOADER 1
+#define PICOLCD_FAILED 2
+#define PICOLCD_CIR_SHUN 4
+};
+
+#ifdef CONFIG_HID_PICOLCD_FB
+struct picolcd_fb_data {
+        /* Framebuffer stuff */
+        spinlock_t lock;
+        struct picolcd_data *picolcd;
+        u8 update_rate;
+        u8 bpp;
+        u8 force;
+        u8 ready;
+        u8 *vbitmap;            /* local copy of what was sent to PicoLCD */
+        u8 *bitmap;             /* framebuffer */
+};
+#endif /* CONFIG_HID_PICOLCD_FB */
+
+/* Find a given report */
+#define picolcd_in_report(id, dev) picolcd_report(id, dev, HID_INPUT_REPORT)
+#define picolcd_out_report(id, dev) picolcd_report(id, dev, HID_OUTPUT_REPORT)
+
+struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir);
+
+#ifdef CONFIG_DEBUG_FS
+void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report);
+#define usbhid_submit_report(a, b, c) \
+        do { \
+                picolcd_debug_out_report(hid_get_drvdata(a), a, b); \
+                usbhid_submit_report(a, b, c); \
+        } while (0)
+
+void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size);
+
+void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset);
+
+void picolcd_exit_devfs(struct picolcd_data *data);
+#else
+static inline void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report)
+{
+}
+static inline void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size)
+{
+}
+static inline void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset)
+{
+}
+static inline void picolcd_exit_devfs(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_DEBUG_FS */
+
+
+#ifdef CONFIG_HID_PICOLCD_FB
+int picolcd_fb_reset(struct picolcd_data *data, int clear);
+
+int picolcd_init_framebuffer(struct picolcd_data *data);
+
+void picolcd_exit_framebuffer(struct picolcd_data *data);
+
+void picolcd_fb_refresh(struct picolcd_data *data);
+#define picolcd_fbinfo(d) ((d)->fb_info)
+#else
+static inline int picolcd_fb_reset(struct picolcd_data *data, int clear)
+{
+        return 0;
+}
+static inline int picolcd_init_framebuffer(struct picolcd_data *data)
+{
+        return 0;
+}
+static inline void picolcd_exit_framebuffer(struct picolcd_data *data)
+{
+}
+static inline void picolcd_fb_refresh(struct picolcd_data *data)
+{
+}
+#define picolcd_fbinfo(d) NULL
+#endif /* CONFIG_HID_PICOLCD_FB */
+
+
+#ifdef CONFIG_HID_PICOLCD_BACKLIGHT
+int picolcd_init_backlight(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_backlight(struct picolcd_data *data);
+
+int picolcd_resume_backlight(struct picolcd_data *data);
+
+void picolcd_suspend_backlight(struct picolcd_data *data);
+#else
+static inline int picolcd_init_backlight(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_backlight(struct picolcd_data *data)
+{
+}
+static inline int picolcd_resume_backlight(struct picolcd_data *data)
+{
+        return 0;
+}
+static inline void picolcd_suspend_backlight(struct picolcd_data *data)
+{
+}
+
+#endif /* CONFIG_HID_PICOLCD_BACKLIGHT */
+
+
+#ifdef CONFIG_HID_PICOLCD_LCD
+int picolcd_init_lcd(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_lcd(struct picolcd_data *data);
+
+int picolcd_resume_lcd(struct picolcd_data *data);
+#else
+static inline int picolcd_init_lcd(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_lcd(struct picolcd_data *data)
+{
+}
+static inline int picolcd_resume_lcd(struct picolcd_data *data)
+{
+        return 0;
+}
+#endif /* CONFIG_HID_PICOLCD_LCD */
+
+
+#ifdef CONFIG_HID_PICOLCD_LEDS
+int picolcd_init_leds(struct picolcd_data *data,
+                struct hid_report *report);
+
+void picolcd_exit_leds(struct picolcd_data *data);
+
+void picolcd_leds_set(struct picolcd_data *data);
+#else
+static inline int picolcd_init_leds(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_leds(struct picolcd_data *data)
+{
+}
+static inline void picolcd_leds_set(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_HID_PICOLCD_LEDS */
+
+
+#ifdef CONFIG_HID_PICOLCD_CIR
+int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size);
+
+int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report);
+
+void picolcd_exit_cir(struct picolcd_data *data);
+#else
+static inline int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        return 1;
+}
+static inline int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
+{
+        return 0;
+}
+static inline void picolcd_exit_cir(struct picolcd_data *data)
+{
+}
+#endif /* CONFIG_HID_PICOLCD_LIRC */
+
+int picolcd_reset(struct hid_device *hdev);
+struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
+                        int report_id, const u8 *raw_data, int size);
diff --git a/drivers/hid/hid-picolcd_backlight.c b/drivers/hid/hid-picolcd_backlight.c
new file mode 100644
index 000000000000..b91f30945f9c
--- /dev/null
+++ b/drivers/hid/hid-picolcd_backlight.c
@@ -0,0 +1,122 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/backlight.h>
+
+#include "hid-picolcd.h"
+
+static int picolcd_get_brightness(struct backlight_device *bdev)
+{
+        struct picolcd_data *data = bl_get_data(bdev);
+        return data->lcd_brightness;
+}
+
+static int picolcd_set_brightness(struct backlight_device *bdev)
+{
+        struct picolcd_data *data = bl_get_data(bdev);
+        struct hid_report *report = picolcd_out_report(REPORT_BRIGHTNESS, data->hdev);
+        unsigned long flags;
+
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return -ENODEV;
+
+        data->lcd_brightness = bdev->props.brightness & 0x0ff;
+        data->lcd_power      = bdev->props.power;
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->lcd_power == FB_BLANK_UNBLANK ? data->lcd_brightness : 0);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static int picolcd_check_bl_fb(struct backlight_device *bdev, struct fb_info *fb)
+{
+        return fb && fb == picolcd_fbinfo((struct picolcd_data *)bl_get_data(bdev));
+}
+
+static const struct backlight_ops picolcd_blops = {
+        .update_status  = picolcd_set_brightness,
+        .get_brightness = picolcd_get_brightness,
+        .check_fb       = picolcd_check_bl_fb,
+};
+
+int picolcd_init_backlight(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct backlight_device *bdev;
+        struct backlight_properties props;
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported BRIGHTNESS report");
+                return -EINVAL;
+        }
+
+        memset(&props, 0, sizeof(props));
+        props.type = BACKLIGHT_RAW;
+        props.max_brightness = 0xff;
+        bdev = backlight_device_register(dev_name(dev), dev, data,
+                        &picolcd_blops, &props);
+        if (IS_ERR(bdev)) {
+                dev_err(dev, "failed to register backlight\n");
+                return PTR_ERR(bdev);
+        }
+        bdev->props.brightness     = 0xff;
+        data->lcd_brightness       = 0xff;
+        data->backlight            = bdev;
+        picolcd_set_brightness(bdev);
+        return 0;
+}
+
+void picolcd_exit_backlight(struct picolcd_data *data)
+{
+        struct backlight_device *bdev = data->backlight;
+
+        data->backlight = NULL;
+        if (bdev)
+                backlight_device_unregister(bdev);
+}
+
+int picolcd_resume_backlight(struct picolcd_data *data)
+{
+        if (!data->backlight)
+                return 0;
+        return picolcd_set_brightness(data->backlight);
+}
+
+#ifdef CONFIG_PM
+void picolcd_suspend_backlight(struct picolcd_data *data)
+{
+        int bl_power = data->lcd_power;
+        if (!data->backlight)
+                return;
+
+        data->backlight->props.power = FB_BLANK_POWERDOWN;
+        picolcd_set_brightness(data->backlight);
+        data->lcd_power = data->backlight->props.power = bl_power;
+}
+#endif /* CONFIG_PM */
+
diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
new file mode 100644
index 000000000000..13ca9191b630
--- /dev/null
+++ b/drivers/hid/hid-picolcd_cir.c
@@ -0,0 +1,152 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+
+#include <linux/leds.h>
+
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+#include <media/rc-core.h>
+
+#include "hid-picolcd.h"
+
+
+int picolcd_raw_cir(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        unsigned long flags;
+        int i, w, sz;
+        DEFINE_IR_RAW_EVENT(rawir);
+
+        /* ignore if rc_dev is NULL or status is shunned */
+        spin_lock_irqsave(&data->lock, flags);
+        if (!data->rc_dev || (data->status & PICOLCD_CIR_SHUN)) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return 1;
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        /* PicoLCD USB packets contain 16-bit intervals in network order,
+         * with value negated for pulse. Intervals are in microseconds.
+         *
+         * Note: some userspace LIRC code for PicoLCD says negated values
+         * for space - is it a matter of IR chip? (pulse for my TSOP2236)
+         *
+         * In addition, the first interval seems to be around 15000 + base
+         * interval for non-first report of IR data - thus the quirk below
+         * to get RC_CODE to understand Sony and JVC remotes I have at hand
+         */
+        sz = size > 0 ? min((int)raw_data[0], size-1) : 0;
+        for (i = 0; i+1 < sz; i += 2) {
+                init_ir_raw_event(&rawir);
+                w = (raw_data[i] << 8) | (raw_data[i+1]);
+                rawir.pulse = !!(w & 0x8000);
+                rawir.duration = US_TO_NS(rawir.pulse ? (65536 - w) : w);
+                /* Quirk!! - see above */
+                if (i == 0 && rawir.duration > 15000000)
+                        rawir.duration -= 15000000;
+                ir_raw_event_store(data->rc_dev, &rawir);
+        }
+        ir_raw_event_handle(data->rc_dev);
+
+        return 1;
+}
+
+static int picolcd_cir_open(struct rc_dev *dev)
+{
+        struct picolcd_data *data = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&data->lock, flags);
+        data->status &= ~PICOLCD_CIR_SHUN;
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static void picolcd_cir_close(struct rc_dev *dev)
+{
+        struct picolcd_data *data = dev->priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&data->lock, flags);
+        data->status |= PICOLCD_CIR_SHUN;
+        spin_unlock_irqrestore(&data->lock, flags);
+}
+
+/* initialize CIR input device */
+int picolcd_init_cir(struct picolcd_data *data, struct hid_report *report)
+{
+        struct rc_dev *rdev;
+        int ret = 0;
+
+        rdev = rc_allocate_device();
+        if (!rdev)
+                return -ENOMEM;
+
+        rdev->priv             = data;
+        rdev->driver_type      = RC_DRIVER_IR_RAW;
+        rdev->allowed_protos   = RC_TYPE_ALL;
+        rdev->open             = picolcd_cir_open;
+        rdev->close            = picolcd_cir_close;
+        rdev->input_name       = data->hdev->name;
+        rdev->input_phys       = data->hdev->phys;
+        rdev->input_id.bustype = data->hdev->bus;
+        rdev->input_id.vendor  = data->hdev->vendor;
+        rdev->input_id.product = data->hdev->product;
+        rdev->input_id.version = data->hdev->version;
+        rdev->dev.parent       = &data->hdev->dev;
+        rdev->driver_name      = PICOLCD_NAME;
+        rdev->map_name         = RC_MAP_RC6_MCE;
+        rdev->timeout          = MS_TO_NS(100);
+        rdev->rx_resolution    = US_TO_NS(1);
+
+        ret = rc_register_device(rdev);
+        if (ret)
+                goto err;
+        data->rc_dev = rdev;
+        return 0;
+
+err:
+        rc_free_device(rdev);
+        return ret;
+}
+
+void picolcd_exit_cir(struct picolcd_data *data)
+{
+        struct rc_dev *rdev = data->rc_dev;
+
+        data->rc_dev = NULL;
+        rc_unregister_device(rdev);
+}
+
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
new file mode 100644
index 000000000000..86df26e58aba
--- /dev/null
+++ b/drivers/hid/hid-picolcd_core.c
@@ -0,0 +1,689 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+
+/* Input device
+ *
+ * The PicoLCD has an IR receiver header, a built-in keypad with 5 keys
+ * and header for 4x4 key matrix. The built-in keys are part of the matrix.
+ */
+static const unsigned short def_keymap[PICOLCD_KEYS] = {
+        KEY_RESERVED,   /* none */
+        KEY_BACK,       /* col 4 + row 1 */
+        KEY_HOMEPAGE,   /* col 3 + row 1 */
+        KEY_RESERVED,   /* col 2 + row 1 */
+        KEY_RESERVED,   /* col 1 + row 1 */
+        KEY_SCROLLUP,   /* col 4 + row 2 */
+        KEY_OK,         /* col 3 + row 2 */
+        KEY_SCROLLDOWN, /* col 2 + row 2 */
+        KEY_RESERVED,   /* col 1 + row 2 */
+        KEY_RESERVED,   /* col 4 + row 3 */
+        KEY_RESERVED,   /* col 3 + row 3 */
+        KEY_RESERVED,   /* col 2 + row 3 */
+        KEY_RESERVED,   /* col 1 + row 3 */
+        KEY_RESERVED,   /* col 4 + row 4 */
+        KEY_RESERVED,   /* col 3 + row 4 */
+        KEY_RESERVED,   /* col 2 + row 4 */
+        KEY_RESERVED,   /* col 1 + row 4 */
+};
+
+
+/* Find a given report */
+struct hid_report *picolcd_report(int id, struct hid_device *hdev, int dir)
+{
+        struct list_head *feature_report_list = &hdev->report_enum[dir].report_list;
+        struct hid_report *report = NULL;
+
+        list_for_each_entry(report, feature_report_list, list) {
+                if (report->id == id)
+                        return report;
+        }
+        hid_warn(hdev, "No report with id 0x%x found\n", id);
+        return NULL;
+}
+
+/* Submit a report and wait for a reply from device - if device fades away
+ * or does not respond in time, return NULL */
+struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
+                int report_id, const u8 *raw_data, int size)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct picolcd_pending *work;
+        struct hid_report *report = picolcd_out_report(report_id, hdev);
+        unsigned long flags;
+        int i, j, k;
+
+        if (!report || !data)
+                return NULL;
+        if (data->status & PICOLCD_FAILED)
+                return NULL;
+        work = kzalloc(sizeof(*work), GFP_KERNEL);
+        if (!work)
+                return NULL;
+
+        init_completion(&work->ready);
+        work->out_report = report;
+        work->in_report  = NULL;
+        work->raw_size   = 0;
+
+        mutex_lock(&data->mutex);
+        spin_lock_irqsave(&data->lock, flags);
+        for (i = k = 0; i < report->maxfield; i++)
+                for (j = 0; j < report->field[i]->report_count; j++) {
+                        hid_set_field(report->field[i], j, k < size ? raw_data[k] : 0);
+                        k++;
+                }
+        if (data->status & PICOLCD_FAILED) {
+                kfree(work);
+                work = NULL;
+        } else {
+                data->pending = work;
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+                spin_unlock_irqrestore(&data->lock, flags);
+                wait_for_completion_interruptible_timeout(&work->ready, HZ*2);
+                spin_lock_irqsave(&data->lock, flags);
+                data->pending = NULL;
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+        mutex_unlock(&data->mutex);
+        return work;
+}
+
+/*
+ * input class device
+ */
+static int picolcd_raw_keypad(struct picolcd_data *data,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        /*
+         * Keypad event
+         * First and second data bytes list currently pressed keys,
+         * 0x00 means no key and at most 2 keys may be pressed at same time
+         */
+        int i, j;
+
+        /* determine newly pressed keys */
+        for (i = 0; i < size; i++) {
+                unsigned int key_code;
+                if (raw_data[i] == 0)
+                        continue;
+                for (j = 0; j < sizeof(data->pressed_keys); j++)
+                        if (data->pressed_keys[j] == raw_data[i])
+                                goto key_already_down;
+                for (j = 0; j < sizeof(data->pressed_keys); j++)
+                        if (data->pressed_keys[j] == 0) {
+                                data->pressed_keys[j] = raw_data[i];
+                                break;
+                        }
+                input_event(data->input_keys, EV_MSC, MSC_SCAN, raw_data[i]);
+                if (raw_data[i] < PICOLCD_KEYS)
+                        key_code = data->keycode[raw_data[i]];
+                else
+                        key_code = KEY_UNKNOWN;
+                if (key_code != KEY_UNKNOWN) {
+                        dbg_hid(PICOLCD_NAME " got key press for %u:%d",
+                                        raw_data[i], key_code);
+                        input_report_key(data->input_keys, key_code, 1);
+                }
+                input_sync(data->input_keys);
+key_already_down:
+                continue;
+        }
+
+        /* determine newly released keys */
+        for (j = 0; j < sizeof(data->pressed_keys); j++) {
+                unsigned int key_code;
+                if (data->pressed_keys[j] == 0)
+                        continue;
+                for (i = 0; i < size; i++)
+                        if (data->pressed_keys[j] == raw_data[i])
+                                goto key_still_down;
+                input_event(data->input_keys, EV_MSC, MSC_SCAN, data->pressed_keys[j]);
+                if (data->pressed_keys[j] < PICOLCD_KEYS)
+                        key_code = data->keycode[data->pressed_keys[j]];
+                else
+                        key_code = KEY_UNKNOWN;
+                if (key_code != KEY_UNKNOWN) {
+                        dbg_hid(PICOLCD_NAME " got key release for %u:%d",
+                                        data->pressed_keys[j], key_code);
+                        input_report_key(data->input_keys, key_code, 0);
+                }
+                input_sync(data->input_keys);
+                data->pressed_keys[j] = 0;
+key_still_down:
+                continue;
+        }
+        return 1;
+}
+
+static int picolcd_check_version(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct picolcd_pending *verinfo;
+        int ret = 0;
+
+        if (!data)
+                return -ENODEV;
+
+        verinfo = picolcd_send_and_wait(hdev, REPORT_VERSION, NULL, 0);
+        if (!verinfo) {
+                hid_err(hdev, "no version response from PicoLCD\n");
+                return -ENODEV;
+        }
+
+        if (verinfo->raw_size == 2) {
+                data->version[0] = verinfo->raw_data[1];
+                data->version[1] = verinfo->raw_data[0];
+                if (data->status & PICOLCD_BOOTLOADER) {
+                        hid_info(hdev, "PicoLCD, bootloader version %d.%d\n",
+                                 verinfo->raw_data[1], verinfo->raw_data[0]);
+                } else {
+                        hid_info(hdev, "PicoLCD, firmware version %d.%d\n",
+                                 verinfo->raw_data[1], verinfo->raw_data[0]);
+                }
+        } else {
+                hid_err(hdev, "confused, got unexpected version response from PicoLCD\n");
+                ret = -EINVAL;
+        }
+        kfree(verinfo);
+        return ret;
+}
+
+/*
+ * Reset our device and wait for answer to VERSION request
+ */
+int picolcd_reset(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        struct hid_report *report = picolcd_out_report(REPORT_RESET, hdev);
+        unsigned long flags;
+        int error;
+
+        if (!data || !report || report->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
+                data->status |= PICOLCD_BOOTLOADER;
+
+        /* perform the reset */
+        hid_set_field(report->field[0], 0, 1);
+        if (data->status & PICOLCD_FAILED) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return -ENODEV;
+        }
+        usbhid_submit_report(hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        error = picolcd_check_version(hdev);
+        if (error)
+                return error;
+
+        picolcd_resume_lcd(data);
+        picolcd_resume_backlight(data);
+        picolcd_fb_refresh(data);
+        picolcd_leds_set(data);
+        return 0;
+}
+
+/*
+ * The "operation_mode" sysfs attribute
+ */
+static ssize_t picolcd_operation_mode_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                return snprintf(buf, PAGE_SIZE, "[bootloader] lcd\n");
+        else
+                return snprintf(buf, PAGE_SIZE, "bootloader [lcd]\n");
+}
+
+static ssize_t picolcd_operation_mode_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct hid_report *report = NULL;
+        size_t cnt = count;
+        int timeout = data->opmode_delay;
+        unsigned long flags;
+
+        if (cnt >= 3 && strncmp("lcd", buf, 3) == 0) {
+                if (data->status & PICOLCD_BOOTLOADER)
+                        report = picolcd_out_report(REPORT_EXIT_FLASHER, data->hdev);
+                buf += 3;
+                cnt -= 3;
+        } else if (cnt >= 10 && strncmp("bootloader", buf, 10) == 0) {
+                if (!(data->status & PICOLCD_BOOTLOADER))
+                        report = picolcd_out_report(REPORT_EXIT_KEYBOARD, data->hdev);
+                buf += 10;
+                cnt -= 10;
+        }
+        if (!report)
+                return -EINVAL;
+
+        while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
+                cnt--;
+        if (cnt != 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, timeout & 0xff);
+        hid_set_field(report->field[0], 1, (timeout >> 8) & 0xff);
+        usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return count;
+}
+
+static DEVICE_ATTR(operation_mode, 0644, picolcd_operation_mode_show,
+                picolcd_operation_mode_store);
+
+/*
+ * The "operation_mode_delay" sysfs attribute
+ */
+static ssize_t picolcd_operation_mode_delay_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+
+        return snprintf(buf, PAGE_SIZE, "%hu\n", data->opmode_delay);
+}
+
+static ssize_t picolcd_operation_mode_delay_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        unsigned u;
+        if (sscanf(buf, "%u", &u) != 1)
+                return -EINVAL;
+        if (u > 30000)
+                return -EINVAL;
+        else
+                data->opmode_delay = u;
+        return count;
+}
+
+static DEVICE_ATTR(operation_mode_delay, 0644, picolcd_operation_mode_delay_show,
+                picolcd_operation_mode_delay_store);
+
+/*
+ * Handle raw report as sent by device
+ */
+static int picolcd_raw_event(struct hid_device *hdev,
+                struct hid_report *report, u8 *raw_data, int size)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!data)
+                return 1;
+
+        if (report->id == REPORT_KEY_STATE) {
+                if (data->input_keys)
+                        ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
+        } else if (report->id == REPORT_IR_DATA) {
+                ret = picolcd_raw_cir(data, report, raw_data+1, size-1);
+        } else {
+                spin_lock_irqsave(&data->lock, flags);
+                /*
+                 * We let the caller of picolcd_send_and_wait() check if the
+                 * report we got is one of the expected ones or not.
+                 */
+                if (data->pending) {
+                        memcpy(data->pending->raw_data, raw_data+1, size-1);
+                        data->pending->raw_size  = size-1;
+                        data->pending->in_report = report;
+                        complete(&data->pending->ready);
+                }
+                spin_unlock_irqrestore(&data->lock, flags);
+        }
+
+        picolcd_debug_raw_event(data, hdev, report, raw_data, size);
+        return 1;
+}
+
+#ifdef CONFIG_PM
+static int picolcd_suspend(struct hid_device *hdev, pm_message_t message)
+{
+        if (PMSG_IS_AUTO(message))
+                return 0;
+
+        picolcd_suspend_backlight(hid_get_drvdata(hdev));
+        dbg_hid(PICOLCD_NAME " device ready for suspend\n");
+        return 0;
+}
+
+static int picolcd_resume(struct hid_device *hdev)
+{
+        int ret;
+        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
+        return 0;
+}
+
+static int picolcd_reset_resume(struct hid_device *hdev)
+{
+        int ret;
+        ret = picolcd_reset(hdev);
+        if (ret)
+                dbg_hid(PICOLCD_NAME " resetting our device failed: %d\n", ret);
+        ret = picolcd_fb_reset(hid_get_drvdata(hdev), 0);
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring framebuffer content failed: %d\n", ret);
+        ret = picolcd_resume_lcd(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring lcd failed: %d\n", ret);
+        ret = picolcd_resume_backlight(hid_get_drvdata(hdev));
+        if (ret)
+                dbg_hid(PICOLCD_NAME " restoring backlight failed: %d\n", ret);
+        picolcd_leds_set(hid_get_drvdata(hdev));
+        return 0;
+}
+#endif
+
+/* initialize keypad input device */
+static int picolcd_init_keys(struct picolcd_data *data,
+                struct hid_report *report)
+{
+        struct hid_device *hdev = data->hdev;
+        struct input_dev *idev;
+        int error, i;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 2 ||
+                        report->field[0]->report_size != 8) {
+                hid_err(hdev, "unsupported KEY_STATE report\n");
+                return -EINVAL;
+        }
+
+        idev = input_allocate_device();
+        if (idev == NULL) {
+                hid_err(hdev, "failed to allocate input device\n");
+                return -ENOMEM;
+        }
+        input_set_drvdata(idev, hdev);
+        memcpy(data->keycode, def_keymap, sizeof(def_keymap));
+        idev->name = hdev->name;
+        idev->phys = hdev->phys;
+        idev->uniq = hdev->uniq;
+        idev->id.bustype = hdev->bus;
+        idev->id.vendor  = hdev->vendor;
+        idev->id.product = hdev->product;
+        idev->id.version = hdev->version;
+        idev->dev.parent = &hdev->dev;
+        idev->keycode     = &data->keycode;
+        idev->keycodemax  = PICOLCD_KEYS;
+        idev->keycodesize = sizeof(data->keycode[0]);
+        input_set_capability(idev, EV_MSC, MSC_SCAN);
+        set_bit(EV_REP, idev->evbit);
+        for (i = 0; i < PICOLCD_KEYS; i++)
+                input_set_capability(idev, EV_KEY, data->keycode[i]);
+        error = input_register_device(idev);
+        if (error) {
+                hid_err(hdev, "error registering the input device\n");
+                input_free_device(idev);
+                return error;
+        }
+        data->input_keys = idev;
+        return 0;
+}
+
+static void picolcd_exit_keys(struct picolcd_data *data)
+{
+        struct input_dev *idev = data->input_keys;
+
+        data->input_keys = NULL;
+        if (idev)
+                input_unregister_device(idev);
+}
+
+static int picolcd_probe_lcd(struct hid_device *hdev, struct picolcd_data *data)
+{
+        int error;
+
+        /* Setup keypad input device */
+        error = picolcd_init_keys(data, picolcd_in_report(REPORT_KEY_STATE, hdev));
+        if (error)
+                goto err;
+
+        /* Setup CIR input device */
+        error = picolcd_init_cir(data, picolcd_in_report(REPORT_IR_DATA, hdev));
+        if (error)
+                goto err;
+
+        /* Set up the framebuffer device */
+        error = picolcd_init_framebuffer(data);
+        if (error)
+                goto err;
+
+        /* Setup lcd class device */
+        error = picolcd_init_lcd(data, picolcd_out_report(REPORT_CONTRAST, hdev));
+        if (error)
+                goto err;
+
+        /* Setup backlight class device */
+        error = picolcd_init_backlight(data, picolcd_out_report(REPORT_BRIGHTNESS, hdev));
+        if (error)
+                goto err;
+
+        /* Setup the LED class devices */
+        error = picolcd_init_leds(data, picolcd_out_report(REPORT_LED_STATE, hdev));
+        if (error)
+                goto err;
+
+        picolcd_init_devfs(data, picolcd_out_report(REPORT_EE_READ, hdev),
+                        picolcd_out_report(REPORT_EE_WRITE, hdev),
+                        picolcd_out_report(REPORT_READ_MEMORY, hdev),
+                        picolcd_out_report(REPORT_WRITE_MEMORY, hdev),
+                        picolcd_out_report(REPORT_RESET, hdev));
+        return 0;
+err:
+        picolcd_exit_leds(data);
+        picolcd_exit_backlight(data);
+        picolcd_exit_lcd(data);
+        picolcd_exit_framebuffer(data);
+        picolcd_exit_cir(data);
+        picolcd_exit_keys(data);
+        return error;
+}
+
+static int picolcd_probe_bootloader(struct hid_device *hdev, struct picolcd_data *data)
+{
+        picolcd_init_devfs(data, NULL, NULL,
+                        picolcd_out_report(REPORT_BL_READ_MEMORY, hdev),
+                        picolcd_out_report(REPORT_BL_WRITE_MEMORY, hdev), NULL);
+        return 0;
+}
+
+static int picolcd_probe(struct hid_device *hdev,
+                     const struct hid_device_id *id)
+{
+        struct picolcd_data *data;
+        int error = -ENOMEM;
+
+        dbg_hid(PICOLCD_NAME " hardware probe...\n");
+
+        /*
+         * Let's allocate the picolcd data structure, set some reasonable
+         * defaults, and associate it with the device
+         */
+        data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
+        if (data == NULL) {
+                hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
+                error = -ENOMEM;
+                goto err_no_cleanup;
+        }
+
+        spin_lock_init(&data->lock);
+        mutex_init(&data->mutex);
+        data->hdev = hdev;
+        data->opmode_delay = 5000;
+        if (hdev->product == USB_DEVICE_ID_PICOLCD_BOOTLOADER)
+                data->status |= PICOLCD_BOOTLOADER;
+        hid_set_drvdata(hdev, data);
+
+        /* Parse the device reports and start it up */
+        error = hid_parse(hdev);
+        if (error) {
+                hid_err(hdev, "device report parse failed\n");
+                goto err_cleanup_data;
+        }
+
+        error = hid_hw_start(hdev, 0);
+        if (error) {
+                hid_err(hdev, "hardware start failed\n");
+                goto err_cleanup_data;
+        }
+
+        error = hid_hw_open(hdev);
+        if (error) {
+                hid_err(hdev, "failed to open input interrupt pipe for key and IR events\n");
+                goto err_cleanup_hid_hw;
+        }
+
+        error = device_create_file(&hdev->dev, &dev_attr_operation_mode_delay);
+        if (error) {
+                hid_err(hdev, "failed to create sysfs attributes\n");
+                goto err_cleanup_hid_ll;
+        }
+
+        error = device_create_file(&hdev->dev, &dev_attr_operation_mode);
+        if (error) {
+                hid_err(hdev, "failed to create sysfs attributes\n");
+                goto err_cleanup_sysfs1;
+        }
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                error = picolcd_probe_bootloader(hdev, data);
+        else
+                error = picolcd_probe_lcd(hdev, data);
+        if (error)
+                goto err_cleanup_sysfs2;
+
+        dbg_hid(PICOLCD_NAME " activated and initialized\n");
+        return 0;
+
+err_cleanup_sysfs2:
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
+err_cleanup_sysfs1:
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
+err_cleanup_hid_ll:
+        hid_hw_close(hdev);
+err_cleanup_hid_hw:
+        hid_hw_stop(hdev);
+err_cleanup_data:
+        kfree(data);
+err_no_cleanup:
+        hid_set_drvdata(hdev, NULL);
+
+        return error;
+}
+
+static void picolcd_remove(struct hid_device *hdev)
+{
+        struct picolcd_data *data = hid_get_drvdata(hdev);
+        unsigned long flags;
+
+        dbg_hid(PICOLCD_NAME " hardware remove...\n");
+        spin_lock_irqsave(&data->lock, flags);
+        data->status |= PICOLCD_FAILED;
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        picolcd_exit_devfs(data);
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode);
+        device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay);
+        hid_hw_close(hdev);
+        hid_hw_stop(hdev);
+
+        /* Shortcut potential pending reply that will never arrive */
+        spin_lock_irqsave(&data->lock, flags);
+        if (data->pending)
+                complete(&data->pending->ready);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        /* Cleanup LED */
+        picolcd_exit_leds(data);
+        /* Clean up the framebuffer */
+        picolcd_exit_backlight(data);
+        picolcd_exit_lcd(data);
+        picolcd_exit_framebuffer(data);
+        /* Cleanup input */
+        picolcd_exit_cir(data);
+        picolcd_exit_keys(data);
+
+        hid_set_drvdata(hdev, NULL);
+        mutex_destroy(&data->mutex);
+        /* Finally, clean up the picolcd data itself */
+        kfree(data);
+}
+
+static const struct hid_device_id picolcd_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, picolcd_devices);
+
+static struct hid_driver picolcd_driver = {
+        .name =          "hid-picolcd",
+        .id_table =      picolcd_devices,
+        .probe =         picolcd_probe,
+        .remove =        picolcd_remove,
+        .raw_event =     picolcd_raw_event,
+#ifdef CONFIG_PM
+        .suspend =       picolcd_suspend,
+        .resume =        picolcd_resume,
+        .reset_resume =  picolcd_reset_resume,
+#endif
+};
+
+static int __init picolcd_init(void)
+{
+        return hid_register_driver(&picolcd_driver);
+}
+
+static void __exit picolcd_exit(void)
+{
+        hid_unregister_driver(&picolcd_driver);
+}
+
+module_init(picolcd_init);
+module_exit(picolcd_exit);
+MODULE_DESCRIPTION("Minibox graphics PicoLCD Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c
new file mode 100644
index 000000000000..4809aa1bdb9c
--- /dev/null
+++ b/drivers/hid/hid-picolcd_debugfs.c
@@ -0,0 +1,899 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/module.h>
+#include <linux/uaccess.h>
+
+#include "hid-picolcd.h"
+
+
+static int picolcd_debug_reset_show(struct seq_file *f, void *p)
+{
+        if (picolcd_fbinfo((struct picolcd_data *)f->private))
+                seq_printf(f, "all fb\n");
+        else
+                seq_printf(f, "all\n");
+        return 0;
+}
+
+static int picolcd_debug_reset_open(struct inode *inode, struct file *f)
+{
+        return single_open(f, picolcd_debug_reset_show, inode->i_private);
+}
+
+static ssize_t picolcd_debug_reset_write(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *ppos)
+{
+        struct picolcd_data *data = ((struct seq_file *)f->private_data)->private;
+        char buf[32];
+        size_t cnt = min(count, sizeof(buf)-1);
+        if (copy_from_user(buf, user_buf, cnt))
+                return -EFAULT;
+
+        while (cnt > 0 && (buf[cnt-1] == ' ' || buf[cnt-1] == '\n'))
+                cnt--;
+        buf[cnt] = '\0';
+        if (strcmp(buf, "all") == 0) {
+                picolcd_reset(data->hdev);
+                picolcd_fb_reset(data, 1);
+        } else if (strcmp(buf, "fb") == 0) {
+                picolcd_fb_reset(data, 1);
+        } else {
+                return -EINVAL;
+        }
+        return count;
+}
+
+static const struct file_operations picolcd_debug_reset_fops = {
+        .owner    = THIS_MODULE,
+        .open     = picolcd_debug_reset_open,
+        .read     = seq_read,
+        .llseek   = seq_lseek,
+        .write    = picolcd_debug_reset_write,
+        .release  = single_release,
+};
+
+/*
+ * The "eeprom" file
+ */
+static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        struct picolcd_pending *resp;
+        u8 raw_data[3];
+        ssize_t ret = -EIO;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x0ff)
+                return 0;
+
+        /* prepare buffer with info about what we want to read (addr & len) */
+        raw_data[0] = *off & 0xff;
+        raw_data[1] = (*off >> 8) & 0xff;
+        raw_data[2] = s < 20 ? s : 20;
+        if (*off + raw_data[2] > 0xff)
+                raw_data[2] = 0x100 - *off;
+        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_READ, raw_data,
+                        sizeof(raw_data));
+        if (!resp)
+                return -EIO;
+
+        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
+                /* successful read :) */
+                ret = resp->raw_data[2];
+                if (ret > s)
+                        ret = s;
+                if (copy_to_user(u, resp->raw_data+3, ret))
+                        ret = -EFAULT;
+                else
+                        *off += ret;
+        } /* anything else is some kind of IO error */
+
+        kfree(resp);
+        return ret;
+}
+
+static ssize_t picolcd_debug_eeprom_write(struct file *f, const char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        struct picolcd_pending *resp;
+        ssize_t ret = -EIO;
+        u8 raw_data[23];
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x0ff)
+                return -ENOSPC;
+
+        memset(raw_data, 0, sizeof(raw_data));
+        raw_data[0] = *off & 0xff;
+        raw_data[1] = (*off >> 8) & 0xff;
+        raw_data[2] = min_t(size_t, 20, s);
+        if (*off + raw_data[2] > 0xff)
+                raw_data[2] = 0x100 - *off;
+
+        if (copy_from_user(raw_data+3, u, min((u8)20, raw_data[2])))
+                return -EFAULT;
+        resp = picolcd_send_and_wait(data->hdev, REPORT_EE_WRITE, raw_data,
+                        sizeof(raw_data));
+
+        if (!resp)
+                return -EIO;
+
+        if (resp->in_report && resp->in_report->id == REPORT_EE_DATA) {
+                /* check if written data matches */
+                if (memcmp(raw_data, resp->raw_data, 3+raw_data[2]) == 0) {
+                        *off += raw_data[2];
+                        ret = raw_data[2];
+                }
+        }
+        kfree(resp);
+        return ret;
+}
+
+/*
+ * Notes:
+ * - read/write happens in chunks of at most 20 bytes, it's up to userspace
+ *   to loop in order to get more data.
+ * - on write errors on otherwise correct write request the bytes
+ *   that should have been written are in undefined state.
+ */
+static const struct file_operations picolcd_debug_eeprom_fops = {
+        .owner    = THIS_MODULE,
+        .open     = simple_open,
+        .read     = picolcd_debug_eeprom_read,
+        .write    = picolcd_debug_eeprom_write,
+        .llseek   = generic_file_llseek,
+};
+
+/*
+ * The "flash" file
+ */
+/* record a flash address to buf (bounds check to be done by caller) */
+static int _picolcd_flash_setaddr(struct picolcd_data *data, u8 *buf, long off)
+{
+        buf[0] = off & 0xff;
+        buf[1] = (off >> 8) & 0xff;
+        if (data->addr_sz == 3)
+                buf[2] = (off >> 16) & 0xff;
+        return data->addr_sz == 2 ? 2 : 3;
+}
+
+/* read a given size of data (bounds check to be done by caller) */
+static ssize_t _picolcd_flash_read(struct picolcd_data *data, int report_id,
+                char __user *u, size_t s, loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[4];
+        ssize_t ret = 0;
+        int len_off, err = -EIO;
+
+        while (s > 0) {
+                err = -EIO;
+                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+                raw_data[len_off] = s > 32 ? 32 : s;
+                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off+1);
+                if (!resp || !resp->in_report)
+                        goto skip;
+                if (resp->in_report->id == REPORT_MEMORY ||
+                        resp->in_report->id == REPORT_BL_READ_MEMORY) {
+                        if (memcmp(raw_data, resp->raw_data, len_off+1) != 0)
+                                goto skip;
+                        if (copy_to_user(u+ret, resp->raw_data+len_off+1, raw_data[len_off])) {
+                                err = -EFAULT;
+                                goto skip;
+                        }
+                        *off += raw_data[len_off];
+                        s    -= raw_data[len_off];
+                        ret  += raw_data[len_off];
+                        err   = 0;
+                }
+skip:
+                kfree(resp);
+                if (err)
+                        return ret > 0 ? ret : err;
+        }
+        return ret;
+}
+
+static ssize_t picolcd_debug_flash_read(struct file *f, char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x05fff)
+                return 0;
+        if (*off + s > 0x05fff)
+                s = 0x06000 - *off;
+
+        if (data->status & PICOLCD_BOOTLOADER)
+                return _picolcd_flash_read(data, REPORT_BL_READ_MEMORY, u, s, off);
+        else
+                return _picolcd_flash_read(data, REPORT_READ_MEMORY, u, s, off);
+}
+
+/* erase block aligned to 64bytes boundary */
+static ssize_t _picolcd_flash_erase64(struct picolcd_data *data, int report_id,
+                loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[3];
+        int len_off;
+        ssize_t ret = -EIO;
+
+        if (*off & 0x3f)
+                return -EINVAL;
+
+        len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+        resp = picolcd_send_and_wait(data->hdev, report_id, raw_data, len_off);
+        if (!resp || !resp->in_report)
+                goto skip;
+        if (resp->in_report->id == REPORT_MEMORY ||
+                resp->in_report->id == REPORT_BL_ERASE_MEMORY) {
+                if (memcmp(raw_data, resp->raw_data, len_off) != 0)
+                        goto skip;
+                ret = 0;
+        }
+skip:
+        kfree(resp);
+        return ret;
+}
+
+/* write a given size of data (bounds check to be done by caller) */
+static ssize_t _picolcd_flash_write(struct picolcd_data *data, int report_id,
+                const char __user *u, size_t s, loff_t *off)
+{
+        struct picolcd_pending *resp;
+        u8 raw_data[36];
+        ssize_t ret = 0;
+        int len_off, err = -EIO;
+
+        while (s > 0) {
+                err = -EIO;
+                len_off = _picolcd_flash_setaddr(data, raw_data, *off);
+                raw_data[len_off] = s > 32 ? 32 : s;
+                if (copy_from_user(raw_data+len_off+1, u, raw_data[len_off])) {
+                        err = -EFAULT;
+                        break;
+                }
+                resp = picolcd_send_and_wait(data->hdev, report_id, raw_data,
+                                len_off+1+raw_data[len_off]);
+                if (!resp || !resp->in_report)
+                        goto skip;
+                if (resp->in_report->id == REPORT_MEMORY ||
+                        resp->in_report->id == REPORT_BL_WRITE_MEMORY) {
+                        if (memcmp(raw_data, resp->raw_data, len_off+1+raw_data[len_off]) != 0)
+                                goto skip;
+                        *off += raw_data[len_off];
+                        s    -= raw_data[len_off];
+                        ret  += raw_data[len_off];
+                        err   = 0;
+                }
+skip:
+                kfree(resp);
+                if (err)
+                        break;
+        }
+        return ret > 0 ? ret : err;
+}
+
+static ssize_t picolcd_debug_flash_write(struct file *f, const char __user *u,
+                size_t s, loff_t *off)
+{
+        struct picolcd_data *data = f->private_data;
+        ssize_t err, ret = 0;
+        int report_erase, report_write;
+
+        if (s == 0)
+                return -EINVAL;
+        if (*off > 0x5fff)
+                return -ENOSPC;
+        if (s & 0x3f)
+                return -EINVAL;
+        if (*off & 0x3f)
+                return -EINVAL;
+
+        if (data->status & PICOLCD_BOOTLOADER) {
+                report_erase = REPORT_BL_ERASE_MEMORY;
+                report_write = REPORT_BL_WRITE_MEMORY;
+        } else {
+                report_erase = REPORT_ERASE_MEMORY;
+                report_write = REPORT_WRITE_MEMORY;
+        }
+        mutex_lock(&data->mutex_flash);
+        while (s > 0) {
+                err = _picolcd_flash_erase64(data, report_erase, off);
+                if (err)
+                        break;
+                err = _picolcd_flash_write(data, report_write, u, 64, off);
+                if (err < 0)
+                        break;
+                ret += err;
+                *off += err;
+                s -= err;
+                if (err != 64)
+                        break;
+        }
+        mutex_unlock(&data->mutex_flash);
+        return ret > 0 ? ret : err;
+}
+
+/*
+ * Notes:
+ * - concurrent writing is prevented by mutex and all writes must be
+ *   n*64 bytes and 64-byte aligned, each write being preceded by an
+ *   ERASE which erases a 64byte block.
+ *   If less than requested was written or an error is returned for an
+ *   otherwise correct write request the next 64-byte block which should
+ *   have been written is in undefined state (mostly: original, erased,
+ *   (half-)written with write error)
+ * - reading can happen without special restriction
+ */
+static const struct file_operations picolcd_debug_flash_fops = {
+        .owner    = THIS_MODULE,
+        .open     = simple_open,
+        .read     = picolcd_debug_flash_read,
+        .write    = picolcd_debug_flash_write,
+        .llseek   = generic_file_llseek,
+};
+
+
+/*
+ * Helper code for HID report level dumping/debugging
+ */
+static const char * const error_codes[] = {
+        "success", "parameter missing", "data_missing", "block readonly",
+        "block not erasable", "block too big", "section overflow",
+        "invalid command length", "invalid data length",
+};
+
+static void dump_buff_as_hex(char *dst, size_t dst_sz, const u8 *data,
+                const size_t data_len)
+{
+        int i, j;
+        for (i = j = 0; i < data_len && j + 4 < dst_sz; i++) {
+                dst[j++] = hex_asc[(data[i] >> 4) & 0x0f];
+                dst[j++] = hex_asc[data[i] & 0x0f];
+                dst[j++] = ' ';
+        }
+        dst[j]   = '\0';
+        if (j > 0)
+                dst[j-1] = '\n';
+        if (i < data_len && j > 2)
+                dst[j-2] = dst[j-3] = '.';
+}
+
+void picolcd_debug_out_report(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report)
+{
+        u8 raw_data[70];
+        int raw_size = (report->size >> 3) + 1;
+        char *buff;
+#define BUFF_SZ 256
+
+        /* Avoid unnecessary overhead if debugfs is disabled */
+        if (list_empty(&hdev->debug_list))
+                return;
+
+        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
+        if (!buff)
+                return;
+
+        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
+                        report->id, raw_size);
+        hid_debug_event(hdev, buff);
+        if (raw_size + 5 > sizeof(raw_data)) {
+                kfree(buff);
+                hid_debug_event(hdev, " TOO BIG\n");
+                return;
+        } else {
+                raw_data[0] = report->id;
+                hid_output_report(report, raw_data);
+                dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
+                hid_debug_event(hdev, buff);
+        }
+
+        switch (report->id) {
+        case REPORT_LED_STATE:
+                /* 1 data byte with GPO state */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LED_STATE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tGPO state: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_BRIGHTNESS:
+                /* 1 data byte with brightness */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_BRIGHTNESS", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tBrightness: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_CONTRAST:
+                /* 1 data byte with contrast */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_CONTRAST", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tContrast: 0x%02x\n", raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_RESET:
+                /* 2 data bytes with reset duration in ms */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_RESET", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tDuration: 0x%02x%02x (%dms)\n",
+                                raw_data[2], raw_data[1], raw_data[2] << 8 | raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_LCD_CMD:
+                /* 63 data bytes with LCD commands */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO: format decoding */
+                break;
+        case REPORT_LCD_DATA:
+                /* 63 data bytes with LCD data */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                /* TODO: format decoding */
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_LCD_CMD_DATA:
+                /* 63 data bytes with LCD commands and data */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_LCD_CMD", report->id, raw_size-1);
+                /* TODO: format decoding */
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EE_READ:
+                /* 3 data bytes with read area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EE_READ", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EE_WRITE:
+                /* 3+1..20 data bytes with write area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EE_WRITE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                if (raw_data[3] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tNo data\n");
+                } else if (raw_data[3] + 4 <= raw_size) {
+                        snprintf(buff, BUFF_SZ, "\tData: ");
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_ERASE_MEMORY:
+        case REPORT_BL_ERASE_MEMORY:
+                /* 3 data bytes with pointer inside erase block */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_ERASE_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tAddress inside 64 byte block: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_READ_MEMORY:
+        case REPORT_BL_READ_MEMORY:
+                /* 4 data bytes with read area description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_READ_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_WRITE_MEMORY:
+        case REPORT_BL_WRITE_MEMORY:
+                /* 4+1..32 data bytes with write adrea description */
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_WRITE_MEMORY", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[3] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[3] + 4 <= raw_size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[4] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[4] + 5 <= raw_size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_RESTART:
+                /* TODO */
+                break;
+        case REPORT_EXIT_KEYBOARD:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_EXIT_KEYBOARD", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
+                                raw_data[1] | (raw_data[2] << 8),
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_VERSION:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_DEVID:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_DEVID", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_SIZE:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_SPLASH_SIZE", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_HOOK_VERSION:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_HOOK_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_EXIT_FLASHER:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tRestart delay: %dms (0x%02x%02x)\n",
+                                raw_data[1] | (raw_data[2] << 8),
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        default:
+                snprintf(buff, BUFF_SZ, "out report %s (%d, size=%d)\n",
+                        "<unknown>", report->id, raw_size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        }
+        wake_up_interruptible(&hdev->debug_wait);
+        kfree(buff);
+}
+
+void picolcd_debug_raw_event(struct picolcd_data *data,
+                struct hid_device *hdev, struct hid_report *report,
+                u8 *raw_data, int size)
+{
+        char *buff;
+
+#define BUFF_SZ 256
+        /* Avoid unnecessary overhead if debugfs is disabled */
+        if (list_empty(&hdev->debug_list))
+                return;
+
+        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
+        if (!buff)
+                return;
+
+        switch (report->id) {
+        case REPORT_ERROR_CODE:
+                /* 2 data bytes with affected report and error code */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_ERROR_CODE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[2] < ARRAY_SIZE(error_codes))
+                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x (%s) in reply to report 0x%02x\n",
+                                        raw_data[2], error_codes[raw_data[2]], raw_data[1]);
+                else
+                        snprintf(buff, BUFF_SZ, "\tError code 0x%02x in reply to report 0x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_KEY_STATE:
+                /* 2 data bytes with key state */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_KEY_STATE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[1] == 0)
+                        snprintf(buff, BUFF_SZ, "\tNo key pressed\n");
+                else if (raw_data[2] == 0)
+                        snprintf(buff, BUFF_SZ, "\tOne key pressed: 0x%02x (%d)\n",
+                                        raw_data[1], raw_data[1]);
+                else
+                        snprintf(buff, BUFF_SZ, "\tTwo keys pressed: 0x%02x (%d), 0x%02x (%d)\n",
+                                        raw_data[1], raw_data[1], raw_data[2], raw_data[2]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_IR_DATA:
+                /* Up to 20 byes of IR scancode data */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_IR_DATA", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                if (raw_data[1] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tUnexpectedly 0 data length\n");
+                        hid_debug_event(hdev, buff);
+                } else if (raw_data[1] + 1 <= size) {
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n\tIR Data: ",
+                                        raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+2, raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tOverflowing data length: %d\n",
+                                        raw_data[1]-1);
+                        hid_debug_event(hdev, buff);
+                }
+                break;
+        case REPORT_EE_DATA:
+                /* Data buffer in response to REPORT_EE_READ or REPORT_EE_WRITE */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_EE_DATA", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                hid_debug_event(hdev, buff);
+                if (raw_data[3] == 0) {
+                        snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        hid_debug_event(hdev, buff);
+                } else if (raw_data[3] + 4 <= size) {
+                        snprintf(buff, BUFF_SZ, "\tData: ");
+                        hid_debug_event(hdev, buff);
+                        dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                } else {
+                        snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        hid_debug_event(hdev, buff);
+                }
+                break;
+        case REPORT_MEMORY:
+                /* Data buffer in response to REPORT_READ_MEMORY or REPORT_WRTIE_MEMORY */
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                switch (data->addr_sz) {
+                case 2:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x\n",
+                                        raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[3]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[3] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[3] + 4 <= size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+4, raw_data[3]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                case 3:
+                        snprintf(buff, BUFF_SZ, "\tData address: 0x%02x%02x%02x\n",
+                                        raw_data[3], raw_data[2], raw_data[1]);
+                        hid_debug_event(hdev, buff);
+                        snprintf(buff, BUFF_SZ, "\tData length: %d\n", raw_data[4]);
+                        hid_debug_event(hdev, buff);
+                        if (raw_data[4] == 0) {
+                                snprintf(buff, BUFF_SZ, "\tNo data\n");
+                        } else if (raw_data[4] + 5 <= size) {
+                                snprintf(buff, BUFF_SZ, "\tData: ");
+                                hid_debug_event(hdev, buff);
+                                dump_buff_as_hex(buff, BUFF_SZ, raw_data+5, raw_data[4]);
+                        } else {
+                                snprintf(buff, BUFF_SZ, "\tData overflowed\n");
+                        }
+                        break;
+                default:
+                        snprintf(buff, BUFF_SZ, "\tNot supported\n");
+                }
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_VERSION:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_VERSION", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
+                                raw_data[2], raw_data[1]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_BL_ERASE_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_ERASE_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_BL_READ_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_READ_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_BL_WRITE_MEMORY:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_BL_WRITE_MEMORY", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                /* TODO */
+                break;
+        case REPORT_DEVID:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_DEVID", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tSerial: 0x%02x%02x%02x%02x\n",
+                                raw_data[1], raw_data[2], raw_data[3], raw_data[4]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tType: 0x%02x\n",
+                                raw_data[5]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_SPLASH_SIZE:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_SPLASH_SIZE", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tTotal splash space: %d\n",
+                                (raw_data[2] << 8) | raw_data[1]);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tUsed splash space: %d\n",
+                                (raw_data[4] << 8) | raw_data[3]);
+                hid_debug_event(hdev, buff);
+                break;
+        case REPORT_HOOK_VERSION:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "REPORT_HOOK_VERSION", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                snprintf(buff, BUFF_SZ, "\tFirmware version: %d.%d\n",
+                                raw_data[1], raw_data[2]);
+                hid_debug_event(hdev, buff);
+                break;
+        default:
+                snprintf(buff, BUFF_SZ, "report %s (%d, size=%d)\n",
+                        "<unknown>", report->id, size-1);
+                hid_debug_event(hdev, buff);
+                break;
+        }
+        wake_up_interruptible(&hdev->debug_wait);
+        kfree(buff);
+}
+
+void picolcd_init_devfs(struct picolcd_data *data,
+                struct hid_report *eeprom_r, struct hid_report *eeprom_w,
+                struct hid_report *flash_r, struct hid_report *flash_w,
+                struct hid_report *reset)
+{
+        struct hid_device *hdev = data->hdev;
+
+        mutex_init(&data->mutex_flash);
+
+        /* reset */
+        if (reset)
+                data->debug_reset = debugfs_create_file("reset", 0600,
+                                hdev->debug_dir, data, &picolcd_debug_reset_fops);
+
+        /* eeprom */
+        if (eeprom_r || eeprom_w)
+                data->debug_eeprom = debugfs_create_file("eeprom",
+                        (eeprom_w ? S_IWUSR : 0) | (eeprom_r ? S_IRUSR : 0),
+                        hdev->debug_dir, data, &picolcd_debug_eeprom_fops);
+
+        /* flash */
+        if (flash_r && flash_r->maxfield == 1 && flash_r->field[0]->report_size == 8)
+                data->addr_sz = flash_r->field[0]->report_count - 1;
+        else
+                data->addr_sz = -1;
+        if (data->addr_sz == 2 || data->addr_sz == 3) {
+                data->debug_flash = debugfs_create_file("flash",
+                        (flash_w ? S_IWUSR : 0) | (flash_r ? S_IRUSR : 0),
+                        hdev->debug_dir, data, &picolcd_debug_flash_fops);
+        } else if (flash_r || flash_w)
+                hid_warn(hdev, "Unexpected FLASH access reports, please submit rdesc for review\n");
+}
+
+void picolcd_exit_devfs(struct picolcd_data *data)
+{
+        struct dentry *dent;
+
+        dent = data->debug_reset;
+        data->debug_reset = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        dent = data->debug_eeprom;
+        data->debug_eeprom = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        dent = data->debug_flash;
+        data->debug_flash = NULL;
+        if (dent)
+                debugfs_remove(dent);
+        mutex_destroy(&data->mutex_flash);
+}
+
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
new file mode 100644
index 000000000000..0008a512211d
--- /dev/null
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -0,0 +1,615 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/vmalloc.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+/* Framebuffer
+ *
+ * The PicoLCD use a Topway LCD module of 256x64 pixel
+ * This display area is tiled over 4 controllers with 8 tiles
+ * each. Each tile has 8x64 pixel, each data byte representing
+ * a 1-bit wide vertical line of the tile.
+ *
+ * The display can be updated at a tile granularity.
+ *
+ *       Chip 1           Chip 2           Chip 3           Chip 4
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 1     |     Tile 1     |     Tile 1     |     Tile 1     |
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 2     |     Tile 2     |     Tile 2     |     Tile 2     |
+ * +----------------+----------------+----------------+----------------+
+ *                                  ...
+ * +----------------+----------------+----------------+----------------+
+ * |     Tile 8     |     Tile 8     |     Tile 8     |     Tile 8     |
+ * +----------------+----------------+----------------+----------------+
+ */
+#define PICOLCDFB_NAME "picolcdfb"
+#define PICOLCDFB_WIDTH (256)
+#define PICOLCDFB_HEIGHT (64)
+#define PICOLCDFB_SIZE (PICOLCDFB_WIDTH * PICOLCDFB_HEIGHT / 8)
+
+#define PICOLCDFB_UPDATE_RATE_LIMIT   10
+#define PICOLCDFB_UPDATE_RATE_DEFAULT  2
+
+/* Framebuffer visual structures */
+static const struct fb_fix_screeninfo picolcdfb_fix = {
+        .id          = PICOLCDFB_NAME,
+        .type        = FB_TYPE_PACKED_PIXELS,
+        .visual      = FB_VISUAL_MONO01,
+        .xpanstep    = 0,
+        .ypanstep    = 0,
+        .ywrapstep   = 0,
+        .line_length = PICOLCDFB_WIDTH / 8,
+        .accel       = FB_ACCEL_NONE,
+};
+
+static const struct fb_var_screeninfo picolcdfb_var = {
+        .xres           = PICOLCDFB_WIDTH,
+        .yres           = PICOLCDFB_HEIGHT,
+        .xres_virtual   = PICOLCDFB_WIDTH,
+        .yres_virtual   = PICOLCDFB_HEIGHT,
+        .width          = 103,
+        .height         = 26,
+        .bits_per_pixel = 1,
+        .grayscale      = 1,
+        .red            = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .green          = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .blue           = {
+                .offset = 0,
+                .length = 1,
+                .msb_right = 0,
+        },
+        .transp         = {
+                .offset = 0,
+                .length = 0,
+                .msb_right = 0,
+        },
+};
+
+/* Send a given tile to PicoLCD */
+static int picolcd_fb_send_tile(struct picolcd_data *data, u8 *vbitmap,
+                int chip, int tile)
+{
+        struct hid_report *report1, *report2;
+        unsigned long flags;
+        u8 *tdata;
+        int i;
+
+        report1 = picolcd_out_report(REPORT_LCD_CMD_DATA, data->hdev);
+        if (!report1 || report1->maxfield != 1)
+                return -ENODEV;
+        report2 = picolcd_out_report(REPORT_LCD_DATA, data->hdev);
+        if (!report2 || report2->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        if ((data->status & PICOLCD_FAILED)) {
+                spin_unlock_irqrestore(&data->lock, flags);
+                return -ENODEV;
+        }
+        hid_set_field(report1->field[0],  0, chip << 2);
+        hid_set_field(report1->field[0],  1, 0x02);
+        hid_set_field(report1->field[0],  2, 0x00);
+        hid_set_field(report1->field[0],  3, 0x00);
+        hid_set_field(report1->field[0],  4, 0xb8 | tile);
+        hid_set_field(report1->field[0],  5, 0x00);
+        hid_set_field(report1->field[0],  6, 0x00);
+        hid_set_field(report1->field[0],  7, 0x40);
+        hid_set_field(report1->field[0],  8, 0x00);
+        hid_set_field(report1->field[0],  9, 0x00);
+        hid_set_field(report1->field[0], 10,   32);
+
+        hid_set_field(report2->field[0],  0, (chip << 2) | 0x01);
+        hid_set_field(report2->field[0],  1, 0x00);
+        hid_set_field(report2->field[0],  2, 0x00);
+        hid_set_field(report2->field[0],  3,   32);
+
+        tdata = vbitmap + (tile * 4 + chip) * 64;
+        for (i = 0; i < 64; i++)
+                if (i < 32)
+                        hid_set_field(report1->field[0], 11 + i, tdata[i]);
+                else
+                        hid_set_field(report2->field[0], 4 + i - 32, tdata[i]);
+
+        usbhid_submit_report(data->hdev, report1, USB_DIR_OUT);
+        usbhid_submit_report(data->hdev, report2, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+/* Translate a single tile*/
+static int picolcd_fb_update_tile(u8 *vbitmap, const u8 *bitmap, int bpp,
+                int chip, int tile)
+{
+        int i, b, changed = 0;
+        u8 tdata[64];
+        u8 *vdata = vbitmap + (tile * 4 + chip) * 64;
+
+        if (bpp == 1) {
+                for (b = 7; b >= 0; b--) {
+                        const u8 *bdata = bitmap + tile * 256 + chip * 8 + b * 32;
+                        for (i = 0; i < 64; i++) {
+                                tdata[i] <<= 1;
+                                tdata[i] |= (bdata[i/8] >> (i % 8)) & 0x01;
+                        }
+                }
+        } else if (bpp == 8) {
+                for (b = 7; b >= 0; b--) {
+                        const u8 *bdata = bitmap + (tile * 256 + chip * 8 + b * 32) * 8;
+                        for (i = 0; i < 64; i++) {
+                                tdata[i] <<= 1;
+                                tdata[i] |= (bdata[i] & 0x80) ? 0x01 : 0x00;
+                        }
+                }
+        } else {
+                /* Oops, we should never get here! */
+                WARN_ON(1);
+                return 0;
+        }
+
+        for (i = 0; i < 64; i++)
+                if (tdata[i] != vdata[i]) {
+                        changed = 1;
+                        vdata[i] = tdata[i];
+                }
+        return changed;
+}
+
+void picolcd_fb_refresh(struct picolcd_data *data)
+{
+        if (data->fb_info)
+                schedule_delayed_work(&data->fb_info->deferred_work, 0);
+}
+
+/* Reconfigure LCD display */
+int picolcd_fb_reset(struct picolcd_data *data, int clear)
+{
+        struct hid_report *report = picolcd_out_report(REPORT_LCD_CMD, data->hdev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        int i, j;
+        unsigned long flags;
+        static const u8 mapcmd[8] = { 0x00, 0x02, 0x00, 0x64, 0x3f, 0x00, 0x64, 0xc0 };
+
+        if (!report || report->maxfield != 1)
+                return -ENODEV;
+
+        spin_lock_irqsave(&data->lock, flags);
+        for (i = 0; i < 4; i++) {
+                for (j = 0; j < report->field[0]->maxusage; j++)
+                        if (j == 0)
+                                hid_set_field(report->field[0], j, i << 2);
+                        else if (j < sizeof(mapcmd))
+                                hid_set_field(report->field[0], j, mapcmd[j]);
+                        else
+                                hid_set_field(report->field[0], j, 0);
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        }
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        if (clear) {
+                memset(fbdata->vbitmap, 0, PICOLCDFB_SIZE);
+                memset(fbdata->bitmap, 0, PICOLCDFB_SIZE*fbdata->bpp);
+        }
+        fbdata->force = 1;
+
+        /* schedule first output of framebuffer */
+        if (fbdata->ready)
+                schedule_delayed_work(&data->fb_info->deferred_work, 0);
+        else
+                fbdata->ready = 1;
+
+        return 0;
+}
+
+/* Update fb_vbitmap from the screen_base and send changed tiles to device */
+static void picolcd_fb_update(struct fb_info *info)
+{
+        int chip, tile, n;
+        unsigned long flags;
+        struct picolcd_fb_data *fbdata = info->par;
+        struct picolcd_data *data;
+
+        mutex_lock(&info->lock);
+
+        spin_lock_irqsave(&fbdata->lock, flags);
+        if (!fbdata->ready && fbdata->picolcd)
+                picolcd_fb_reset(fbdata->picolcd, 0);
+        spin_unlock_irqrestore(&fbdata->lock, flags);
+
+        /*
+         * Translate the framebuffer into the format needed by the PicoLCD.
+         * See display layout above.
+         * Do this one tile after the other and push those tiles that changed.
+         *
+         * Wait for our IO to complete as otherwise we might flood the queue!
+         */
+        n = 0;
+        for (chip = 0; chip < 4; chip++)
+                for (tile = 0; tile < 8; tile++) {
+                        if (!fbdata->force && !picolcd_fb_update_tile(
+                                        fbdata->vbitmap, fbdata->bitmap,
+                                        fbdata->bpp, chip, tile))
+                                continue;
+                        n += 2;
+                        if (n >= HID_OUTPUT_FIFO_SIZE / 2) {
+                                spin_lock_irqsave(&fbdata->lock, flags);
+                                data = fbdata->picolcd;
+                                spin_unlock_irqrestore(&fbdata->lock, flags);
+                                mutex_unlock(&info->lock);
+                                if (!data)
+                                        return;
+                                usbhid_wait_io(data->hdev);
+                                mutex_lock(&info->lock);
+                                n = 0;
+                        }
+                        spin_lock_irqsave(&fbdata->lock, flags);
+                        data = fbdata->picolcd;
+                        spin_unlock_irqrestore(&fbdata->lock, flags);
+                        if (!data || picolcd_fb_send_tile(data,
+                                        fbdata->vbitmap, chip, tile))
+                                goto out;
+                }
+        fbdata->force = false;
+        if (n) {
+                spin_lock_irqsave(&fbdata->lock, flags);
+                data = fbdata->picolcd;
+                spin_unlock_irqrestore(&fbdata->lock, flags);
+                mutex_unlock(&info->lock);
+                if (data)
+                        usbhid_wait_io(data->hdev);
+                return;
+        }
+out:
+        mutex_unlock(&info->lock);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_fillrect(struct fb_info *info,
+                const struct fb_fillrect *rect)
+{
+        if (!info->par)
+                return;
+        sys_fillrect(info, rect);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_copyarea(struct fb_info *info,
+                const struct fb_copyarea *area)
+{
+        if (!info->par)
+                return;
+        sys_copyarea(info, area);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/* Stub to call the system default and update the image on the picoLCD */
+static void picolcd_fb_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+        if (!info->par)
+                return;
+        sys_imageblit(info, image);
+
+        schedule_delayed_work(&info->deferred_work, 0);
+}
+
+/*
+ * this is the slow path from userspace. they can seek and write to
+ * the fb. it's inefficient to do anything less than a full screen draw
+ */
+static ssize_t picolcd_fb_write(struct fb_info *info, const char __user *buf,
+                size_t count, loff_t *ppos)
+{
+        ssize_t ret;
+        if (!info->par)
+                return -ENODEV;
+        ret = fb_sys_write(info, buf, count, ppos);
+        if (ret >= 0)
+                schedule_delayed_work(&info->deferred_work, 0);
+        return ret;
+}
+
+static int picolcd_fb_blank(int blank, struct fb_info *info)
+{
+        /* We let fb notification do this for us via lcd/backlight device */
+        return 0;
+}
+
+static void picolcd_fb_destroy(struct fb_info *info)
+{
+        struct picolcd_fb_data *fbdata = info->par;
+
+        /* make sure no work is deferred */
+        fb_deferred_io_cleanup(info);
+
+        /* No thridparty should ever unregister our framebuffer! */
+        WARN_ON(fbdata->picolcd != NULL);
+
+        vfree((u8 *)info->fix.smem_start);
+        framebuffer_release(info);
+}
+
+static int picolcd_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+        __u32 bpp      = var->bits_per_pixel;
+        __u32 activate = var->activate;
+
+        /* only allow 1/8 bit depth (8-bit is grayscale) */
+        *var = picolcdfb_var;
+        var->activate = activate;
+        if (bpp >= 8) {
+                var->bits_per_pixel = 8;
+                var->red.length     = 8;
+                var->green.length   = 8;
+                var->blue.length    = 8;
+        } else {
+                var->bits_per_pixel = 1;
+                var->red.length     = 1;
+                var->green.length   = 1;
+                var->blue.length    = 1;
+        }
+        return 0;
+}
+
+static int picolcd_set_par(struct fb_info *info)
+{
+        struct picolcd_fb_data *fbdata = info->par;
+        u8 *tmp_fb, *o_fb;
+        if (info->var.bits_per_pixel == fbdata->bpp)
+                return 0;
+        /* switch between 1/8 bit depths */
+        if (info->var.bits_per_pixel != 1 && info->var.bits_per_pixel != 8)
+                return -EINVAL;
+
+        o_fb   = fbdata->bitmap;
+        tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
+        if (!tmp_fb)
+                return -ENOMEM;
+
+        /* translate FB content to new bits-per-pixel */
+        if (info->var.bits_per_pixel == 1) {
+                int i, b;
+                for (i = 0; i < PICOLCDFB_SIZE; i++) {
+                        u8 p = 0;
+                        for (b = 0; b < 8; b++) {
+                                p <<= 1;
+                                p |= o_fb[i*8+b] ? 0x01 : 0x00;
+                        }
+                        tmp_fb[i] = p;
+                }
+                memcpy(o_fb, tmp_fb, PICOLCDFB_SIZE);
+                info->fix.visual = FB_VISUAL_MONO01;
+                info->fix.line_length = PICOLCDFB_WIDTH / 8;
+        } else {
+                int i;
+                memcpy(tmp_fb, o_fb, PICOLCDFB_SIZE);
+                for (i = 0; i < PICOLCDFB_SIZE * 8; i++)
+                        o_fb[i] = tmp_fb[i/8] & (0x01 << (7 - i % 8)) ? 0xff : 0x00;
+                info->fix.visual = FB_VISUAL_DIRECTCOLOR;
+                info->fix.line_length = PICOLCDFB_WIDTH;
+        }
+
+        kfree(tmp_fb);
+        fbdata->bpp = info->var.bits_per_pixel;
+        return 0;
+}
+
+/* Note this can't be const because of struct fb_info definition */
+static struct fb_ops picolcdfb_ops = {
+        .owner        = THIS_MODULE,
+        .fb_destroy   = picolcd_fb_destroy,
+        .fb_read      = fb_sys_read,
+        .fb_write     = picolcd_fb_write,
+        .fb_blank     = picolcd_fb_blank,
+        .fb_fillrect  = picolcd_fb_fillrect,
+        .fb_copyarea  = picolcd_fb_copyarea,
+        .fb_imageblit = picolcd_fb_imageblit,
+        .fb_check_var = picolcd_fb_check_var,
+        .fb_set_par   = picolcd_set_par,
+};
+
+
+/* Callback from deferred IO workqueue */
+static void picolcd_fb_deferred_io(struct fb_info *info, struct list_head *pagelist)
+{
+        picolcd_fb_update(info);
+}
+
+static const struct fb_deferred_io picolcd_fb_defio = {
+        .delay = HZ / PICOLCDFB_UPDATE_RATE_DEFAULT,
+        .deferred_io = picolcd_fb_deferred_io,
+};
+
+
+/*
+ * The "fb_update_rate" sysfs attribute
+ */
+static ssize_t picolcd_fb_update_rate_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        unsigned i, fb_update_rate = fbdata->update_rate;
+        size_t ret = 0;
+
+        for (i = 1; i <= PICOLCDFB_UPDATE_RATE_LIMIT; i++)
+                if (ret >= PAGE_SIZE)
+                        break;
+                else if (i == fb_update_rate)
+                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "[%u] ", i);
+                else
+                        ret += snprintf(buf+ret, PAGE_SIZE-ret, "%u ", i);
+        if (ret > 0)
+                buf[min(ret, (size_t)PAGE_SIZE)-1] = '\n';
+        return ret;
+}
+
+static ssize_t picolcd_fb_update_rate_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct picolcd_data *data = dev_get_drvdata(dev);
+        struct picolcd_fb_data *fbdata = data->fb_info->par;
+        int i;
+        unsigned u;
+
+        if (count < 1 || count > 10)
+                return -EINVAL;
+
+        i = sscanf(buf, "%u", &u);
+        if (i != 1)
+                return -EINVAL;
+
+        if (u > PICOLCDFB_UPDATE_RATE_LIMIT)
+                return -ERANGE;
+        else if (u == 0)
+                u = PICOLCDFB_UPDATE_RATE_DEFAULT;
+
+        fbdata->update_rate = u;
+        data->fb_info->fbdefio->delay = HZ / fbdata->update_rate;
+        return count;
+}
+
+static DEVICE_ATTR(fb_update_rate, 0666, picolcd_fb_update_rate_show,
+                picolcd_fb_update_rate_store);
+
+/* initialize Framebuffer device */
+int picolcd_init_framebuffer(struct picolcd_data *data)
+{
+        struct device *dev = &data->hdev->dev;
+        struct fb_info *info = NULL;
+        struct picolcd_fb_data *fbdata = NULL;
+        int i, error = -ENOMEM;
+        u32 *palette;
+
+        /* The extra memory is:
+         * - 256*u32 for pseudo_palette
+         * - struct fb_deferred_io
+         */
+        info = framebuffer_alloc(256 * sizeof(u32) +
+                        sizeof(struct fb_deferred_io) +
+                        sizeof(struct picolcd_fb_data) +
+                        PICOLCDFB_SIZE, dev);
+        if (info == NULL) {
+                dev_err(dev, "failed to allocate a framebuffer\n");
+                goto err_nomem;
+        }
+
+        info->fbdefio = info->par;
+        *info->fbdefio = picolcd_fb_defio;
+        info->par += sizeof(struct fb_deferred_io);
+        palette = info->par;
+        info->par += 256 * sizeof(u32);
+        for (i = 0; i < 256; i++)
+                palette[i] = i > 0 && i < 16 ? 0xff : 0;
+        info->pseudo_palette = palette;
+        info->fbops = &picolcdfb_ops;
+        info->var = picolcdfb_var;
+        info->fix = picolcdfb_fix;
+        info->fix.smem_len   = PICOLCDFB_SIZE*8;
+        info->flags = FBINFO_FLAG_DEFAULT;
+
+        fbdata = info->par;
+        spin_lock_init(&fbdata->lock);
+        fbdata->picolcd = data;
+        fbdata->update_rate = PICOLCDFB_UPDATE_RATE_DEFAULT;
+        fbdata->bpp     = picolcdfb_var.bits_per_pixel;
+        fbdata->force   = 1;
+        fbdata->vbitmap = info->par + sizeof(struct picolcd_fb_data);
+        fbdata->bitmap  = vmalloc(PICOLCDFB_SIZE*8);
+        if (fbdata->bitmap == NULL) {
+                dev_err(dev, "can't get a free page for framebuffer\n");
+                goto err_nomem;
+        }
+        info->screen_base = (char __force __iomem *)fbdata->bitmap;
+        info->fix.smem_start = (unsigned long)fbdata->bitmap;
+        memset(fbdata->vbitmap, 0xff, PICOLCDFB_SIZE);
+        data->fb_info = info;
+
+        error = picolcd_fb_reset(data, 1);
+        if (error) {
+                dev_err(dev, "failed to configure display\n");
+                goto err_cleanup;
+        }
+
+        error = device_create_file(dev, &dev_attr_fb_update_rate);
+        if (error) {
+                dev_err(dev, "failed to create sysfs attributes\n");
+                goto err_cleanup;
+        }
+
+        fb_deferred_io_init(info);
+        error = register_framebuffer(info);
+        if (error) {
+                dev_err(dev, "failed to register framebuffer\n");
+                goto err_sysfs;
+        }
+        return 0;
+
+err_sysfs:
+        device_remove_file(dev, &dev_attr_fb_update_rate);
+        fb_deferred_io_cleanup(info);
+err_cleanup:
+        data->fb_info    = NULL;
+
+err_nomem:
+        if (fbdata)
+                vfree(fbdata->bitmap);
+        framebuffer_release(info);
+        return error;
+}
+
+void picolcd_exit_framebuffer(struct picolcd_data *data)
+{
+        struct fb_info *info = data->fb_info;
+        struct picolcd_fb_data *fbdata = info->par;
+        unsigned long flags;
+
+        device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
+
+        /* disconnect framebuffer from HID dev */
+        spin_lock_irqsave(&fbdata->lock, flags);
+        fbdata->picolcd = NULL;
+        spin_unlock_irqrestore(&fbdata->lock, flags);
+
+        /* make sure there is no running update - thus that fbdata->picolcd
+         * once obtained under lock is guaranteed not to get free() under
+         * the feet of the deferred work */
+        flush_delayed_work_sync(&info->deferred_work);
+
+        data->fb_info = NULL;
+        unregister_framebuffer(info);
+}
diff --git a/drivers/hid/hid-picolcd_lcd.c b/drivers/hid/hid-picolcd_lcd.c
new file mode 100644
index 000000000000..2d0ddc5ac65f
--- /dev/null
+++ b/drivers/hid/hid-picolcd_lcd.c
@@ -0,0 +1,107 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/lcd.h>
+
+#include "hid-picolcd.h"
+
+/*
+ * lcd class device
+ */
+static int picolcd_get_contrast(struct lcd_device *ldev)
+{
+        struct picolcd_data *data = lcd_get_data(ldev);
+        return data->lcd_contrast;
+}
+
+static int picolcd_set_contrast(struct lcd_device *ldev, int contrast)
+{
+        struct picolcd_data *data = lcd_get_data(ldev);
+        struct hid_report *report = picolcd_out_report(REPORT_CONTRAST, data->hdev);
+        unsigned long flags;
+
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return -ENODEV;
+
+        data->lcd_contrast = contrast & 0x0ff;
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->lcd_contrast);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+        return 0;
+}
+
+static int picolcd_check_lcd_fb(struct lcd_device *ldev, struct fb_info *fb)
+{
+        return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
+}
+
+static struct lcd_ops picolcd_lcdops = {
+        .get_contrast   = picolcd_get_contrast,
+        .set_contrast   = picolcd_set_contrast,
+        .check_fb       = picolcd_check_lcd_fb,
+};
+
+int picolcd_init_lcd(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct lcd_device *ldev;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported CONTRAST report");
+                return -EINVAL;
+        }
+
+        ldev = lcd_device_register(dev_name(dev), dev, data, &picolcd_lcdops);
+        if (IS_ERR(ldev)) {
+                dev_err(dev, "failed to register LCD\n");
+                return PTR_ERR(ldev);
+        }
+        ldev->props.max_contrast = 0x0ff;
+        data->lcd_contrast = 0xe5;
+        data->lcd = ldev;
+        picolcd_set_contrast(ldev, 0xe5);
+        return 0;
+}
+
+void picolcd_exit_lcd(struct picolcd_data *data)
+{
+        struct lcd_device *ldev = data->lcd;
+
+        data->lcd = NULL;
+        if (ldev)
+                lcd_device_unregister(ldev);
+}
+
+int picolcd_resume_lcd(struct picolcd_data *data)
+{
+        if (!data->lcd)
+                return 0;
+        return picolcd_set_contrast(data->lcd, data->lcd_contrast);
+}
+
diff --git a/drivers/hid/hid-picolcd_leds.c b/drivers/hid/hid-picolcd_leds.c
new file mode 100644
index 000000000000..28cb6a4f9634
--- /dev/null
+++ b/drivers/hid/hid-picolcd_leds.c
@@ -0,0 +1,175 @@
+/***************************************************************************
+ *   Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org>  *
+ *                                                                         *
+ *   Based on Logitech G13 driver (v0.4)                                   *
+ *     Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu>   *
+ *                                                                         *
+ *   This program is free software: you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation, version 2 of the License.               *
+ *                                                                         *
+ *   This driver is distributed in the hope that it will be useful, but    *
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      *
+ *   General Public License for more details.                              *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this software. If not see <http://www.gnu.org/licenses/>.  *
+ ***************************************************************************/
+
+#include <linux/hid.h>
+#include <linux/hid-debug.h>
+#include <linux/input.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+#include <linux/usb.h>
+
+#include <linux/fb.h>
+#include <linux/vmalloc.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+
+#include <linux/leds.h>
+
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/module.h>
+
+#include "hid-picolcd.h"
+
+
+void picolcd_leds_set(struct picolcd_data *data)
+{
+        struct hid_report *report;
+        unsigned long flags;
+
+        if (!data->led[0])
+                return;
+        report = picolcd_out_report(REPORT_LED_STATE, data->hdev);
+        if (!report || report->maxfield != 1 || report->field[0]->report_count != 1)
+                return;
+
+        spin_lock_irqsave(&data->lock, flags);
+        hid_set_field(report->field[0], 0, data->led_state);
+        if (!(data->status & PICOLCD_FAILED))
+                usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
+        spin_unlock_irqrestore(&data->lock, flags);
+}
+
+static void picolcd_led_set_brightness(struct led_classdev *led_cdev,
+                        enum led_brightness value)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct picolcd_data *data;
+        int i, state = 0;
+
+        dev  = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data = hid_get_drvdata(hdev);
+        if (!data)
+                return;
+        for (i = 0; i < 8; i++) {
+                if (led_cdev != data->led[i])
+                        continue;
+                state = (data->led_state >> i) & 1;
+                if (value == LED_OFF && state) {
+                        data->led_state &= ~(1 << i);
+                        picolcd_leds_set(data);
+                } else if (value != LED_OFF && !state) {
+                        data->led_state |= 1 << i;
+                        picolcd_leds_set(data);
+                }
+                break;
+        }
+}
+
+static enum led_brightness picolcd_led_get_brightness(struct led_classdev *led_cdev)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct picolcd_data *data;
+        int i, value = 0;
+
+        dev  = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data = hid_get_drvdata(hdev);
+        for (i = 0; i < 8; i++)
+                if (led_cdev == data->led[i]) {
+                        value = (data->led_state >> i) & 1;
+                        break;
+                }
+        return value ? LED_FULL : LED_OFF;
+}
+
+int picolcd_init_leds(struct picolcd_data *data, struct hid_report *report)
+{
+        struct device *dev = &data->hdev->dev;
+        struct led_classdev *led;
+        size_t name_sz = strlen(dev_name(dev)) + 8;
+        char *name;
+        int i, ret = 0;
+
+        if (!report)
+                return -ENODEV;
+        if (report->maxfield != 1 || report->field[0]->report_count != 1 ||
+                        report->field[0]->report_size != 8) {
+                dev_err(dev, "unsupported LED_STATE report");
+                return -EINVAL;
+        }
+
+        for (i = 0; i < 8; i++) {
+                led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+                if (!led) {
+                        dev_err(dev, "can't allocate memory for LED %d\n", i);
+                        ret = -ENOMEM;
+                        goto err;
+                }
+                name = (void *)(&led[1]);
+                snprintf(name, name_sz, "%s::GPO%d", dev_name(dev), i);
+                led->name = name;
+                led->brightness = 0;
+                led->max_brightness = 1;
+                led->brightness_get = picolcd_led_get_brightness;
+                led->brightness_set = picolcd_led_set_brightness;
+
+                data->led[i] = led;
+                ret = led_classdev_register(dev, data->led[i]);
+                if (ret) {
+                        data->led[i] = NULL;
+                        kfree(led);
+                        dev_err(dev, "can't register LED %d\n", i);
+                        goto err;
+                }
+        }
+        return 0;
+err:
+        for (i = 0; i < 8; i++)
+                if (data->led[i]) {
+                        led = data->led[i];
+                        data->led[i] = NULL;
+                        led_classdev_unregister(led);
+                        kfree(led);
+                }
+        return ret;
+}
+
+void picolcd_exit_leds(struct picolcd_data *data)
+{
+        struct led_classdev *led;
+        int i;
+
+        for (i = 0; i < 8; i++) {
+                led = data->led[i];
+                data->led[i] = NULL;
+                if (!led)
+                        continue;
+                led_classdev_unregister(led);
+                kfree(led);
+        }
+}
+
+
diff --git a/drivers/hid/hid-primax.c b/drivers/hid/hid-primax.c
index 4d3c60d88318..c15adb0c98a1 100644
--- a/drivers/hid/hid-primax.c
+++ b/drivers/hid/hid-primax.c
@@ -64,29 +64,6 @@ static int px_raw_event(struct hid_device *hid, struct hid_report *report,
         return 0;
 }
 
-static int px_probe(struct hid_device *hid, const struct hid_device_id *id)
-{
-        int ret;
-
-        ret = hid_parse(hid);
-        if (ret) {
-                hid_err(hid, "parse failed\n");
-                goto fail;
-        }
-
-        ret = hid_hw_start(hid, HID_CONNECT_DEFAULT);
-        if (ret)
-                hid_err(hid, "hw start failed\n");
-
-fail:
-        return ret;
-}
-
-static void px_remove(struct hid_device *hid)
-{
-        hid_hw_stop(hid);
-}
-
 static const struct hid_device_id px_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
         { }
@@ -97,8 +74,6 @@ static struct hid_driver px_driver = {
         .name = "primax",
         .id_table = px_devices,
         .raw_event = px_raw_event,
-        .probe = px_probe,
-        .remove = px_remove,
 };
 
 static int __init px_init(void)
diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index b71b77ab0dc7..ec8ca3336315 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -105,7 +105,7 @@ static ssize_t show_channel(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read channel=%u\n", pk->pm->midi_channel);
 
@@ -118,7 +118,7 @@ static ssize_t store_channel(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         unsigned channel = 0;
 
@@ -142,7 +142,7 @@ static ssize_t show_sustain(struct device *dev,
  struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read sustain=%u\n", pk->pm->midi_sustain);
 
@@ -155,7 +155,7 @@ static ssize_t store_sustain(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         unsigned sustain = 0;
 
@@ -181,7 +181,7 @@ static ssize_t show_octave(struct device *dev,
         struct device_attribute *attr, char *buf)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         dbg_hid("pcmidi sysfs read octave=%d\n", pk->pm->midi_octave);
 
@@ -194,7 +194,7 @@ static ssize_t store_octave(struct device *dev,
         struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hid_device *hdev = container_of(dev, struct hid_device, dev);
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
 
         int octave = 0;
 
@@ -759,7 +759,7 @@ static int pk_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         struct pcmidi_snd *pm;
 
         pm = pk->pm;
@@ -777,7 +777,7 @@ static int pk_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
         u8 *data, int size)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         int ret = 0;
 
         if (1 == pk->pm->ifnum) {
@@ -858,7 +858,7 @@ err_free_pk:
 
 static void pk_remove(struct hid_device *hdev)
 {
-        struct pk_device *pk = (struct pk_device *)hid_get_drvdata(hdev);
+        struct pk_device *pk = hid_get_drvdata(hdev);
         struct pcmidi_snd *pm;
 
         pm = pk->pm;
diff --git a/drivers/hid/hid-ps3remote.c b/drivers/hid/hid-ps3remote.c
new file mode 100644
index 000000000000..03811e539d71
--- /dev/null
+++ b/drivers/hid/hid-ps3remote.c
@@ -0,0 +1,215 @@
+/*
+ * HID driver for Sony PS3 BD Remote Control
+ *
+ * Copyright (c) 2012 David Dillow <dave@thedillows.org>
+ * Based on a blend of the bluez fakehid user-space code by Marcel Holtmann
+ * and other kernel HID drivers.
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+/* NOTE: in order for the Sony PS3 BD Remote Control to be found by
+ * a Bluetooth host, the key combination Start+Enter has to be kept pressed
+ * for about 7 seconds with the Bluetooth Host Controller in discovering mode.
+ *
+ * There will be no PIN request from the device.
+ */
+
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+
+#include "hid-ids.h"
+
+static __u8 ps3remote_rdesc[] = {
+        0x05, 0x01,          /* GUsagePage Generic Desktop */
+        0x09, 0x05,          /* LUsage 0x05 [Game Pad] */
+        0xA1, 0x01,          /* MCollection Application (mouse, keyboard) */
+
+         /* Use collection 1 for joypad buttons */
+         0xA1, 0x02,         /* MCollection Logical (interrelated data) */
+
+          /* Ignore the 1st byte, maybe it is used for a controller
+           * number but it's not needed for correct operation */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x81, 0x01,        /* MInput 0x01 (Const[0] Arr[1] Abs[2]) */
+
+          /* Bytes from 2nd to 4th are a bitmap for joypad buttons, for these
+           * buttons multiple keypresses are allowed */
+          0x05, 0x09,        /* GUsagePage Button */
+          0x19, 0x01,        /* LUsageMinimum 0x01 [Button 1 (primary/trigger)] */
+          0x29, 0x18,        /* LUsageMaximum 0x18 [Button 24] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x25, 0x01,        /* GLogicalMaximum 0x01 [1] */
+          0x75, 0x01,        /* GReportSize 0x01 [1] */
+          0x95, 0x18,        /* GReportCount 0x18 [24] */
+          0x81, 0x02,        /* MInput 0x02 (Data[0] Var[1] Abs[2]) */
+
+          0xC0,              /* MEndCollection */
+
+         /* Use collection 2 for remote control buttons */
+         0xA1, 0x02,         /* MCollection Logical (interrelated data) */
+
+          /* 5th byte is used for remote control buttons */
+          0x05, 0x09,        /* GUsagePage Button */
+          0x18,              /* LUsageMinimum [No button pressed] */
+          0x29, 0xFE,        /* LUsageMaximum 0xFE [Button 254] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x26, 0xFE, 0x00,  /* GLogicalMaximum 0x00FE [254] */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x80,              /* MInput  */
+
+          /* Ignore bytes from 6th to 11th, 6th to 10th are always constant at
+           * 0xff and 11th is for press indication */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x06,        /* GReportCount 0x06 [6] */
+          0x81, 0x01,        /* MInput 0x01 (Const[0] Arr[1] Abs[2]) */
+
+          /* 12th byte is for battery strength */
+          0x05, 0x06,        /* GUsagePage Generic Device Controls */
+          0x09, 0x20,        /* LUsage 0x20 [Battery Strength] */
+          0x14,              /* GLogicalMinimum [0] */
+          0x25, 0x05,        /* GLogicalMaximum 0x05 [5] */
+          0x75, 0x08,        /* GReportSize 0x08 [8] */
+          0x95, 0x01,        /* GReportCount 0x01 [1] */
+          0x81, 0x02,        /* MInput 0x02 (Data[0] Var[1] Abs[2]) */
+
+          0xC0,              /* MEndCollection */
+
+         0xC0                /* MEndCollection [Game Pad] */
+};
+
+static const unsigned int ps3remote_keymap_joypad_buttons[] = {
+        [0x01] = KEY_SELECT,
+        [0x02] = BTN_THUMBL,            /* L3 */
+        [0x03] = BTN_THUMBR,            /* R3 */
+        [0x04] = BTN_START,
+        [0x05] = KEY_UP,
+        [0x06] = KEY_RIGHT,
+        [0x07] = KEY_DOWN,
+        [0x08] = KEY_LEFT,
+        [0x09] = BTN_TL2,               /* L2 */
+        [0x0a] = BTN_TR2,               /* R2 */
+        [0x0b] = BTN_TL,                /* L1 */
+        [0x0c] = BTN_TR,                /* R1 */
+        [0x0d] = KEY_OPTION,            /* options/triangle */
+        [0x0e] = KEY_BACK,              /* back/circle */
+        [0x0f] = BTN_0,                 /* cross */
+        [0x10] = KEY_SCREEN,            /* view/square */
+        [0x11] = KEY_HOMEPAGE,          /* PS button */
+        [0x14] = KEY_ENTER,
+};
+static const unsigned int ps3remote_keymap_remote_buttons[] = {
+        [0x00] = KEY_1,
+        [0x01] = KEY_2,
+        [0x02] = KEY_3,
+        [0x03] = KEY_4,
+        [0x04] = KEY_5,
+        [0x05] = KEY_6,
+        [0x06] = KEY_7,
+        [0x07] = KEY_8,
+        [0x08] = KEY_9,
+        [0x09] = KEY_0,
+        [0x0e] = KEY_ESC,               /* return */
+        [0x0f] = KEY_CLEAR,
+        [0x16] = KEY_EJECTCD,
+        [0x1a] = KEY_MENU,              /* top menu */
+        [0x28] = KEY_TIME,
+        [0x30] = KEY_PREVIOUS,
+        [0x31] = KEY_NEXT,
+        [0x32] = KEY_PLAY,
+        [0x33] = KEY_REWIND,            /* scan back */
+        [0x34] = KEY_FORWARD,           /* scan forward */
+        [0x38] = KEY_STOP,
+        [0x39] = KEY_PAUSE,
+        [0x40] = KEY_CONTEXT_MENU,      /* pop up/menu */
+        [0x60] = KEY_FRAMEBACK,         /* slow/step back */
+        [0x61] = KEY_FRAMEFORWARD,      /* slow/step forward */
+        [0x63] = KEY_SUBTITLE,
+        [0x64] = KEY_AUDIO,
+        [0x65] = KEY_ANGLE,
+        [0x70] = KEY_INFO,              /* display */
+        [0x80] = KEY_BLUE,
+        [0x81] = KEY_RED,
+        [0x82] = KEY_GREEN,
+        [0x83] = KEY_YELLOW,
+};
+
+static __u8 *ps3remote_fixup(struct hid_device *hdev, __u8 *rdesc,
+                             unsigned int *rsize)
+{
+        *rsize = sizeof(ps3remote_rdesc);
+        return ps3remote_rdesc;
+}
+
+static int ps3remote_mapping(struct hid_device *hdev, struct hid_input *hi,
+                             struct hid_field *field, struct hid_usage *usage,
+                             unsigned long **bit, int *max)
+{
+        unsigned int key = usage->hid & HID_USAGE;
+
+        if ((usage->hid & HID_USAGE_PAGE) != HID_UP_BUTTON)
+                return -1;
+
+        switch (usage->collection_index) {
+        case 1:
+                if (key >= ARRAY_SIZE(ps3remote_keymap_joypad_buttons))
+                        return -1;
+
+                key = ps3remote_keymap_joypad_buttons[key];
+                if (!key)
+                        return -1;
+                break;
+        case 2:
+                if (key >= ARRAY_SIZE(ps3remote_keymap_remote_buttons))
+                        return -1;
+
+                key = ps3remote_keymap_remote_buttons[key];
+                if (!key)
+                        return -1;
+                break;
+        default:
+                return -1;
+        }
+
+        hid_map_usage_clear(hi, usage, bit, max, EV_KEY, key);
+        return 1;
+}
+
+static const struct hid_device_id ps3remote_devices[] = {
+        /* PS3 BD Remote Control */
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_BDREMOTE) },
+        /* Logitech Harmony Adapter for PS3 */
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, ps3remote_devices);
+
+static struct hid_driver ps3remote_driver = {
+        .name          = "ps3_remote",
+        .id_table      = ps3remote_devices,
+        .report_fixup  = ps3remote_fixup,
+        .input_mapping = ps3remote_mapping,
+};
+
+static int __init ps3remote_init(void)
+{
+        return hid_register_driver(&ps3remote_driver);
+}
+
+static void __exit ps3remote_exit(void)
+{
+        hid_unregister_driver(&ps3remote_driver);
+}
+
+module_init(ps3remote_init);
+module_exit(ps3remote_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("David Dillow <dave@thedillows.org>, Antonio Ospite <ospite@studenti.unina.it>");
diff --git a/drivers/hid/hid-samsung.c b/drivers/hid/hid-samsung.c
index 3c1fd8af5e0c..a5821d317229 100644
--- a/drivers/hid/hid-samsung.c
+++ b/drivers/hid/hid-samsung.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2010 Don Prince <dhprince.devel@yahoo.co.uk>
  *
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 5cd25bd907f8..7f33ebf299c2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -4,7 +4,6 @@
  *  Copyright (c) 1999 Andreas Gal
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  *  Copyright (c) 2006-2008 Jiri Kosina
  */
diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
index d484a0043dd4..45b4b066a262 100644
--- a/drivers/hid/hid-sunplus.c
+++ b/drivers/hid/hid-sunplus.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby
  */
 
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 3aba02be1f26..2e56a1fd2375 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -466,6 +466,86 @@ static __u8 twhl850_rdesc_fixed2[] = {
         0xC0                /*  End Collection                      */
 };
 
+/*
+ * See TWHA60 description, device and HID report descriptors at
+ * http://sf.net/apps/mediawiki/digimend/?title=UC-Logic_Tablet_TWHA60
+ */
+
+/* Size of the original descriptors of TWHA60 tablet */
+#define TWHA60_RDESC_ORIG_SIZE0 254
+#define TWHA60_RDESC_ORIG_SIZE1 139
+
+/* Fixed TWHA60 report descriptor, interface 0 (stylus) */
+static __u8 twha60_rdesc_fixed0[] = {
+        0x05, 0x0D,         /*  Usage Page (Digitizer),             */
+        0x09, 0x02,         /*  Usage (Pen),                        */
+        0xA1, 0x01,         /*  Collection (Application),           */
+        0x85, 0x09,         /*      Report ID (9),                  */
+        0x09, 0x20,         /*      Usage (Stylus),                 */
+        0xA0,               /*      Collection (Physical),          */
+        0x75, 0x01,         /*          Report Size (1),            */
+        0x09, 0x42,         /*          Usage (Tip Switch),         */
+        0x09, 0x44,         /*          Usage (Barrel Switch),      */
+        0x09, 0x46,         /*          Usage (Tablet Pick),        */
+        0x14,               /*          Logical Minimum (0),        */
+        0x25, 0x01,         /*          Logical Maximum (1),        */
+        0x95, 0x03,         /*          Report Count (3),           */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x95, 0x04,         /*          Report Count (4),           */
+        0x81, 0x01,         /*          Input (Constant),           */
+        0x09, 0x32,         /*          Usage (In Range),           */
+        0x95, 0x01,         /*          Report Count (1),           */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x75, 0x10,         /*          Report Size (16),           */
+        0x95, 0x01,         /*          Report Count (1),           */
+        0x14,               /*          Logical Minimum (0),        */
+        0xA4,               /*          Push,                       */
+        0x05, 0x01,         /*          Usage Page (Desktop),       */
+        0x55, 0xFD,         /*          Unit Exponent (-3),         */
+        0x65, 0x13,         /*          Unit (Inch),                */
+        0x34,               /*          Physical Minimum (0),       */
+        0x09, 0x30,         /*          Usage (X),                  */
+        0x46, 0x10, 0x27,   /*          Physical Maximum (10000),   */
+        0x27, 0x3F, 0x9C,
+                0x00, 0x00, /*          Logical Maximum (39999),    */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0x09, 0x31,         /*          Usage (Y),                  */
+        0x46, 0x6A, 0x18,   /*          Physical Maximum (6250),    */
+        0x26, 0xA7, 0x61,   /*          Logical Maximum (24999),    */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0xB4,               /*          Pop,                        */
+        0x09, 0x30,         /*          Usage (Tip Pressure),       */
+        0x26, 0xFF, 0x03,   /*          Logical Maximum (1023),     */
+        0x81, 0x02,         /*          Input (Variable),           */
+        0xC0,               /*      End Collection,                 */
+        0xC0                /*  End Collection                      */
+};
+
+/* Fixed TWHA60 report descriptor, interface 1 (frame buttons) */
+static __u8 twha60_rdesc_fixed1[] = {
+        0x05, 0x01, /*  Usage Page (Desktop),       */
+        0x09, 0x06, /*  Usage (Keyboard),           */
+        0xA1, 0x01, /*  Collection (Application),   */
+        0x85, 0x05, /*      Report ID (5),          */
+        0x05, 0x07, /*      Usage Page (Keyboard),  */
+        0x14,       /*      Logical Minimum (0),    */
+        0x25, 0x01, /*      Logical Maximum (1),    */
+        0x75, 0x01, /*      Report Size (1),        */
+        0x95, 0x08, /*      Report Count (8),       */
+        0x81, 0x01, /*      Input (Constant),       */
+        0x95, 0x0C, /*      Report Count (12),      */
+        0x19, 0x3A, /*      Usage Minimum (KB F1),  */
+        0x29, 0x45, /*      Usage Maximum (KB F12), */
+        0x81, 0x02, /*      Input (Variable),       */
+        0x95, 0x0C, /*      Report Count (12),      */
+        0x19, 0x68, /*      Usage Minimum (KB F13), */
+        0x29, 0x73, /*      Usage Maximum (KB F24), */
+        0x81, 0x02, /*      Input (Variable),       */
+        0x95, 0x08, /*      Report Count (8),       */
+        0x81, 0x01, /*      Input (Constant),       */
+        0xC0        /*  End Collection              */
+};
+
 static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                                         unsigned int *rsize)
 {
@@ -525,6 +605,22 @@ static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                         break;
                 }
                 break;
+        case USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60:
+                switch (iface_num) {
+                case 0:
+                        if (*rsize == TWHA60_RDESC_ORIG_SIZE0) {
+                                rdesc = twha60_rdesc_fixed0;
+                                *rsize = sizeof(twha60_rdesc_fixed0);
+                        }
+                        break;
+                case 1:
+                        if (*rsize == TWHA60_RDESC_ORIG_SIZE1) {
+                                rdesc = twha60_rdesc_fixed1;
+                                *rsize = sizeof(twha60_rdesc_fixed1);
+                        }
+                        break;
+                }
+                break;
         }
 
         return rdesc;
@@ -543,6 +639,8 @@ static const struct hid_device_id uclogic_devices[] = {
                                 USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
                                 USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
+                                USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, uclogic_devices);
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index fe23a1eb586b..2f60da9ed066 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -5,7 +5,6 @@
  *  Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
  *  Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
  *  Copyright (c) 2006-2007 Jiri Kosina
- *  Copyright (c) 2007 Paul Walmsley
  *  Copyright (c) 2008 Jiri Slaby <jirislaby@gmail.com>
  *  Copyright (c) 2006 Andrew Zabolotny <zap@homelink.ru>
  *  Copyright (c) 2009 Bastien Nocera <hadess@hadess.net>
@@ -33,6 +32,8 @@
 #define PAD_DEVICE_ID   0x0F
 
 #define WAC_CMD_LED_CONTROL     0x20
+#define WAC_CMD_ICON_START_STOP     0x21
+#define WAC_CMD_ICON_TRANSFER       0x26
 
 struct wacom_data {
         __u16 tool;
@@ -69,6 +70,91 @@ static enum power_supply_property wacom_ac_props[] = {
         POWER_SUPPLY_PROP_SCOPE,
 };
 
+static void wacom_scramble(__u8 *image)
+{
+        __u16 mask;
+        __u16 s1;
+        __u16 s2;
+        __u16 r1 ;
+        __u16 r2 ;
+        __u16 r;
+        __u8 buf[256];
+        int i, w, x, y, z;
+
+        for (x = 0; x < 32; x++) {
+                for (y = 0; y < 8; y++)
+                        buf[(8 * x) + (7 - y)] = image[(8 * x) + y];
+        }
+
+        /* Change 76543210 into GECA6420 as required by Intuos4 WL
+         *        HGFEDCBA      HFDB7531
+         */
+        for (x = 0; x < 4; x++) {
+                for (y = 0; y < 4; y++) {
+                        for (z = 0; z < 8; z++) {
+                                mask = 0x0001;
+                                r1 = 0;
+                                r2 = 0;
+                                i = (x << 6) + (y << 4) + z;
+                                s1 = buf[i];
+                                s2 = buf[i+8];
+                                for (w = 0; w < 8; w++) {
+                                        r1 |= (s1 & mask);
+                                        r2 |= (s2 & mask);
+                                        s1 <<= 1;
+                                        s2 <<= 1;
+                                        mask <<= 2;
+                                }
+                                r = r1 | (r2 << 1);
+                                i = (x << 6) + (y << 4) + (z << 1);
+                                image[i] = 0xFF & r;
+                                image[i+1] = (0xFF00 & r) >> 8;
+                        }
+                }
+        }
+}
+
+static void wacom_set_image(struct hid_device *hdev, const char *image,
+                                                __u8 icon_no)
+{
+        __u8 rep_data[68];
+        __u8 p[256];
+        int ret, i, j;
+
+        for (i = 0; i < 256; i++)
+                p[i] = image[i];
+
+        rep_data[0] = WAC_CMD_ICON_START_STOP;
+        rep_data[1] = 0;
+        ret = hdev->hid_output_raw_report(hdev, rep_data, 2,
+                                HID_FEATURE_REPORT);
+        if (ret < 0)
+                goto err;
+
+        rep_data[0] = WAC_CMD_ICON_TRANSFER;
+        rep_data[1] = icon_no & 0x07;
+
+        wacom_scramble(p);
+
+        for (i = 0; i < 4; i++) {
+                for (j = 0; j < 64; j++)
+                        rep_data[j + 3] = p[(i << 6) + j];
+
+                rep_data[2] = i;
+                ret = hdev->hid_output_raw_report(hdev, rep_data, 67,
+                                        HID_FEATURE_REPORT);
+        }
+
+        rep_data[0] = WAC_CMD_ICON_START_STOP;
+        rep_data[1] = 0;
+
+        ret = hdev->hid_output_raw_report(hdev, rep_data, 2,
+                                HID_FEATURE_REPORT);
+
+err:
+        return;
+}
+
 static void wacom_leds_set_brightness(struct led_classdev *led_dev,
                                                 enum led_brightness value)
 {
@@ -91,7 +177,10 @@ static void wacom_leds_set_brightness(struct led_classdev *led_dev,
         if (buf) {
                 buf[0] = WAC_CMD_LED_CONTROL;
                 buf[1] = led;
-                buf[2] = value;
+                buf[2] = value >> 2;
+                buf[3] = value;
+                /* use fixed brightness for OLEDs */
+                buf[4] = 0x08;
                 hdev->hid_output_raw_report(hdev, buf, 9, HID_FEATURE_REPORT);
                 kfree(buf);
         }
@@ -317,6 +406,34 @@ static ssize_t wacom_store_speed(struct device *dev,
 static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR | S_IWGRP,
                 wacom_show_speed, wacom_store_speed);
 
+#define WACOM_STORE(OLED_ID)                                            \
+static ssize_t wacom_oled##OLED_ID##_store(struct device *dev,          \
+                                struct device_attribute *attr,          \
+                                const char *buf, size_t count)          \
+{                                                                       \
+        struct hid_device *hdev = container_of(dev, struct hid_device,  \
+                                dev);                                   \
+                                                                        \
+        if (count != 256)                                               \
+                return -EINVAL;                                         \
+                                                                        \
+        wacom_set_image(hdev, buf, OLED_ID);                            \
+                                                                        \
+        return count;                                                   \
+}                                                                       \
+                                                                        \
+static DEVICE_ATTR(oled##OLED_ID##_img, S_IWUSR | S_IWGRP, NULL,        \
+                                wacom_oled##OLED_ID##_store)
+
+WACOM_STORE(0);
+WACOM_STORE(1);
+WACOM_STORE(2);
+WACOM_STORE(3);
+WACOM_STORE(4);
+WACOM_STORE(5);
+WACOM_STORE(6);
+WACOM_STORE(7);
+
 static int wacom_gr_parse_report(struct hid_device *hdev,
                         struct wacom_data *wdata,
                         struct input_dev *input, unsigned char *data)
@@ -717,17 +834,33 @@ static int wacom_probe(struct hid_device *hdev,
                 hid_warn(hdev,
                          "can't create sysfs speed attribute err: %d\n", ret);
 
+#define OLED_INIT(OLED_ID)                                              \
+        do {                                                            \
+                ret = device_create_file(&hdev->dev,                    \
+                                &dev_attr_oled##OLED_ID##_img);         \
+                if (ret)                                                \
+                        hid_warn(hdev,                                  \
+                         "can't create sysfs oled attribute, err: %d\n", ret);\
+        } while (0)
+
+OLED_INIT(0);
+OLED_INIT(1);
+OLED_INIT(2);
+OLED_INIT(3);
+OLED_INIT(4);
+OLED_INIT(5);
+OLED_INIT(6);
+OLED_INIT(7);
+
         wdata->features = 0;
         wacom_set_features(hdev, 1);
 
         if (hdev->product == USB_DEVICE_ID_WACOM_INTUOS4_BLUETOOTH) {
                 sprintf(hdev->name, "%s", "Wacom Intuos4 WL");
                 ret = wacom_initialize_leds(hdev);
-                if (ret) {
+                if (ret)
                         hid_warn(hdev,
                                  "can't create led attribute, err: %d\n", ret);
-                        goto destroy_leds;
-                }
         }
 
         wdata->battery.properties = wacom_battery_props;
@@ -740,8 +873,8 @@ static int wacom_probe(struct hid_device *hdev,
 
         ret = power_supply_register(&hdev->dev, &wdata->battery);
         if (ret) {
-                hid_warn(hdev, "can't create sysfs battery attribute, err: %d\n",
-                         ret);
+                hid_err(hdev, "can't create sysfs battery attribute, err: %d\n",
+                        ret);
                 goto err_battery;
         }
 
@@ -756,8 +889,8 @@ static int wacom_probe(struct hid_device *hdev,
 
         ret = power_supply_register(&hdev->dev, &wdata->ac);
         if (ret) {
-                hid_warn(hdev,
-                         "can't create ac battery attribute, err: %d\n", ret);
+                hid_err(hdev,
+                        "can't create ac battery attribute, err: %d\n", ret);
                 goto err_ac;
         }
 
@@ -767,10 +900,17 @@ static int wacom_probe(struct hid_device *hdev,
 err_ac:
         power_supply_unregister(&wdata->battery);
 err_battery:
+        wacom_destroy_leds(hdev);
+        device_remove_file(&hdev->dev, &dev_attr_oled0_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled1_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled2_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled3_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled4_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled5_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled6_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled7_img);
         device_remove_file(&hdev->dev, &dev_attr_speed);
         hid_hw_stop(hdev);
-destroy_leds:
-        wacom_destroy_leds(hdev);
 err_free:
         kfree(wdata);
         return ret;
@@ -781,6 +921,14 @@ static void wacom_remove(struct hid_device *hdev)
         struct wacom_data *wdata = hid_get_drvdata(hdev);
 
         wacom_destroy_leds(hdev);
+        device_remove_file(&hdev->dev, &dev_attr_oled0_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled1_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled2_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled3_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled4_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled5_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled6_img);
+        device_remove_file(&hdev->dev, &dev_attr_oled7_img);
         device_remove_file(&hdev->dev, &dev_attr_speed);
         hid_hw_stop(hdev);
 
diff --git a/drivers/hid/hid-waltop.c b/drivers/hid/hid-waltop.c
index 745e4e9a8cf2..bb536ab5941e 100644
--- a/drivers/hid/hid-waltop.c
+++ b/drivers/hid/hid-waltop.c
@@ -638,28 +638,6 @@ static __u8 sirius_battery_free_tablet_rdesc_fixed[] = {
         0xC0                /*  End Collection                      */
 };
 
-static int waltop_probe(struct hid_device *hdev,
-                        const struct hid_device_id *id)
-{
-        int ret;
-
-        ret = hid_parse(hdev);
-        if (ret) {
-                hid_err(hdev, "parse failed\n");
-                goto err;
-        }
-
-        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
-        if (ret) {
-                hid_err(hdev, "hw start failed\n");
-                goto err;
-        }
-
-        return 0;
-err:
-        return ret;
-}
-
 static __u8 *waltop_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
@@ -776,11 +754,6 @@ static int waltop_raw_event(struct hid_device *hdev, struct hid_report *report,
         return 0;
 }
 
-static void waltop_remove(struct hid_device *hdev)
-{
-        hid_hw_stop(hdev);
-}
-
 static const struct hid_device_id waltop_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP,
                                 USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
@@ -803,10 +776,8 @@ MODULE_DEVICE_TABLE(hid, waltop_devices);
 static struct hid_driver waltop_driver = {
         .name = "waltop",
         .id_table = waltop_devices,
-        .probe = waltop_probe,
         .report_fixup = waltop_report_fixup,
         .raw_event = waltop_raw_event,
-        .remove = waltop_remove,
 };
 
 static int __init waltop_init(void)
diff --git a/drivers/hid/hid-wiimote-ext.c b/drivers/hid/hid-wiimote-ext.c
index 0a1805c9b0e5..bc85bf29062e 100644
--- a/drivers/hid/hid-wiimote-ext.c
+++ b/drivers/hid/hid-wiimote-ext.c
@@ -28,12 +28,14 @@ struct wiimote_ext {
         bool mp_plugged;
         bool motionp;
         __u8 ext_type;
+        __u16 calib[4][3];
 };
 
 enum wiiext_type {
         WIIEXT_NONE,            /* placeholder */
         WIIEXT_CLASSIC,         /* Nintendo classic controller */
         WIIEXT_NUNCHUCK,        /* Nintendo nunchuck controller */
+        WIIEXT_BALANCE_BOARD,   /* Nintendo balance board controller */
 };
 
 enum wiiext_keys {
@@ -126,6 +128,7 @@ error:
 static __u8 ext_read(struct wiimote_ext *ext)
 {
         ssize_t ret;
+        __u8 buf[24], i, j, offs = 0;
         __u8 rmem[2], wmem;
         __u8 type = WIIEXT_NONE;
 
@@ -151,6 +154,28 @@ static __u8 ext_read(struct wiimote_ext *ext)
                         type = WIIEXT_NUNCHUCK;
                 else if (rmem[0] == 0x01 && rmem[1] == 0x01)
                         type = WIIEXT_CLASSIC;
+                else if (rmem[0] == 0x04 && rmem[1] == 0x02)
+                        type = WIIEXT_BALANCE_BOARD;
+        }
+
+        /* get balance board calibration data */
+        if (type == WIIEXT_BALANCE_BOARD) {
+                ret = wiimote_cmd_read(ext->wdata, 0xa40024, buf, 12);
+                ret += wiimote_cmd_read(ext->wdata, 0xa40024 + 12,
+                                        buf + 12, 12);
+
+                if (ret != 24) {
+                        type = WIIEXT_NONE;
+                } else {
+                        for (i = 0; i < 3; i++) {
+                                for (j = 0; j < 4; j++) {
+                                        ext->calib[j][i] = buf[offs];
+                                        ext->calib[j][i] <<= 8;
+                                        ext->calib[j][i] |= buf[offs + 1];
+                                        offs += 2;
+                                }
+                        }
+                }
         }
 
         wiimote_cmd_release(ext->wdata);
@@ -509,6 +534,71 @@ static void handler_classic(struct wiimote_ext *ext, const __u8 *payload)
         input_sync(ext->input);
 }
 
+static void handler_balance_board(struct wiimote_ext *ext, const __u8 *payload)
+{
+        __s32 val[4], tmp;
+        unsigned int i;
+
+        /*   Byte |  8  7  6  5  4  3  2  1  |
+         *   -----+--------------------------+
+         *    1   |    Top Right <15:8>      |
+         *    2   |    Top Right  <7:0>      |
+         *   -----+--------------------------+
+         *    3   | Bottom Right <15:8>      |
+         *    4   | Bottom Right  <7:0>      |
+         *   -----+--------------------------+
+         *    5   |     Top Left <15:8>      |
+         *    6   |     Top Left  <7:0>      |
+         *   -----+--------------------------+
+         *    7   |  Bottom Left <15:8>      |
+         *    8   |  Bottom Left  <7:0>      |
+         *   -----+--------------------------+
+         *
+         * These values represent the weight-measurements of the Wii-balance
+         * board with 16bit precision.
+         *
+         * The balance-board is never reported interleaved with motionp.
+         */
+
+        val[0] = payload[0];
+        val[0] <<= 8;
+        val[0] |= payload[1];
+
+        val[1] = payload[2];
+        val[1] <<= 8;
+        val[1] |= payload[3];
+
+        val[2] = payload[4];
+        val[2] <<= 8;
+        val[2] |= payload[5];
+
+        val[3] = payload[6];
+        val[3] <<= 8;
+        val[3] |= payload[7];
+
+        /* apply calibration data */
+        for (i = 0; i < 4; i++) {
+                if (val[i] < ext->calib[i][1]) {
+                        tmp = val[i] - ext->calib[i][0];
+                        tmp *= 1700;
+                        tmp /= ext->calib[i][1] - ext->calib[i][0];
+                } else {
+                        tmp = val[i] - ext->calib[i][1];
+                        tmp *= 1700;
+                        tmp /= ext->calib[i][2] - ext->calib[i][1];
+                        tmp += 1700;
+                }
+                val[i] = tmp;
+        }
+
+        input_report_abs(ext->input, ABS_HAT0X, val[0]);
+        input_report_abs(ext->input, ABS_HAT0Y, val[1]);
+        input_report_abs(ext->input, ABS_HAT1X, val[2]);
+        input_report_abs(ext->input, ABS_HAT1Y, val[3]);
+
+        input_sync(ext->input);
+}
+
 /* call this with state.lock spinlock held */
 void wiiext_handle(struct wiimote_data *wdata, const __u8 *payload)
 {
@@ -523,6 +613,8 @@ void wiiext_handle(struct wiimote_data *wdata, const __u8 *payload)
                 handler_nunchuck(ext, payload);
         } else if (ext->ext_type == WIIEXT_CLASSIC) {
                 handler_classic(ext, payload);
+        } else if (ext->ext_type == WIIEXT_BALANCE_BOARD) {
+                handler_balance_board(ext, payload);
         }
 }
 
@@ -551,6 +643,11 @@ static ssize_t wiiext_show(struct device *dev, struct device_attribute *attr,
                         return sprintf(buf, "motionp+classic\n");
                 else
                         return sprintf(buf, "classic\n");
+        } else if (type == WIIEXT_BALANCE_BOARD) {
+                if (motionp)
+                        return sprintf(buf, "motionp+balanceboard\n");
+                else
+                        return sprintf(buf, "balanceboard\n");
         } else {
                 if (motionp)
                         return sprintf(buf, "motionp\n");
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 3b6f7bf5a77e..17d15bb610d1 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -42,6 +42,7 @@ static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
 static DEFINE_MUTEX(minors_lock);
+static void drop_ref(struct hidraw *hid, int exists_bit);
 
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -113,7 +114,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
         __u8 *buf;
         int ret = 0;
 
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 ret = -ENODEV;
                 goto out;
         }
@@ -261,7 +262,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
         }
 
         mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 err = -ENODEV;
                 goto out_unlock;
         }
@@ -298,36 +299,12 @@ out:
 static int hidraw_release(struct inode * inode, struct file * file)
 {
         unsigned int minor = iminor(inode);
-        struct hidraw *dev;
         struct hidraw_list *list = file->private_data;
-        int ret;
-        int i;
-
-        mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
-                ret = -ENODEV;
-                goto unlock;
-        }
 
+        drop_ref(hidraw_table[minor], 0);
         list_del(&list->node);
-        dev = hidraw_table[minor];
-        if (!--dev->open) {
-                if (list->hidraw->exist) {
-                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
-                        hid_hw_close(dev->hid);
-                } else {
-                        kfree(list->hidraw);
-                }
-        }
-
-        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
-                kfree(list->buffer[i].value);
         kfree(list);
-        ret = 0;
-unlock:
-        mutex_unlock(&minors_lock);
-
-        return ret;
+        return 0;
 }
 
 static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -529,21 +506,7 @@ EXPORT_SYMBOL_GPL(hidraw_connect);
 void hidraw_disconnect(struct hid_device *hid)
 {
         struct hidraw *hidraw = hid->hidraw;
-
-        mutex_lock(&minors_lock);
-        hidraw->exist = 0;
-
-        device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
-
-        hidraw_table[hidraw->minor] = NULL;
-
-        if (hidraw->open) {
-                hid_hw_close(hid);
-                wake_up_interruptible(&hidraw->wait);
-        } else {
-                kfree(hidraw);
-        }
-        mutex_unlock(&minors_lock);
+        drop_ref(hidraw, 1);
 }
 EXPORT_SYMBOL_GPL(hidraw_disconnect);
 
@@ -559,21 +522,28 @@ int __init hidraw_init(void)
 
         if (result < 0) {
                 pr_warn("can't get major number\n");
-                result = 0;
                 goto out;
         }
 
         hidraw_class = class_create(THIS_MODULE, "hidraw");
         if (IS_ERR(hidraw_class)) {
                 result = PTR_ERR(hidraw_class);
-                unregister_chrdev(hidraw_major, "hidraw");
-                goto out;
+                goto error_cdev;
         }
 
         cdev_init(&hidraw_cdev, &hidraw_ops);
-        cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
+        result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
+        if (result < 0)
+                goto error_class;
+
 out:
         return result;
+
+error_class:
+        class_destroy(hidraw_class);
+error_cdev:
+        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
+        goto out;
 }
 
 void hidraw_exit(void)
@@ -585,3 +555,23 @@ void hidraw_exit(void)
         unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
 
 }
+
+static void drop_ref(struct hidraw *hidraw, int exists_bit)
+{
+        mutex_lock(&minors_lock);
+        if (exists_bit) {
+                hid_hw_close(hidraw->hid);
+                hidraw->exist = 0;
+                if (hidraw->open)
+                        wake_up_interruptible(&hidraw->wait);
+        } else {
+                --hidraw->open;
+        }
+
+        if (!hidraw->open && !hidraw->exist) {
+                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+                hidraw_table[hidraw->minor] = NULL;
+                kfree(hidraw);
+        }
+        mutex_unlock(&minors_lock);
+}
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index dedd8e4e5c6d..8e0c4bf94ebc 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1415,20 +1415,20 @@ static int hid_post_reset(struct usb_interface *intf)
          * configuration descriptors passed, we already know that
          * the size of the HID report descriptor has not changed.
          */
-        rdesc = kmalloc(hid->rsize, GFP_KERNEL);
+        rdesc = kmalloc(hid->dev_rsize, GFP_KERNEL);
         if (!rdesc) {
                 dbg_hid("couldn't allocate rdesc memory (post_reset)\n");
                 return 1;
         }
         status = hid_get_class_descriptor(dev,
                                 interface->desc.bInterfaceNumber,
-                                HID_DT_REPORT, rdesc, hid->rsize);
+                                HID_DT_REPORT, rdesc, hid->dev_rsize);
         if (status < 0) {
                 dbg_hid("reading report descriptor failed (post_reset)\n");
                 kfree(rdesc);
                 return 1;
         }
-        status = memcmp(rdesc, hid->rdesc, hid->rsize);
+        status = memcmp(rdesc, hid->dev_rdesc, hid->dev_rsize);
         kfree(rdesc);
         if (status != 0) {
                 dbg_hid("report descriptor changed\n");
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 991e85c7325c..11c7932dc7e6 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,12 +70,13 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index cfec802cf9ca..f915eb1c29f7 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(struct device *dev,
         }
 }
 
+static ssize_t ad7314_show_name(struct device *dev,
+                                struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
+static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
                           ad7314_show_temperature, NULL, 0);
 
 static struct attribute *ad7314_attributes[] = {
+        &dev_attr_name.attr,
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         NULL,
 };
diff --git a/drivers/hwmon/ads7871.c b/drivers/hwmon/ads7871.c
index e65c6e45d36b..7bf4ce3d405e 100644
--- a/drivers/hwmon/ads7871.c
+++ b/drivers/hwmon/ads7871.c
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct device *dev,
         }
 }
 
+static ssize_t ads7871_show_name(struct device *dev,
+                                 struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
 static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5);
 static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
 static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
 
+static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
+
 static struct attribute *ads7871_attributes[] = {
         &sensor_dev_attr_in0_input.dev_attr.attr,
         &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attributes[] = {
         &sensor_dev_attr_in5_input.dev_attr.attr,
         &sensor_dev_attr_in6_input.dev_attr.attr,
         &sensor_dev_attr_in7_input.dev_attr.attr,
+        &dev_attr_name.attr,
         NULL
 };
 
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 282708860517..8f3f6f2c45fd 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -53,10 +53,10 @@
 
 #define APPLESMC_MAX_DATA_LENGTH 32
 
-/* wait up to 32 ms for a status change. */
+/* wait up to 128 ms for a status change. */
 #define APPLESMC_MIN_WAIT       0x0010
 #define APPLESMC_RETRY_WAIT     0x0100
-#define APPLESMC_MAX_WAIT       0x8000
+#define APPLESMC_MAX_WAIT       0x20000
 
 #define APPLESMC_READ_CMD       0x10
 #define APPLESMC_WRITE_CMD      0x11
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 0fa356fe82cc..984a3f13923b 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -815,17 +815,20 @@ static int __init coretemp_init(void)
         if (err)
                 goto exit;
 
+        get_online_cpus();
         for_each_online_cpu(i)
                 get_core_online(i);
 
 #ifndef CONFIG_HOTPLUG_CPU
         if (list_empty(&pdev_list)) {
+                put_online_cpus();
                 err = -ENODEV;
                 goto exit_driver_unreg;
         }
 #endif
 
         register_hotcpu_notifier(&coretemp_cpu_notifier);
+        put_online_cpus();
         return 0;
 
 #ifndef CONFIG_HOTPLUG_CPU
@@ -840,6 +843,7 @@ static void __exit coretemp_exit(void)
 {
         struct pdev_entry *p, *n;
 
+        get_online_cpus();
         unregister_hotcpu_notifier(&coretemp_cpu_notifier);
         mutex_lock(&pdev_list_mutex);
         list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -848,6 +852,7 @@ static void __exit coretemp_exit(void)
                 kfree(p);
         }
         mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
         platform_driver_unregister(&coretemp_driver);
 }
 
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index 2764b78a784b..af69073b3fe8 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -129,12 +129,12 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
  * counter saturations resulting in bogus power readings.
  * We correct this value ourselves to cope with older BIOSes.
  */
-static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
+static const struct pci_device_id affected_device[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
         { 0 }
 };
 
-static void __devinit tweak_runavg_range(struct pci_dev *pdev)
+static void tweak_runavg_range(struct pci_dev *pdev)
 {
         u32 val;
 
@@ -158,6 +158,16 @@ static void __devinit tweak_runavg_range(struct pci_dev *pdev)
                 REG_TDP_RUNNING_AVERAGE, val);
 }
 
+#ifdef CONFIG_PM
+static int fam15h_power_resume(struct pci_dev *pdev)
+{
+        tweak_runavg_range(pdev);
+        return 0;
+}
+#else
+#define fam15h_power_resume NULL
+#endif
+
 static void __devinit fam15h_power_init_data(struct pci_dev *f4,
                                              struct fam15h_power_data *data)
 {
@@ -256,6 +266,7 @@ static struct pci_driver fam15h_power_driver = {
         .id_table = fam15h_power_id_table,
         .probe = fam15h_power_probe,
         .remove = __devexit_p(fam15h_power_remove),
+        .resume = fam15h_power_resume,
 };
 
 module_pci_driver(fam15h_power_driver);
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index 7f3f4a385729..602148299f68 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -69,22 +69,6 @@ struct ina2xx_data {
         u16 regs[INA2XX_MAX_REGISTERS];
 };
 
-int ina2xx_read_word(struct i2c_client *client, int reg)
-{
-        int val = i2c_smbus_read_word_data(client, reg);
-        if (unlikely(val < 0)) {
-                dev_dbg(&client->dev,
-                        "Failed to read register: %d\n", reg);
-                return val;
-        }
-        return be16_to_cpu(val);
-}
-
-void ina2xx_write_word(struct i2c_client *client, int reg, int data)
-{
-        i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
-}
-
 static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 
                 /* Read all registers */
                 for (i = 0; i < data->registers; i++) {
-                        int rv = ina2xx_read_word(client, i);
+                        int rv = i2c_smbus_read_word_swapped(client, i);
                         if (rv < 0) {
                                 ret = ERR_PTR(rv);
                                 goto abort;
@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_client *client,
         switch (data->kind) {
         case ina219:
                 /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA219_CONFIG_DEFAULT);
 
                 /* set current LSB to 1mA, shunt is in uOhms */
                 /* (equation 13 in datasheet) */
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             40960000 / shunt);
                 dev_info(&client->dev,
                          "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
                 data->registers = INA219_REGISTERS;
                 break;
         case ina226:
                 /* device configuration */
-                ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
+                i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+                                             INA226_CONFIG_DEFAULT);
 
                 /* set current LSB to 1mA, shunt is in uOhms */
                 /* (equation 1 in datasheet)*/
-                ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
+                i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+                                             5120000 / shunt);
                 dev_info(&client->dev,
                          "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
                 data->registers = INA226_REGISTERS;
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index 0018c7dd0097..1a174f0a3cde 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *dev,
                          struct device_attribute *devattr, char *buf)
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct twl4030_madc_request req;
+        struct twl4030_madc_request req = {
+                .channels = 1 << attr->index,
+                .method = TWL4030_MADC_SW2,
+                .type = TWL4030_MADC_WAIT,
+        };
         long val;
 
-        req.channels = (1 << attr->index);
-        req.method = TWL4030_MADC_SW2;
-        req.func_cb = NULL;
         val = twl4030_madc_conversion(&req);
         if (val < 0)
                 return val;
diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
index ee4ebc198a94..2e56c6ce9fb6 100644
--- a/drivers/hwmon/via-cputemp.c
+++ b/drivers/hwmon/via-cputemp.c
@@ -328,6 +328,7 @@ static int __init via_cputemp_init(void)
         if (err)
                 goto exit;
 
+        get_online_cpus();
         for_each_online_cpu(i) {
                 struct cpuinfo_x86 *c = &cpu_data(i);
 
@@ -347,12 +348,14 @@ static int __init via_cputemp_init(void)
 
 #ifndef CONFIG_HOTPLUG_CPU
         if (list_empty(&pdev_list)) {
+                put_online_cpus();
                 err = -ENODEV;
                 goto exit_driver_unreg;
         }
 #endif
 
         register_hotcpu_notifier(&via_cputemp_cpu_notifier);
+        put_online_cpus();
         return 0;
 
 #ifndef CONFIG_HOTPLUG_CPU
@@ -367,6 +370,7 @@ static void __exit via_cputemp_exit(void)
 {
         struct pdev_entry *p, *n;
 
+        get_online_cpus();
         unregister_hotcpu_notifier(&via_cputemp_cpu_notifier);
         mutex_lock(&pdev_list_mutex);
         list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -375,6 +379,7 @@ static void __exit via_cputemp_exit(void)
                 kfree(p);
         }
         mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
         platform_driver_unregister(&via_cputemp_driver);
 }
 
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 1201a15784c3..db713c0dfba4 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -552,7 +552,7 @@ EXPORT_SYMBOL_GPL(hwspin_lock_request_specific);
  */
 int hwspin_lock_free(struct hwspinlock *hwlock)
 {
-        struct device *dev = hwlock->bank->dev;
+        struct device *dev;
         struct hwspinlock *tmp;
         int ret;
 
@@ -561,6 +561,7 @@ int hwspin_lock_free(struct hwspinlock *hwlock)
                 return -EINVAL;
         }
 
+        dev = hwlock->bank->dev;
         mutex_lock(&hwspinlock_tree_lock);
 
         /* make sure the hwspinlock is used */
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 73133b1063f0..6f5f98d69af7 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -476,17 +476,17 @@ static int pca_init(struct i2c_adapter *adap)
                 /* To avoid integer overflow, use clock/100 for calculations */
                 clock = pca_clock(pca_data) / 100;
 
-                if (pca_data->i2c_clock > 10000) {
+                if (pca_data->i2c_clock > 1000000) {
                         mode = I2C_PCA_MODE_TURBO;
                         min_tlow = 14;
                         min_thi  = 5;
                         raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 4000) {
+                } else if (pca_data->i2c_clock > 400000) {
                         mode = I2C_PCA_MODE_FASTP;
                         min_tlow = 17;
                         min_thi  = 9;
                         raise_fall_time = 22; /* Raise 11e-8s, Fall 11e-8s */
-                } else if (pca_data->i2c_clock > 1000) {
+                } else if (pca_data->i2c_clock > 100000) {
                         mode = I2C_PCA_MODE_FAST;
                         min_tlow = 44;
                         min_thi  = 20;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index b4aaa1bd6728..970a1612e795 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -104,6 +104,7 @@ config I2C_I801
             DH89xxCC (PCH)
             Panther Point (PCH)
             Lynx Point (PCH)
+            Lynx Point-LP (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
@@ -354,9 +355,13 @@ config I2C_DAVINCI
           devices such as DaVinci NIC.
           For details please see http://www.ti.com/davinci
 
+config I2C_DESIGNWARE_CORE
+        tristate
+
 config I2C_DESIGNWARE_PLATFORM
         tristate "Synopsys DesignWare Platform"
         depends on HAVE_CLK
+        select I2C_DESIGNWARE_CORE
         help
           If you say yes to this option, support will be included for the
           Synopsys DesignWare I2C adapter. Only master mode is supported.
@@ -367,6 +372,7 @@ config I2C_DESIGNWARE_PLATFORM
 config I2C_DESIGNWARE_PCI
         tristate "Synopsys DesignWare PCI"
         depends on PCI
+        select I2C_DESIGNWARE_CORE
         help
           If you say yes to this option, support will be included for the
           Synopsys DesignWare I2C adapter. Only master mode is supported.
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index ce3c2be7fb40..37c4182cc98b 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -33,10 +33,11 @@ obj-$(CONFIG_I2C_AU1550)	+= i2c-au1550.o
 obj-$(CONFIG_I2C_BLACKFIN_TWI)  += i2c-bfin-twi.o
 obj-$(CONFIG_I2C_CPM)           += i2c-cpm.o
 obj-$(CONFIG_I2C_DAVINCI)       += i2c-davinci.o
+obj-$(CONFIG_I2C_DESIGNWARE_CORE)       += i2c-designware-core.o
 obj-$(CONFIG_I2C_DESIGNWARE_PLATFORM)   += i2c-designware-platform.o
-i2c-designware-platform-objs := i2c-designware-platdrv.o i2c-designware-core.o
+i2c-designware-platform-objs := i2c-designware-platdrv.o
 obj-$(CONFIG_I2C_DESIGNWARE_PCI)        += i2c-designware-pci.o
-i2c-designware-pci-objs := i2c-designware-pcidrv.o i2c-designware-core.o
+i2c-designware-pci-objs := i2c-designware-pcidrv.o
 obj-$(CONFIG_I2C_EG20T)         += i2c-eg20t.o
 obj-$(CONFIG_I2C_GPIO)          += i2c-gpio.o
 obj-$(CONFIG_I2C_HIGHLANDER)    += i2c-highlander.o
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 1e48bec80edf..7b8ebbefb581 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -25,6 +25,7 @@
  * ----------------------------------------------------------------------------
  *
  */
+#include <linux/export.h>
 #include <linux/clk.h>
 #include <linux/errno.h>
 #include <linux/err.h>
@@ -316,6 +317,7 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dw_writel(dev, dev->master_cfg , DW_IC_CON);
         return 0;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_init);
 
 /*
  * Waiting for bus not busy
@@ -568,12 +570,14 @@ done:
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_xfer);
 
 u32 i2c_dw_func(struct i2c_adapter *adap)
 {
         struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
         return dev->functionality;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_func);
 
 static u32 i2c_dw_read_clear_intrbits(struct dw_i2c_dev *dev)
 {
@@ -678,17 +682,20 @@ tx_aborted:
 
         return IRQ_HANDLED;
 }
+EXPORT_SYMBOL_GPL(i2c_dw_isr);
 
 void i2c_dw_enable(struct dw_i2c_dev *dev)
 {
        /* Enable the adapter */
         dw_writel(dev, 1, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_enable);
 
 u32 i2c_dw_is_enabled(struct dw_i2c_dev *dev)
 {
         return dw_readl(dev, DW_IC_ENABLE);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_is_enabled);
 
 void i2c_dw_disable(struct dw_i2c_dev *dev)
 {
@@ -699,18 +706,22 @@ void i2c_dw_disable(struct dw_i2c_dev *dev)
         dw_writel(dev, 0, DW_IC_INTR_MASK);
         dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable);
 
 void i2c_dw_clear_int(struct dw_i2c_dev *dev)
 {
         dw_readl(dev, DW_IC_CLR_INTR);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_clear_int);
 
 void i2c_dw_disable_int(struct dw_i2c_dev *dev)
 {
         dw_writel(dev, 0, DW_IC_INTR_MASK);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_disable_int);
 
 u32 i2c_dw_read_comp_param(struct dw_i2c_dev *dev)
 {
         return dw_readl(dev, DW_IC_COMP_PARAM_1);
 }
+EXPORT_SYMBOL_GPL(i2c_dw_read_comp_param);
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 898dcf9c7ade..33e9b0c09af2 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -52,6 +52,7 @@
   DH89xxCC (PCH)        0x2330     32     hard     yes     yes     yes
   Panther Point (PCH)   0x1e22     32     hard     yes     yes     yes
   Lynx Point (PCH)      0x8c22     32     hard     yes     yes     yes
+  Lynx Point-LP (PCH)   0x9c22     32     hard     yes     yes     yes
 
   Features supported by this driver:
   Software PEC                     no
@@ -155,6 +156,7 @@
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS     0x8c22
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS  0x9c22
 
 struct i801_priv {
         struct i2c_adapter adapter;
@@ -771,6 +773,7 @@ static DEFINE_PCI_DEVICE_TABLE(i801_ids) = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PANTHERPOINT_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_SMBUS) },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 088c5c1ed17d..51f05b8520ed 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -365,10 +365,6 @@ static int mxs_i2c_get_ofdata(struct mxs_i2c_dev *i2c)
         struct device_node *node = dev->of_node;
         int ret;
 
-        if (!node)
-                return -EINVAL;
-
-        i2c->speed = &mxs_i2c_95kHz_config;
         ret = of_property_read_u32(node, "clock-frequency", &speed);
         if (ret)
                 dev_warn(dev, "No I2C speed selected, using 100kHz\n");
@@ -419,10 +415,13 @@ static int __devinit mxs_i2c_probe(struct platform_device *pdev)
                 return err;
 
         i2c->dev = dev;
+        i2c->speed = &mxs_i2c_95kHz_config;
 
-        err = mxs_i2c_get_ofdata(i2c);
-        if (err)
-                return err;
+        if (dev->of_node) {
+                err = mxs_i2c_get_ofdata(i2c);
+                if (err)
+                        return err;
+        }
 
         platform_set_drvdata(pdev, i2c);
 
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 5d54416770b0..8488bddfe465 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -48,8 +48,9 @@ enum {
         mcntrl_afie = 0x00000002,
         mcntrl_naie = 0x00000004,
         mcntrl_drmie = 0x00000008,
-        mcntrl_daie = 0x00000020,
-        mcntrl_rffie = 0x00000040,
+        mcntrl_drsie = 0x00000010,
+        mcntrl_rffie = 0x00000020,
+        mcntrl_daie = 0x00000040,
         mcntrl_tffie = 0x00000080,
         mcntrl_reset = 0x00000100,
         mcntrl_cdbmode = 0x00000400,
@@ -290,31 +291,37 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
          * or we didn't 'ask' for it yet.
          */
         if (ioread32(I2C_REG_STS(alg_data)) & mstatus_rfe) {
-                dev_dbg(&alg_data->adapter.dev,
-                        "%s(): Write dummy data to fill Rx-fifo...\n",
-                        __func__);
+                /* 'Asking' is done asynchronously, e.g. dummy TX of several
+                 * bytes is done before the first actual RX arrives in FIFO.
+                 * Therefore, ordered bytes (via TX) are counted separately.
+                 */
+                if (alg_data->mif.order) {
+                        dev_dbg(&alg_data->adapter.dev,
+                                "%s(): Write dummy data to fill Rx-fifo...\n",
+                                __func__);
 
-                if (alg_data->mif.len == 1) {
-                        /* Last byte, do not acknowledge next rcv. */
-                        val |= stop_bit;
+                        if (alg_data->mif.order == 1) {
+                                /* Last byte, do not acknowledge next rcv. */
+                                val |= stop_bit;
+
+                                /*
+                                 * Enable interrupt RFDAIE (data in Rx fifo),
+                                 * and disable DRMIE (need data for Tx)
+                                 */
+                                ctl = ioread32(I2C_REG_CTL(alg_data));
+                                ctl |= mcntrl_rffie | mcntrl_daie;
+                                ctl &= ~mcntrl_drmie;
+                                iowrite32(ctl, I2C_REG_CTL(alg_data));
+                        }
 
                         /*
-                         * Enable interrupt RFDAIE (data in Rx fifo),
-                         * and disable DRMIE (need data for Tx)
+                         * Now we'll 'ask' for data:
+                         * For each byte we want to receive, we must
+                         * write a (dummy) byte to the Tx-FIFO.
                          */
-                        ctl = ioread32(I2C_REG_CTL(alg_data));
-                        ctl |= mcntrl_rffie | mcntrl_daie;
-                        ctl &= ~mcntrl_drmie;
-                        iowrite32(ctl, I2C_REG_CTL(alg_data));
+                        iowrite32(val, I2C_REG_TX(alg_data));
+                        alg_data->mif.order--;
                 }
-
-                /*
-                 * Now we'll 'ask' for data:
-                 * For each byte we want to receive, we must
-                 * write a (dummy) byte to the Tx-FIFO.
-                 */
-                iowrite32(val, I2C_REG_TX(alg_data));
-
                 return 0;
         }
 
@@ -514,6 +521,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 
                 alg_data->mif.buf = pmsg->buf;
                 alg_data->mif.len = pmsg->len;
+                alg_data->mif.order = pmsg->len;
                 alg_data->mif.mode = (pmsg->flags & I2C_M_RD) ?
                         I2C_SMBUS_READ : I2C_SMBUS_WRITE;
                 alg_data->mif.ret = 0;
@@ -566,6 +574,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
         /* Cleanup to be sure... */
         alg_data->mif.buf = NULL;
         alg_data->mif.len = 0;
+        alg_data->mif.order = 0;
 
         dev_dbg(&alg_data->adapter.dev, "%s(): exiting, stat = %x\n",
                 __func__, ioread32(I2C_REG_STS(alg_data)));
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2efa56c5ff2c..2091ae8f539a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -637,6 +637,22 @@ static void i2c_adapter_dev_release(struct device *dev)
 }
 
 /*
+ * This function is only needed for mutex_lock_nested, so it is never
+ * called unless locking correctness checking is enabled. Thus we
+ * make it inline to avoid a compiler warning. That's what gcc ends up
+ * doing anyway.
+ */
+static inline unsigned int i2c_adapter_depth(struct i2c_adapter *adapter)
+{
+        unsigned int depth = 0;
+
+        while ((adapter = i2c_parent_is_i2c_adapter(adapter)))
+                depth++;
+
+        return depth;
+}
+
+/*
  * Let users instantiate I2C devices through sysfs. This can be used when
  * platform initialization code doesn't contain the proper data for
  * whatever reason. Also useful for drivers that do device detection and
@@ -726,7 +742,8 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
 
         /* Make sure the device was added through sysfs */
         res = -ENOENT;
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
         list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                  detected) {
                 if (client->addr == addr) {
@@ -1073,7 +1090,8 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                 return res;
 
         /* Remove devices instantiated from sysfs */
-        mutex_lock(&adap->userspace_clients_lock);
+        mutex_lock_nested(&adap->userspace_clients_lock,
+                          i2c_adapter_depth(adap));
         list_for_each_entry_safe(client, next, &adap->userspace_clients,
                                  detected) {
                 dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index f61780a02374..3bd5540238a7 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -617,7 +617,7 @@ static int __devinit at91_adc_probe(struct platform_device *pdev)
         st->adc_clk = clk_get(&pdev->dev, "adc_op_clk");
         if (IS_ERR(st->adc_clk)) {
                 dev_err(&pdev->dev, "Failed to get the ADC clock.\n");
-                ret = PTR_ERR(st->clk);
+                ret = PTR_ERR(st->adc_clk);
                 goto error_disable_clk;
         }
 
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 51f42061dae9..6cfd4d8fd0bd 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1361,11 +1361,11 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         struct tid_info *t = dev->rdev.lldi.tids;
 
         ep = lookup_tid(t, tid);
-        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         if (!ep) {
                 printk(KERN_WARNING MOD "Abort rpl to freed endpoint\n");
                 return 0;
         }
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
         mutex_lock(&ep->com.mutex);
         switch (ep->com.state) {
         case ABORTING:
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 53589000fd07..8615d7cf7e01 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -42,6 +42,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/smpboot.h>
 
 #include "ehca_classes.h"
 #include "ehca_irq.h"
@@ -652,7 +653,7 @@ void ehca_tasklet_eq(unsigned long data)
         ehca_process_eq((struct ehca_shca*)data, 1);
 }
 
-static inline int find_next_online_cpu(struct ehca_comp_pool *pool)
+static int find_next_online_cpu(struct ehca_comp_pool *pool)
 {
         int cpu;
         unsigned long flags;
@@ -662,17 +663,20 @@ static inline int find_next_online_cpu(struct ehca_comp_pool *pool)
                 ehca_dmp(cpu_online_mask, cpumask_size(), "");
 
         spin_lock_irqsave(&pool->last_cpu_lock, flags);
-        cpu = cpumask_next(pool->last_cpu, cpu_online_mask);
-        if (cpu >= nr_cpu_ids)
-                cpu = cpumask_first(cpu_online_mask);
-        pool->last_cpu = cpu;
+        do {
+                cpu = cpumask_next(pool->last_cpu, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        cpu = cpumask_first(cpu_online_mask);
+                pool->last_cpu = cpu;
+        } while (!per_cpu_ptr(pool->cpu_comp_tasks, cpu)->active);
         spin_unlock_irqrestore(&pool->last_cpu_lock, flags);
 
         return cpu;
 }
 
 static void __queue_comp_task(struct ehca_cq *__cq,
-                              struct ehca_cpu_comp_task *cct)
+                              struct ehca_cpu_comp_task *cct,
+                              struct task_struct *thread)
 {
         unsigned long flags;
 
@@ -683,7 +687,7 @@ static void __queue_comp_task(struct ehca_cq *__cq,
                 __cq->nr_callbacks++;
                 list_add_tail(&__cq->entry, &cct->cq_list);
                 cct->cq_jobs++;
-                wake_up(&cct->wait_queue);
+                wake_up_process(thread);
         } else
                 __cq->nr_callbacks++;
 
@@ -695,6 +699,7 @@ static void queue_comp_task(struct ehca_cq *__cq)
 {
         int cpu_id;
         struct ehca_cpu_comp_task *cct;
+        struct task_struct *thread;
         int cq_jobs;
         unsigned long flags;
 
@@ -702,7 +707,8 @@ static void queue_comp_task(struct ehca_cq *__cq)
         BUG_ON(!cpu_online(cpu_id));
 
         cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
-        BUG_ON(!cct);
+        thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu_id);
+        BUG_ON(!cct || !thread);
 
         spin_lock_irqsave(&cct->task_lock, flags);
         cq_jobs = cct->cq_jobs;
@@ -710,28 +716,25 @@ static void queue_comp_task(struct ehca_cq *__cq)
         if (cq_jobs > 0) {
                 cpu_id = find_next_online_cpu(pool);
                 cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
-                BUG_ON(!cct);
+                thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu_id);
+                BUG_ON(!cct || !thread);
         }
-
-        __queue_comp_task(__cq, cct);
+        __queue_comp_task(__cq, cct, thread);
 }
 
 static void run_comp_task(struct ehca_cpu_comp_task *cct)
 {
         struct ehca_cq *cq;
-        unsigned long flags;
-
-        spin_lock_irqsave(&cct->task_lock, flags);
 
         while (!list_empty(&cct->cq_list)) {
                 cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
-                spin_unlock_irqrestore(&cct->task_lock, flags);
+                spin_unlock_irq(&cct->task_lock);
 
                 comp_event_callback(cq);
                 if (atomic_dec_and_test(&cq->nr_events))
                         wake_up(&cq->wait_completion);
 
-                spin_lock_irqsave(&cct->task_lock, flags);
+                spin_lock_irq(&cct->task_lock);
                 spin_lock(&cq->task_lock);
                 cq->nr_callbacks--;
                 if (!cq->nr_callbacks) {
@@ -740,159 +743,76 @@ static void run_comp_task(struct ehca_cpu_comp_task *cct)
                 }
                 spin_unlock(&cq->task_lock);
         }
-
-        spin_unlock_irqrestore(&cct->task_lock, flags);
 }
 
-static int comp_task(void *__cct)
+static void comp_task_park(unsigned int cpu)
 {
-        struct ehca_cpu_comp_task *cct = __cct;
-        int cql_empty;
-        DECLARE_WAITQUEUE(wait, current);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-        while (!kthread_should_stop()) {
-                add_wait_queue(&cct->wait_queue, &wait);
-
-                spin_lock_irq(&cct->task_lock);
-                cql_empty = list_empty(&cct->cq_list);
-                spin_unlock_irq(&cct->task_lock);
-                if (cql_empty)
-                        schedule();
-                else
-                        __set_current_state(TASK_RUNNING);
-
-                remove_wait_queue(&cct->wait_queue, &wait);
+        struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+        struct ehca_cpu_comp_task *target;
+        struct task_struct *thread;
+        struct ehca_cq *cq, *tmp;
+        LIST_HEAD(list);
 
-                spin_lock_irq(&cct->task_lock);
-                cql_empty = list_empty(&cct->cq_list);
-                spin_unlock_irq(&cct->task_lock);
-                if (!cql_empty)
-                        run_comp_task(__cct);
+        spin_lock_irq(&cct->task_lock);
+        cct->cq_jobs = 0;
+        cct->active = 0;
+        list_splice_init(&cct->cq_list, &list);
+        spin_unlock_irq(&cct->task_lock);
 
-                set_current_state(TASK_INTERRUPTIBLE);
+        cpu = find_next_online_cpu(pool);
+        target = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+        thread = *per_cpu_ptr(pool->cpu_comp_threads, cpu);
+        spin_lock_irq(&target->task_lock);
+        list_for_each_entry_safe(cq, tmp, &list, entry) {
+                list_del(&cq->entry);
+                __queue_comp_task(cq, target, thread);
         }
-        __set_current_state(TASK_RUNNING);
-
-        return 0;
-}
-
-static struct task_struct *create_comp_task(struct ehca_comp_pool *pool,
-                                            int cpu)
-{
-        struct ehca_cpu_comp_task *cct;
-
-        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-        spin_lock_init(&cct->task_lock);
-        INIT_LIST_HEAD(&cct->cq_list);
-        init_waitqueue_head(&cct->wait_queue);
-        cct->task = kthread_create_on_node(comp_task, cct, cpu_to_node(cpu),
-                                           "ehca_comp/%d", cpu);
-
-        return cct->task;
+        spin_unlock_irq(&target->task_lock);
 }
 
-static void destroy_comp_task(struct ehca_comp_pool *pool,
-                              int cpu)
+static void comp_task_stop(unsigned int cpu, bool online)
 {
-        struct ehca_cpu_comp_task *cct;
-        struct task_struct *task;
-        unsigned long flags_cct;
-
-        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-
-        spin_lock_irqsave(&cct->task_lock, flags_cct);
+        struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
 
-        task = cct->task;
-        cct->task = NULL;
+        spin_lock_irq(&cct->task_lock);
         cct->cq_jobs = 0;
-
-        spin_unlock_irqrestore(&cct->task_lock, flags_cct);
-
-        if (task)
-                kthread_stop(task);
+        cct->active = 0;
+        WARN_ON(!list_empty(&cct->cq_list));
+        spin_unlock_irq(&cct->task_lock);
 }
 
-static void __cpuinit take_over_work(struct ehca_comp_pool *pool, int cpu)
+static int comp_task_should_run(unsigned int cpu)
 {
         struct ehca_cpu_comp_task *cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-        LIST_HEAD(list);
-        struct ehca_cq *cq;
-        unsigned long flags_cct;
-
-        spin_lock_irqsave(&cct->task_lock, flags_cct);
-
-        list_splice_init(&cct->cq_list, &list);
-
-        while (!list_empty(&list)) {
-                cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
-
-                list_del(&cq->entry);
-                __queue_comp_task(cq, this_cpu_ptr(pool->cpu_comp_tasks));
-        }
-
-        spin_unlock_irqrestore(&cct->task_lock, flags_cct);
 
+        return cct->cq_jobs;
 }
 
-static int __cpuinit comp_pool_callback(struct notifier_block *nfb,
-                                        unsigned long action,
-                                        void *hcpu)
+static void comp_task(unsigned int cpu)
 {
-        unsigned int cpu = (unsigned long)hcpu;
-        struct ehca_cpu_comp_task *cct;
+        struct ehca_cpu_comp_task *cct = this_cpu_ptr(pool->cpu_comp_tasks);
+        int cql_empty;
 
-        switch (action) {
-        case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_PREPARE)", cpu);
-                if (!create_comp_task(pool, cpu)) {
-                        ehca_gen_err("Can't create comp_task for cpu: %x", cpu);
-                        return notifier_from_errno(-ENOMEM);
-                }
-                break;
-        case CPU_UP_CANCELED:
-        case CPU_UP_CANCELED_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_CANCELED)", cpu);
-                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-                kthread_bind(cct->task, cpumask_any(cpu_online_mask));
-                destroy_comp_task(pool, cpu);
-                break;
-        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_ONLINE)", cpu);
-                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
-                kthread_bind(cct->task, cpu);
-                wake_up_process(cct->task);
-                break;
-        case CPU_DOWN_PREPARE:
-        case CPU_DOWN_PREPARE_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DOWN_PREPARE)", cpu);
-                break;
-        case CPU_DOWN_FAILED:
-        case CPU_DOWN_FAILED_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DOWN_FAILED)", cpu);
-                break;
-        case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
-                ehca_gen_dbg("CPU: %x (CPU_DEAD)", cpu);
-                destroy_comp_task(pool, cpu);
-                take_over_work(pool, cpu);
-                break;
+        spin_lock_irq(&cct->task_lock);
+        cql_empty = list_empty(&cct->cq_list);
+        if (!cql_empty) {
+                __set_current_state(TASK_RUNNING);
+                run_comp_task(cct);
         }
-
-        return NOTIFY_OK;
+        spin_unlock_irq(&cct->task_lock);
 }
 
-static struct notifier_block comp_pool_callback_nb __cpuinitdata = {
-        .notifier_call  = comp_pool_callback,
-        .priority       = 0,
+static struct smp_hotplug_thread comp_pool_threads = {
+        .thread_should_run      = comp_task_should_run,
+        .thread_fn              = comp_task,
+        .thread_comm            = "ehca_comp/%u",
+        .cleanup                = comp_task_stop,
+        .park                   = comp_task_park,
 };
 
 int ehca_create_comp_pool(void)
 {
-        int cpu;
-        struct task_struct *task;
+        int cpu, ret = -ENOMEM;
 
         if (!ehca_scaling_code)
                 return 0;
@@ -905,38 +825,46 @@ int ehca_create_comp_pool(void)
         pool->last_cpu = cpumask_any(cpu_online_mask);
 
         pool->cpu_comp_tasks = alloc_percpu(struct ehca_cpu_comp_task);
-        if (pool->cpu_comp_tasks == NULL) {
-                kfree(pool);
-                return -EINVAL;
-        }
+        if (!pool->cpu_comp_tasks)
+                goto out_pool;
 
-        for_each_online_cpu(cpu) {
-                task = create_comp_task(pool, cpu);
-                if (task) {
-                        kthread_bind(task, cpu);
-                        wake_up_process(task);
-                }
+        pool->cpu_comp_threads = alloc_percpu(struct task_struct *);
+        if (!pool->cpu_comp_threads)
+                goto out_tasks;
+
+        for_each_present_cpu(cpu) {
+                struct ehca_cpu_comp_task *cct;
+
+                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu);
+                spin_lock_init(&cct->task_lock);
+                INIT_LIST_HEAD(&cct->cq_list);
         }
 
-        register_hotcpu_notifier(&comp_pool_callback_nb);
+        comp_pool_threads.store = pool->cpu_comp_threads;
+        ret = smpboot_register_percpu_thread(&comp_pool_threads);
+        if (ret)
+                goto out_threads;
 
-        printk(KERN_INFO "eHCA scaling code enabled\n");
+        pr_info("eHCA scaling code enabled\n");
+        return ret;
 
-        return 0;
+out_threads:
+        free_percpu(pool->cpu_comp_threads);
+out_tasks:
+        free_percpu(pool->cpu_comp_tasks);
+out_pool:
+        kfree(pool);
+        return ret;
 }
 
 void ehca_destroy_comp_pool(void)
 {
-        int i;
-
         if (!ehca_scaling_code)
                 return;
 
-        unregister_hotcpu_notifier(&comp_pool_callback_nb);
-
-        for_each_online_cpu(i)
-                destroy_comp_task(pool, i);
+        smpboot_unregister_percpu_thread(&comp_pool_threads);
 
+        free_percpu(pool->cpu_comp_threads);
         free_percpu(pool->cpu_comp_tasks);
         kfree(pool);
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.h b/drivers/infiniband/hw/ehca/ehca_irq.h
index 3346cb06cea6..5370199f08c7 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.h
+++ b/drivers/infiniband/hw/ehca/ehca_irq.h
@@ -58,15 +58,15 @@ void ehca_tasklet_eq(unsigned long data);
 void ehca_process_eq(struct ehca_shca *shca, int is_irq);
 
 struct ehca_cpu_comp_task {
-        wait_queue_head_t wait_queue;
         struct list_head cq_list;
-        struct task_struct *task;
         spinlock_t task_lock;
         int cq_jobs;
+        int active;
 };
 
 struct ehca_comp_pool {
-        struct ehca_cpu_comp_task *cpu_comp_tasks;
+        struct ehca_cpu_comp_task __percpu *cpu_comp_tasks;
+        struct task_struct * __percpu *cpu_comp_threads;
         int last_cpu;
         spinlock_t last_cpu_lock;
 };
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index cb5b7f7d4d38..b29a4246ef41 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -2219,7 +2219,6 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
         u32 wqe_idx;
 
         if (!qp->wqe_wr_id_tbl[tail].signaled) {
-                expand = true;  /* CQE cannot be consumed yet */
                 *polled = false;    /* WC cannot be consumed yet */
         } else {
                 ibwc->status = IB_WC_SUCCESS;
@@ -2227,10 +2226,11 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
                 ibwc->qp = &qp->ibqp;
                 ocrdma_update_wc(qp, ibwc, tail);
                 *polled = true;
-                wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
-                if (tail != wqe_idx)
-                        expand = true; /* Coalesced CQE can't be consumed yet */
         }
+        wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
+        if (tail != wqe_idx)
+                expand = true; /* Coalesced CQE can't be consumed yet */
+
         ocrdma_hwq_inc_tail(&qp->sq);
         return expand;
 }
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 19f1e6c45fb6..ccb119143d20 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -471,9 +471,10 @@ static int subn_get_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                 if (port_num != port) {
                         ibp = to_iport(ibdev, port_num);
                         ret = check_mkey(ibp, smp, 0);
-                        if (ret)
+                        if (ret) {
                                 ret = IB_MAD_RESULT_FAILURE;
                                 goto bail;
+                        }
                 }
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ca43901ed861..0af216d21f87 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -262,7 +262,10 @@ struct ipoib_ethtool_st {
         u16     max_coalesced_frames;
 };
 
+struct ipoib_neigh_table;
+
 struct ipoib_neigh_hash {
+        struct ipoib_neigh_table       *ntbl;
         struct ipoib_neigh __rcu      **buckets;
         struct rcu_head                 rcu;
         u32                             mask;
@@ -271,9 +274,9 @@ struct ipoib_neigh_hash {
 
 struct ipoib_neigh_table {
         struct ipoib_neigh_hash __rcu  *htbl;
-        rwlock_t                        rwlock;
         atomic_t                        entries;
         struct completion               flushed;
+        struct completion               deleted;
 };
 
 /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 3e2085a3ee47..1e19b5ae7c47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -546,15 +546,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
         struct ipoib_neigh *neigh;
         unsigned long flags;
 
+        spin_lock_irqsave(&priv->lock, flags);
         neigh = ipoib_neigh_alloc(daddr, dev);
         if (!neigh) {
+                spin_unlock_irqrestore(&priv->lock, flags);
                 ++dev->stats.tx_dropped;
                 dev_kfree_skb_any(skb);
                 return;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         path = __path_find(dev, daddr + 4);
         if (!path) {
                 path = path_rec_create(dev, daddr + 4);
@@ -863,10 +863,10 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         if (test_bit(IPOIB_STOP_NEIGH_GC, &priv->flags))
                 return;
 
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -883,16 +883,14 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* was the neigh idle for two GC periods */
                         if (time_after(neigh_obsolete, neigh->alive)) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from path/mc list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -902,7 +900,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
         }
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_reap_neigh(struct work_struct *work)
@@ -947,10 +945,8 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         struct ipoib_neigh *neigh;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
         if (!htbl) {
                 neigh = NULL;
                 goto out_unlock;
@@ -961,10 +957,10 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
          */
         hash_val = ipoib_addr_hash(htbl, daddr);
         for (neigh = rcu_dereference_protected(htbl->buckets[hash_val],
-                                               lockdep_is_held(&ntbl->rwlock));
+                                               lockdep_is_held(&priv->lock));
              neigh != NULL;
              neigh = rcu_dereference_protected(neigh->hnext,
-                                               lockdep_is_held(&ntbl->rwlock))) {
+                                               lockdep_is_held(&priv->lock))) {
                 if (memcmp(daddr, neigh->daddr, INFINIBAND_ALEN) == 0) {
                         /* found, take one ref on behalf of the caller */
                         if (!atomic_inc_not_zero(&neigh->refcnt)) {
@@ -987,12 +983,11 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         /* put in hash */
         rcu_assign_pointer(neigh->hnext,
                            rcu_dereference_protected(htbl->buckets[hash_val],
-                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                     lockdep_is_held(&priv->lock)));
         rcu_assign_pointer(htbl->buckets[hash_val], neigh);
         atomic_inc(&ntbl->entries);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
 
         return neigh;
 }
@@ -1040,35 +1035,29 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
         struct ipoib_neigh *n;
         u32 hash_val;
 
-        write_lock_bh(&ntbl->rwlock);
-
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
-                goto out_unlock;
+                return;
 
         hash_val = ipoib_addr_hash(htbl, neigh->daddr);
         np = &htbl->buckets[hash_val];
         for (n = rcu_dereference_protected(*np,
-                                            lockdep_is_held(&ntbl->rwlock));
+                                            lockdep_is_held(&priv->lock));
              n != NULL;
              n = rcu_dereference_protected(*np,
-                                        lockdep_is_held(&ntbl->rwlock))) {
+                                        lockdep_is_held(&priv->lock))) {
                 if (n == neigh) {
                         /* found */
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
-                        goto out_unlock;
+                        return;
                 } else {
                         np = &n->hnext;
                 }
         }
-
-out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
-
 }
 
 static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
@@ -1080,7 +1069,6 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
 
         clear_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
         ntbl->htbl = NULL;
-        rwlock_init(&ntbl->rwlock);
         htbl = kzalloc(sizeof(*htbl), GFP_KERNEL);
         if (!htbl)
                 return -ENOMEM;
@@ -1095,6 +1083,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
         htbl->mask = (size - 1);
         htbl->buckets = buckets;
         ntbl->htbl = htbl;
+        htbl->ntbl = ntbl;
         atomic_set(&ntbl->entries, 0);
 
         /* start garbage collection */
@@ -1111,9 +1100,11 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
                                                     struct ipoib_neigh_hash,
                                                     rcu);
         struct ipoib_neigh __rcu **buckets = htbl->buckets;
+        struct ipoib_neigh_table *ntbl = htbl->ntbl;
 
         kfree(buckets);
         kfree(htbl);
+        complete(&ntbl->deleted);
 }
 
 void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
@@ -1125,10 +1116,10 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
         int i;
 
         /* remove all neigh connected to a given path or mcast */
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
 
         if (!htbl)
                 goto out_unlock;
@@ -1138,16 +1129,14 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                         /* delete neighs belong to this parent */
                         if (!memcmp(gid, neigh->daddr + 4, sizeof (union ib_gid))) {
                                 rcu_assign_pointer(*np,
                                                    rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                 /* remove from parent list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                 list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                 call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                         } else {
                                 np = &neigh->hnext;
@@ -1156,7 +1145,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                 }
         }
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
@@ -1164,37 +1153,44 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
         struct ipoib_neigh_table *ntbl = &priv->ntbl;
         struct ipoib_neigh_hash *htbl;
         unsigned long flags;
-        int i;
+        int i, wait_flushed = 0;
 
-        write_lock_bh(&ntbl->rwlock);
+        init_completion(&priv->ntbl.flushed);
+
+        spin_lock_irqsave(&priv->lock, flags);
 
         htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
         if (!htbl)
                 goto out_unlock;
 
+        wait_flushed = atomic_read(&priv->ntbl.entries);
+        if (!wait_flushed)
+                goto free_htbl;
+
         for (i = 0; i < htbl->size; i++) {
                 struct ipoib_neigh *neigh;
                 struct ipoib_neigh __rcu **np = &htbl->buckets[i];
 
                 while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                       lockdep_is_held(&priv->lock))) != NULL) {
                         rcu_assign_pointer(*np,
                                            rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                         /* remove from path/mc list */
-                        spin_lock_irqsave(&priv->lock, flags);
                         list_del(&neigh->list);
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                 }
         }
 
+free_htbl:
         rcu_assign_pointer(ntbl->htbl, NULL);
         call_rcu(&htbl->rcu, neigh_hash_free_rcu);
 
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        if (wait_flushed)
+                wait_for_completion(&priv->ntbl.flushed);
 }
 
 static void ipoib_neigh_hash_uninit(struct net_device *dev)
@@ -1203,7 +1199,7 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         int stopped;
 
         ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
-        init_completion(&priv->ntbl.flushed);
+        init_completion(&priv->ntbl.deleted);
         set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
 
         /* Stop GC if called at init fail need to cancel work */
@@ -1211,10 +1207,9 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         if (!stopped)
                 cancel_delayed_work(&priv->neigh_reap_task);
 
-        if (atomic_read(&priv->ntbl.entries)) {
-                ipoib_flush_neighs(priv);
-                wait_for_completion(&priv->ntbl.flushed);
-        }
+        ipoib_flush_neighs(priv);
+
+        wait_for_completion(&priv->ntbl.deleted);
 }
 
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 13f4aa7593c8..75367249f447 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -707,9 +707,7 @@ out:
                 neigh = ipoib_neigh_get(dev, daddr);
                 spin_lock_irqsave(&priv->lock, flags);
                 if (!neigh) {
-                        spin_unlock_irqrestore(&priv->lock, flags);
                         neigh = ipoib_neigh_alloc(daddr, dev);
-                        spin_lock_irqsave(&priv->lock, flags);
                         if (neigh) {
                                 kref_get(&mcast->ah->ref);
                                 neigh->ah       = mcast->ah;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 6c58bfff01a3..118d0300f1fb 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -54,16 +54,9 @@ struct evdev_client {
 static struct evdev *evdev_table[EVDEV_MINORS];
 static DEFINE_MUTEX(evdev_table_mutex);
 
-static void evdev_pass_event(struct evdev_client *client,
-                             struct input_event *event,
-                             ktime_t mono, ktime_t real)
+static void __pass_event(struct evdev_client *client,
+                         const struct input_event *event)
 {
-        event->time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
-                                        mono : real);
-
-        /* Interrupts are disabled, just acquire the lock. */
-        spin_lock(&client->buffer_lock);
-
         client->buffer[client->head++] = *event;
         client->head &= client->bufsize - 1;
 
@@ -86,42 +79,74 @@ static void evdev_pass_event(struct evdev_client *client,
                 client->packet_head = client->head;
                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
         }
+}
+
+static void evdev_pass_values(struct evdev_client *client,
+                        const struct input_value *vals, unsigned int count,
+                        ktime_t mono, ktime_t real)
+{
+        struct evdev *evdev = client->evdev;
+        const struct input_value *v;
+        struct input_event event;
+        bool wakeup = false;
+
+        event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
+                                      mono : real);
+
+        /* Interrupts are disabled, just acquire the lock. */
+        spin_lock(&client->buffer_lock);
+
+        for (v = vals; v != vals + count; v++) {
+                event.type = v->type;
+                event.code = v->code;
+                event.value = v->value;
+                __pass_event(client, &event);
+                if (v->type == EV_SYN && v->code == SYN_REPORT)
+                        wakeup = true;
+        }
 
         spin_unlock(&client->buffer_lock);
+
+        if (wakeup)
+                wake_up_interruptible(&evdev->wait);
 }
 
 /*
- * Pass incoming event to all connected clients.
+ * Pass incoming events to all connected clients.
  */
-static void evdev_event(struct input_handle *handle,
-                        unsigned int type, unsigned int code, int value)
+static void evdev_events(struct input_handle *handle,
+                         const struct input_value *vals, unsigned int count)
 {
         struct evdev *evdev = handle->private;
         struct evdev_client *client;
-        struct input_event event;
         ktime_t time_mono, time_real;
 
         time_mono = ktime_get();
         time_real = ktime_sub(time_mono, ktime_get_monotonic_offset());
 
-        event.type = type;
-        event.code = code;
-        event.value = value;
-
         rcu_read_lock();
 
         client = rcu_dereference(evdev->grab);
 
         if (client)
-                evdev_pass_event(client, &event, time_mono, time_real);
+                evdev_pass_values(client, vals, count, time_mono, time_real);
         else
                 list_for_each_entry_rcu(client, &evdev->client_list, node)
-                        evdev_pass_event(client, &event, time_mono, time_real);
+                        evdev_pass_values(client, vals, count,
+                                          time_mono, time_real);
 
         rcu_read_unlock();
+}
 
-        if (type == EV_SYN && code == SYN_REPORT)
-                wake_up_interruptible(&evdev->wait);
+/*
+ * Pass incoming event to all connected clients.
+ */
+static void evdev_event(struct input_handle *handle,
+                        unsigned int type, unsigned int code, int value)
+{
+        struct input_value vals[] = { { type, code, value } };
+
+        evdev_events(handle, vals, 1);
 }
 
 static int evdev_fasync(int fd, struct file *file, int on)
@@ -653,20 +678,22 @@ static int evdev_handle_mt_request(struct input_dev *dev,
                                    unsigned int size,
                                    int __user *ip)
 {
-        const struct input_mt_slot *mt = dev->mt;
+        const struct input_mt *mt = dev->mt;
         unsigned int code;
         int max_slots;
         int i;
 
         if (get_user(code, &ip[0]))
                 return -EFAULT;
-        if (!input_is_mt_value(code))
+        if (!mt || !input_is_mt_value(code))
                 return -EINVAL;
 
         max_slots = (size - sizeof(__u32)) / sizeof(__s32);
-        for (i = 0; i < dev->mtsize && i < max_slots; i++)
-                if (put_user(input_mt_get_value(&mt[i], code), &ip[1 + i]))
+        for (i = 0; i < mt->num_slots && i < max_slots; i++) {
+                int value = input_mt_get_value(&mt->slots[i], code);
+                if (put_user(value, &ip[1 + i]))
                         return -EFAULT;
+        }
 
         return 0;
 }
@@ -1048,6 +1075,7 @@ MODULE_DEVICE_TABLE(input, evdev_ids);
 
 static struct input_handler evdev_handler = {
         .event          = evdev_event,
+        .events         = evdev_events,
         .connect        = evdev_connect,
         .disconnect     = evdev_disconnect,
         .fops           = &evdev_fops,
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index 70a16c7da8cc..c0ec7d42c3be 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -14,6 +14,14 @@
 
 #define TRKID_SGN       ((TRKID_MAX + 1) >> 1)
 
+static void copy_abs(struct input_dev *dev, unsigned int dst, unsigned int src)
+{
+        if (dev->absinfo && test_bit(src, dev->absbit)) {
+                dev->absinfo[dst] = dev->absinfo[src];
+                dev->absbit[BIT_WORD(dst)] |= BIT_MASK(dst);
+        }
+}
+
 /**
  * input_mt_init_slots() - initialize MT input slots
  * @dev: input device supporting MT events and finger tracking
@@ -25,29 +33,63 @@
  * May be called repeatedly. Returns -EINVAL if attempting to
  * reinitialize with a different number of slots.
  */
-int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots)
+int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
+                        unsigned int flags)
 {
+        struct input_mt *mt = dev->mt;
         int i;
 
         if (!num_slots)
                 return 0;
-        if (dev->mt)
-                return dev->mtsize != num_slots ? -EINVAL : 0;
+        if (mt)
+                return mt->num_slots != num_slots ? -EINVAL : 0;
 
-        dev->mt = kcalloc(num_slots, sizeof(struct input_mt_slot), GFP_KERNEL);
-        if (!dev->mt)
-                return -ENOMEM;
+        mt = kzalloc(sizeof(*mt) + num_slots * sizeof(*mt->slots), GFP_KERNEL);
+        if (!mt)
+                goto err_mem;
 
-        dev->mtsize = num_slots;
+        mt->num_slots = num_slots;
+        mt->flags = flags;
         input_set_abs_params(dev, ABS_MT_SLOT, 0, num_slots - 1, 0, 0);
         input_set_abs_params(dev, ABS_MT_TRACKING_ID, 0, TRKID_MAX, 0, 0);
-        input_set_events_per_packet(dev, 6 * num_slots);
+
+        if (flags & (INPUT_MT_POINTER | INPUT_MT_DIRECT)) {
+                __set_bit(EV_KEY, dev->evbit);
+                __set_bit(BTN_TOUCH, dev->keybit);
+
+                copy_abs(dev, ABS_X, ABS_MT_POSITION_X);
+                copy_abs(dev, ABS_Y, ABS_MT_POSITION_Y);
+                copy_abs(dev, ABS_PRESSURE, ABS_MT_PRESSURE);
+        }
+        if (flags & INPUT_MT_POINTER) {
+                __set_bit(BTN_TOOL_FINGER, dev->keybit);
+                __set_bit(BTN_TOOL_DOUBLETAP, dev->keybit);
+                if (num_slots >= 3)
+                        __set_bit(BTN_TOOL_TRIPLETAP, dev->keybit);
+                if (num_slots >= 4)
+                        __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+                if (num_slots >= 5)
+                        __set_bit(BTN_TOOL_QUINTTAP, dev->keybit);
+                __set_bit(INPUT_PROP_POINTER, dev->propbit);
+        }
+        if (flags & INPUT_MT_DIRECT)
+                __set_bit(INPUT_PROP_DIRECT, dev->propbit);
+        if (flags & INPUT_MT_TRACK) {
+                unsigned int n2 = num_slots * num_slots;
+                mt->red = kcalloc(n2, sizeof(*mt->red), GFP_KERNEL);
+                if (!mt->red)
+                        goto err_mem;
+        }
 
         /* Mark slots as 'unused' */
         for (i = 0; i < num_slots; i++)
-                input_mt_set_value(&dev->mt[i], ABS_MT_TRACKING_ID, -1);
+                input_mt_set_value(&mt->slots[i], ABS_MT_TRACKING_ID, -1);
 
+        dev->mt = mt;
         return 0;
+err_mem:
+        kfree(mt);
+        return -ENOMEM;
 }
 EXPORT_SYMBOL(input_mt_init_slots);
 
@@ -60,11 +102,11 @@ EXPORT_SYMBOL(input_mt_init_slots);
  */
 void input_mt_destroy_slots(struct input_dev *dev)
 {
-        kfree(dev->mt);
+        if (dev->mt) {
+                kfree(dev->mt->red);
+                kfree(dev->mt);
+        }
         dev->mt = NULL;
-        dev->mtsize = 0;
-        dev->slot = 0;
-        dev->trkid = 0;
 }
 EXPORT_SYMBOL(input_mt_destroy_slots);
 
@@ -83,18 +125,24 @@ EXPORT_SYMBOL(input_mt_destroy_slots);
 void input_mt_report_slot_state(struct input_dev *dev,
                                 unsigned int tool_type, bool active)
 {
-        struct input_mt_slot *mt;
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *slot;
         int id;
 
-        if (!dev->mt || !active) {
+        if (!mt)
+                return;
+
+        slot = &mt->slots[mt->slot];
+        slot->frame = mt->frame;
+
+        if (!active) {
                 input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
                 return;
         }
 
-        mt = &dev->mt[dev->slot];
-        id = input_mt_get_value(mt, ABS_MT_TRACKING_ID);
-        if (id < 0 || input_mt_get_value(mt, ABS_MT_TOOL_TYPE) != tool_type)
-                id = input_mt_new_trkid(dev);
+        id = input_mt_get_value(slot, ABS_MT_TRACKING_ID);
+        if (id < 0 || input_mt_get_value(slot, ABS_MT_TOOL_TYPE) != tool_type)
+                id = input_mt_new_trkid(mt);
 
         input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, id);
         input_event(dev, EV_ABS, ABS_MT_TOOL_TYPE, tool_type);
@@ -135,13 +183,19 @@ EXPORT_SYMBOL(input_mt_report_finger_count);
  */
 void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count)
 {
-        struct input_mt_slot *oldest = NULL;
-        int oldid = dev->trkid;
-        int count = 0;
-        int i;
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *oldest;
+        int oldid, count, i;
+
+        if (!mt)
+                return;
+
+        oldest = 0;
+        oldid = mt->trkid;
+        count = 0;
 
-        for (i = 0; i < dev->mtsize; ++i) {
-                struct input_mt_slot *ps = &dev->mt[i];
+        for (i = 0; i < mt->num_slots; ++i) {
+                struct input_mt_slot *ps = &mt->slots[i];
                 int id = input_mt_get_value(ps, ABS_MT_TRACKING_ID);
 
                 if (id < 0)
@@ -160,13 +214,208 @@ void input_mt_report_pointer_emulation(struct input_dev *dev, bool use_count)
         if (oldest) {
                 int x = input_mt_get_value(oldest, ABS_MT_POSITION_X);
                 int y = input_mt_get_value(oldest, ABS_MT_POSITION_Y);
-                int p = input_mt_get_value(oldest, ABS_MT_PRESSURE);
 
                 input_event(dev, EV_ABS, ABS_X, x);
                 input_event(dev, EV_ABS, ABS_Y, y);
-                input_event(dev, EV_ABS, ABS_PRESSURE, p);
+
+                if (test_bit(ABS_MT_PRESSURE, dev->absbit)) {
+                        int p = input_mt_get_value(oldest, ABS_MT_PRESSURE);
+                        input_event(dev, EV_ABS, ABS_PRESSURE, p);
+                }
         } else {
-                input_event(dev, EV_ABS, ABS_PRESSURE, 0);
+                if (test_bit(ABS_MT_PRESSURE, dev->absbit))
+                        input_event(dev, EV_ABS, ABS_PRESSURE, 0);
         }
 }
 EXPORT_SYMBOL(input_mt_report_pointer_emulation);
+
+/**
+ * input_mt_sync_frame() - synchronize mt frame
+ * @dev: input device with allocated MT slots
+ *
+ * Close the frame and prepare the internal state for a new one.
+ * Depending on the flags, marks unused slots as inactive and performs
+ * pointer emulation.
+ */
+void input_mt_sync_frame(struct input_dev *dev)
+{
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *s;
+
+        if (!mt)
+                return;
+
+        if (mt->flags & INPUT_MT_DROP_UNUSED) {
+                for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                        if (s->frame == mt->frame)
+                                continue;
+                        input_mt_slot(dev, s - mt->slots);
+                        input_event(dev, EV_ABS, ABS_MT_TRACKING_ID, -1);
+                }
+        }
+
+        input_mt_report_pointer_emulation(dev, (mt->flags & INPUT_MT_POINTER));
+
+        mt->frame++;
+}
+EXPORT_SYMBOL(input_mt_sync_frame);
+
+static int adjust_dual(int *begin, int step, int *end, int eq)
+{
+        int f, *p, s, c;
+
+        if (begin == end)
+                return 0;
+
+        f = *begin;
+        p = begin + step;
+        s = p == end ? f + 1 : *p;
+
+        for (; p != end; p += step)
+                if (*p < f)
+                        s = f, f = *p;
+                else if (*p < s)
+                        s = *p;
+
+        c = (f + s + 1) / 2;
+        if (c == 0 || (c > 0 && !eq))
+                return 0;
+        if (s < 0)
+                c *= 2;
+
+        for (p = begin; p != end; p += step)
+                *p -= c;
+
+        return (c < s && s <= 0) || (f >= 0 && f < c);
+}
+
+static void find_reduced_matrix(int *w, int nr, int nc, int nrc)
+{
+        int i, k, sum;
+
+        for (k = 0; k < nrc; k++) {
+                for (i = 0; i < nr; i++)
+                        adjust_dual(w + i, nr, w + i + nrc, nr <= nc);
+                sum = 0;
+                for (i = 0; i < nrc; i += nr)
+                        sum += adjust_dual(w + i, 1, w + i + nr, nc <= nr);
+                if (!sum)
+                        break;
+        }
+}
+
+static int input_mt_set_matrix(struct input_mt *mt,
+                               const struct input_mt_pos *pos, int num_pos)
+{
+        const struct input_mt_pos *p;
+        struct input_mt_slot *s;
+        int *w = mt->red;
+        int x, y;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (!input_mt_is_active(s))
+                        continue;
+                x = input_mt_get_value(s, ABS_MT_POSITION_X);
+                y = input_mt_get_value(s, ABS_MT_POSITION_Y);
+                for (p = pos; p != pos + num_pos; p++) {
+                        int dx = x - p->x, dy = y - p->y;
+                        *w++ = dx * dx + dy * dy;
+                }
+        }
+
+        return w - mt->red;
+}
+
+static void input_mt_set_slots(struct input_mt *mt,
+                               int *slots, int num_pos)
+{
+        struct input_mt_slot *s;
+        int *w = mt->red, *p;
+
+        for (p = slots; p != slots + num_pos; p++)
+                *p = -1;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (!input_mt_is_active(s))
+                        continue;
+                for (p = slots; p != slots + num_pos; p++)
+                        if (*w++ < 0)
+                                *p = s - mt->slots;
+        }
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+                if (input_mt_is_active(s))
+                        continue;
+                for (p = slots; p != slots + num_pos; p++)
+                        if (*p < 0) {
+                                *p = s - mt->slots;
+                                break;
+                        }
+        }
+}
+
+/**
+ * input_mt_assign_slots() - perform a best-match assignment
+ * @dev: input device with allocated MT slots
+ * @slots: the slot assignment to be filled
+ * @pos: the position array to match
+ * @num_pos: number of positions
+ *
+ * Performs a best match against the current contacts and returns
+ * the slot assignment list. New contacts are assigned to unused
+ * slots.
+ *
+ * Returns zero on success, or negative error in case of failure.
+ */
+int input_mt_assign_slots(struct input_dev *dev, int *slots,
+                          const struct input_mt_pos *pos, int num_pos)
+{
+        struct input_mt *mt = dev->mt;
+        int nrc;
+
+        if (!mt || !mt->red)
+                return -ENXIO;
+        if (num_pos > mt->num_slots)
+                return -EINVAL;
+        if (num_pos < 1)
+                return 0;
+
+        nrc = input_mt_set_matrix(mt, pos, num_pos);
+        find_reduced_matrix(mt->red, num_pos, nrc / num_pos, nrc);
+        input_mt_set_slots(mt, slots, num_pos);
+
+        return 0;
+}
+EXPORT_SYMBOL(input_mt_assign_slots);
+
+/**
+ * input_mt_get_slot_by_key() - return slot matching key
+ * @dev: input device with allocated MT slots
+ * @key: the key of the sought slot
+ *
+ * Returns the slot of the given key, if it exists, otherwise
+ * set the key on the first unused slot and return.
+ *
+ * If no available slot can be found, -1 is returned.
+ */
+int input_mt_get_slot_by_key(struct input_dev *dev, int key)
+{
+        struct input_mt *mt = dev->mt;
+        struct input_mt_slot *s;
+
+        if (!mt)
+                return -1;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++)
+                if (input_mt_is_active(s) && s->key == key)
+                        return s - mt->slots;
+
+        for (s = mt->slots; s != mt->slots + mt->num_slots; s++)
+                if (!input_mt_is_active(s)) {
+                        s->key = key;
+                        return s - mt->slots;
+                }
+
+        return -1;
+}
+EXPORT_SYMBOL(input_mt_get_slot_by_key);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 8921c6180c51..5244f3d05b12 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -47,6 +47,8 @@ static DEFINE_MUTEX(input_mutex);
 
 static struct input_handler *input_table[8];
 
+static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };
+
 static inline int is_event_supported(unsigned int code,
                                      unsigned long *bm, unsigned int max)
 {
@@ -69,42 +71,102 @@ static int input_defuzz_abs_event(int value, int old_val, int fuzz)
         return value;
 }
 
+static void input_start_autorepeat(struct input_dev *dev, int code)
+{
+        if (test_bit(EV_REP, dev->evbit) &&
+            dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
+            dev->timer.data) {
+                dev->repeat_key = code;
+                mod_timer(&dev->timer,
+                          jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
+        }
+}
+
+static void input_stop_autorepeat(struct input_dev *dev)
+{
+        del_timer(&dev->timer);
+}
+
 /*
  * Pass event first through all filters and then, if event has not been
  * filtered out, through all open handles. This function is called with
  * dev->event_lock held and interrupts disabled.
  */
-static void input_pass_event(struct input_dev *dev,
-                             unsigned int type, unsigned int code, int value)
+static unsigned int input_to_handler(struct input_handle *handle,
+                        struct input_value *vals, unsigned int count)
+{
+        struct input_handler *handler = handle->handler;
+        struct input_value *end = vals;
+        struct input_value *v;
+
+        for (v = vals; v != vals + count; v++) {
+                if (handler->filter &&
+                    handler->filter(handle, v->type, v->code, v->value))
+                        continue;
+                if (end != v)
+                        *end = *v;
+                end++;
+        }
+
+        count = end - vals;
+        if (!count)
+                return 0;
+
+        if (handler->events)
+                handler->events(handle, vals, count);
+        else if (handler->event)
+                for (v = vals; v != end; v++)
+                        handler->event(handle, v->type, v->code, v->value);
+
+        return count;
+}
+
+/*
+ * Pass values first through all filters and then, if event has not been
+ * filtered out, through all open handles. This function is called with
+ * dev->event_lock held and interrupts disabled.
+ */
+static void input_pass_values(struct input_dev *dev,
+                              struct input_value *vals, unsigned int count)
 {
-        struct input_handler *handler;
         struct input_handle *handle;
+        struct input_value *v;
+
+        if (!count)
+                return;
 
         rcu_read_lock();
 
         handle = rcu_dereference(dev->grab);
-        if (handle)
-                handle->handler->event(handle, type, code, value);
-        else {
-                bool filtered = false;
-
-                list_for_each_entry_rcu(handle, &dev->h_list, d_node) {
-                        if (!handle->open)
-                                continue;
+        if (handle) {
+                count = input_to_handler(handle, vals, count);
+        } else {
+                list_for_each_entry_rcu(handle, &dev->h_list, d_node)
+                        if (handle->open)
+                                count = input_to_handler(handle, vals, count);
+        }
 
-                        handler = handle->handler;
-                        if (!handler->filter) {
-                                if (filtered)
-                                        break;
+        rcu_read_unlock();
 
-                                handler->event(handle, type, code, value);
+        add_input_randomness(vals->type, vals->code, vals->value);
 
-                        } else if (handler->filter(handle, type, code, value))
-                                filtered = true;
+        /* trigger auto repeat for key events */
+        for (v = vals; v != vals + count; v++) {
+                if (v->type == EV_KEY && v->value != 2) {
+                        if (v->value)
+                                input_start_autorepeat(dev, v->code);
+                        else
+                                input_stop_autorepeat(dev);
                 }
         }
+}
 
-        rcu_read_unlock();
+static void input_pass_event(struct input_dev *dev,
+                             unsigned int type, unsigned int code, int value)
+{
+        struct input_value vals[] = { { type, code, value } };
+
+        input_pass_values(dev, vals, ARRAY_SIZE(vals));
 }
 
 /*
@@ -121,18 +183,12 @@ static void input_repeat_key(unsigned long data)
 
         if (test_bit(dev->repeat_key, dev->key) &&
             is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
+                struct input_value vals[] =  {
+                        { EV_KEY, dev->repeat_key, 2 },
+                        input_value_sync
+                };
 
-                input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
-
-                if (dev->sync) {
-                        /*
-                         * Only send SYN_REPORT if we are not in a middle
-                         * of driver parsing a new hardware packet.
-                         * Otherwise assume that the driver will send
-                         * SYN_REPORT once it's done.
-                         */
-                        input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
-                }
+                input_pass_values(dev, vals, ARRAY_SIZE(vals));
 
                 if (dev->rep[REP_PERIOD])
                         mod_timer(&dev->timer, jiffies +
@@ -142,30 +198,17 @@ static void input_repeat_key(unsigned long data)
         spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
-static void input_start_autorepeat(struct input_dev *dev, int code)
-{
-        if (test_bit(EV_REP, dev->evbit) &&
-            dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
-            dev->timer.data) {
-                dev->repeat_key = code;
-                mod_timer(&dev->timer,
-                          jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
-        }
-}
-
-static void input_stop_autorepeat(struct input_dev *dev)
-{
-        del_timer(&dev->timer);
-}
-
 #define INPUT_IGNORE_EVENT      0
 #define INPUT_PASS_TO_HANDLERS  1
 #define INPUT_PASS_TO_DEVICE    2
+#define INPUT_SLOT              4
+#define INPUT_FLUSH             8
 #define INPUT_PASS_TO_ALL       (INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
 
 static int input_handle_abs_event(struct input_dev *dev,
                                   unsigned int code, int *pval)
 {
+        struct input_mt *mt = dev->mt;
         bool is_mt_event;
         int *pold;
 
@@ -174,8 +217,8 @@ static int input_handle_abs_event(struct input_dev *dev,
                  * "Stage" the event; we'll flush it later, when we
                  * get actual touch data.
                  */
-                if (*pval >= 0 && *pval < dev->mtsize)
-                        dev->slot = *pval;
+                if (mt && *pval >= 0 && *pval < mt->num_slots)
+                        mt->slot = *pval;
 
                 return INPUT_IGNORE_EVENT;
         }
@@ -184,9 +227,8 @@ static int input_handle_abs_event(struct input_dev *dev,
 
         if (!is_mt_event) {
                 pold = &dev->absinfo[code].value;
-        } else if (dev->mt) {
-                struct input_mt_slot *mtslot = &dev->mt[dev->slot];
-                pold = &mtslot->abs[code - ABS_MT_FIRST];
+        } else if (mt) {
+                pold = &mt->slots[mt->slot].abs[code - ABS_MT_FIRST];
         } else {
                 /*
                  * Bypass filtering for multi-touch events when
@@ -205,16 +247,16 @@ static int input_handle_abs_event(struct input_dev *dev,
         }
 
         /* Flush pending "slot" event */
-        if (is_mt_event && dev->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
-                input_abs_set_val(dev, ABS_MT_SLOT, dev->slot);
-                input_pass_event(dev, EV_ABS, ABS_MT_SLOT, dev->slot);
+        if (is_mt_event && mt && mt->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
+                input_abs_set_val(dev, ABS_MT_SLOT, mt->slot);
+                return INPUT_PASS_TO_HANDLERS | INPUT_SLOT;
         }
 
         return INPUT_PASS_TO_HANDLERS;
 }
 
-static void input_handle_event(struct input_dev *dev,
-                               unsigned int type, unsigned int code, int value)
+static int input_get_disposition(struct input_dev *dev,
+                          unsigned int type, unsigned int code, int value)
 {
         int disposition = INPUT_IGNORE_EVENT;
 
@@ -227,37 +269,34 @@ static void input_handle_event(struct input_dev *dev,
                         break;
 
                 case SYN_REPORT:
-                        if (!dev->sync) {
-                                dev->sync = true;
-                                disposition = INPUT_PASS_TO_HANDLERS;
-                        }
+                        disposition = INPUT_PASS_TO_HANDLERS | INPUT_FLUSH;
                         break;
                 case SYN_MT_REPORT:
-                        dev->sync = false;
                         disposition = INPUT_PASS_TO_HANDLERS;
                         break;
                 }
                 break;
 
         case EV_KEY:
-                if (is_event_supported(code, dev->keybit, KEY_MAX) &&
-                    !!test_bit(code, dev->key) != value) {
+                if (is_event_supported(code, dev->keybit, KEY_MAX)) {
 
-                        if (value != 2) {
-                                __change_bit(code, dev->key);
-                                if (value)
-                                        input_start_autorepeat(dev, code);
-                                else
-                                        input_stop_autorepeat(dev);
+                        /* auto-repeat bypasses state updates */
+                        if (value == 2) {
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                                break;
                         }
 
-                        disposition = INPUT_PASS_TO_HANDLERS;
+                        if (!!test_bit(code, dev->key) != !!value) {
+
+                                __change_bit(code, dev->key);
+                                disposition = INPUT_PASS_TO_HANDLERS;
+                        }
                 }
                 break;
 
         case EV_SW:
                 if (is_event_supported(code, dev->swbit, SW_MAX) &&
-                    !!test_bit(code, dev->sw) != value) {
+                    !!test_bit(code, dev->sw) != !!value) {
 
                         __change_bit(code, dev->sw);
                         disposition = INPUT_PASS_TO_HANDLERS;
@@ -284,7 +323,7 @@ static void input_handle_event(struct input_dev *dev,
 
         case EV_LED:
                 if (is_event_supported(code, dev->ledbit, LED_MAX) &&
-                    !!test_bit(code, dev->led) != value) {
+                    !!test_bit(code, dev->led) != !!value) {
 
                         __change_bit(code, dev->led);
                         disposition = INPUT_PASS_TO_ALL;
@@ -317,14 +356,48 @@ static void input_handle_event(struct input_dev *dev,
                 break;
         }
 
-        if (disposition != INPUT_IGNORE_EVENT && type != EV_SYN)
-                dev->sync = false;
+        return disposition;
+}
+
+static void input_handle_event(struct input_dev *dev,
+                               unsigned int type, unsigned int code, int value)
+{
+        int disposition;
+
+        disposition = input_get_disposition(dev, type, code, value);
 
         if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
                 dev->event(dev, type, code, value);
 
-        if (disposition & INPUT_PASS_TO_HANDLERS)
-                input_pass_event(dev, type, code, value);
+        if (!dev->vals)
+                return;
+
+        if (disposition & INPUT_PASS_TO_HANDLERS) {
+                struct input_value *v;
+
+                if (disposition & INPUT_SLOT) {
+                        v = &dev->vals[dev->num_vals++];
+                        v->type = EV_ABS;
+                        v->code = ABS_MT_SLOT;
+                        v->value = dev->mt->slot;
+                }
+
+                v = &dev->vals[dev->num_vals++];
+                v->type = type;
+                v->code = code;
+                v->value = value;
+        }
+
+        if (disposition & INPUT_FLUSH) {
+                if (dev->num_vals >= 2)
+                        input_pass_values(dev, dev->vals, dev->num_vals);
+                dev->num_vals = 0;
+        } else if (dev->num_vals >= dev->max_vals - 2) {
+                dev->vals[dev->num_vals++] = input_value_sync;
+                input_pass_values(dev, dev->vals, dev->num_vals);
+                dev->num_vals = 0;
+        }
+
 }
 
 /**
@@ -352,7 +425,6 @@ void input_event(struct input_dev *dev,
         if (is_event_supported(type, dev->evbit, EV_MAX)) {
 
                 spin_lock_irqsave(&dev->event_lock, flags);
-                add_input_randomness(type, code, value);
                 input_handle_event(dev, type, code, value);
                 spin_unlock_irqrestore(&dev->event_lock, flags);
         }
@@ -831,10 +903,12 @@ int input_set_keycode(struct input_dev *dev,
         if (test_bit(EV_KEY, dev->evbit) &&
             !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
             __test_and_clear_bit(old_keycode, dev->key)) {
+                struct input_value vals[] =  {
+                        { EV_KEY, old_keycode, 0 },
+                        input_value_sync
+                };
 
-                input_pass_event(dev, EV_KEY, old_keycode, 0);
-                if (dev->sync)
-                        input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+                input_pass_values(dev, vals, ARRAY_SIZE(vals));
         }
 
  out:
@@ -1416,6 +1490,7 @@ static void input_dev_release(struct device *device)
         input_ff_destroy(dev);
         input_mt_destroy_slots(dev);
         kfree(dev->absinfo);
+        kfree(dev->vals);
         kfree(dev);
 
         module_put(THIS_MODULE);
@@ -1751,8 +1826,8 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
         int i;
         unsigned int events;
 
-        if (dev->mtsize) {
-                mt_slots = dev->mtsize;
+        if (dev->mt) {
+                mt_slots = dev->mt->num_slots;
         } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
                 mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
                            dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
@@ -1778,6 +1853,9 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
                 if (test_bit(i, dev->relbit))
                         events++;
 
+        /* Make room for KEY and MSC events */
+        events += 7;
+
         return events;
 }
 
@@ -1816,6 +1894,7 @@ int input_register_device(struct input_dev *dev)
 {
         static atomic_t input_no = ATOMIC_INIT(0);
         struct input_handler *handler;
+        unsigned int packet_size;
         const char *path;
         int error;
 
@@ -1828,9 +1907,14 @@ int input_register_device(struct input_dev *dev)
         /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
         input_cleanse_bitmasks(dev);
 
-        if (!dev->hint_events_per_packet)
-                dev->hint_events_per_packet =
-                                input_estimate_events_per_packet(dev);
+        packet_size = input_estimate_events_per_packet(dev);
+        if (dev->hint_events_per_packet < packet_size)
+                dev->hint_events_per_packet = packet_size;
+
+        dev->max_vals = max(dev->hint_events_per_packet, packet_size) + 2;
+        dev->vals = kcalloc(dev->max_vals, sizeof(*dev->vals), GFP_KERNEL);
+        if (!dev->vals)
+                return -ENOMEM;
 
         /*
          * If delay and period are pre-set by the driver, then autorepeating
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ce68e361558c..cdc252612c0b 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -516,9 +516,9 @@ static int __devinit imx_keypad_probe(struct platform_device *pdev)
         input_set_drvdata(input_dev, keypad);
 
         /* Ensure that the keypad will stay dormant until opened */
-        clk_enable(keypad->clk);
+        clk_prepare_enable(keypad->clk);
         imx_keypad_inhibit(keypad);
-        clk_disable(keypad->clk);
+        clk_disable_unprepare(keypad->clk);
 
         error = request_irq(irq, imx_keypad_irq_handler, 0,
                             pdev->name, keypad);
diff --git a/drivers/input/misc/ab8500-ponkey.c b/drivers/input/misc/ab8500-ponkey.c
index f06231b7cab1..84ec691c05aa 100644
--- a/drivers/input/misc/ab8500-ponkey.c
+++ b/drivers/input/misc/ab8500-ponkey.c
@@ -74,8 +74,8 @@ static int __devinit ab8500_ponkey_probe(struct platform_device *pdev)
 
         ponkey->idev = input;
         ponkey->ab8500 = ab8500;
-        ponkey->irq_dbf = ab8500_irq_get_virq(ab8500, irq_dbf);
-        ponkey->irq_dbr = ab8500_irq_get_virq(ab8500, irq_dbr);
+        ponkey->irq_dbf = irq_dbf;
+        ponkey->irq_dbr = irq_dbr;
 
         input->name = "AB8500 POn(PowerOn) Key";
         input->dev.parent = &pdev->dev;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 736056897e50..6b1797503e34 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -405,7 +405,7 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                         goto exit;
                 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
                         int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
-                        input_mt_init_slots(dev, nslot);
+                        input_mt_init_slots(dev, nslot, 0);
                 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
                         input_set_events_per_packet(dev, 60);
                 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 4a1347e91bdc..cf5af1f495ec 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1620,7 +1620,7 @@ int alps_init(struct psmouse *psmouse)
         case ALPS_PROTO_V3:
         case ALPS_PROTO_V4:
                 set_bit(INPUT_PROP_SEMI_MT, dev1->propbit);
-                input_mt_init_slots(dev1, 2);
+                input_mt_init_slots(dev1, 2, 0);
                 input_set_abs_params(dev1, ABS_MT_POSITION_X, 0, ALPS_V3_X_MAX, 0, 0);
                 input_set_abs_params(dev1, ABS_MT_POSITION_Y, 0, ALPS_V3_Y_MAX, 0, 0);
 
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index d528c23e194f..3a78f235fa3e 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -40,6 +40,7 @@
 #include <linux/usb/input.h>
 #include <linux/hid.h>
 #include <linux/mutex.h>
+#include <linux/input/mt.h>
 
 #define USB_VENDOR_ID_APPLE             0x05ac
 
@@ -183,26 +184,26 @@ struct tp_finger {
         __le16 abs_y;           /* absolute y coodinate */
         __le16 rel_x;           /* relative x coodinate */
         __le16 rel_y;           /* relative y coodinate */
-        __le16 size_major;      /* finger size, major axis? */
-        __le16 size_minor;      /* finger size, minor axis? */
+        __le16 tool_major;      /* tool area, major axis */
+        __le16 tool_minor;      /* tool area, minor axis */
         __le16 orientation;     /* 16384 when point, else 15 bit angle */
-        __le16 force_major;     /* trackpad force, major axis? */
-        __le16 force_minor;     /* trackpad force, minor axis? */
+        __le16 touch_major;     /* touch area, major axis */
+        __le16 touch_minor;     /* touch area, minor axis */
         __le16 unused[3];       /* zeros */
         __le16 multi;           /* one finger: varies, more fingers: constant */
 } __attribute__((packed,aligned(2)));
 
 /* trackpad finger data size, empirically at least ten fingers */
+#define MAX_FINGERS             16
 #define SIZEOF_FINGER           sizeof(struct tp_finger)
-#define SIZEOF_ALL_FINGERS      (16 * SIZEOF_FINGER)
+#define SIZEOF_ALL_FINGERS      (MAX_FINGERS * SIZEOF_FINGER)
 #define MAX_FINGER_ORIENTATION  16384
 
 /* device-specific parameters */
 struct bcm5974_param {
-        int dim;                /* logical dimension */
-        int fuzz;               /* logical noise value */
-        int devmin;             /* device minimum reading */
-        int devmax;             /* device maximum reading */
+        int snratio;            /* signal-to-noise ratio */
+        int min;                /* device minimum reading */
+        int max;                /* device maximum reading */
 };
 
 /* device-specific configuration */
@@ -219,6 +220,7 @@ struct bcm5974_config {
         struct bcm5974_param w; /* finger width limits */
         struct bcm5974_param x; /* horizontal limits */
         struct bcm5974_param y; /* vertical limits */
+        struct bcm5974_param o; /* orientation limits */
 };
 
 /* logical device structure */
@@ -234,23 +236,16 @@ struct bcm5974 {
         struct bt_data *bt_data;        /* button transferred data */
         struct urb *tp_urb;             /* trackpad usb request block */
         u8 *tp_data;                    /* trackpad transferred data */
-        int fingers;                    /* number of fingers on trackpad */
+        const struct tp_finger *index[MAX_FINGERS];     /* finger index data */
+        struct input_mt_pos pos[MAX_FINGERS];           /* position array */
+        int slots[MAX_FINGERS];                         /* slot assignments */
 };
 
-/* logical dimensions */
-#define DIM_PRESSURE    256             /* maximum finger pressure */
-#define DIM_WIDTH       16              /* maximum finger width */
-#define DIM_X           1280            /* maximum trackpad x value */
-#define DIM_Y           800             /* maximum trackpad y value */
-
 /* logical signal quality */
 #define SN_PRESSURE     45              /* pressure signal-to-noise ratio */
-#define SN_WIDTH        100             /* width signal-to-noise ratio */
+#define SN_WIDTH        25              /* width signal-to-noise ratio */
 #define SN_COORD        250             /* coordinate signal-to-noise ratio */
-
-/* pressure thresholds */
-#define PRESSURE_LOW    (2 * DIM_PRESSURE / SN_PRESSURE)
-#define PRESSURE_HIGH   (3 * PRESSURE_LOW)
+#define SN_ORIENT       10              /* orientation signal-to-noise ratio */
 
 /* device constants */
 static const struct bcm5974_config bcm5974_config_table[] = {
@@ -261,10 +256,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 0,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4824, 5342 },
-                { DIM_Y, DIM_Y / SN_COORD, -172, 5820 }
+                { SN_PRESSURE, 0, 256 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4824, 5342 },
+                { SN_COORD, -172, 5820 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI,
@@ -273,10 +269,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 0,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 256 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4824, 4824 },
-                { DIM_Y, DIM_Y / SN_COORD, -172, 4290 }
+                { SN_PRESSURE, 0, 256 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4824, 4824 },
+                { SN_COORD, -172, 4290 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI,
@@ -285,10 +282,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4460, 5166 },
-                { DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4460, 5166 },
+                { SN_COORD, -75, 6700 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI,
@@ -297,10 +295,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI,
@@ -309,10 +308,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4616, 5112 },
-                { DIM_Y, DIM_Y / SN_COORD, -142, 5234 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4616, 5112 },
+                { SN_COORD, -142, 5234 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI,
@@ -321,10 +321,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4415, 5050 },
-                { DIM_Y, DIM_Y / SN_COORD, -55, 6680 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4415, 5050 },
+                { SN_COORD, -55, 6680 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI,
@@ -333,10 +334,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI,
@@ -345,10 +347,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4750, 5280 },
+                { SN_COORD, -150, 6730 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI,
@@ -357,10 +360,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4620, 5140 },
+                { SN_COORD, -150, 6600 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {
                 USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI,
@@ -369,10 +373,11 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
                 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
-                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
-                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
-                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
-                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4750, 5280 },
+                { SN_COORD, -150, 6730 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
         {}
 };
@@ -396,18 +401,11 @@ static inline int raw2int(__le16 x)
         return (signed short)le16_to_cpu(x);
 }
 
-/* scale device data to logical dimensions (asserts devmin < devmax) */
-static inline int int2scale(const struct bcm5974_param *p, int x)
-{
-        return x * p->dim / (p->devmax - p->devmin);
-}
-
-/* all logical value ranges are [0,dim). */
-static inline int int2bound(const struct bcm5974_param *p, int x)
+static void set_abs(struct input_dev *input, unsigned int code,
+                    const struct bcm5974_param *p)
 {
-        int s = int2scale(p, x);
-
-        return clamp_val(s, 0, p->dim - 1);
+        int fuzz = p->snratio ? (p->max - p->min) / p->snratio : 0;
+        input_set_abs_params(input, code, p->min, p->max, fuzz, 0);
 }
 
 /* setup which logical events to report */
@@ -416,48 +414,30 @@ static void setup_events_to_report(struct input_dev *input_dev,
 {
         __set_bit(EV_ABS, input_dev->evbit);
 
-        input_set_abs_params(input_dev, ABS_PRESSURE,
-                                0, cfg->p.dim, cfg->p.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_TOOL_WIDTH,
-                                0, cfg->w.dim, cfg->w.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_X,
-                                0, cfg->x.dim, cfg->x.fuzz, 0);
-        input_set_abs_params(input_dev, ABS_Y,
-                                0, cfg->y.dim, cfg->y.fuzz, 0);
+        /* for synaptics only */
+        input_set_abs_params(input_dev, ABS_PRESSURE, 0, 256, 5, 0);
+        input_set_abs_params(input_dev, ABS_TOOL_WIDTH, 0, 16, 0, 0);
 
         /* finger touch area */
-        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_TOUCH_MAJOR, &cfg->w);
+        set_abs(input_dev, ABS_MT_TOUCH_MINOR, &cfg->w);
         /* finger approach area */
-        input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR,
-                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_WIDTH_MAJOR, &cfg->w);
+        set_abs(input_dev, ABS_MT_WIDTH_MINOR, &cfg->w);
         /* finger orientation */
-        input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
-                             -MAX_FINGER_ORIENTATION,
-                             MAX_FINGER_ORIENTATION, 0, 0);
+        set_abs(input_dev, ABS_MT_ORIENTATION, &cfg->o);
         /* finger position */
-        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
-                             cfg->x.devmin, cfg->x.devmax, 0, 0);
-        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
-                             cfg->y.devmin, cfg->y.devmax, 0, 0);
+        set_abs(input_dev, ABS_MT_POSITION_X, &cfg->x);
+        set_abs(input_dev, ABS_MT_POSITION_Y, &cfg->y);
 
         __set_bit(EV_KEY, input_dev->evbit);
-        __set_bit(BTN_TOUCH, input_dev->keybit);
-        __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
-        __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
-        __set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
-        __set_bit(BTN_TOOL_QUADTAP, input_dev->keybit);
         __set_bit(BTN_LEFT, input_dev->keybit);
 
-        __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
         if (cfg->caps & HAS_INTEGRATED_BUTTON)
                 __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
 
-        input_set_events_per_packet(input_dev, 60);
+        input_mt_init_slots(input_dev, MAX_FINGERS,
+                INPUT_MT_POINTER | INPUT_MT_DROP_UNUSED | INPUT_MT_TRACK);
 }
 
 /* report button data as logical button state */
@@ -477,24 +457,44 @@ static int report_bt_state(struct bcm5974 *dev, int size)
         return 0;
 }
 
-static void report_finger_data(struct input_dev *input,
-                               const struct bcm5974_config *cfg,
+static void report_finger_data(struct input_dev *input, int slot,
+                               const struct input_mt_pos *pos,
                                const struct tp_finger *f)
 {
+        input_mt_slot(input, slot);
+        input_mt_report_slot_state(input, MT_TOOL_FINGER, true);
+
         input_report_abs(input, ABS_MT_TOUCH_MAJOR,
-                         raw2int(f->force_major) << 1);
+                         raw2int(f->touch_major) << 1);
         input_report_abs(input, ABS_MT_TOUCH_MINOR,
-                         raw2int(f->force_minor) << 1);
+                         raw2int(f->touch_minor) << 1);
         input_report_abs(input, ABS_MT_WIDTH_MAJOR,
-                         raw2int(f->size_major) << 1);
+                         raw2int(f->tool_major) << 1);
         input_report_abs(input, ABS_MT_WIDTH_MINOR,
-                         raw2int(f->size_minor) << 1);
+                         raw2int(f->tool_minor) << 1);
         input_report_abs(input, ABS_MT_ORIENTATION,
                          MAX_FINGER_ORIENTATION - raw2int(f->orientation));
-        input_report_abs(input, ABS_MT_POSITION_X, raw2int(f->abs_x));
-        input_report_abs(input, ABS_MT_POSITION_Y,
-                         cfg->y.devmin + cfg->y.devmax - raw2int(f->abs_y));
-        input_mt_sync(input);
+        input_report_abs(input, ABS_MT_POSITION_X, pos->x);
+        input_report_abs(input, ABS_MT_POSITION_Y, pos->y);
+}
+
+static void report_synaptics_data(struct input_dev *input,
+                                  const struct bcm5974_config *cfg,
+                                  const struct tp_finger *f, int raw_n)
+{
+        int abs_p = 0, abs_w = 0;
+
+        if (raw_n) {
+                int p = raw2int(f->touch_major);
+                int w = raw2int(f->tool_major);
+                if (p > 0 && raw2int(f->origin)) {
+                        abs_p = clamp_val(256 * p / cfg->p.max, 0, 255);
+                        abs_w = clamp_val(16 * w / cfg->w.max, 0, 15);
+                }
+        }
+
+        input_report_abs(input, ABS_PRESSURE, abs_p);
+        input_report_abs(input, ABS_TOOL_WIDTH, abs_w);
 }
 
 /* report trackpad data as logical trackpad state */
@@ -503,9 +503,7 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         const struct bcm5974_config *c = &dev->cfg;
         const struct tp_finger *f;
         struct input_dev *input = dev->input;
-        int raw_p, raw_w, raw_x, raw_y, raw_n, i;
-        int ptest, origin, ibt = 0, nmin = 0, nmax = 0;
-        int abs_p = 0, abs_w = 0, abs_x = 0, abs_y = 0;
+        int raw_n, i, n = 0;
 
         if (size < c->tp_offset || (size - c->tp_offset) % SIZEOF_FINGER != 0)
                 return -EIO;
@@ -514,76 +512,29 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         f = (const struct tp_finger *)(dev->tp_data + c->tp_offset);
         raw_n = (size - c->tp_offset) / SIZEOF_FINGER;
 
-        /* always track the first finger; when detached, start over */
-        if (raw_n) {
-
-                /* report raw trackpad data */
-                for (i = 0; i < raw_n; i++)
-                        report_finger_data(input, c, &f[i]);
-
-                raw_p = raw2int(f->force_major);
-                raw_w = raw2int(f->size_major);
-                raw_x = raw2int(f->abs_x);
-                raw_y = raw2int(f->abs_y);
-
-                dprintk(9,
-                        "bcm5974: "
-                        "raw: p: %+05d w: %+05d x: %+05d y: %+05d n: %d\n",
-                        raw_p, raw_w, raw_x, raw_y, raw_n);
-
-                ptest = int2bound(&c->p, raw_p);
-                origin = raw2int(f->origin);
-
-                /* while tracking finger still valid, count all fingers */
-                if (ptest > PRESSURE_LOW && origin) {
-                        abs_p = ptest;
-                        abs_w = int2bound(&c->w, raw_w);
-                        abs_x = int2bound(&c->x, raw_x - c->x.devmin);
-                        abs_y = int2bound(&c->y, c->y.devmax - raw_y);
-                        while (raw_n--) {
-                                ptest = int2bound(&c->p,
-                                                  raw2int(f->force_major));
-                                if (ptest > PRESSURE_LOW)
-                                        nmax++;
-                                if (ptest > PRESSURE_HIGH)
-                                        nmin++;
-                                f++;
-                        }
-                }
+        for (i = 0; i < raw_n; i++) {
+                if (raw2int(f[i].touch_major) == 0)
+                        continue;
+                dev->pos[n].x = raw2int(f[i].abs_x);
+                dev->pos[n].y = c->y.min + c->y.max - raw2int(f[i].abs_y);
+                dev->index[n++] = &f[i];
         }
 
-        /* set the integrated button if applicable */
-        if (c->tp_type == TYPE2)
-                ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
-
-        if (dev->fingers < nmin)
-                dev->fingers = nmin;
-        if (dev->fingers > nmax)
-                dev->fingers = nmax;
-
-        input_report_key(input, BTN_TOUCH, dev->fingers > 0);
-        input_report_key(input, BTN_TOOL_FINGER, dev->fingers == 1);
-        input_report_key(input, BTN_TOOL_DOUBLETAP, dev->fingers == 2);
-        input_report_key(input, BTN_TOOL_TRIPLETAP, dev->fingers == 3);
-        input_report_key(input, BTN_TOOL_QUADTAP, dev->fingers > 3);
-
-        input_report_abs(input, ABS_PRESSURE, abs_p);
-        input_report_abs(input, ABS_TOOL_WIDTH, abs_w);
+        input_mt_assign_slots(input, dev->slots, dev->pos, n);
 
-        if (abs_p) {
-                input_report_abs(input, ABS_X, abs_x);
-                input_report_abs(input, ABS_Y, abs_y);
+        for (i = 0; i < n; i++)
+                report_finger_data(input, dev->slots[i],
+                                   &dev->pos[i], dev->index[i]);
 
-                dprintk(8,
-                        "bcm5974: abs: p: %+05d w: %+05d x: %+05d y: %+05d "
-                        "nmin: %d nmax: %d n: %d ibt: %d\n", abs_p, abs_w,
-                        abs_x, abs_y, nmin, nmax, dev->fingers, ibt);
+        input_mt_sync_frame(input);
 
-        }
+        report_synaptics_data(input, c, f, raw_n);
 
         /* type 2 reports button events via ibt only */
-        if (c->tp_type == TYPE2)
+        if (c->tp_type == TYPE2) {
+                int ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
                 input_report_key(input, BTN_LEFT, ibt);
+        }
 
         input_sync(input);
 
@@ -742,9 +693,11 @@ static int bcm5974_start_traffic(struct bcm5974 *dev)
                 goto err_out;
         }
 
-        error = usb_submit_urb(dev->bt_urb, GFP_KERNEL);
-        if (error)
-                goto err_reset_mode;
+        if (dev->bt_urb) {
+                error = usb_submit_urb(dev->bt_urb, GFP_KERNEL);
+                if (error)
+                        goto err_reset_mode;
+        }
 
         error = usb_submit_urb(dev->tp_urb, GFP_KERNEL);
         if (error)
@@ -868,19 +821,23 @@ static int bcm5974_probe(struct usb_interface *iface,
         mutex_init(&dev->pm_mutex);
 
         /* setup urbs */
-        dev->bt_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!dev->bt_urb)
-                goto err_free_devs;
+        if (cfg->tp_type == TYPE1) {
+                dev->bt_urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (!dev->bt_urb)
+                        goto err_free_devs;
+        }
 
         dev->tp_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->tp_urb)
                 goto err_free_bt_urb;
 
-        dev->bt_data = usb_alloc_coherent(dev->udev,
+        if (dev->bt_urb) {
+                dev->bt_data = usb_alloc_coherent(dev->udev,
                                           dev->cfg.bt_datalen, GFP_KERNEL,
                                           &dev->bt_urb->transfer_dma);
-        if (!dev->bt_data)
-                goto err_free_urb;
+                if (!dev->bt_data)
+                        goto err_free_urb;
+        }
 
         dev->tp_data = usb_alloc_coherent(dev->udev,
                                           dev->cfg.tp_datalen, GFP_KERNEL,
@@ -888,10 +845,11 @@ static int bcm5974_probe(struct usb_interface *iface,
         if (!dev->tp_data)
                 goto err_free_bt_buffer;
 
-        usb_fill_int_urb(dev->bt_urb, udev,
-                         usb_rcvintpipe(udev, cfg->bt_ep),
-                         dev->bt_data, dev->cfg.bt_datalen,
-                         bcm5974_irq_button, dev, 1);
+        if (dev->bt_urb)
+                usb_fill_int_urb(dev->bt_urb, udev,
+                                 usb_rcvintpipe(udev, cfg->bt_ep),
+                                 dev->bt_data, dev->cfg.bt_datalen,
+                                 bcm5974_irq_button, dev, 1);
 
         usb_fill_int_urb(dev->tp_urb, udev,
                          usb_rcvintpipe(udev, cfg->tp_ep),
@@ -929,8 +887,9 @@ err_free_buffer:
         usb_free_coherent(dev->udev, dev->cfg.tp_datalen,
                 dev->tp_data, dev->tp_urb->transfer_dma);
 err_free_bt_buffer:
-        usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
-                dev->bt_data, dev->bt_urb->transfer_dma);
+        if (dev->bt_urb)
+                usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
+                                  dev->bt_data, dev->bt_urb->transfer_dma);
 err_free_urb:
         usb_free_urb(dev->tp_urb);
 err_free_bt_urb:
@@ -951,8 +910,9 @@ static void bcm5974_disconnect(struct usb_interface *iface)
         input_unregister_device(dev->input);
         usb_free_coherent(dev->udev, dev->cfg.tp_datalen,
                           dev->tp_data, dev->tp_urb->transfer_dma);
-        usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
-                          dev->bt_data, dev->bt_urb->transfer_dma);
+        if (dev->bt_urb)
+                usb_free_coherent(dev->udev, dev->cfg.bt_datalen,
+                                  dev->bt_data, dev->bt_urb->transfer_dma);
         usb_free_urb(dev->tp_urb);
         usb_free_urb(dev->bt_urb);
         kfree(dev);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 479011004a11..1e8e42fb03a4 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1004,7 +1004,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                         input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
                                              ETP_WMAX_V2, 0, 0);
                 }
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
                 break;
@@ -1035,7 +1035,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                 input_set_abs_params(dev, ABS_TOOL_WIDTH, ETP_WMIN_V2,
                                      ETP_WMAX_V2, 0, 0);
                 /* Multitouch capable pad, up to 5 fingers. */
-                input_mt_init_slots(dev, ETP_MAX_FINGERS);
+                input_mt_init_slots(dev, ETP_MAX_FINGERS, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
                 input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 3f5649f19082..e582922bacf7 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -721,6 +721,17 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
 
         switch (psmouse->packet[0] >> FSP_PKT_TYPE_SHIFT) {
         case FSP_PKT_TYPE_ABS:
+
+                if ((packet[0] == 0x48 || packet[0] == 0x49) &&
+                    packet[1] == 0 && packet[2] == 0) {
+                        /*
+                         * Ignore coordinate noise when finger leaving the
+                         * surface, otherwise cursor may jump to upper-left
+                         * corner.
+                         */
+                        packet[3] &= 0xf0;
+                }
+
                 abs_x = GET_ABS_X(packet);
                 abs_y = GET_ABS_Y(packet);
 
@@ -960,7 +971,7 @@ static int fsp_set_input_params(struct psmouse *psmouse)
 
                 input_set_abs_params(dev, ABS_X, 0, abs_x, 0, 0);
                 input_set_abs_params(dev, ABS_Y, 0, abs_y, 0, 0);
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, 0, abs_x, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, 0, abs_y, 0, 0);
         }
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 14eaecea2b70..37033ade79d3 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1232,7 +1232,7 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
         input_set_abs_params(dev, ABS_PRESSURE, 0, 255, 0, 0);
 
         if (SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) {
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 set_abs_position_params(dev, priv, ABS_MT_POSITION_X,
                                         ABS_MT_POSITION_Y);
                 /* Image sensors can report per-contact pressure */
@@ -1244,7 +1244,7 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
         } else if (SYN_CAP_ADV_GESTURE(priv->ext_cap_0c)) {
                 /* Non-image sensors with AGM use semi-mt */
                 __set_bit(INPUT_PROP_SEMI_MT, dev->propbit);
-                input_mt_init_slots(dev, 2);
+                input_mt_init_slots(dev, 2, 0);
                 set_abs_position_params(dev, priv, ABS_MT_POSITION_X,
                                         ABS_MT_POSITION_Y);
         }
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 2ffd110bd5bc..2e77246c2e5a 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -72,7 +72,7 @@ static int amba_kmi_open(struct serio *io)
         unsigned int divisor;
         int ret;
 
-        ret = clk_enable(kmi->clk);
+        ret = clk_prepare_enable(kmi->clk);
         if (ret)
                 goto out;
 
@@ -92,7 +92,7 @@ static int amba_kmi_open(struct serio *io)
         return 0;
 
  clk_disable:
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
  out:
         return ret;
 }
@@ -104,7 +104,7 @@ static void amba_kmi_close(struct serio *io)
         writeb(0, KMICR);
 
         free_irq(kmi->irq, kmi);
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
 }
 
 static int __devinit amba_kmi_probe(struct amba_device *dev,
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 6918773ce024..d6cc77a53c7e 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
         },
         {
                 .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
                 },
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 532d067a9e07..2a81ce375f75 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1530,7 +1530,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                         __set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
                         __set_bit(BTN_TOOL_QUADTAP, input_dev->keybit);
 
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
 
                         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                                              0, 255, 0, 0);
@@ -1575,7 +1575,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
         case TABLETPC2FG:
                 if (features->device_type == BTN_TOOL_FINGER) {
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
                         input_set_abs_params(input_dev, ABS_MT_TOOL_TYPE,
                                         0, MT_TOOL_MAX, 0, 0);
                         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
@@ -1631,7 +1631,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
 
                         __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
                         __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
-                        input_mt_init_slots(input_dev, features->touch_max);
+                        input_mt_init_slots(input_dev, features->touch_max, 0);
 
                         if (features->pktlen == WACOM_PKGLEN_BBTOUCH3) {
                                 __set_bit(BTN_TOOL_TRIPLETAP,
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 4623cc69fc60..e92615d0b1b0 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1152,7 +1152,7 @@ static int __devinit mxt_probe(struct i2c_client *client,
 
         /* For multi touch */
         num_mt_slots = data->T9_reportid_max - data->T9_reportid_min + 1;
-        error = input_mt_init_slots(input_dev, num_mt_slots);
+        error = input_mt_init_slots(input_dev, num_mt_slots, 0);
         if (error)
                 goto err_free_object;
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c
index f030d9ec795d..8e60437ac85b 100644
--- a/drivers/input/touchscreen/cyttsp_core.c
+++ b/drivers/input/touchscreen/cyttsp_core.c
@@ -571,7 +571,7 @@ struct cyttsp *cyttsp_probe(const struct cyttsp_bus_ops *bus_ops,
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                              0, CY_MAXZ, 0, 0);
 
-        input_mt_init_slots(input_dev, CY_MAX_ID);
+        input_mt_init_slots(input_dev, CY_MAX_ID, 0);
 
         error = request_threaded_irq(ts->irq, NULL, cyttsp_irq,
                                      IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index b06a5e3a665e..099d144ab7c9 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -566,9 +566,12 @@ static ssize_t edt_ft5x06_debugfs_raw_data_read(struct file *file,
         }
 
         read = min_t(size_t, count, tsdata->raw_bufsize - *off);
-        error = copy_to_user(buf, tsdata->raw_buffer + *off, read);
-        if (!error)
-                *off += read;
+        if (copy_to_user(buf, tsdata->raw_buffer + *off, read)) {
+                error = -EFAULT;
+                goto out;
+        }
+
+        *off += read;
 out:
         mutex_unlock(&tsdata->mutex);
         return error ?: read;
@@ -779,7 +782,7 @@ static int __devinit edt_ft5x06_ts_probe(struct i2c_client *client,
                              0, tsdata->num_x * 64 - 1, 0, 0);
         input_set_abs_params(input, ABS_MT_POSITION_Y,
                              0, tsdata->num_y * 64 - 1, 0, 0);
-        error = input_mt_init_slots(input, MAX_SUPPORT_POINTS);
+        error = input_mt_init_slots(input, MAX_SUPPORT_POINTS, 0);
         if (error) {
                 dev_err(&client->dev, "Unable to init MT slots.\n");
                 goto err_free_mem;
diff --git a/drivers/input/touchscreen/egalax_ts.c b/drivers/input/touchscreen/egalax_ts.c
index 70524dd34f42..c1e3460f1195 100644
--- a/drivers/input/touchscreen/egalax_ts.c
+++ b/drivers/input/touchscreen/egalax_ts.c
@@ -204,7 +204,7 @@ static int __devinit egalax_ts_probe(struct i2c_client *client,
                              ABS_MT_POSITION_X, 0, EGALAX_MAX_X, 0, 0);
         input_set_abs_params(input_dev,
                              ABS_MT_POSITION_X, 0, EGALAX_MAX_Y, 0, 0);
-        input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS);
+        input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS, 0);
 
         input_set_drvdata(input_dev, ts);
 
diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index c0044175a921..4ac69760ec08 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -252,7 +252,7 @@ static int __devinit ili210x_i2c_probe(struct i2c_client *client,
         input_set_abs_params(input, ABS_Y, 0, ymax, 0, 0);
 
         /* Multi touch */
-        input_mt_init_slots(input, MAX_TOUCHES);
+        input_mt_init_slots(input, MAX_TOUCHES, 0);
         input_set_abs_params(input, ABS_MT_POSITION_X, 0, xmax, 0, 0);
         input_set_abs_params(input, ABS_MT_POSITION_Y, 0, ymax, 0, 0);
 
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 49c44bbf548d..560cf09d1c5a 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -404,7 +404,7 @@ static int __devinit mms114_probe(struct i2c_client *client,
         input_set_abs_params(input_dev, ABS_Y, 0, data->pdata->y_size, 0, 0);
 
         /* For multi touch */
-        input_mt_init_slots(input_dev, MMS114_MAX_TOUCH);
+        input_mt_init_slots(input_dev, MMS114_MAX_TOUCH, 0);
         input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
                              0, MMS114_MAX_AREA, 0, 0);
         input_set_abs_params(input_dev, ABS_MT_POSITION_X,
diff --git a/drivers/input/touchscreen/penmount.c b/drivers/input/touchscreen/penmount.c
index 4ccde45b9da2..b49f0b836925 100644
--- a/drivers/input/touchscreen/penmount.c
+++ b/drivers/input/touchscreen/penmount.c
@@ -264,7 +264,7 @@ static int pm_connect(struct serio *serio, struct serio_driver *drv)
         input_set_abs_params(pm->dev, ABS_Y, 0, max_y, 0, 0);
 
         if (pm->maxcontacts > 1) {
-                input_mt_init_slots(pm->dev, pm->maxcontacts);
+                input_mt_init_slots(pm->dev, pm->maxcontacts, 0);
                 input_set_abs_params(pm->dev,
                                      ABS_MT_POSITION_X, 0, max_x, 0, 0);
                 input_set_abs_params(pm->dev,
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index e32709e0dd65..721fdb3597ca 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -304,6 +304,45 @@ static int e2i_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 #define EGALAX_PKT_TYPE_REPT            0x80
 #define EGALAX_PKT_TYPE_DIAG            0x0A
 
+static int egalax_init(struct usbtouch_usb *usbtouch)
+{
+        int ret, i;
+        unsigned char *buf;
+        struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
+
+        /*
+         * An eGalax diagnostic packet kicks the device into using the right
+         * protocol.  We send a "check active" packet.  The response will be
+         * read later and ignored.
+         */
+
+        buf = kmalloc(3, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = EGALAX_PKT_TYPE_DIAG;
+        buf[1] = 1;     /* length */
+        buf[2] = 'A';   /* command - check active */
+
+        for (i = 0; i < 3; i++) {
+                ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                      0,
+                                      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                      0, 0, buf, 3,
+                                      USB_CTRL_SET_TIMEOUT);
+                if (ret >= 0) {
+                        ret = 0;
+                        break;
+                }
+                if (ret != -EPIPE)
+                        break;
+        }
+
+        kfree(buf);
+
+        return ret;
+}
+
 static int egalax_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
         if ((pkt[0] & EGALAX_PKT_TYPE_MASK) != EGALAX_PKT_TYPE_REPT)
@@ -1056,6 +1095,7 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
                 .process_pkt    = usbtouch_process_multi,
                 .get_pkt_len    = egalax_get_pkt_len,
                 .read_data      = egalax_read_data,
+                .init           = egalax_init,
         },
 #endif
 
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 8f9ad2f893b8..9a83be6b6584 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -471,7 +471,7 @@ static int w8001_setup(struct w8001 *w8001)
                 case 5:
                         w8001->pktlen = W8001_PKTLEN_TOUCH2FG;
 
-                        input_mt_init_slots(dev, 2);
+                        input_mt_init_slots(dev, 2, 0);
                         input_set_abs_params(dev, ABS_MT_POSITION_X,
                                                 0, touch.x, 0, 0);
                         input_set_abs_params(dev, ABS_MT_POSITION_Y,
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index b64502dfa9f4..e89daf1b21b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -266,7 +266,7 @@ static void swap_pci_ref(struct pci_dev **from, struct pci_dev *to)
 
 static int iommu_init_device(struct device *dev)
 {
-        struct pci_dev *dma_pdev, *pdev = to_pci_dev(dev);
+        struct pci_dev *dma_pdev = NULL, *pdev = to_pci_dev(dev);
         struct iommu_dev_data *dev_data;
         struct iommu_group *group;
         u16 alias;
@@ -293,7 +293,9 @@ static int iommu_init_device(struct device *dev)
                 dev_data->alias_data = alias_data;
 
                 dma_pdev = pci_get_bus_and_slot(alias >> 8, alias & 0xff);
-        } else
+        }
+
+        if (dma_pdev == NULL)
                 dma_pdev = pci_dev_get(pdev);
 
         /* Account for quirked devices */
diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index fa6ca4733725..dceaec821b0e 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&fc->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modehdlc(bch, ISDN_P_NONE);
                 spin_unlock_irqrestore(&fc->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 5e402cf2e795..f02794203bb1 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5059,6 +5059,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
                                 printk(KERN_INFO
                                        "HFC-E1 #%d has overlapping B-channels on fragment #%d\n",
                                        E1_cnt + 1, pt);
+                                kfree(hc);
                                 return -EINVAL;
                         }
                         maskcheck |= hc->bmask[pt];
@@ -5086,6 +5087,7 @@ hfcmulti_init(struct hm_map *m, struct pci_dev *pdev,
         if ((poll >> 1) > sizeof(hc->silence_data)) {
                 printk(KERN_ERR "HFCMULTI error: silence_data too small, "
                        "please fix\n");
+                kfree(hc);
                 return -EINVAL;
         }
         for (i = 0; i < (poll >> 1); i++)
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index 752e0825591f..ccd7d851be26 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(hx->ip->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 hscx_mode(hx, ISDN_P_NONE);
                 spin_unlock_irqrestore(hx->ip->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index be5973ded6d6..182ecf0626c2 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(ich->is->hwlock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 modeisar(ich, ISDN_P_NONE);
                 spin_unlock_irqrestore(ich->is->hwlock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index c3e3e7686273..9bcade59eb73 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 mode_tiger(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
index 26a86b846099..335fe6455002 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
         switch (cmd) {
         case CLOSE_CHANNEL:
                 test_and_clear_bit(FLG_OPEN, &bch->Flags);
+                cancel_work_sync(&bch->workq);
                 spin_lock_irqsave(&card->lock, flags);
-                mISDN_freebchannel(bch);
+                mISDN_clear_bchannel(bch);
                 w6692_mode(bc, ISDN_P_NONE);
                 spin_unlock_irqrestore(&card->lock, flags);
                 ch->protocol = ISDN_P_NONE;
diff --git a/drivers/isdn/mISDN/hwchannel.c b/drivers/isdn/mISDN/hwchannel.c
index ef34fd40867c..2602be23f341 100644
--- a/drivers/isdn/mISDN/hwchannel.c
+++ b/drivers/isdn/mISDN/hwchannel.c
@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch)
         ch->next_minlen = ch->init_minlen;
         ch->maxlen = ch->init_maxlen;
         ch->next_maxlen = ch->init_maxlen;
+        skb_queue_purge(&ch->rqueue);
+        ch->rcount = 0;
 }
 EXPORT_SYMBOL(mISDN_clear_bchannel);
 
-int
+void
 mISDN_freebchannel(struct bchannel *ch)
 {
+        cancel_work_sync(&ch->workq);
         mISDN_clear_bchannel(ch);
-        skb_queue_purge(&ch->rqueue);
-        ch->rcount = 0;
-        flush_work_sync(&ch->workq);
-        return 0;
 }
 EXPORT_SYMBOL(mISDN_freebchannel);
 
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 39809035320a..4af12e1844d5 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -203,8 +203,8 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
          * we set it now, so we can trap and pass that trap to the Guest if it
          * uses the FPU.
          */
-        if (cpu->ts)
-                unlazy_fpu(current);
+        if (cpu->ts && user_has_fpu())
+                stts();
 
         /*
          * SYSENTER is an optimized way of doing system calls.  We can't allow
@@ -234,6 +234,10 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
          if (boot_cpu_has(X86_FEATURE_SEP))
                 wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
 
+        /* Clear the host TS bit if it was set above. */
+        if (cpu->ts && user_has_fpu())
+                clts();
+
         /*
          * If the Guest page faulted, then the cr2 register will tell us the
          * bad virtual address.  We have to grab this now, because once we
@@ -249,7 +253,7 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
          * a different CPU. So all the critical stuff should be done
          * before this.
          */
-        else if (cpu->regs->trapnum == 7)
+        else if (cpu->regs->trapnum == 7 && !user_has_fpu())
                 math_state_restore();
 }
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index d8abb90a6c2f..034233eefc82 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1555,6 +1555,7 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                            unsigned long arg)
 {
         struct multipath *m = ti->private;
+        struct pgpath *pgpath;
         struct block_device *bdev;
         fmode_t mode;
         unsigned long flags;
@@ -1570,12 +1571,14 @@ again:
         if (!m->current_pgpath)
                 __choose_pgpath(m, 0);
 
-        if (m->current_pgpath) {
-                bdev = m->current_pgpath->path.dev->bdev;
-                mode = m->current_pgpath->path.dev->mode;
+        pgpath = m->current_pgpath;
+
+        if (pgpath) {
+                bdev = pgpath->path.dev->bdev;
+                mode = pgpath->path.dev->mode;
         }
 
-        if (m->queue_io)
+        if ((pgpath && m->queue_io) || (!pgpath && m->queue_if_no_path))
                 r = -EAGAIN;
         else if (!bdev)
                 r = -EIO;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index f90069029aae..100368eb7991 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1212,6 +1212,41 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
         return &t->targets[(KEYS_PER_NODE * n) + k];
 }
 
+static int count_device(struct dm_target *ti, struct dm_dev *dev,
+                        sector_t start, sector_t len, void *data)
+{
+        unsigned *num_devices = data;
+
+        (*num_devices)++;
+
+        return 0;
+}
+
+/*
+ * Check whether a table has no data devices attached using each
+ * target's iterate_devices method.
+ * Returns false if the result is unknown because a target doesn't
+ * support iterate_devices.
+ */
+bool dm_table_has_no_data_devices(struct dm_table *table)
+{
+        struct dm_target *uninitialized_var(ti);
+        unsigned i = 0, num_devices = 0;
+
+        while (i < dm_table_get_num_targets(table)) {
+                ti = dm_table_get_target(table, i++);
+
+                if (!ti->type->iterate_devices)
+                        return false;
+
+                ti->type->iterate_devices(ti, count_device, &num_devices);
+                if (num_devices)
+                        return false;
+        }
+
+        return true;
+}
+
 /*
  * Establish the new table's queue_limits and validate them.
  */
@@ -1354,17 +1389,25 @@ static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
         return q && blk_queue_nonrot(q);
 }
 
-static bool dm_table_is_nonrot(struct dm_table *t)
+static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
+                             sector_t start, sector_t len, void *data)
+{
+        struct request_queue *q = bdev_get_queue(dev->bdev);
+
+        return q && !blk_queue_add_random(q);
+}
+
+static bool dm_table_all_devices_attribute(struct dm_table *t,
+                                           iterate_devices_callout_fn func)
 {
         struct dm_target *ti;
         unsigned i = 0;
 
-        /* Ensure that all underlying device are non-rotational. */
         while (i < dm_table_get_num_targets(t)) {
                 ti = dm_table_get_target(t, i++);
 
                 if (!ti->type->iterate_devices ||
-                    !ti->type->iterate_devices(ti, device_is_nonrot, NULL))
+                    !ti->type->iterate_devices(ti, func, NULL))
                         return 0;
         }
 
@@ -1396,7 +1439,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         if (!dm_table_discard_zeroes_data(t))
                 q->limits.discard_zeroes_data = 0;
 
-        if (dm_table_is_nonrot(t))
+        /* Ensure that all underlying devices are non-rotational. */
+        if (dm_table_all_devices_attribute(t, device_is_nonrot))
                 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
         else
                 queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
@@ -1404,6 +1448,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         dm_table_set_integrity(t);
 
         /*
+         * Determine whether or not this queue's I/O timings contribute
+         * to the entropy pool, Only request-based targets use this.
+         * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
+         * have it set.
+         */
+        if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
+                queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
+
+        /*
          * QUEUE_FLAG_STACKABLE must be set after all queue settings are
          * visible to other CPUs because, once the flag is set, incoming bios
          * are processed by request-based dm, which refers to the queue
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index af1fc3b2c2ad..c29410af1e22 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -509,9 +509,9 @@ enum pool_mode {
 struct pool_features {
         enum pool_mode mode;
 
-        unsigned zero_new_blocks:1;
-        unsigned discard_enabled:1;
-        unsigned discard_passdown:1;
+        bool zero_new_blocks:1;
+        bool discard_enabled:1;
+        bool discard_passdown:1;
 };
 
 struct thin_c;
@@ -580,7 +580,8 @@ struct pool_c {
         struct dm_target_callbacks callbacks;
 
         dm_block_t low_water_blocks;
-        struct pool_features pf;
+        struct pool_features requested_pf; /* Features requested during table load */
+        struct pool_features adjusted_pf;  /* Features used after adjusting for constituent devices */
 };
 
 /*
@@ -1839,6 +1840,47 @@ static void __requeue_bios(struct pool *pool)
 /*----------------------------------------------------------------
  * Binding of control targets to a pool object
  *--------------------------------------------------------------*/
+static bool data_dev_supports_discard(struct pool_c *pt)
+{
+        struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
+
+        return q && blk_queue_discard(q);
+}
+
+/*
+ * If discard_passdown was enabled verify that the data device
+ * supports discards.  Disable discard_passdown if not.
+ */
+static void disable_passdown_if_not_supported(struct pool_c *pt)
+{
+        struct pool *pool = pt->pool;
+        struct block_device *data_bdev = pt->data_dev->bdev;
+        struct queue_limits *data_limits = &bdev_get_queue(data_bdev)->limits;
+        sector_t block_size = pool->sectors_per_block << SECTOR_SHIFT;
+        const char *reason = NULL;
+        char buf[BDEVNAME_SIZE];
+
+        if (!pt->adjusted_pf.discard_passdown)
+                return;
+
+        if (!data_dev_supports_discard(pt))
+                reason = "discard unsupported";
+
+        else if (data_limits->max_discard_sectors < pool->sectors_per_block)
+                reason = "max discard sectors smaller than a block";
+
+        else if (data_limits->discard_granularity > block_size)
+                reason = "discard granularity larger than a block";
+
+        else if (block_size & (data_limits->discard_granularity - 1))
+                reason = "discard granularity not a factor of block size";
+
+        if (reason) {
+                DMWARN("Data device (%s) %s: Disabling discard passdown.", bdevname(data_bdev, buf), reason);
+                pt->adjusted_pf.discard_passdown = false;
+        }
+}
+
 static int bind_control_target(struct pool *pool, struct dm_target *ti)
 {
         struct pool_c *pt = ti->private;
@@ -1847,31 +1889,16 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
          * We want to make sure that degraded pools are never upgraded.
          */
         enum pool_mode old_mode = pool->pf.mode;
-        enum pool_mode new_mode = pt->pf.mode;
+        enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         if (old_mode > new_mode)
                 new_mode = old_mode;
 
         pool->ti = ti;
         pool->low_water_blocks = pt->low_water_blocks;
-        pool->pf = pt->pf;
-        set_pool_mode(pool, new_mode);
+        pool->pf = pt->adjusted_pf;
 
-        /*
-         * If discard_passdown was enabled verify that the data device
-         * supports discards.  Disable discard_passdown if not; otherwise
-         * -EOPNOTSUPP will be returned.
-         */
-        /* FIXME: pull this out into a sep fn. */
-        if (pt->pf.discard_passdown) {
-                struct request_queue *q = bdev_get_queue(pt->data_dev->bdev);
-                if (!q || !blk_queue_discard(q)) {
-                        char buf[BDEVNAME_SIZE];
-                        DMWARN("Discard unsupported by data device (%s): Disabling discard passdown.",
-                               bdevname(pt->data_dev->bdev, buf));
-                        pool->pf.discard_passdown = 0;
-                }
-        }
+        set_pool_mode(pool, new_mode);
 
         return 0;
 }
@@ -1889,9 +1916,9 @@ static void unbind_control_target(struct pool *pool, struct dm_target *ti)
 static void pool_features_init(struct pool_features *pf)
 {
         pf->mode = PM_WRITE;
-        pf->zero_new_blocks = 1;
-        pf->discard_enabled = 1;
-        pf->discard_passdown = 1;
+        pf->zero_new_blocks = true;
+        pf->discard_enabled = true;
+        pf->discard_passdown = true;
 }
 
 static void __pool_destroy(struct pool *pool)
@@ -2119,13 +2146,13 @@ static int parse_pool_features(struct dm_arg_set *as, struct pool_features *pf,
                 argc--;
 
                 if (!strcasecmp(arg_name, "skip_block_zeroing"))
-                        pf->zero_new_blocks = 0;
+                        pf->zero_new_blocks = false;
 
                 else if (!strcasecmp(arg_name, "ignore_discard"))
-                        pf->discard_enabled = 0;
+                        pf->discard_enabled = false;
 
                 else if (!strcasecmp(arg_name, "no_discard_passdown"))
-                        pf->discard_passdown = 0;
+                        pf->discard_passdown = false;
 
                 else if (!strcasecmp(arg_name, "read_only"))
                         pf->mode = PM_READ_ONLY;
@@ -2259,8 +2286,9 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
         pt->metadata_dev = metadata_dev;
         pt->data_dev = data_dev;
         pt->low_water_blocks = low_water_blocks;
-        pt->pf = pf;
+        pt->adjusted_pf = pt->requested_pf = pf;
         ti->num_flush_requests = 1;
+
         /*
          * Only need to enable discards if the pool should pass
          * them down to the data device.  The thin device's discard
@@ -2268,12 +2296,14 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
          */
         if (pf.discard_enabled && pf.discard_passdown) {
                 ti->num_discard_requests = 1;
+
                 /*
                  * Setting 'discards_supported' circumvents the normal
                  * stacking of discard limits (this keeps the pool and
                  * thin devices' discard limits consistent).
                  */
                 ti->discards_supported = true;
+                ti->discard_zeroes_data_unsupported = true;
         }
         ti->private = pt;
 
@@ -2703,7 +2733,7 @@ static int pool_status(struct dm_target *ti, status_type_t type,
                        format_dev_t(buf2, pt->data_dev->bdev->bd_dev),
                        (unsigned long)pool->sectors_per_block,
                        (unsigned long long)pt->low_water_blocks);
-                emit_flags(&pt->pf, result, sz, maxlen);
+                emit_flags(&pt->requested_pf, result, sz, maxlen);
                 break;
         }
 
@@ -2732,20 +2762,21 @@ static int pool_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
         return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
 }
 
-static void set_discard_limits(struct pool *pool, struct queue_limits *limits)
+static void set_discard_limits(struct pool_c *pt, struct queue_limits *limits)
 {
-        /*
-         * FIXME: these limits may be incompatible with the pool's data device
-         */
+        struct pool *pool = pt->pool;
+        struct queue_limits *data_limits;
+
         limits->max_discard_sectors = pool->sectors_per_block;
 
         /*
-         * This is just a hint, and not enforced.  We have to cope with
-         * bios that cover a block partially.  A discard that spans a block
-         * boundary is not sent to this target.
+         * discard_granularity is just a hint, and not enforced.
          */
-        limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
-        limits->discard_zeroes_data = pool->pf.zero_new_blocks;
+        if (pt->adjusted_pf.discard_passdown) {
+                data_limits = &bdev_get_queue(pt->data_dev->bdev)->limits;
+                limits->discard_granularity = data_limits->discard_granularity;
+        } else
+                limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
 }
 
 static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
@@ -2755,15 +2786,25 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
         blk_limits_io_min(limits, 0);
         blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        if (pool->pf.discard_enabled)
-                set_discard_limits(pool, limits);
+
+        /*
+         * pt->adjusted_pf is a staging area for the actual features to use.
+         * They get transferred to the live pool in bind_control_target()
+         * called from pool_preresume().
+         */
+        if (!pt->adjusted_pf.discard_enabled)
+                return;
+
+        disable_passdown_if_not_supported(pt);
+
+        set_discard_limits(pt, limits);
 }
 
 static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -3042,19 +3083,19 @@ static int thin_iterate_devices(struct dm_target *ti,
         return 0;
 }
 
+/*
+ * A thin device always inherits its queue limits from its pool.
+ */
 static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
-        struct pool *pool = tc->pool;
 
-        blk_limits_io_min(limits, 0);
-        blk_limits_io_opt(limits, pool->sectors_per_block << SECTOR_SHIFT);
-        set_discard_limits(pool, limits);
+        *limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
 }
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 254d19268ad2..892ae2766aa6 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -718,8 +718,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         v->hash_dev_block_bits = ffs(num) - 1;
 
         if (sscanf(argv[5], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->data_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->data_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->data_dev_block_bits - SECTOR_SHIFT))
+            >> (v->data_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid data blocks";
                 r = -EINVAL;
                 goto bad;
@@ -733,8 +733,8 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
 
         if (sscanf(argv[6], "%llu%c", &num_ll, &dummy) != 1 ||
-            num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT) !=
-            (sector_t)num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT)) {
+            (sector_t)(num_ll << (v->hash_dev_block_bits - SECTOR_SHIFT))
+            >> (v->hash_dev_block_bits - SECTOR_SHIFT) != num_ll) {
                 ti->error = "Invalid hash start";
                 r = -EINVAL;
                 goto bad;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4e09b6ff5b49..67ffa391edcf 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -865,10 +865,14 @@ static void dm_done(struct request *clone, int error, bool mapped)
 {
         int r = error;
         struct dm_rq_target_io *tio = clone->end_io_data;
-        dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
+        dm_request_endio_fn rq_end_io = NULL;
 
-        if (mapped && rq_end_io)
-                r = rq_end_io(tio->ti, clone, error, &tio->info);
+        if (tio->ti) {
+                rq_end_io = tio->ti->type->rq_end_io;
+
+                if (mapped && rq_end_io)
+                        r = rq_end_io(tio->ti, clone, error, &tio->info);
+        }
 
         if (r <= 0)
                 /* The target wants to complete the I/O */
@@ -1588,15 +1592,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
         int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
-        /*
-         * Hold the md reference here for the in-flight I/O.
-         * We can't rely on the reference count by device opener,
-         * because the device may be closed during the request completion
-         * when all bios are completed.
-         * See the comment in rq_completed() too.
-         */
-        dm_get(md);
-
         tio->ti = ti;
         r = ti->type->map_rq(ti, clone, &tio->info);
         switch (r) {
@@ -1628,6 +1623,26 @@ static int map_request(struct dm_target *ti, struct request *clone,
         return requeued;
 }
 
+static struct request *dm_start_request(struct mapped_device *md, struct request *orig)
+{
+        struct request *clone;
+
+        blk_start_request(orig);
+        clone = orig->special;
+        atomic_inc(&md->pending[rq_data_dir(clone)]);
+
+        /*
+         * Hold the md reference here for the in-flight I/O.
+         * We can't rely on the reference count by device opener,
+         * because the device may be closed during the request completion
+         * when all bios are completed.
+         * See the comment in rq_completed() too.
+         */
+        dm_get(md);
+
+        return clone;
+}
+
 /*
  * q->request_fn for request-based dm.
  * Called with the queue lock held.
@@ -1657,14 +1672,21 @@ static void dm_request_fn(struct request_queue *q)
                         pos = blk_rq_pos(rq);
 
                 ti = dm_table_find_target(map, pos);
-                BUG_ON(!dm_target_is_valid(ti));
+                if (!dm_target_is_valid(ti)) {
+                        /*
+                         * Must perform setup, that dm_done() requires,
+                         * before calling dm_kill_unmapped_request
+                         */
+                        DMERR_LIMIT("request attempted access beyond the end of device");
+                        clone = dm_start_request(md, rq);
+                        dm_kill_unmapped_request(clone, -EIO);
+                        continue;
+                }
 
                 if (ti->type->busy && ti->type->busy(ti))
                         goto delay_and_out;
 
-                blk_start_request(rq);
-                clone = rq->special;
-                atomic_inc(&md->pending[rq_data_dir(clone)]);
+                clone = dm_start_request(md, rq);
 
                 spin_unlock(q->queue_lock);
                 if (map_request(ti, clone, md))
@@ -1684,8 +1706,6 @@ delay_and_out:
         blk_delay_queue(q, HZ / 10);
 out:
         dm_table_put(map);
-
-        return;
 }
 
 int dm_underlying_device_busy(struct request_queue *q)
@@ -2409,7 +2429,7 @@ static void dm_queue_flush(struct mapped_device *md)
  */
 struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
-        struct dm_table *map = ERR_PTR(-EINVAL);
+        struct dm_table *live_map, *map = ERR_PTR(-EINVAL);
         struct queue_limits limits;
         int r;
 
@@ -2419,6 +2439,19 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         if (!dm_suspended_md(md))
                 goto out;
 
+        /*
+         * If the new table has no data devices, retain the existing limits.
+         * This helps multipath with queue_if_no_path if all paths disappear,
+         * then new I/O is queued based on these limits, and then some paths
+         * reappear.
+         */
+        if (dm_table_has_no_data_devices(table)) {
+                live_map = dm_get_live_table(md);
+                if (live_map)
+                        limits = md->queue->limits;
+                dm_table_put(live_map);
+        }
+
         r = dm_calculate_queue_limits(table, &limits);
         if (r) {
                 map = ERR_PTR(r);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 52eef493d266..6a99fefaa743 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -54,6 +54,7 @@ void dm_table_event_callback(struct dm_table *t,
                              void (*fn)(void *), void *context);
 struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index);
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector);
+bool dm_table_has_no_data_devices(struct dm_table *table);
 int dm_calculate_queue_limits(struct dm_table *table,
                               struct queue_limits *limits);
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3f6203a4c7ea..308e87b417e0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7619,6 +7619,8 @@ static int remove_and_add_spares(struct mddev *mddev)
                         }
                 }
         }
+        if (removed)
+                set_bit(MD_CHANGE_DEVS, &mddev->flags);
         return spares;
 }
 
@@ -7632,9 +7634,11 @@ static void reap_sync_thread(struct mddev *mddev)
             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                 /* success...*/
                 /* activate any spares */
-                if (mddev->pers->spare_active(mddev))
+                if (mddev->pers->spare_active(mddev)) {
                         sysfs_notify(&mddev->kobj, NULL,
                                      "degraded");
+                        set_bit(MD_CHANGE_DEVS, &mddev->flags);
+                }
         }
         if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
             mddev->pers->finish_reshape)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1c2eb38f3c51..0138a727c1f3 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1512,14 +1512,16 @@ static int _enough(struct r10conf *conf, struct geom *geo, int ignore)
         do {
                 int n = conf->copies;
                 int cnt = 0;
+                int this = first;
                 while (n--) {
-                        if (conf->mirrors[first].rdev &&
-                            first != ignore)
+                        if (conf->mirrors[this].rdev &&
+                            this != ignore)
                                 cnt++;
-                        first = (first+1) % geo->raid_disks;
+                        this = (this+1) % geo->raid_disks;
                 }
                 if (cnt == 0)
                         return 0;
+                first = (first + geo->near_copies) % geo->raid_disks;
         } while (first != 0);
         return 1;
 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index adda94df5eb2..0689173fd9f5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -393,6 +393,8 @@ static int calc_degraded(struct r5conf *conf)
         degraded = 0;
         for (i = 0; i < conf->previous_raid_disks; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                 if (!rdev || test_bit(Faulty, &rdev->flags))
                         degraded++;
                 else if (test_bit(In_sync, &rdev->flags))
@@ -417,6 +419,8 @@ static int calc_degraded(struct r5conf *conf)
         degraded2 = 0;
         for (i = 0; i < conf->raid_disks; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                 if (!rdev || test_bit(Faulty, &rdev->flags))
                         degraded2++;
                 else if (test_bit(In_sync, &rdev->flags))
@@ -1587,6 +1591,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                 #ifdef CONFIG_MULTICORE_RAID456
                 init_waitqueue_head(&nsh->ops.wait_for_ops);
                 #endif
+                spin_lock_init(&nsh->stripe_lock);
 
                 list_add(&nsh->lru, &newstripes);
         }
@@ -4192,7 +4197,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                         finish_wait(&conf->wait_for_overlap, &w);
                         set_bit(STRIPE_HANDLE, &sh->state);
                         clear_bit(STRIPE_DELAYED, &sh->state);
-                        if ((bi->bi_rw & REQ_NOIDLE) &&
+                        if ((bi->bi_rw & REQ_SYNC) &&
                             !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                 atomic_inc(&conf->preread_active_stripes);
                         release_stripe_plug(mddev, sh);
diff --git a/drivers/mfd/88pm800.c b/drivers/mfd/88pm800.c
index b67a3018b136..ce229ea933d1 100644
--- a/drivers/mfd/88pm800.c
+++ b/drivers/mfd/88pm800.c
@@ -470,7 +470,8 @@ static int __devinit device_800_init(struct pm80x_chip *chip,
 
         ret =
             mfd_add_devices(chip->dev, 0, &onkey_devs[0],
-                            ARRAY_SIZE(onkey_devs), &onkey_resources[0], 0);
+                            ARRAY_SIZE(onkey_devs), &onkey_resources[0], 0,
+                            NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
                 goto out_dev;
@@ -481,7 +482,7 @@ static int __devinit device_800_init(struct pm80x_chip *chip,
                 rtc_devs[0].platform_data = pdata->rtc;
                 rtc_devs[0].pdata_size = sizeof(struct pm80x_rtc_pdata);
                 ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
-                                      ARRAY_SIZE(rtc_devs), NULL, 0);
+                                      ARRAY_SIZE(rtc_devs), NULL, 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add rtc subdev\n");
                         goto out_dev;
diff --git a/drivers/mfd/88pm805.c b/drivers/mfd/88pm805.c
index 6146583589f6..c20a31136f04 100644
--- a/drivers/mfd/88pm805.c
+++ b/drivers/mfd/88pm805.c
@@ -216,7 +216,8 @@ static int __devinit device_805_init(struct pm80x_chip *chip)
         }
 
         ret = mfd_add_devices(chip->dev, 0, &codec_devs[0],
-                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0);
+                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0,
+                              NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add codec subdev\n");
                 goto out_codec;
diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index d09918cf1b15..b73f033b2c60 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -637,7 +637,7 @@ static void __devinit device_bk_init(struct pm860x_chip *chip,
                         bk_devs[i].resources = &bk_resources[j];
                         ret = mfd_add_devices(chip->dev, 0,
                                               &bk_devs[i], 1,
-                                              &bk_resources[j], 0);
+                                              &bk_resources[j], 0, NULL);
                         if (ret < 0) {
                                 dev_err(chip->dev, "Failed to add "
                                         "backlight subdev\n");
@@ -672,7 +672,7 @@ static void __devinit device_led_init(struct pm860x_chip *chip,
                         led_devs[i].resources = &led_resources[j],
                         ret = mfd_add_devices(chip->dev, 0,
                                               &led_devs[i], 1,
-                                              &led_resources[j], 0);
+                                              &led_resources[j], 0, NULL);
                         if (ret < 0) {
                                 dev_err(chip->dev, "Failed to add "
                                         "led subdev\n");
@@ -709,7 +709,7 @@ static void __devinit device_regulator_init(struct pm860x_chip *chip,
                 regulator_devs[i].resources = &regulator_resources[seq];
 
                 ret = mfd_add_devices(chip->dev, 0, &regulator_devs[i], 1,
-                                      &regulator_resources[seq], 0);
+                                      &regulator_resources[seq], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add regulator subdev\n");
                         goto out;
@@ -733,7 +733,7 @@ static void __devinit device_rtc_init(struct pm860x_chip *chip,
         rtc_devs[0].resources = &rtc_resources[0];
         ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
                               ARRAY_SIZE(rtc_devs), &rtc_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add rtc subdev\n");
 }
@@ -752,7 +752,7 @@ static void __devinit device_touch_init(struct pm860x_chip *chip,
         touch_devs[0].resources = &touch_resources[0];
         ret = mfd_add_devices(chip->dev, 0, &touch_devs[0],
                               ARRAY_SIZE(touch_devs), &touch_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add touch subdev\n");
 }
@@ -770,7 +770,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[0].num_resources = ARRAY_SIZE(battery_resources);
         power_devs[0].resources = &battery_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[0], 1,
-                              &battery_resources[0], chip->irq_base);
+                              &battery_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add battery subdev\n");
 
@@ -779,7 +779,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[1].num_resources = ARRAY_SIZE(charger_resources);
         power_devs[1].resources = &charger_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[1], 1,
-                              &charger_resources[0], chip->irq_base);
+                              &charger_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add charger subdev\n");
 
@@ -788,7 +788,7 @@ static void __devinit device_power_init(struct pm860x_chip *chip,
         power_devs[2].num_resources = ARRAY_SIZE(preg_resources);
         power_devs[2].resources = &preg_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &power_devs[2], 1,
-                              &preg_resources[0], chip->irq_base);
+                              &preg_resources[0], chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add preg subdev\n");
 }
@@ -802,7 +802,7 @@ static void __devinit device_onkey_init(struct pm860x_chip *chip,
         onkey_devs[0].resources = &onkey_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &onkey_devs[0],
                               ARRAY_SIZE(onkey_devs), &onkey_resources[0],
-                              chip->irq_base);
+                              chip->irq_base, NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
 }
@@ -815,7 +815,8 @@ static void __devinit device_codec_init(struct pm860x_chip *chip,
         codec_devs[0].num_resources = ARRAY_SIZE(codec_resources);
         codec_devs[0].resources = &codec_resources[0],
         ret = mfd_add_devices(chip->dev, 0, &codec_devs[0],
-                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0);
+                              ARRAY_SIZE(codec_devs), &codec_resources[0], 0,
+                              NULL);
         if (ret < 0)
                 dev_err(chip->dev, "Failed to add codec subdev\n");
 }
diff --git a/drivers/mfd/aat2870-core.c b/drivers/mfd/aat2870-core.c
index 44a3fdbadef4..f1beb4971f87 100644
--- a/drivers/mfd/aat2870-core.c
+++ b/drivers/mfd/aat2870-core.c
@@ -424,7 +424,7 @@ static int aat2870_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(aat2870->dev, 0, aat2870_devs,
-                              ARRAY_SIZE(aat2870_devs), NULL, 0);
+                              ARRAY_SIZE(aat2870_devs), NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(aat2870->dev, "Failed to add subdev: %d\n", ret);
                 goto out_disable;
diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index 78fca2902c8d..01781ae5d0d7 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -946,7 +946,7 @@ static int __devinit ab3100_probe(struct i2c_client *client,
         }
 
         err = mfd_add_devices(&client->dev, 0, ab3100_devs,
-                ARRAY_SIZE(ab3100_devs), NULL, 0);
+                              ARRAY_SIZE(ab3100_devs), NULL, 0, NULL);
 
         ab3100_setup_debugfs(ab3100);
 
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 626b4ecaf647..47adf800024e 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1418,25 +1418,25 @@ static int __devinit ab8500_probe(struct platform_device *pdev)
 
         ret = mfd_add_devices(ab8500->dev, 0, abx500_common_devs,
                         ARRAY_SIZE(abx500_common_devs), NULL,
-                        ab8500->irq_base);
+                        ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
         if (is_ab9540(ab8500))
                 ret = mfd_add_devices(ab8500->dev, 0, ab9540_devs,
                                 ARRAY_SIZE(ab9540_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         else
                 ret = mfd_add_devices(ab8500->dev, 0, ab8500_devs,
                                 ARRAY_SIZE(ab8500_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
         if (is_ab9540(ab8500) || is_ab8505(ab8500))
                 ret = mfd_add_devices(ab8500->dev, 0, ab9540_ab8505_devs,
                                 ARRAY_SIZE(ab9540_ab8505_devs), NULL,
-                                ab8500->irq_base);
+                                ab8500->irq_base, ab8500->domain);
         if (ret)
                 goto out_freeirq;
 
@@ -1444,7 +1444,7 @@ static int __devinit ab8500_probe(struct platform_device *pdev)
                 /* Add battery management devices */
                 ret = mfd_add_devices(ab8500->dev, 0, ab8500_bm_devs,
                                       ARRAY_SIZE(ab8500_bm_devs), NULL,
-                                      ab8500->irq_base);
+                                      ab8500->irq_base, ab8500->domain);
                 if (ret)
                         dev_err(ab8500->dev, "error adding bm devices\n");
         }
diff --git a/drivers/mfd/ab8500-gpadc.c b/drivers/mfd/ab8500-gpadc.c
index 866f95960b4b..29d72a259c85 100644
--- a/drivers/mfd/ab8500-gpadc.c
+++ b/drivers/mfd/ab8500-gpadc.c
@@ -342,7 +342,7 @@ int ab8500_gpadc_read_raw(struct ab8500_gpadc *gpadc, u8 channel)
 
                  /*
                   * Delay might be needed for ABB8500 cut 3.0, if not, remove
-                  * when hardware will be availible
+                  * when hardware will be available
                   */
                         msleep(1);
                         break;
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index c7983e862549..1b48f2094806 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -316,7 +316,7 @@ int __devinit arizona_dev_init(struct arizona *arizona)
         }
 
         ret = mfd_add_devices(arizona->dev, -1, early_devs,
-                              ARRAY_SIZE(early_devs), NULL, 0);
+                              ARRAY_SIZE(early_devs), NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(dev, "Failed to add early children: %d\n", ret);
                 return ret;
@@ -516,11 +516,11 @@ int __devinit arizona_dev_init(struct arizona *arizona)
         switch (arizona->type) {
         case WM5102:
                 ret = mfd_add_devices(arizona->dev, -1, wm5102_devs,
-                                      ARRAY_SIZE(wm5102_devs), NULL, 0);
+                                      ARRAY_SIZE(wm5102_devs), NULL, 0, NULL);
                 break;
         case WM5110:
                 ret = mfd_add_devices(arizona->dev, -1, wm5110_devs,
-                                      ARRAY_SIZE(wm5102_devs), NULL, 0);
+                                      ARRAY_SIZE(wm5102_devs), NULL, 0, NULL);
                 break;
         }
 
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 683e18a23329..62f0883a7630 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -913,14 +913,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
         if (pdata->clock_rate) {
                 ds1wm_pdata.clock_rate = pdata->clock_rate;
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                        &asic3_cell_ds1wm, 1, mem, asic->irq_base);
+                        &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL);
                 if (ret < 0)
                         goto out;
         }
 
         if (mem_sdio && (irq >= 0)) {
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                        &asic3_cell_mmc, 1, mem_sdio, irq);
+                        &asic3_cell_mmc, 1, mem_sdio, irq, NULL);
                 if (ret < 0)
                         goto out;
         }
@@ -934,7 +934,7 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
                         asic3_cell_leds[i].pdata_size = sizeof(pdata->leds[i]);
                 }
                 ret = mfd_add_devices(&pdev->dev, 0,
-                        asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0);
+                        asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL);
         }
 
  out:
diff --git a/drivers/mfd/cs5535-mfd.c b/drivers/mfd/cs5535-mfd.c
index 3419e726de47..2b282133c725 100644
--- a/drivers/mfd/cs5535-mfd.c
+++ b/drivers/mfd/cs5535-mfd.c
@@ -149,7 +149,7 @@ static int __devinit cs5535_mfd_probe(struct pci_dev *pdev,
         }
 
         err = mfd_add_devices(&pdev->dev, -1, cs5535_mfd_cells,
-                        ARRAY_SIZE(cs5535_mfd_cells), NULL, 0);
+                              ARRAY_SIZE(cs5535_mfd_cells), NULL, 0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "MFD add devices failed: %d\n", err);
                 goto err_disable;
diff --git a/drivers/mfd/da9052-core.c b/drivers/mfd/da9052-core.c
index 2544910e1fd6..a0a62b24621b 100644
--- a/drivers/mfd/da9052-core.c
+++ b/drivers/mfd/da9052-core.c
@@ -803,7 +803,7 @@ int __devinit da9052_device_init(struct da9052 *da9052, u8 chip_id)
                 dev_err(da9052->dev, "DA9052 ADC IRQ failed ret=%d\n", ret);
 
         ret = mfd_add_devices(da9052->dev, -1, da9052_subdev_info,
-                              ARRAY_SIZE(da9052_subdev_info), NULL, 0);
+                              ARRAY_SIZE(da9052_subdev_info), NULL, 0, NULL);
         if (ret)
                 goto err;
 
diff --git a/drivers/mfd/davinci_voicecodec.c b/drivers/mfd/davinci_voicecodec.c
index 4e2af2cb2d26..45e83a68641b 100644
--- a/drivers/mfd/davinci_voicecodec.c
+++ b/drivers/mfd/davinci_voicecodec.c
@@ -129,7 +129,7 @@ static int __init davinci_vc_probe(struct platform_device *pdev)
         cell->pdata_size = sizeof(*davinci_vc);
 
         ret = mfd_add_devices(&pdev->dev, pdev->id, davinci_vc->cells,
-                              DAVINCI_VC_CELLS, NULL, 0);
+                              DAVINCI_VC_CELLS, NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(&pdev->dev, "fail to register client devices\n");
                 goto fail4;
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 7040a0081130..0e63cdd9b52a 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -3010,7 +3010,7 @@ static int __devinit db8500_prcmu_probe(struct platform_device *pdev)
                 prcmu_config_esram0_deep_sleep(ESRAM0_DEEP_SLEEP_STATE_RET);
 
         err = mfd_add_devices(&pdev->dev, 0, db8500_prcmu_devs,
-                        ARRAY_SIZE(db8500_prcmu_devs), NULL, 0);
+                              ARRAY_SIZE(db8500_prcmu_devs), NULL, 0, NULL);
         if (err) {
                 pr_err("prcmu: Failed to add subdevices\n");
                 return err;
diff --git a/drivers/mfd/htc-pasic3.c b/drivers/mfd/htc-pasic3.c
index 04c7093d6499..9e5453d21a68 100644
--- a/drivers/mfd/htc-pasic3.c
+++ b/drivers/mfd/htc-pasic3.c
@@ -168,7 +168,7 @@ static int __init pasic3_probe(struct platform_device *pdev)
                 /* the first 5 PASIC3 registers control the DS1WM */
                 ds1wm_resources[0].end = (5 << asic->bus_shift) - 1;
                 ret = mfd_add_devices(&pdev->dev, pdev->id,
-                                &ds1wm_cell, 1, r, irq);
+                                      &ds1wm_cell, 1, r, irq, NULL);
                 if (ret < 0)
                         dev_warn(dev, "failed to register DS1WM\n");
         }
@@ -176,7 +176,8 @@ static int __init pasic3_probe(struct platform_device *pdev)
         if (pdata && pdata->led_pdata) {
                 led_cell.platform_data = pdata->led_pdata;
                 led_cell.pdata_size = sizeof(struct pasic3_leds_machinfo);
-                ret = mfd_add_devices(&pdev->dev, pdev->id, &led_cell, 1, r, 0);
+                ret = mfd_add_devices(&pdev->dev, pdev->id, &led_cell, 1, r,
+                                      0, NULL);
                 if (ret < 0)
                         dev_warn(dev, "failed to register LED device\n");
         }
diff --git a/drivers/mfd/intel_msic.c b/drivers/mfd/intel_msic.c
index 59df5584cb58..266bdc5bd96d 100644
--- a/drivers/mfd/intel_msic.c
+++ b/drivers/mfd/intel_msic.c
@@ -344,13 +344,13 @@ static int __devinit intel_msic_init_devices(struct intel_msic *msic)
                         continue;
 
                 ret = mfd_add_devices(&pdev->dev, -1, &msic_devs[i], 1, NULL,
-                                      pdata->irq[i]);
+                                      pdata->irq[i], NULL);
                 if (ret)
                         goto fail;
         }
 
         ret = mfd_add_devices(&pdev->dev, 0, msic_other_devs,
-                              ARRAY_SIZE(msic_other_devs), NULL, 0);
+                              ARRAY_SIZE(msic_other_devs), NULL, 0, NULL);
         if (ret)
                 goto fail;
 
diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
index 2ea99989551a..965c4801df8a 100644
--- a/drivers/mfd/janz-cmodio.c
+++ b/drivers/mfd/janz-cmodio.c
@@ -147,7 +147,7 @@ static int __devinit cmodio_probe_submodules(struct cmodio_device *priv)
         }
 
         return mfd_add_devices(&pdev->dev, 0, priv->cells,
-                               num_probed, NULL, pdev->irq);
+                               num_probed, NULL, pdev->irq, NULL);
 }
 
 /*
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 87662a17dec6..c6b6d7dda517 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -287,7 +287,8 @@ static int __devinit jz4740_adc_probe(struct platform_device *pdev)
         writeb(0xff, adc->base + JZ_REG_ADC_CTRL);
 
         ret = mfd_add_devices(&pdev->dev, 0, jz4740_adc_cells,
-                ARRAY_SIZE(jz4740_adc_cells), mem_base, irq_base);
+                              ARRAY_SIZE(jz4740_adc_cells), mem_base,
+                              irq_base, NULL);
         if (ret < 0)
                 goto err_clk_put;
 
diff --git a/drivers/mfd/lm3533-core.c b/drivers/mfd/lm3533-core.c
index 0b2879b87fd9..24212f45b201 100644
--- a/drivers/mfd/lm3533-core.c
+++ b/drivers/mfd/lm3533-core.c
@@ -393,7 +393,8 @@ static int __devinit lm3533_device_als_init(struct lm3533 *lm3533)
         lm3533_als_devs[0].platform_data = pdata->als;
         lm3533_als_devs[0].pdata_size = sizeof(*pdata->als);
 
-        ret = mfd_add_devices(lm3533->dev, 0, lm3533_als_devs, 1, NULL, 0);
+        ret = mfd_add_devices(lm3533->dev, 0, lm3533_als_devs, 1, NULL,
+                              0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add ALS device\n");
                 return ret;
@@ -422,7 +423,7 @@ static int __devinit lm3533_device_bl_init(struct lm3533 *lm3533)
         }
 
         ret = mfd_add_devices(lm3533->dev, 0, lm3533_bl_devs,
-                                        pdata->num_backlights, NULL, 0);
+                              pdata->num_backlights, NULL, 0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add backlight devices\n");
                 return ret;
@@ -451,7 +452,7 @@ static int __devinit lm3533_device_led_init(struct lm3533 *lm3533)
         }
 
         ret = mfd_add_devices(lm3533->dev, 0, lm3533_led_devs,
-                                                pdata->num_leds, NULL, 0);
+                              pdata->num_leds, NULL, 0, NULL);
         if (ret) {
                 dev_err(lm3533->dev, "failed to add LED devices\n");
                 return ret;
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index 027cc8f86132..092ad4b44b6d 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -750,7 +750,7 @@ gpe0_done:
 
         lpc_ich_finalize_cell(&lpc_ich_cells[LPC_GPIO], id);
         ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_GPIO],
-                                1, NULL, 0);
+                              1, NULL, 0, NULL);
 
 gpio_done:
         if (acpi_conflict)
@@ -765,7 +765,6 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
         u32 base_addr_cfg;
         u32 base_addr;
         int ret;
-        bool acpi_conflict = false;
         struct resource *res;
 
         /* Setup power management base register */
@@ -780,20 +779,11 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
         res = wdt_io_res(ICH_RES_IO_TCO);
         res->start = base_addr + ACPIBASE_TCO_OFF;
         res->end = base_addr + ACPIBASE_TCO_END;
-        ret = acpi_check_resource_conflict(res);
-        if (ret) {
-                acpi_conflict = true;
-                goto wdt_done;
-        }
 
         res = wdt_io_res(ICH_RES_IO_SMI);
         res->start = base_addr + ACPIBASE_SMI_OFF;
         res->end = base_addr + ACPIBASE_SMI_END;
-        ret = acpi_check_resource_conflict(res);
-        if (ret) {
-                acpi_conflict = true;
-                goto wdt_done;
-        }
+
         lpc_ich_enable_acpi_space(dev);
 
         /*
@@ -813,21 +803,13 @@ static int __devinit lpc_ich_init_wdt(struct pci_dev *dev,
                 res = wdt_mem_res(ICH_RES_MEM_GCS);
                 res->start = base_addr + ACPIBASE_GCS_OFF;
                 res->end = base_addr + ACPIBASE_GCS_END;
-                ret = acpi_check_resource_conflict(res);
-                if (ret) {
-                        acpi_conflict = true;
-                        goto wdt_done;
-                }
         }
 
         lpc_ich_finalize_cell(&lpc_ich_cells[LPC_WDT], id);
         ret = mfd_add_devices(&dev->dev, -1, &lpc_ich_cells[LPC_WDT],
-                                1, NULL, 0);
+                              1, NULL, 0, NULL);
 
 wdt_done:
-        if (acpi_conflict)
-                pr_warn("Resource conflict(s) found affecting %s\n",
-                                lpc_ich_cells[LPC_WDT].name);
         return ret;
 }
 
diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
index 9f20abc5e393..f6b9c5c96b24 100644
--- a/drivers/mfd/lpc_sch.c
+++ b/drivers/mfd/lpc_sch.c
@@ -127,7 +127,8 @@ static int __devinit lpc_sch_probe(struct pci_dev *dev,
                 lpc_sch_cells[i].id = id->device;
 
         ret = mfd_add_devices(&dev->dev, 0,
-                        lpc_sch_cells, ARRAY_SIZE(lpc_sch_cells), NULL, 0);
+                              lpc_sch_cells, ARRAY_SIZE(lpc_sch_cells), NULL,
+                              0, NULL);
         if (ret)
                 goto out_dev;
 
@@ -153,7 +154,8 @@ static int __devinit lpc_sch_probe(struct pci_dev *dev,
                         tunnelcreek_cells[i].id = id->device;
 
                 ret = mfd_add_devices(&dev->dev, 0, tunnelcreek_cells,
-                        ARRAY_SIZE(tunnelcreek_cells), NULL, 0);
+                                      ARRAY_SIZE(tunnelcreek_cells), NULL,
+                                      0, NULL);
         }
 
         return ret;
diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index c03e12b51924..d9e24c849a00 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -126,7 +126,7 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         max77686_irq_init(max77686);
 
         ret = mfd_add_devices(max77686->dev, -1, max77686_devs,
-                              ARRAY_SIZE(max77686_devs), NULL, 0);
+                              ARRAY_SIZE(max77686_devs), NULL, 0, NULL);
 
         if (ret < 0)
                 goto err_mfd;
diff --git a/drivers/mfd/max77693-irq.c b/drivers/mfd/max77693-irq.c
index 2b403569e0a6..1029d018c739 100644
--- a/drivers/mfd/max77693-irq.c
+++ b/drivers/mfd/max77693-irq.c
@@ -137,6 +137,9 @@ static void max77693_irq_mask(struct irq_data *data)
         const struct max77693_irq_data *irq_data =
                                 irq_to_max77693_irq(max77693, data->irq);
 
+        if (irq_data->group >= MAX77693_IRQ_GROUP_NR)
+                return;
+
         if (irq_data->group >= MUIC_INT1 && irq_data->group <= MUIC_INT3)
                 max77693->irq_masks_cur[irq_data->group] &= ~irq_data->mask;
         else
@@ -149,6 +152,9 @@ static void max77693_irq_unmask(struct irq_data *data)
         const struct max77693_irq_data *irq_data =
             irq_to_max77693_irq(max77693, data->irq);
 
+        if (irq_data->group >= MAX77693_IRQ_GROUP_NR)
+                return;
+
         if (irq_data->group >= MUIC_INT1 && irq_data->group <= MUIC_INT3)
                 max77693->irq_masks_cur[irq_data->group] |= irq_data->mask;
         else
@@ -200,7 +206,7 @@ static irqreturn_t max77693_irq_thread(int irq, void *data)
 
         if (irq_src & MAX77693_IRQSRC_MUIC)
                 /* MUIC INT1 ~ INT3 */
-                max77693_bulk_read(max77693->regmap, MAX77693_MUIC_REG_INT1,
+                max77693_bulk_read(max77693->regmap_muic, MAX77693_MUIC_REG_INT1,
                         MAX77693_NUM_IRQ_MUIC_REGS, &irq_reg[MUIC_INT1]);
 
         /* Apply masking */
@@ -255,7 +261,8 @@ int max77693_irq_init(struct max77693_dev *max77693)
 {
         struct irq_domain *domain;
         int i;
-        int ret;
+        int ret = 0;
+        u8 intsrc_mask;
 
         mutex_init(&max77693->irqlock);
 
@@ -287,19 +294,38 @@ int max77693_irq_init(struct max77693_dev *max77693)
                                         &max77693_irq_domain_ops, max77693);
         if (!domain) {
                 dev_err(max77693->dev, "could not create irq domain\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto err_irq;
         }
         max77693->irq_domain = domain;
 
+        /* Unmask max77693 interrupt */
+        ret = max77693_read_reg(max77693->regmap,
+                        MAX77693_PMIC_REG_INTSRC_MASK, &intsrc_mask);
+        if (ret < 0) {
+                dev_err(max77693->dev, "fail to read PMIC register\n");
+                goto err_irq;
+        }
+
+        intsrc_mask &= ~(MAX77693_IRQSRC_CHG);
+        intsrc_mask &= ~(MAX77693_IRQSRC_FLASH);
+        intsrc_mask &= ~(MAX77693_IRQSRC_MUIC);
+        ret = max77693_write_reg(max77693->regmap,
+                        MAX77693_PMIC_REG_INTSRC_MASK, intsrc_mask);
+        if (ret < 0) {
+                dev_err(max77693->dev, "fail to write PMIC register\n");
+                goto err_irq;
+        }
+
         ret = request_threaded_irq(max77693->irq, NULL, max77693_irq_thread,
                                    IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                    "max77693-irq", max77693);
-
         if (ret)
                 dev_err(max77693->dev, "Failed to request IRQ %d: %d\n",
                         max77693->irq, ret);
 
-        return 0;
+err_irq:
+        return ret;
 }
 
 void max77693_irq_exit(struct max77693_dev *max77693)
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index a1811cb50ec7..cc5155e20494 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -152,6 +152,20 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
         i2c_set_clientdata(max77693->haptic, max77693);
 
+        /*
+         * Initialize register map for MUIC device because use regmap-muic
+         * instance of MUIC device when irq of max77693 is initialized
+         * before call max77693-muic probe() function.
+         */
+        max77693->regmap_muic = devm_regmap_init_i2c(max77693->muic,
+                                         &max77693_regmap_config);
+        if (IS_ERR(max77693->regmap_muic)) {
+                ret = PTR_ERR(max77693->regmap_muic);
+                dev_err(max77693->dev,
+                        "failed to allocate register map: %d\n", ret);
+                goto err_regmap;
+        }
+
         ret = max77693_irq_init(max77693);
         if (ret < 0)
                 goto err_irq;
@@ -159,7 +173,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         pm_runtime_set_active(max77693->dev);
 
         ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
-                        ARRAY_SIZE(max77693_devs), NULL, 0);
+                              ARRAY_SIZE(max77693_devs), NULL, 0, NULL);
         if (ret < 0)
                 goto err_mfd;
 
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 825a7f06d9ba..ee53757beca7 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -598,7 +598,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
 
         ret = mfd_add_devices(chip->dev, 0, &rtc_devs[0],
                               ARRAY_SIZE(rtc_devs),
-                              &rtc_resources[0], chip->irq_base);
+                              &rtc_resources[0], chip->irq_base, NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add rtc subdev\n");
                 goto out;
@@ -606,7 +606,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
 
         ret = mfd_add_devices(chip->dev, 0, &onkey_devs[0],
                               ARRAY_SIZE(onkey_devs),
-                              &onkey_resources[0], 0);
+                              &onkey_resources[0], 0, NULL);
         if (ret < 0) {
                 dev_err(chip->dev, "Failed to add onkey subdev\n");
                 goto out_dev;
@@ -615,7 +615,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata) {
                 ret = mfd_add_devices(chip->dev, 0, &regulator_devs[0],
                                       ARRAY_SIZE(regulator_devs),
-                                      &regulator_resources[0], 0);
+                                      &regulator_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add regulator subdev\n");
                         goto out_dev;
@@ -625,7 +625,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->backlight) {
                 ret = mfd_add_devices(chip->dev, 0, &backlight_devs[0],
                                       ARRAY_SIZE(backlight_devs),
-                                      &backlight_resources[0], 0);
+                                      &backlight_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add backlight subdev\n");
                         goto out_dev;
@@ -635,7 +635,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->power) {
                 ret = mfd_add_devices(chip->dev, 0, &power_devs[0],
                                         ARRAY_SIZE(power_devs),
-                                        &power_supply_resources[0], 0);
+                                      &power_supply_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add power supply "
                                 "subdev\n");
@@ -646,7 +646,7 @@ int __devinit max8925_device_init(struct max8925_chip *chip,
         if (pdata && pdata->touch) {
                 ret = mfd_add_devices(chip->dev, 0, &touch_devs[0],
                                       ARRAY_SIZE(touch_devs),
-                                      &touch_resources[0], 0);
+                                      &touch_resources[0], 0, NULL);
                 if (ret < 0) {
                         dev_err(chip->dev, "Failed to add touch subdev\n");
                         goto out_dev;
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index 10b629c245b6..f123517065ec 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -160,7 +160,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
 
         mfd_add_devices(max8997->dev, -1, max8997_devs,
                         ARRAY_SIZE(max8997_devs),
-                        NULL, 0);
+                        NULL, 0, NULL);
 
         /*
          * TODO: enable others (flash, muic, rtc, battery, ...) and
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 6ef56d28c056..d7218cc90945 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -161,13 +161,13 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
         switch (id->driver_data) {
         case TYPE_LP3974:
                 ret = mfd_add_devices(max8998->dev, -1,
-                                lp3974_devs, ARRAY_SIZE(lp3974_devs),
-                                NULL, 0);
+                                      lp3974_devs, ARRAY_SIZE(lp3974_devs),
+                                      NULL, 0, NULL);
                 break;
         case TYPE_MAX8998:
                 ret = mfd_add_devices(max8998->dev, -1,
-                                max8998_devs, ARRAY_SIZE(max8998_devs),
-                                NULL, 0);
+                                      max8998_devs, ARRAY_SIZE(max8998_devs),
+                                      NULL, 0, NULL);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
index b801dc72f041..1ec79b54bd2f 100644
--- a/drivers/mfd/mc13xxx-core.c
+++ b/drivers/mfd/mc13xxx-core.c
@@ -612,7 +612,7 @@ static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
         if (!cell.name)
                 return -ENOMEM;
 
-        return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0);
+        return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0, NULL);
 }
 
 static int mc13xxx_add_subdevice(struct mc13xxx *mc13xxx, const char *format)
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0c3a01cde2f7..f8b77711ad2d 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -74,12 +74,11 @@ static int mfd_platform_add_cell(struct platform_device *pdev,
 static int mfd_add_device(struct device *parent, int id,
                           const struct mfd_cell *cell,
                           struct resource *mem_base,
-                          int irq_base)
+                          int irq_base, struct irq_domain *domain)
 {
         struct resource *res;
         struct platform_device *pdev;
         struct device_node *np = NULL;
-        struct irq_domain *domain = NULL;
         int ret = -ENOMEM;
         int r;
 
@@ -97,7 +96,6 @@ static int mfd_add_device(struct device *parent, int id,
                 for_each_child_of_node(parent->of_node, np) {
                         if (of_device_is_compatible(np, cell->of_compatible)) {
                                 pdev->dev.of_node = np;
-                                domain = irq_find_host(parent->of_node);
                                 break;
                         }
                 }
@@ -177,7 +175,7 @@ fail_alloc:
 int mfd_add_devices(struct device *parent, int id,
                     struct mfd_cell *cells, int n_devs,
                     struct resource *mem_base,
-                    int irq_base)
+                    int irq_base, struct irq_domain *domain)
 {
         int i;
         int ret = 0;
@@ -191,7 +189,8 @@ int mfd_add_devices(struct device *parent, int id,
         for (i = 0; i < n_devs; i++) {
                 atomic_set(&cnts[i], 0);
                 cells[i].usage_count = &cnts[i];
-                ret = mfd_add_device(parent, id, cells + i, mem_base, irq_base);
+                ret = mfd_add_device(parent, id, cells + i, mem_base,
+                                     irq_base, domain);
                 if (ret)
                         break;
         }
@@ -247,7 +246,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
         for (i = 0; i < n_clones; i++) {
                 cell_entry.name = clones[i];
                 /* don't give up if a single call fails; just report error */
-                if (mfd_add_device(pdev->dev.parent, -1, &cell_entry, NULL, 0))
+                if (mfd_add_device(pdev->dev.parent, -1, &cell_entry, NULL, 0,
+                                   NULL))
                         dev_err(dev, "failed to create platform device '%s'\n",
                                         clones[i]);
         }
diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
index c4a69f193a1d..a345f9bb7b47 100644
--- a/drivers/mfd/palmas.c
+++ b/drivers/mfd/palmas.c
@@ -453,7 +453,8 @@ static int __devinit palmas_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(palmas->dev, -1,
                               children, ARRAY_SIZE(palmas_children),
-                              NULL, regmap_irq_chip_get_base(palmas->irq_data));
+                              NULL, regmap_irq_chip_get_base(palmas->irq_data),
+                              NULL);
         kfree(children);
 
         if (ret < 0)
diff --git a/drivers/mfd/rc5t583.c b/drivers/mfd/rc5t583.c
index cdc1df7fa0e9..ff61efc76ce2 100644
--- a/drivers/mfd/rc5t583.c
+++ b/drivers/mfd/rc5t583.c
@@ -281,7 +281,7 @@ static int __devinit rc5t583_i2c_probe(struct i2c_client *i2c,
 
         if (i2c->irq) {
                 ret = rc5t583_irq_init(rc5t583, i2c->irq, pdata->irq_base);
-                /* Still continue with waring if irq init fails */
+                /* Still continue with warning, if irq init fails */
                 if (ret)
                         dev_warn(&i2c->dev, "IRQ init failed: %d\n", ret);
                 else
@@ -289,7 +289,7 @@ static int __devinit rc5t583_i2c_probe(struct i2c_client *i2c,
         }
 
         ret = mfd_add_devices(rc5t583->dev, -1, rc5t583_subdevs,
-                        ARRAY_SIZE(rc5t583_subdevs), NULL, 0);
+                              ARRAY_SIZE(rc5t583_subdevs), NULL, 0, NULL);
         if (ret) {
                 dev_err(&i2c->dev, "add mfd devices failed: %d\n", ret);
                 goto err_add_devs;
diff --git a/drivers/mfd/rdc321x-southbridge.c b/drivers/mfd/rdc321x-southbridge.c
index 685d61e431ad..fbabc3cbe350 100644
--- a/drivers/mfd/rdc321x-southbridge.c
+++ b/drivers/mfd/rdc321x-southbridge.c
@@ -1,5 +1,5 @@
 /*
- * RDC321x MFD southbrige driver
+ * RDC321x MFD southbridge driver
  *
  * Copyright (C) 2007-2010 Florian Fainelli <florian@openwrt.org>
  * Copyright (C) 2010 Bernhard Loos <bernhardloos@googlemail.com>
@@ -87,7 +87,8 @@ static int __devinit rdc321x_sb_probe(struct pci_dev *pdev,
         rdc321x_wdt_pdata.sb_pdev = pdev;
 
         return mfd_add_devices(&pdev->dev, -1,
-                rdc321x_sb_cells, ARRAY_SIZE(rdc321x_sb_cells), NULL, 0);
+                               rdc321x_sb_cells, ARRAY_SIZE(rdc321x_sb_cells),
+                               NULL, 0, NULL);
 }
 
 static void __devexit rdc321x_sb_remove(struct pci_dev *pdev)
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 2988efde11eb..49d361a618d0 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -141,19 +141,19 @@ static int sec_pmic_probe(struct i2c_client *i2c,
         switch (sec_pmic->device_type) {
         case S5M8751X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8751_devs,
-                                        ARRAY_SIZE(s5m8751_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8751_devs), NULL, 0, NULL);
                 break;
         case S5M8763X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8763_devs,
-                                        ARRAY_SIZE(s5m8763_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8763_devs), NULL, 0, NULL);
                 break;
         case S5M8767X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s5m8767_devs,
-                                        ARRAY_SIZE(s5m8767_devs), NULL, 0);
+                                      ARRAY_SIZE(s5m8767_devs), NULL, 0, NULL);
                 break;
         case S2MPS11X:
                 ret = mfd_add_devices(sec_pmic->dev, -1, s2mps11_devs,
-                                        ARRAY_SIZE(s2mps11_devs), NULL, 0);
+                                      ARRAY_SIZE(s2mps11_devs), NULL, 0, NULL);
                 break;
         default:
                 /* If this happens the probe function is problem */
diff --git a/drivers/mfd/sta2x11-mfd.c b/drivers/mfd/sta2x11-mfd.c
index d31fed07aefb..d35da6820bea 100644
--- a/drivers/mfd/sta2x11-mfd.c
+++ b/drivers/mfd/sta2x11-mfd.c
@@ -407,7 +407,7 @@ static int __devinit sta2x11_mfd_probe(struct pci_dev *pdev,
                               sta2x11_mfd_bar0,
                               ARRAY_SIZE(sta2x11_mfd_bar0),
                               &pdev->resource[0],
-                              0);
+                              0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "mfd_add_devices[0] failed: %d\n", err);
                 goto err_disable;
@@ -417,7 +417,7 @@ static int __devinit sta2x11_mfd_probe(struct pci_dev *pdev,
                               sta2x11_mfd_bar1,
                               ARRAY_SIZE(sta2x11_mfd_bar1),
                               &pdev->resource[1],
-                              0);
+                              0, NULL);
         if (err) {
                 dev_err(&pdev->dev, "mfd_add_devices[1] failed: %d\n", err);
                 goto err_disable;
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 2dd8d49cb30b..c94f521f392c 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -962,7 +962,7 @@ static int __devinit stmpe_add_device(struct stmpe *stmpe,
                                       struct mfd_cell *cell, int irq)
 {
         return mfd_add_devices(stmpe->dev, stmpe->pdata->id, cell, 1,
-                               NULL, stmpe->irq_base + irq);
+                               NULL, stmpe->irq_base + irq, NULL);
 }
 
 static int __devinit stmpe_devices_init(struct stmpe *stmpe)
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index 2d9e8799e733..b32940ec9034 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -388,7 +388,7 @@ static int t7l66xb_probe(struct platform_device *dev)
 
         ret = mfd_add_devices(&dev->dev, dev->id,
                               t7l66xb_cells, ARRAY_SIZE(t7l66xb_cells),
-                              iomem, t7l66xb->irq_base);
+                              iomem, t7l66xb->irq_base, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
index 048bf0532a09..b56ba6b43294 100644
--- a/drivers/mfd/tc3589x.c
+++ b/drivers/mfd/tc3589x.c
@@ -262,8 +262,8 @@ static int __devinit tc3589x_device_init(struct tc3589x *tc3589x)
 
         if (blocks & TC3589x_BLOCK_GPIO) {
                 ret = mfd_add_devices(tc3589x->dev, -1, tc3589x_dev_gpio,
-                                ARRAY_SIZE(tc3589x_dev_gpio), NULL,
-                                tc3589x->irq_base);
+                                      ARRAY_SIZE(tc3589x_dev_gpio), NULL,
+                                      tc3589x->irq_base, NULL);
                 if (ret) {
                         dev_err(tc3589x->dev, "failed to add gpio child\n");
                         return ret;
@@ -273,8 +273,8 @@ static int __devinit tc3589x_device_init(struct tc3589x *tc3589x)
 
         if (blocks & TC3589x_BLOCK_KEYPAD) {
                 ret = mfd_add_devices(tc3589x->dev, -1, tc3589x_dev_keypad,
-                                ARRAY_SIZE(tc3589x_dev_keypad), NULL,
-                                tc3589x->irq_base);
+                                      ARRAY_SIZE(tc3589x_dev_keypad), NULL,
+                                      tc3589x->irq_base, NULL);
                 if (ret) {
                         dev_err(tc3589x->dev, "failed to keypad child\n");
                         return ret;
diff --git a/drivers/mfd/tc6387xb.c b/drivers/mfd/tc6387xb.c
index d20a284ad4ba..413c891102f8 100644
--- a/drivers/mfd/tc6387xb.c
+++ b/drivers/mfd/tc6387xb.c
@@ -192,7 +192,7 @@ static int __devinit tc6387xb_probe(struct platform_device *dev)
         printk(KERN_INFO "Toshiba tc6387xb initialised\n");
 
         ret = mfd_add_devices(&dev->dev, dev->id, tc6387xb_cells,
-                              ARRAY_SIZE(tc6387xb_cells), iomem, irq);
+                              ARRAY_SIZE(tc6387xb_cells), iomem, irq, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
index 9612264f0e6d..dcab026fcbb2 100644
--- a/drivers/mfd/tc6393xb.c
+++ b/drivers/mfd/tc6393xb.c
@@ -700,8 +700,8 @@ static int __devinit tc6393xb_probe(struct platform_device *dev)
         tc6393xb_cells[TC6393XB_CELL_FB].pdata_size = sizeof(*tcpd->fb_data);
 
         ret = mfd_add_devices(&dev->dev, dev->id,
-                        tc6393xb_cells, ARRAY_SIZE(tc6393xb_cells),
-                        iomem, tcpd->irq_base);
+                              tc6393xb_cells, ARRAY_SIZE(tc6393xb_cells),
+                              iomem, tcpd->irq_base, NULL);
 
         if (!ret)
                 return 0;
diff --git a/drivers/mfd/ti-ssp.c b/drivers/mfd/ti-ssp.c
index 4fb0e6c8e8fe..7c3675a74f93 100644
--- a/drivers/mfd/ti-ssp.c
+++ b/drivers/mfd/ti-ssp.c
@@ -412,7 +412,7 @@ static int __devinit ti_ssp_probe(struct platform_device *pdev)
                 cells[id].data_size     = data->pdata_size;
         }
 
-        error = mfd_add_devices(dev, 0, cells, 2, NULL, 0);
+        error = mfd_add_devices(dev, 0, cells, 2, NULL, 0, NULL);
         if (error < 0) {
                 dev_err(dev, "cannot add mfd cells\n");
                 goto error_enable;
diff --git a/drivers/mfd/timberdale.c b/drivers/mfd/timberdale.c
index a447f4ec11fb..cccc626c83c8 100644
--- a/drivers/mfd/timberdale.c
+++ b/drivers/mfd/timberdale.c
@@ -757,25 +757,25 @@ static int __devinit timb_probe(struct pci_dev *dev,
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg0,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg0),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER1:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg1,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg1),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER2:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg2,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg2),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         case TIMB_HW_VER3:
                 err = mfd_add_devices(&dev->dev, -1,
                         timberdale_cells_bar0_cfg3,
                         ARRAY_SIZE(timberdale_cells_bar0_cfg3),
-                        &dev->resource[0], msix_entries[0].vector);
+                        &dev->resource[0], msix_entries[0].vector, NULL);
                 break;
         default:
                 dev_err(&dev->dev, "Uknown IP setup: %d.%d.%d\n",
@@ -792,7 +792,7 @@ static int __devinit timb_probe(struct pci_dev *dev,
 
         err = mfd_add_devices(&dev->dev, 0,
                 timberdale_cells_bar1, ARRAY_SIZE(timberdale_cells_bar1),
-                &dev->resource[1], msix_entries[0].vector);
+                &dev->resource[1], msix_entries[0].vector, NULL);
         if (err) {
                 dev_err(&dev->dev, "mfd_add_devices failed: %d\n", err);
                 goto err_mfd2;
@@ -803,7 +803,7 @@ static int __devinit timb_probe(struct pci_dev *dev,
                 ((priv->fw.config & TIMB_HW_VER_MASK) == TIMB_HW_VER3)) {
                 err = mfd_add_devices(&dev->dev, 1, timberdale_cells_bar2,
                         ARRAY_SIZE(timberdale_cells_bar2),
-                        &dev->resource[2], msix_entries[0].vector);
+                        &dev->resource[2], msix_entries[0].vector, NULL);
                 if (err) {
                         dev_err(&dev->dev, "mfd_add_devices failed: %d\n", err);
                         goto err_mfd2;
diff --git a/drivers/mfd/tps6105x.c b/drivers/mfd/tps6105x.c
index a293b978e27c..14051bdc714b 100644
--- a/drivers/mfd/tps6105x.c
+++ b/drivers/mfd/tps6105x.c
@@ -188,7 +188,7 @@ static int __devinit tps6105x_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(&client->dev, 0, tps6105x_cells,
-                ARRAY_SIZE(tps6105x_cells), NULL, 0);
+                              ARRAY_SIZE(tps6105x_cells), NULL, 0, NULL);
         if (ret)
                 goto fail;
 
diff --git a/drivers/mfd/tps6507x.c b/drivers/mfd/tps6507x.c
index 33ba7723c967..1b203499c744 100644
--- a/drivers/mfd/tps6507x.c
+++ b/drivers/mfd/tps6507x.c
@@ -100,7 +100,7 @@ static int tps6507x_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(tps6507x->dev, -1,
                               tps6507x_devs, ARRAY_SIZE(tps6507x_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
 
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/tps65090.c b/drivers/mfd/tps65090.c
index 80e24f4b47bf..50fd87c87a1c 100644
--- a/drivers/mfd/tps65090.c
+++ b/drivers/mfd/tps65090.c
@@ -292,7 +292,7 @@ static int __devinit tps65090_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(tps65090->dev, -1, tps65090s,
-                ARRAY_SIZE(tps65090s), NULL, 0);
+                              ARRAY_SIZE(tps65090s), NULL, 0, NULL);
         if (ret) {
                 dev_err(&client->dev, "add mfd devices failed with err: %d\n",
                         ret);
diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 61c097a98f5d..a95e9421b735 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -24,11 +24,18 @@
 #include <linux/slab.h>
 #include <linux/regmap.h>
 #include <linux/err.h>
-#include <linux/regulator/of_regulator.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 
 #include <linux/mfd/core.h>
 #include <linux/mfd/tps65217.h>
 
+static struct mfd_cell tps65217s[] = {
+        {
+                .name = "tps65217-pmic",
+        },
+};
+
 /**
  * tps65217_reg_read: Read a single tps65217 register.
  *
@@ -133,83 +140,48 @@ int tps65217_clear_bits(struct tps65217 *tps, unsigned int reg,
 }
 EXPORT_SYMBOL_GPL(tps65217_clear_bits);
 
-#ifdef CONFIG_OF
-static struct of_regulator_match reg_matches[] = {
-        { .name = "dcdc1", .driver_data = (void *)TPS65217_DCDC_1 },
-        { .name = "dcdc2", .driver_data = (void *)TPS65217_DCDC_2 },
-        { .name = "dcdc3", .driver_data = (void *)TPS65217_DCDC_3 },
-        { .name = "ldo1", .driver_data = (void *)TPS65217_LDO_1 },
-        { .name = "ldo2", .driver_data = (void *)TPS65217_LDO_2 },
-        { .name = "ldo3", .driver_data = (void *)TPS65217_LDO_3 },
-        { .name = "ldo4", .driver_data = (void *)TPS65217_LDO_4 },
-};
-
-static struct tps65217_board *tps65217_parse_dt(struct i2c_client *client)
-{
-        struct device_node *node = client->dev.of_node;
-        struct tps65217_board *pdata;
-        struct device_node *regs;
-        int count = ARRAY_SIZE(reg_matches);
-        int ret, i;
-
-        regs = of_find_node_by_name(node, "regulators");
-        if (!regs)
-                return NULL;
-
-        ret = of_regulator_match(&client->dev, regs, reg_matches, count);
-        of_node_put(regs);
-        if ((ret < 0) || (ret > count))
-                return NULL;
-
-        count = ret;
-        pdata = devm_kzalloc(&client->dev, count * sizeof(*pdata), GFP_KERNEL);
-        if (!pdata)
-                return NULL;
-
-        for (i = 0; i < count; i++) {
-                if (!reg_matches[i].init_data || !reg_matches[i].of_node)
-                        continue;
-
-                pdata->tps65217_init_data[i] = reg_matches[i].init_data;
-                pdata->of_node[i] = reg_matches[i].of_node;
-        }
-
-        return pdata;
-}
-
-static struct of_device_id tps65217_of_match[] = {
-        { .compatible = "ti,tps65217", },
-        { },
-};
-#else
-static struct tps65217_board *tps65217_parse_dt(struct i2c_client *client)
-{
-        return NULL;
-}
-#endif
-
 static struct regmap_config tps65217_regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
 };
 
+static const struct of_device_id tps65217_of_match[] = {
+        { .compatible = "ti,tps65217", .data = (void *)TPS65217 },
+        { /* sentinel */ },
+};
+
 static int __devinit tps65217_probe(struct i2c_client *client,
                                 const struct i2c_device_id *ids)
 {
         struct tps65217 *tps;
-        struct regulator_init_data *reg_data;
-        struct tps65217_board *pdata = client->dev.platform_data;
-        int i, ret;
         unsigned int version;
+        unsigned int chip_id = ids->driver_data;
+        const struct of_device_id *match;
+        int ret;
 
-        if (!pdata && client->dev.of_node)
-                pdata = tps65217_parse_dt(client);
+        if (client->dev.of_node) {
+                match = of_match_device(tps65217_of_match, &client->dev);
+                if (!match) {
+                        dev_err(&client->dev,
+                                "Failed to find matching dt id\n");
+                        return -EINVAL;
+                }
+                chip_id = (unsigned int)match->data;
+        }
+
+        if (!chip_id) {
+                dev_err(&client->dev, "id is null.\n");
+                return -ENODEV;
+        }
 
         tps = devm_kzalloc(&client->dev, sizeof(*tps), GFP_KERNEL);
         if (!tps)
                 return -ENOMEM;
 
-        tps->pdata = pdata;
+        i2c_set_clientdata(client, tps);
+        tps->dev = &client->dev;
+        tps->id = chip_id;
+
         tps->regmap = devm_regmap_init_i2c(client, &tps65217_regmap_config);
         if (IS_ERR(tps->regmap)) {
                 ret = PTR_ERR(tps->regmap);
@@ -218,8 +190,12 @@ static int __devinit tps65217_probe(struct i2c_client *client,
                 return ret;
         }
 
-        i2c_set_clientdata(client, tps);
-        tps->dev = &client->dev;
+        ret = mfd_add_devices(tps->dev, -1, tps65217s,
+                              ARRAY_SIZE(tps65217s), NULL, 0, NULL);
+        if (ret < 0) {
+                dev_err(tps->dev, "mfd_add_devices failed: %d\n", ret);
+                return ret;
+        }
 
         ret = tps65217_reg_read(tps, TPS65217_REG_CHIPID, &version);
         if (ret < 0) {
@@ -232,41 +208,21 @@ static int __devinit tps65217_probe(struct i2c_client *client,
                         (version & TPS65217_CHIPID_CHIP_MASK) >> 4,
                         version & TPS65217_CHIPID_REV_MASK);
 
-        for (i = 0; i < TPS65217_NUM_REGULATOR; i++) {
-                struct platform_device *pdev;
-
-                pdev = platform_device_alloc("tps65217-pmic", i);
-                if (!pdev) {
-                        dev_err(tps->dev, "Cannot create regulator %d\n", i);
-                        continue;
-                }
-
-                pdev->dev.parent = tps->dev;
-                pdev->dev.of_node = pdata->of_node[i];
-                reg_data = pdata->tps65217_init_data[i];
-                platform_device_add_data(pdev, reg_data, sizeof(*reg_data));
-                tps->regulator_pdev[i] = pdev;
-
-                platform_device_add(pdev);
-        }
-
         return 0;
 }
 
 static int __devexit tps65217_remove(struct i2c_client *client)
 {
         struct tps65217 *tps = i2c_get_clientdata(client);
-        int i;
 
-        for (i = 0; i < TPS65217_NUM_REGULATOR; i++)
-                platform_device_unregister(tps->regulator_pdev[i]);
+        mfd_remove_devices(tps->dev);
 
         return 0;
 }
 
 static const struct i2c_device_id tps65217_id_table[] = {
-        {"tps65217", 0xF0},
-        {/* end of list */}
+        {"tps65217", TPS65217},
+        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(i2c, tps65217_id_table);
 
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 353c34812120..345960ca2fd8 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -25,6 +25,7 @@
 #include <linux/i2c.h>
 #include <linux/regmap.h>
 #include <linux/regulator/of_regulator.h>
+#include <linux/regulator/machine.h>
 
 #include <linux/mfd/core.h>
 #include <linux/mfd/tps6586x.h>
@@ -346,6 +347,7 @@ failed:
 
 #ifdef CONFIG_OF
 static struct of_regulator_match tps6586x_matches[] = {
+        { .name = "sys",     .driver_data = (void *)TPS6586X_ID_SYS     },
         { .name = "sm0",     .driver_data = (void *)TPS6586X_ID_SM_0    },
         { .name = "sm1",     .driver_data = (void *)TPS6586X_ID_SM_1    },
         { .name = "sm2",     .driver_data = (void *)TPS6586X_ID_SM_2    },
@@ -369,6 +371,7 @@ static struct tps6586x_platform_data *tps6586x_parse_dt(struct i2c_client *clien
         struct tps6586x_platform_data *pdata;
         struct tps6586x_subdev_info *devs;
         struct device_node *regs;
+        const char *sys_rail_name = NULL;
         unsigned int count;
         unsigned int i, j;
         int err;
@@ -391,12 +394,22 @@ static struct tps6586x_platform_data *tps6586x_parse_dt(struct i2c_client *clien
                 return NULL;
 
         for (i = 0, j = 0; i < num && j < count; i++) {
+                struct regulator_init_data *reg_idata;
+
                 if (!tps6586x_matches[i].init_data)
                         continue;
 
+                reg_idata  = tps6586x_matches[i].init_data;
                 devs[j].name = "tps6586x-regulator";
                 devs[j].platform_data = tps6586x_matches[i].init_data;
                 devs[j].id = (int)tps6586x_matches[i].driver_data;
+                if (devs[j].id == TPS6586X_ID_SYS)
+                        sys_rail_name = reg_idata->constraints.name;
+
+                if ((devs[j].id == TPS6586X_ID_LDO_5) ||
+                        (devs[j].id == TPS6586X_ID_LDO_RTC))
+                        reg_idata->supply_regulator = sys_rail_name;
+
                 devs[j].of_node = tps6586x_matches[i].of_node;
                 j++;
         }
@@ -493,7 +506,8 @@ static int __devinit tps6586x_i2c_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(tps6586x->dev, -1,
-                        tps6586x_cell, ARRAY_SIZE(tps6586x_cell), NULL, 0);
+                              tps6586x_cell, ARRAY_SIZE(tps6586x_cell),
+                              NULL, 0, NULL);
         if (ret < 0) {
                 dev_err(&client->dev, "mfd_add_devices failed: %d\n", ret);
                 goto err_mfd_add;
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 1c563792c777..d3ce4d569deb 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -254,7 +254,7 @@ static __devinit int tps65910_i2c_probe(struct i2c_client *i2c,
 
         ret = mfd_add_devices(tps65910->dev, -1,
                               tps65910s, ARRAY_SIZE(tps65910s),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret < 0) {
                 dev_err(&i2c->dev, "mfd_add_devices failed: %d\n", ret);
                 return ret;
diff --git a/drivers/mfd/tps65911-comparator.c b/drivers/mfd/tps65911-comparator.c
index 5a62e6bf89ae..0b6e361432c4 100644
--- a/drivers/mfd/tps65911-comparator.c
+++ b/drivers/mfd/tps65911-comparator.c
@@ -136,7 +136,7 @@ static __devinit int tps65911_comparator_probe(struct platform_device *pdev)
 
         ret = comp_threshold_set(tps65910, COMP2, pdata->vmbch2_threshold);
         if (ret < 0) {
-                dev_err(&pdev->dev, "cannot set COMP2 theshold\n");
+                dev_err(&pdev->dev, "cannot set COMP2 threshold\n");
                 return ret;
         }
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 74fd8cb5f372..4658b5bdcd84 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -146,7 +146,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
 
         ret = mfd_add_devices(tps65912->dev, -1,
                               tps65912s, ARRAY_SIZE(tps65912s),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret < 0)
                 goto err;
 
diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c
index 838ce4eb444e..77c9acb14583 100644
--- a/drivers/mfd/twl4030-audio.c
+++ b/drivers/mfd/twl4030-audio.c
@@ -223,7 +223,7 @@ static int __devinit twl4030_audio_probe(struct platform_device *pdev)
 
         if (childs)
                 ret = mfd_add_devices(&pdev->dev, pdev->id, audio->cells,
-                                      childs, NULL, 0);
+                                      childs, NULL, 0, NULL);
         else {
                 dev_err(&pdev->dev, "No platform data found for childs\n");
                 ret = -ENODEV;
diff --git a/drivers/mfd/twl6040-core.c b/drivers/mfd/twl6040-core.c
index b0fad0ffca56..3dca5c195a20 100644
--- a/drivers/mfd/twl6040-core.c
+++ b/drivers/mfd/twl6040-core.c
@@ -632,7 +632,7 @@ static int __devinit twl6040_probe(struct i2c_client *client,
         }
 
         ret = mfd_add_devices(&client->dev, -1, twl6040->cells, children,
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret)
                 goto mfd_err;
 
diff --git a/drivers/mfd/vx855.c b/drivers/mfd/vx855.c
index 872aff21e4be..b9a636d44c7f 100644
--- a/drivers/mfd/vx855.c
+++ b/drivers/mfd/vx855.c
@@ -102,7 +102,7 @@ static __devinit int vx855_probe(struct pci_dev *pdev,
         vx855_gpio_resources[1].end = vx855_gpio_resources[1].start + 3;
 
         ret = mfd_add_devices(&pdev->dev, -1, vx855_cells, ARRAY_SIZE(vx855_cells),
-                        NULL, 0);
+                        NULL, 0, NULL);
 
         /* we always return -ENODEV here in order to enable other
          * drivers like old, not-yet-platform_device ported i2c-viapro */
diff --git a/drivers/mfd/wl1273-core.c b/drivers/mfd/wl1273-core.c
index f39b756df561..86e0e4309fc2 100644
--- a/drivers/mfd/wl1273-core.c
+++ b/drivers/mfd/wl1273-core.c
@@ -241,7 +241,7 @@ static int __devinit wl1273_core_probe(struct i2c_client *client,
                 __func__, children);
 
         r = mfd_add_devices(&client->dev, -1, core->cells,
-                            children, NULL, 0);
+                            children, NULL, 0, NULL);
         if (r)
                 goto err;
 
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index 946698fd2dc6..301731035940 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -1813,27 +1813,27 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         case WM8310:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8310_devs, ARRAY_SIZE(wm8310_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 break;
 
         case WM8311:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8311_devs, ARRAY_SIZE(wm8311_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (!pdata || !pdata->disable_touch)
                         mfd_add_devices(wm831x->dev, wm831x_num,
                                         touch_devs, ARRAY_SIZE(touch_devs),
-                                        NULL, 0);
+                                        NULL, 0, NULL);
                 break;
 
         case WM8312:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8312_devs, ARRAY_SIZE(wm8312_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (!pdata || !pdata->disable_touch)
                         mfd_add_devices(wm831x->dev, wm831x_num,
                                         touch_devs, ARRAY_SIZE(touch_devs),
-                                        NULL, 0);
+                                        NULL, 0, NULL);
                 break;
 
         case WM8320:
@@ -1842,7 +1842,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         case WM8326:
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       wm8320_devs, ARRAY_SIZE(wm8320_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 break;
 
         default:
@@ -1867,7 +1867,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         if (ret & WM831X_XTAL_ENA) {
                 ret = mfd_add_devices(wm831x->dev, wm831x_num,
                                       rtc_devs, ARRAY_SIZE(rtc_devs),
-                                      NULL, 0);
+                                      NULL, 0, NULL);
                 if (ret != 0) {
                         dev_err(wm831x->dev, "Failed to add RTC: %d\n", ret);
                         goto err_irq;
@@ -1880,7 +1880,7 @@ int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
                 /* Treat errors as non-critical */
                 ret = mfd_add_devices(wm831x->dev, wm831x_num, backlight_devs,
                                       ARRAY_SIZE(backlight_devs), NULL,
-                                      0);
+                                      0, NULL);
                 if (ret < 0)
                         dev_err(wm831x->dev, "Failed to add backlight: %d\n",
                                 ret);
diff --git a/drivers/mfd/wm8400-core.c b/drivers/mfd/wm8400-core.c
index 4b7d378551d5..639ca359242f 100644
--- a/drivers/mfd/wm8400-core.c
+++ b/drivers/mfd/wm8400-core.c
@@ -70,7 +70,7 @@ static int wm8400_register_codec(struct wm8400 *wm8400)
                 .pdata_size = sizeof(*wm8400),
         };
 
-        return mfd_add_devices(wm8400->dev, -1, &cell, 1, NULL, 0);
+        return mfd_add_devices(wm8400->dev, -1, &cell, 1, NULL, 0, NULL);
 }
 
 /*
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index eec74aa55fdf..2febf88cfce8 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -414,7 +414,7 @@ static __devinit int wm8994_device_init(struct wm8994 *wm8994, int irq)
         ret = mfd_add_devices(wm8994->dev, -1,
                               wm8994_regulator_devs,
                               ARRAY_SIZE(wm8994_regulator_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to add children: %d\n", ret);
                 goto err;
@@ -648,7 +648,7 @@ static __devinit int wm8994_device_init(struct wm8994 *wm8994, int irq)
 
         ret = mfd_add_devices(wm8994->dev, -1,
                               wm8994_devs, ARRAY_SIZE(wm8994_devs),
-                              NULL, 0);
+                              NULL, 0, NULL);
         if (ret != 0) {
                 dev_err(wm8994->dev, "Failed to add children: %d\n", ret);
                 goto err_irq;
diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c
index 0aac4aff17a5..a050e56a9bbd 100644
--- a/drivers/mfd/wm8994-irq.c
+++ b/drivers/mfd/wm8994-irq.c
@@ -135,6 +135,7 @@ static struct regmap_irq_chip wm8994_irq_chip = {
         .status_base = WM8994_INTERRUPT_STATUS_1,
         .mask_base = WM8994_INTERRUPT_STATUS_1_MASK,
         .ack_base = WM8994_INTERRUPT_STATUS_1,
+        .runtime_pm = true,
 };
 
 int wm8994_irq_init(struct wm8994 *wm8994)
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index d4619e2ec030..2273ce6b6c1a 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -641,7 +641,7 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
         /*
          * If the host and card support UHS-I mode request the card
          * to switch to 1.8V signaling level.  No 1.8v signalling if
-         * UHS mode is not enabled to maintain compatibilty and some
+         * UHS mode is not enabled to maintain compatibility and some
          * systems that claim 1.8v signalling in fact do not support
          * it.
          */
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index efdb81d21c44..74bed0fc23e7 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -356,7 +356,7 @@ static void at91_mci_handle_transmitted(struct at91mci_host *host)
 }
 
 /*
- * Update bytes tranfered count during a write operation
+ * Update bytes transfered count during a write operation
  */
 static void at91_mci_update_bytes_xfered(struct at91mci_host *host)
 {
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index a53c7c478e05..852d5fbda630 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1022,7 +1022,7 @@ static void atmci_stop_transfer(struct atmel_mci *host)
 }
 
 /*
- * Stop data transfer because error(s) occured.
+ * Stop data transfer because error(s) occurred.
  */
 static void atmci_stop_transfer_pdc(struct atmel_mci *host)
 {
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 3a09f93cc3b6..686e256764c8 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -447,7 +447,7 @@ static void omap_hsmmc_stop_clock(struct omap_hsmmc_host *host)
         OMAP_HSMMC_WRITE(host->base, SYSCTL,
                 OMAP_HSMMC_READ(host->base, SYSCTL) & ~CEN);
         if ((OMAP_HSMMC_READ(host->base, SYSCTL) & CEN) != 0x0)
-                dev_dbg(mmc_dev(host->mmc), "MMC Clock is not stoped\n");
+                dev_dbg(mmc_dev(host->mmc), "MMC Clock is not stopped\n");
 }
 
 static void omap_hsmmc_enable_irq(struct omap_hsmmc_host *host,
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index e23f8134591c..32f4a070551f 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -315,7 +315,7 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
                 new_val = val & (SDHCI_CTRL_LED | \
                                 SDHCI_CTRL_4BITBUS | \
                                 SDHCI_CTRL_D3CD);
-                /* ensure the endianess */
+                /* ensure the endianness */
                 new_val |= ESDHC_HOST_CONTROL_LE;
                 /* bits 8&9 are reserved on mx25 */
                 if (!is_imx25_esdhc(imx_data)) {
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 3135a1a5d75d..58eab9ac1d01 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -806,7 +806,7 @@ static void command_res_completed(struct urb *urb)
                  * we suspect a buggy USB host controller
                  */
         } else if (!vub300->data) {
-                /* this means that the command (typically CMD52) suceeded */
+                /* this means that the command (typically CMD52) succeeded */
         } else if (vub300->resp.common.header_type != 0x02) {
                 /*
                  * this is an error response from the VUB300 chip
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index f2f482bec573..a6e74514e662 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -1123,6 +1123,33 @@ static unsigned long mtdchar_get_unmapped_area(struct file *file,
 }
 #endif
 
+static inline unsigned long get_vm_size(struct vm_area_struct *vma)
+{
+        return vma->vm_end - vma->vm_start;
+}
+
+static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
+{
+        return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
+}
+
+/*
+ * Set a new vm offset.
+ *
+ * Verify that the incoming offset really works as a page offset,
+ * and that the offset and size fit in a resource_size_t.
+ */
+static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
+{
+        pgoff_t pgoff = off >> PAGE_SHIFT;
+        if (off != (resource_size_t) pgoff << PAGE_SHIFT)
+                return -EINVAL;
+        if (off + get_vm_size(vma) - 1 < off)
+                return -EINVAL;
+        vma->vm_pgoff = pgoff;
+        return 0;
+}
+
 /*
  * set up a mapping for shared memory segments
  */
@@ -1132,20 +1159,29 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
         struct mtd_file_info *mfi = file->private_data;
         struct mtd_info *mtd = mfi->mtd;
         struct map_info *map = mtd->priv;
-        unsigned long start;
-        unsigned long off;
-        u32 len;
+        resource_size_t start, off;
+        unsigned long len, vma_len;
 
         if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
-                off = vma->vm_pgoff << PAGE_SHIFT;
+                off = get_vm_offset(vma);
                 start = map->phys;
                 len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
                 start &= PAGE_MASK;
-                if ((vma->vm_end - vma->vm_start + off) > len)
+                vma_len = get_vm_size(vma);
+
+                /* Overflow in off+len? */
+                if (vma_len + off < off)
+                        return -EINVAL;
+                /* Does it fit in the mapping? */
+                if (vma_len + off > len)
                         return -EINVAL;
 
                 off += start;
-                vma->vm_pgoff = off >> PAGE_SHIFT;
+                /* Did that overflow? */
+                if (off < start)
+                        return -EINVAL;
+                if (set_vm_offset(vma, off) < 0)
+                        return -EINVAL;
                 vma->vm_flags |= VM_IO | VM_RESERVED;
 
 #ifdef pgprot_noncached
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index 98ee43819911..7edadee487ba 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1391,7 +1391,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)
  */
 static int ican3_reset_module(struct ican3_dev *mod)
 {
-        u8 val = 1 << mod->num;
         unsigned long start;
         u8 runold, runnew;
 
@@ -1405,8 +1404,7 @@ static int ican3_reset_module(struct ican3_dev *mod)
         runold = ioread8(mod->dpm + TARGET_RUNNING);
 
         /* reset the module */
-        iowrite8(val, &mod->ctrl->reset_assert);
-        iowrite8(val, &mod->ctrl->reset_deassert);
+        iowrite8(0x00, &mod->dpmctrl->hwreset);
 
         /* wait until the module has finished resetting and is running */
         start = jiffies;
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index a580db29e503..26e7129332ab 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -83,6 +83,11 @@
 #define INSTRUCTION_LOAD_TXB(n) (0x40 + 2 * (n))
 #define INSTRUCTION_READ_RXB(n) (((n) == 0) ? 0x90 : 0x94)
 #define INSTRUCTION_RESET       0xC0
+#define RTS_TXB0                0x01
+#define RTS_TXB1                0x02
+#define RTS_TXB2                0x04
+#define INSTRUCTION_RTS(n)      (0x80 | ((n) & 0x07))
+
 
 /* MPC251x registers */
 #define CANSTAT       0x0e
@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
 static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
                           int tx_buf_idx)
 {
+        struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
         u32 sid, eid, exide, rtr;
         u8 buf[SPI_TRANSFER_BUF_LEN];
 
@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
         buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
         memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
         mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
-        mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
+
+        /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
+        priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
+        mcp251x_spi_trans(priv->spi, 1);
 }
 
 static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 527dbcf95335..9ded21e79db5 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct ti_hecc_priv *priv = netdev_priv(ndev);
 
+        unregister_candev(ndev);
         clk_disable(priv->clk);
         clk_put(priv->clk);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         iounmap(priv->base);
         release_mem_region(res->start, resource_size(res));
-        unregister_candev(ndev);
         free_candev(ndev);
         platform_set_drvdata(pdev, NULL);
 
diff --git a/drivers/net/ethernet/3com/typhoon.c b/drivers/net/ethernet/3com/typhoon.c
index b15366635147..bb9670f29b59 100644
--- a/drivers/net/ethernet/3com/typhoon.c
+++ b/drivers/net/ethernet/3com/typhoon.c
@@ -364,7 +364,7 @@ typhoon_inc_rxfree_index(u32 *index, const int count)
 static inline void
 typhoon_inc_tx_index(u32 *index, const int count)
 {
-        /* if we start using the Hi Tx ring, this needs updateing */
+        /* if we start using the Hi Tx ring, this needs updating */
         typhoon_inc_index(index, count, TXLO_ENTRIES);
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index a0e8399793b6..d4310700c7a7 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -8564,7 +8564,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
-        iounmap(bp->regview);
+        pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 6d1a24acb77e..eac25236856c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1458,7 +1458,7 @@ struct bnx2x {
         int                             fw_stats_req_sz;
 
         /*
-         * FW statistics data shortcut (points at the begining of
+         * FW statistics data shortcut (points at the beginning of
          * fw_stats buffer + fw_stats_req_sz).
          */
         struct bnx2x_fw_stats_data      *fw_stats_data;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index af20c6ee2cd9..e8e97a7d1d06 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -662,14 +662,16 @@ void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
                                  struct bnx2x_fastpath *fp,
                                  struct bnx2x_eth_q_stats *qstats)
 {
-        /* Do nothing if no IP/L4 csum validation was done */
-
+        /* Do nothing if no L4 csum validation was done.
+         * We do not check whether IP csum was validated. For IPv4 we assume
+         * that if the card got as far as validating the L4 csum, it also
+         * validated the IP csum. IPv6 has no IP csum.
+         */
         if (cqe->fast_path_cqe.status_flags &
-            (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
-             ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
+            ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG)
                 return;
 
-        /* If both IP/L4 validation were done, check if an error was found. */
+        /* If L4 validation was done, check if an error was found. */
 
         if (cqe->fast_path_cqe.type_error_flags &
             (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 21b553229ea4..dfd86a55f1dc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -710,17 +710,15 @@ static inline u16 bnx2x_tx_avail(struct bnx2x *bp,
         prod = txdata->tx_bd_prod;
         cons = txdata->tx_bd_cons;
 
-        /* NUM_TX_RINGS = number of "next-page" entries
-           It will be used as a threshold */
-        used = SUB_S16(prod, cons) + (s16)NUM_TX_RINGS;
+        used = SUB_S16(prod, cons);
 
 #ifdef BNX2X_STOP_ON_ERROR
         WARN_ON(used < 0);
-        WARN_ON(used > bp->tx_ring_size);
-        WARN_ON((bp->tx_ring_size - used) > MAX_TX_AVAIL);
+        WARN_ON(used > txdata->tx_ring_size);
+        WARN_ON((txdata->tx_ring_size - used) > MAX_TX_AVAIL);
 #endif
 
-        return (s16)(bp->tx_ring_size) - used;
+        return (s16)(txdata->tx_ring_size) - used;
 }
 
 static inline int bnx2x_tx_queue_has_work(struct bnx2x_fp_txdata *txdata)
@@ -1088,6 +1086,7 @@ static inline void bnx2x_init_txdata(struct bnx2x *bp,
         txdata->txq_index = txq_index;
         txdata->tx_cons_sb = tx_cons_sb;
         txdata->parent_fp = fp;
+        txdata->tx_ring_size = IS_FCOE_FP(fp) ? MAX_TX_AVAIL : bp->tx_ring_size;
 
         DP(NETIF_MSG_IFUP, "created tx data cid %d, txq %d\n",
            txdata->cid, txdata->txq_index);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
index 3e4cff9b1ebe..b926f58e983b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dump.h
@@ -401,11 +401,11 @@ static const struct reg_addr reg_addrs[] = {
         { 0x70000, 8, RI_ALL_ONLINE },
         { 0x70020, 8184, RI_ALL_OFFLINE },
         { 0x78000, 8192, RI_E3E3B0_OFFLINE },
-        { 0x85000, 3, RI_ALL_ONLINE },
-        { 0x8501c, 7, RI_ALL_ONLINE },
-        { 0x85048, 1, RI_ALL_ONLINE },
-        { 0x85200, 32, RI_ALL_ONLINE },
-        { 0xb0000, 16384, RI_E1H_ONLINE },
+        { 0x85000, 3, RI_ALL_OFFLINE },
+        { 0x8501c, 7, RI_ALL_OFFLINE },
+        { 0x85048, 1, RI_ALL_OFFLINE },
+        { 0x85200, 32, RI_ALL_OFFLINE },
+        { 0xb0000, 16384, RI_E1H_OFFLINE },
         { 0xc1000, 7, RI_ALL_ONLINE },
         { 0xc103c, 2, RI_E2E3E3B0_ONLINE },
         { 0xc1800, 2, RI_ALL_ONLINE },
@@ -581,17 +581,12 @@ static const struct reg_addr reg_addrs[] = {
         { 0x140188, 3, RI_E1E1HE2E3_ONLINE },
         { 0x140194, 13, RI_ALL_ONLINE },
         { 0x140200, 6, RI_E1E1HE2E3_ONLINE },
-        { 0x140220, 4, RI_E2E3_ONLINE },
-        { 0x140240, 4, RI_E2E3_ONLINE },
         { 0x140260, 4, RI_E2E3_ONLINE },
         { 0x140280, 4, RI_E2E3_ONLINE },
-        { 0x1402a0, 4, RI_E2E3_ONLINE },
-        { 0x1402c0, 4, RI_E2E3_ONLINE },
         { 0x1402e0, 2, RI_E2E3_ONLINE },
         { 0x1402e8, 2, RI_E2E3E3B0_ONLINE },
         { 0x1402f0, 9, RI_E2E3_ONLINE },
         { 0x140314, 44, RI_E3B0_ONLINE },
-        { 0x1403d0, 70, RI_E3B0_ONLINE },
         { 0x144000, 4, RI_E1E1H_ONLINE },
         { 0x148000, 4, RI_E1E1H_ONLINE },
         { 0x14c000, 4, RI_E1E1H_ONLINE },
@@ -704,7 +699,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x180398, 1, RI_E2E3E3B0_ONLINE },
         { 0x1803a0, 5, RI_E2E3E3B0_ONLINE },
         { 0x1803b4, 2, RI_E3E3B0_ONLINE },
-        { 0x180400, 1, RI_ALL_ONLINE },
         { 0x180404, 255, RI_E1E1H_OFFLINE },
         { 0x181000, 4, RI_ALL_ONLINE },
         { 0x181010, 1020, RI_ALL_OFFLINE },
@@ -800,9 +794,9 @@ static const struct reg_addr reg_addrs[] = {
         { 0x1b905c, 1, RI_E3E3B0_ONLINE },
         { 0x1b9064, 1, RI_E3B0_ONLINE },
         { 0x1b9080, 10, RI_E3B0_ONLINE },
-        { 0x1b9400, 14, RI_E2E3E3B0_ONLINE },
-        { 0x1b943c, 19, RI_E2E3E3B0_ONLINE },
-        { 0x1b9490, 10, RI_E2E3E3B0_ONLINE },
+        { 0x1b9400, 14, RI_E2E3E3B0_OFFLINE },
+        { 0x1b943c, 19, RI_E2E3E3B0_OFFLINE },
+        { 0x1b9490, 10, RI_E2E3E3B0_OFFLINE },
         { 0x1c0000, 2, RI_ALL_ONLINE },
         { 0x200000, 65, RI_ALL_ONLINE },
         { 0x20014c, 2, RI_E1HE2E3E3B0_ONLINE },
@@ -814,7 +808,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x200398, 1, RI_E2E3E3B0_ONLINE },
         { 0x2003a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x2003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x200400, 1, RI_ALL_ONLINE },
         { 0x200404, 255, RI_E1E1H_OFFLINE },
         { 0x202000, 4, RI_ALL_ONLINE },
         { 0x202010, 2044, RI_ALL_OFFLINE },
@@ -921,7 +914,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x280398, 1, RI_E2E3E3B0_ONLINE },
         { 0x2803a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x2803a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x280400, 1, RI_ALL_ONLINE },
         { 0x280404, 255, RI_E1E1H_OFFLINE },
         { 0x282000, 4, RI_ALL_ONLINE },
         { 0x282010, 2044, RI_ALL_OFFLINE },
@@ -1031,7 +1023,6 @@ static const struct reg_addr reg_addrs[] = {
         { 0x300398, 1, RI_E2E3E3B0_ONLINE },
         { 0x3003a0, 1, RI_E2E3E3B0_ONLINE },
         { 0x3003a8, 2, RI_E2E3E3B0_ONLINE },
-        { 0x300400, 1, RI_ALL_ONLINE },
         { 0x300404, 255, RI_E1E1H_OFFLINE },
         { 0x302000, 4, RI_ALL_ONLINE },
         { 0x302010, 2044, RI_ALL_OFFLINE },
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index c37a68d68090..ebf40cd7aa10 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -775,7 +775,7 @@ static void bnx2x_get_regs(struct net_device *dev,
         struct bnx2x *bp = netdev_priv(dev);
         struct dump_hdr dump_hdr = {0};
 
-        regs->version = 0;
+        regs->version = 1;
         memset(p, 0, regs->len);
 
         if (!netif_running(bp->dev))
@@ -1587,6 +1587,12 @@ static int bnx2x_set_pauseparam(struct net_device *dev,
                         bp->link_params.req_flow_ctrl[cfg_idx] =
                                 BNX2X_FLOW_CTRL_AUTO;
                 }
+                bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_NONE;
+                if (epause->rx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_RX;
+
+                if (epause->tx_pause)
+                        bp->link_params.req_fc_auto_adv |= BNX2X_FLOW_CTRL_TX;
         }
 
         DP(BNX2X_MSG_ETHTOOL,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index f4beb46c4709..b046beb435b2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -2667,9 +2667,11 @@ int bnx2x_update_pfc(struct link_params *params,
                 return bnx2x_status;
 
         DP(NETIF_MSG_LINK, "About to update PFC in BMAC\n");
-        if (CHIP_IS_E3(bp))
-                bnx2x_update_pfc_xmac(params, vars, 0);
-        else {
+
+        if (CHIP_IS_E3(bp)) {
+                if (vars->mac_type == MAC_TYPE_XMAC)
+                        bnx2x_update_pfc_xmac(params, vars, 0);
+        } else {
                 val = REG_RD(bp, MISC_REG_RESET_REG_2);
                 if ((val &
                      (MISC_REGISTERS_RESET_REG_2_RST_BMAC0 << params->port))
@@ -5432,7 +5434,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                 switch (speed_mask) {
                 case GP_STATUS_10M:
                         vars->line_speed = SPEED_10;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_10TFD;
                         else
                                 vars->link_status |= LINK_10THD;
@@ -5440,7 +5442,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
 
                 case GP_STATUS_100M:
                         vars->line_speed = SPEED_100;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_100TXFD;
                         else
                                 vars->link_status |= LINK_100TXHD;
@@ -5449,7 +5451,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
                 case GP_STATUS_1G:
                 case GP_STATUS_1G_KX:
                         vars->line_speed = SPEED_1000;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_1000TFD;
                         else
                                 vars->link_status |= LINK_1000THD;
@@ -5457,7 +5459,7 @@ static int bnx2x_get_link_speed_duplex(struct bnx2x_phy *phy,
 
                 case GP_STATUS_2_5G:
                         vars->line_speed = SPEED_2500;
-                        if (vars->duplex == DUPLEX_FULL)
+                        if (is_duplex == DUPLEX_FULL)
                                 vars->link_status |= LINK_2500TFD;
                         else
                                 vars->link_status |= LINK_2500THD;
@@ -5531,6 +5533,7 @@ static int bnx2x_link_settings_status(struct bnx2x_phy *phy,
 
         if (gp_status & MDIO_GP_STATUS_TOP_AN_STATUS1_LINK_STATUS) {
                 if (SINGLE_MEDIA_DIRECT(params)) {
+                        vars->duplex = duplex;
                         bnx2x_flow_ctrl_resolve(phy, params, vars, gp_status);
                         if (phy->req_line_speed == SPEED_AUTO_NEG)
                                 bnx2x_xgxs_an_resolve(phy, params, vars,
@@ -5625,6 +5628,7 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
                                         LINK_STATUS_PARALLEL_DETECTION_USED;
                         }
                         bnx2x_ext_phy_resolve_fc(phy, params, vars);
+                        vars->duplex = duplex;
                 }
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 88b4a5439263..e11485ca037d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -7555,8 +7555,14 @@ int bnx2x_set_mac_one(struct bnx2x *bp, u8 *mac,
         }
 
         rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-        if (rc < 0)
+
+        if (rc == -EEXIST) {
+                DP(BNX2X_MSG_SP, "Failed to schedule ADD operations: %d\n", rc);
+                /* do not treat adding same MAC as error */
+                rc = 0;
+        } else if (rc < 0)
                 BNX2X_ERR("%s MAC failed\n", (set ? "Set" : "Del"));
+
         return rc;
 }
 
@@ -9815,12 +9821,13 @@ static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
         }
 
 #ifdef CONFIG_PCI_MSI
-        /*
-         * It's expected that number of CAM entries for this functions is equal
-         * to the number evaluated based on the MSI-X table size. We want a
-         * harsh warning if these values are different!
+        /* Due to new PF resource allocation by MFW T7.4 and above, it's
+         * optional that number of CAM entries will not be equal to the value
+         * advertised in PCI.
+         * Driver should use the minimal value of both as the actual status
+         * block count
          */
-        WARN_ON(bp->igu_sb_cnt != igu_sb_cnt);
+        bp->igu_sb_cnt = min_t(int, bp->igu_sb_cnt, igu_sb_cnt);
 #endif
 
         if (igu_sb_cnt == 0)
@@ -10284,13 +10291,11 @@ static void __devinit bnx2x_get_fcoe_info(struct bnx2x *bp)
                                 dev_info.port_hw_config[port].
                                  fcoe_wwn_node_name_lower);
         } else if (!IS_MF_SD(bp)) {
-                u32 cfg = MF_CFG_RD(bp, func_ext_config[func].func_cfg);
-
                 /*
                  * Read the WWN info only if the FCoE feature is enabled for
                  * this function.
                  */
-                if (cfg & MACP_FUNC_CFG_FLAGS_FCOE_OFFLOAD)
+                if (BNX2X_MF_EXT_PROTOCOL_FCOE(bp) && !CHIP_IS_E1x(bp))
                         bnx2x_get_ext_wwn_info(bp, func);
 
         } else if (IS_MF_FCOE_SD(bp))
@@ -11063,7 +11068,14 @@ static int bnx2x_set_uc_list(struct bnx2x *bp)
         netdev_for_each_uc_addr(ha, dev) {
                 rc = bnx2x_set_mac_one(bp, bnx2x_uc_addr(ha), mac_obj, true,
                                        BNX2X_UC_LIST_MAC, &ramrod_flags);
-                if (rc < 0) {
+                if (rc == -EEXIST) {
+                        DP(BNX2X_MSG_SP,
+                           "Failed to schedule ADD operations: %d\n", rc);
+                        /* do not treat adding same MAC as error */
+                        rc = 0;
+
+                } else if (rc < 0) {
+
                         BNX2X_ERR("Failed to schedule ADD operations: %d\n",
                                   rc);
                         return rc;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index f83e033da6da..acf2fe4ca608 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -1321,7 +1321,7 @@ void bnx2x_init_mcast_obj(struct bnx2x *bp,
  * the current command will be enqueued to the tail of the
  * pending commands list.
  *
- * Return: 0 is operation was sucessfull and there are no pending completions,
+ * Return: 0 is operation was successfull and there are no pending completions,
  *         negative if there were errors, positive if there are pending
  *         completions.
  */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 332db64dd5be..a1d0446b39b3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -101,6 +101,11 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
         if (CHIP_REV_IS_SLOW(bp))
                 return;
 
+        /* Update MCP's statistics if possible */
+        if (bp->func_stx)
+                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
+                       sizeof(bp->func_stats));
+
         /* loader */
         if (bp->executer_idx) {
                 int loader_idx = PMF_DMAE_C(bp);
@@ -128,8 +133,6 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
 
         } else if (bp->func_stx) {
                 *stats_comp = 0;
-                memcpy(bnx2x_sp(bp, func_stats), &bp->func_stats,
-                       sizeof(bp->func_stats));
                 bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
         }
 }
@@ -1151,9 +1154,11 @@ static void bnx2x_stats_update(struct bnx2x *bp)
         if (bp->port.pmf)
                 bnx2x_hw_stats_update(bp);
 
-        if (bnx2x_storm_stats_update(bp) && (bp->stats_pending++ == 3)) {
-                BNX2X_ERR("storm stats were not updated for 3 times\n");
-                bnx2x_panic();
+        if (bnx2x_storm_stats_update(bp)) {
+                if (bp->stats_pending++ == 3) {
+                        BNX2X_ERR("storm stats were not updated for 3 times\n");
+                        bnx2x_panic();
+                }
                 return;
         }
 
diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c
index 77884191a8c6..4e980a7886fb 100644
--- a/drivers/net/ethernet/cadence/at91_ether.c
+++ b/drivers/net/ethernet/cadence/at91_ether.c
@@ -1086,7 +1086,7 @@ static int __init at91ether_probe(struct platform_device *pdev)
         /* Clock */
         lp->ether_clk = clk_get(&pdev->dev, "ether_clk");
         if (IS_ERR(lp->ether_clk)) {
-                res = -ENODEV;
+                res = PTR_ERR(lp->ether_clk);
                 goto err_ioumap;
         }
         clk_enable(lp->ether_clk);
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 8971921cc1c8..ab6762caa957 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -1773,6 +1773,7 @@ static int gfar_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
 }
 
 int gfar_phc_index = -1;
+EXPORT_SYMBOL(gfar_phc_index);
 
 static int gfar_get_ts_info(struct net_device *dev,
                             struct ethtool_ts_info *info)
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index c08e5d40fecb..0daa66b8eca0 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -515,7 +515,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
                 err = PTR_ERR(etsects->clock);
                 goto no_clock;
         }
-        gfar_phc_clock = ptp_clock_index(etsects->clock);
+        gfar_phc_index = ptp_clock_index(etsects->clock);
 
         dev_set_drvdata(&dev->dev, etsects);
 
@@ -539,7 +539,7 @@ static int gianfar_ptp_remove(struct platform_device *dev)
         gfar_write(&etsects->regs->tmr_temask, 0);
         gfar_write(&etsects->regs->tmr_ctrl,   0);
 
-        gfar_phc_clock = -1;
+        gfar_phc_index = -1;
         ptp_clock_unregister(etsects->clock);
         iounmap(etsects->regs);
         release_resource(etsects->rsrc);
diff --git a/drivers/net/ethernet/i825xx/znet.c b/drivers/net/ethernet/i825xx/znet.c
index bd1f1ef91e19..ba4e0cea3506 100644
--- a/drivers/net/ethernet/i825xx/znet.c
+++ b/drivers/net/ethernet/i825xx/znet.c
@@ -139,8 +139,11 @@ struct znet_private {
 /* Only one can be built-in;-> */
 static struct net_device *znet_dev;
 
+#define NETIDBLK_MAGIC          "NETIDBLK"
+#define NETIDBLK_MAGIC_SIZE     8
+
 struct netidblk {
-        char magic[8];          /* The magic number (string) "NETIDBLK" */
+        char magic[NETIDBLK_MAGIC_SIZE];        /* The magic number (string) "NETIDBLK" */
         unsigned char netid[8]; /* The physical station address */
         char nettype, globalopt;
         char vendor[8];         /* The machine vendor and product name. */
@@ -373,14 +376,16 @@ static int __init znet_probe (void)
         struct znet_private *znet;
         struct net_device *dev;
         char *p;
+        char *plast = phys_to_virt(0x100000 - NETIDBLK_MAGIC_SIZE);
         int err = -ENOMEM;
 
         /* This code scans the region 0xf0000 to 0xfffff for a "NETIDBLK". */
-        for(p = (char *)phys_to_virt(0xf0000); p < (char *)phys_to_virt(0x100000); p++)
-                if (*p == 'N'  &&  strncmp(p, "NETIDBLK", 8) == 0)
+        for(p = (char *)phys_to_virt(0xf0000); p <= plast; p++)
+                if (*p == 'N' &&
+                    strncmp(p, NETIDBLK_MAGIC, NETIDBLK_MAGIC_SIZE) == 0)
                         break;
 
-        if (p >= (char *)phys_to_virt(0x100000)) {
+        if (p > plast) {
                 if (znet_debug > 1)
                         printk(KERN_INFO "No Z-Note ethernet adaptor found.\n");
                 return -ENODEV;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 9010cea68bc3..b68d28a130e6 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
         }
 
         if (adapter->rx_queue.queue_addr != NULL) {
-                if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
-                        dma_unmap_single(dev,
-                                        adapter->rx_queue.queue_dma,
-                                        adapter->rx_queue.queue_len,
-                                        DMA_BIDIRECTIONAL);
-                        adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
-                }
-                kfree(adapter->rx_queue.queue_addr);
+                dma_free_coherent(dev, adapter->rx_queue.queue_len,
+                                  adapter->rx_queue.queue_addr,
+                                  adapter->rx_queue.queue_dma);
                 adapter->rx_queue.queue_addr = NULL;
         }
 
@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_device *netdev)
                 goto err_out;
         }
 
+        dev = &adapter->vdev->dev;
+
         adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
                                                 rxq_entries;
-        adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
-                                                GFP_KERNEL);
+        adapter->rx_queue.queue_addr =
+            dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
+                               &adapter->rx_queue.queue_dma, GFP_KERNEL);
 
         if (!adapter->rx_queue.queue_addr) {
                 netdev_err(netdev, "unable to allocate rx queue pages\n");
@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_device *netdev)
                 goto err_out;
         }
 
-        dev = &adapter->vdev->dev;
-
         adapter->buffer_list_dma = dma_map_single(dev,
                         adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
         adapter->filter_list_dma = dma_map_single(dev,
                         adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
-        adapter->rx_queue.queue_dma = dma_map_single(dev,
-                        adapter->rx_queue.queue_addr,
-                        adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
 
         if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
-            (dma_mapping_error(dev, adapter->filter_list_dma)) ||
-            (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
+            (dma_mapping_error(dev, adapter->filter_list_dma))) {
                 netdev_err(netdev, "unable to map filter or buffer list "
                            "pages\n");
                 rc = -ENOMEM;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 524cfb4cac61..f3f9aeb7d1e1 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -3149,6 +3149,17 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                 return NETDEV_TX_OK;
         }
 
+        /* On PCI/PCI-X HW, if packet size is less than ETH_ZLEN,
+         * packets may get corrupted during padding by HW.
+         * To WA this issue, pad all small packets manually.
+         */
+        if (skb->len < ETH_ZLEN) {
+                if (skb_pad(skb, ETH_ZLEN - skb->len))
+                        return NETDEV_TX_OK;
+                skb->len = ETH_ZLEN;
+                skb_set_tail_pointer(skb, ETH_ZLEN);
+        }
+
         mss = skb_shinfo(skb)->gso_size;
         /* The controller does a simple calculation to
          * make sure there is enough room in the FIFO before
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index daf417923661..31d02649be41 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -227,9 +227,10 @@ int mlx4_UNMAP_ICM_AUX(struct mlx4_dev *dev)
                         MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 }
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
+        u32 i = (obj & (table->num_obj - 1)) /
+                        (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
         int ret = 0;
 
         mutex_lock(&table->mutex);
@@ -262,16 +263,18 @@ out:
         return ret;
 }
 
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i;
+        u32 i;
+        u64 offset;
 
         i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
 
         mutex_lock(&table->mutex);
 
         if (--table->icm[i]->refcount == 0) {
-                mlx4_UNMAP_ICM(dev, table->virt + i * MLX4_TABLE_CHUNK_SIZE,
+                offset = (u64) i * MLX4_TABLE_CHUNK_SIZE;
+                mlx4_UNMAP_ICM(dev, table->virt + offset,
                                MLX4_TABLE_CHUNK_SIZE / MLX4_ICM_PAGE_SIZE);
                 mlx4_free_icm(dev, table->icm[i], table->coherent);
                 table->icm[i] = NULL;
@@ -280,9 +283,11 @@ void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
         mutex_unlock(&table->mutex);
 }
 
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle)
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+                        dma_addr_t *dma_handle)
 {
-        int idx, offset, dma_offset, i;
+        int offset, dma_offset, i;
+        u64 idx;
         struct mlx4_icm_chunk *chunk;
         struct mlx4_icm *icm;
         struct page *page = NULL;
@@ -292,7 +297,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_han
 
         mutex_lock(&table->mutex);
 
-        idx = (obj & (table->num_obj - 1)) * table->obj_size;
+        idx = (u64) (obj & (table->num_obj - 1)) * table->obj_size;
         icm = table->icm[idx / MLX4_TABLE_CHUNK_SIZE];
         dma_offset = offset = idx % MLX4_TABLE_CHUNK_SIZE;
 
@@ -326,10 +331,11 @@ out:
 }
 
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end)
+                         u32 start, u32 end)
 {
         int inc = MLX4_TABLE_CHUNK_SIZE / table->obj_size;
-        int i, err;
+        int err;
+        u32 i;
 
         for (i = start; i <= end; i += inc) {
                 err = mlx4_table_get(dev, table, i);
@@ -349,9 +355,9 @@ fail:
 }
 
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end)
+                          u32 start, u32 end)
 {
-        int i;
+        u32 i;
 
         for (i = start; i <= end; i += MLX4_TABLE_CHUNK_SIZE / table->obj_size)
                 mlx4_table_put(dev, table, i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index a67744f53506..dee67fa39107 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -71,17 +71,17 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                                 gfp_t gfp_mask, int coherent);
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent);
 
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end);
+                         u32 start, u32 end);
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end);
+                          u32 start, u32 end);
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                         u64 virt, int obj_size, u32 nobj, int reserved,
                         int use_lowmem, int use_coherent);
 void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table);
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle);
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, dma_addr_t *dma_handle);
 
 static inline void mlx4_icm_first(struct mlx4_icm *icm,
                                   struct mlx4_icm_iter *iter)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 3d65097e0a89..dd6ea942625c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1234,13 +1234,13 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                                 mlx4_info(dev, "non-primary physical function, skipping.\n");
                         else
                                 mlx4_err(dev, "QUERY_FW command failed, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 err = mlx4_load_fw(dev);
                 if (err) {
                         mlx4_err(dev, "Failed to start FW, aborting.\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 mlx4_cfg.log_pg_sz_m = 1;
@@ -1304,7 +1304,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
                 err = mlx4_init_slave(dev);
                 if (err) {
                         mlx4_err(dev, "Failed to initialize slave\n");
-                        goto unmap_bf;
+                        return err;
                 }
 
                 err = mlx4_slave_cap(dev);
@@ -1324,7 +1324,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
         err = mlx4_QUERY_ADAPTER(dev, &adapter);
         if (err) {
                 mlx4_err(dev, "QUERY_ADAPTER command failed, aborting.\n");
-                goto err_close;
+                goto unmap_bf;
         }
 
         priv->eq_table.inta_pin = adapter.inta_pin;
@@ -1332,6 +1332,9 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
         return 0;
 
+unmap_bf:
+        unmap_bf_area(dev);
+
 err_close:
         mlx4_close_hca(dev);
 
@@ -1344,8 +1347,6 @@ err_stop_fw:
                 mlx4_UNMAP_FA(dev);
                 mlx4_free_icm(dev, priv->fw.fw_icm, 0);
         }
-unmap_bf:
-        unmap_bf_area(dev);
         return err;
 }
 
@@ -1996,7 +1997,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         }
 
 slave_start:
-        if (mlx4_cmd_init(dev)) {
+        err = mlx4_cmd_init(dev);
+        if (err) {
                 mlx4_err(dev, "Failed to init command interface, aborting.\n");
                 goto err_sriov;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index a018ea2a43de..e151c21baf2b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -137,11 +137,11 @@ static int mlx4_GID_HASH(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
         return err;
 }
 
-static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 pf_num,
+static struct mlx4_promisc_qp *get_promisc_qp(struct mlx4_dev *dev, u8 port,
                                               enum mlx4_steer_type steer,
                                               u32 qpn)
 {
-        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[pf_num];
+        struct mlx4_steer *s_steer = &mlx4_priv(dev)->steer[port - 1];
         struct mlx4_promisc_qp *pqp;
 
         list_for_each_entry(pqp, &s_steer->promisc_qps[steer], list) {
@@ -182,7 +182,7 @@ static int new_steering_entry(struct mlx4_dev *dev, u8 port,
         /* If the given qpn is also a promisc qp,
          * it should be inserted to duplicates list
          */
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (pqp) {
                 dqp = kmalloc(sizeof *dqp, GFP_KERNEL);
                 if (!dqp) {
@@ -256,7 +256,7 @@ static int existing_steering_entry(struct mlx4_dev *dev, u8 port,
 
         s_steer = &mlx4_priv(dev)->steer[port - 1];
 
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (!pqp)
                 return 0; /* nothing to do */
 
@@ -302,7 +302,7 @@ static bool check_duplicate_entry(struct mlx4_dev *dev, u8 port,
         s_steer = &mlx4_priv(dev)->steer[port - 1];
 
         /* if qp is not promisc, it cannot be duplicated */
-        if (!get_promisc_qp(dev, 0, steer, qpn))
+        if (!get_promisc_qp(dev, port, steer, qpn))
                 return false;
 
         /* The qp is promisc qp so it is a duplicate on this index
@@ -352,7 +352,7 @@ static bool can_remove_steering_entry(struct mlx4_dev *dev, u8 port,
         members_count = be32_to_cpu(mgm->members_count) & 0xffffff;
         for (i = 0;  i < members_count; i++) {
                 qpn = be32_to_cpu(mgm->qp[i]) & MGM_QPN_MASK;
-                if (!get_promisc_qp(dev, 0, steer, qpn) && qpn != tqpn) {
+                if (!get_promisc_qp(dev, port, steer, qpn) && qpn != tqpn) {
                         /* the qp is not promisc, the entry can't be removed */
                         goto out;
                 }
@@ -398,7 +398,7 @@ static int add_promisc_qp(struct mlx4_dev *dev, u8 port,
 
         mutex_lock(&priv->mcg_table.mutex);
 
-        if (get_promisc_qp(dev, 0, steer, qpn)) {
+        if (get_promisc_qp(dev, port, steer, qpn)) {
                 err = 0;  /* Noting to do, already exists */
                 goto out_mutex;
         }
@@ -503,7 +503,7 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 port,
         s_steer = &mlx4_priv(dev)->steer[port - 1];
         mutex_lock(&priv->mcg_table.mutex);
 
-        pqp = get_promisc_qp(dev, 0, steer, qpn);
+        pqp = get_promisc_qp(dev, port, steer, qpn);
         if (unlikely(!pqp)) {
                 mlx4_warn(dev, "QP %x is not promiscuous QP\n", qpn);
                 /* nothing to do */
@@ -650,13 +650,6 @@ static int find_entry(struct mlx4_dev *dev, u8 port,
         return err;
 }
 
-struct mlx4_net_trans_rule_hw_ctrl {
-        __be32 ctrl;
-        __be32 vf_vep_port;
-        __be32 qpn;
-        __be32 reserved;
-};
-
 static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
                                   struct mlx4_net_trans_rule_hw_ctrl *hw)
 {
@@ -680,87 +673,18 @@ static void trans_rule_ctrl_to_hw(struct mlx4_net_trans_rule *ctrl,
         hw->qpn = cpu_to_be32(ctrl->qpn);
 }
 
-struct mlx4_net_trans_rule_hw_ib {
-        u8      size;
-        u8      rsvd1;
-        __be16  id;
-        u32     rsvd2;
-        __be32  qpn;
-        __be32  qpn_mask;
-        u8      dst_gid[16];
-        u8      dst_gid_msk[16];
-} __packed;
-
-struct mlx4_net_trans_rule_hw_eth {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        u8      rsvd1[6];
-        u8      dst_mac[6];
-        u16     rsvd2;
-        u8      dst_mac_msk[6];
-        u16     rsvd3;
-        u8      src_mac[6];
-        u16     rsvd4;
-        u8      src_mac_msk[6];
-        u8      rsvd5;
-        u8      ether_type_enable;
-        __be16  ether_type;
-        __be16  vlan_id_msk;
-        __be16  vlan_id;
-} __packed;
-
-struct mlx4_net_trans_rule_hw_tcp_udp {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be16  rsvd1[3];
-        __be16  dst_port;
-        __be16  rsvd2;
-        __be16  dst_port_msk;
-        __be16  rsvd3;
-        __be16  src_port;
-        __be16  rsvd4;
-        __be16  src_port_msk;
-} __packed;
-
-struct mlx4_net_trans_rule_hw_ipv4 {
-        u8      size;
-        u8      rsvd;
-        __be16  id;
-        __be32  rsvd1;
-        __be32  dst_ip;
-        __be32  dst_ip_msk;
-        __be32  src_ip;
-        __be32  src_ip_msk;
-} __packed;
-
-struct _rule_hw {
-        union {
-                struct {
-                        u8 size;
-                        u8 rsvd;
-                        __be16 id;
-                };
-                struct mlx4_net_trans_rule_hw_eth eth;
-                struct mlx4_net_trans_rule_hw_ib ib;
-                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
-                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
-        };
+const u16 __sw_id_hw[] = {
+        [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
+        [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
+        [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
+        [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
+        [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
+        [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
 };
 
 static int parse_trans_rule(struct mlx4_dev *dev, struct mlx4_spec_list *spec,
                             struct _rule_hw *rule_hw)
 {
-        static const u16 __sw_id_hw[] = {
-                [MLX4_NET_TRANS_RULE_ID_ETH]     = 0xE001,
-                [MLX4_NET_TRANS_RULE_ID_IB]      = 0xE005,
-                [MLX4_NET_TRANS_RULE_ID_IPV6]    = 0xE003,
-                [MLX4_NET_TRANS_RULE_ID_IPV4]    = 0xE002,
-                [MLX4_NET_TRANS_RULE_ID_TCP]     = 0xE004,
-                [MLX4_NET_TRANS_RULE_ID_UDP]     = 0xE006
-        };
-
         static const size_t __rule_hw_sz[] = {
                 [MLX4_NET_TRANS_RULE_ID_ETH] =
                         sizeof(struct mlx4_net_trans_rule_hw_eth),
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 4d9df8f2a126..dba69d98734a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -690,6 +690,82 @@ struct mlx4_steer {
         struct list_head steer_entries[MLX4_NUM_STEERS];
 };
 
+struct mlx4_net_trans_rule_hw_ctrl {
+        __be32 ctrl;
+        __be32 vf_vep_port;
+        __be32 qpn;
+        __be32 reserved;
+};
+
+struct mlx4_net_trans_rule_hw_ib {
+        u8 size;
+        u8 rsvd1;
+        __be16 id;
+        u32 rsvd2;
+        __be32 qpn;
+        __be32 qpn_mask;
+        u8 dst_gid[16];
+        u8 dst_gid_msk[16];
+} __packed;
+
+struct mlx4_net_trans_rule_hw_eth {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        u8      rsvd1[6];
+        u8      dst_mac[6];
+        u16     rsvd2;
+        u8      dst_mac_msk[6];
+        u16     rsvd3;
+        u8      src_mac[6];
+        u16     rsvd4;
+        u8      src_mac_msk[6];
+        u8      rsvd5;
+        u8      ether_type_enable;
+        __be16  ether_type;
+        __be16  vlan_id_msk;
+        __be16  vlan_id;
+} __packed;
+
+struct mlx4_net_trans_rule_hw_tcp_udp {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be16  rsvd1[3];
+        __be16  dst_port;
+        __be16  rsvd2;
+        __be16  dst_port_msk;
+        __be16  rsvd3;
+        __be16  src_port;
+        __be16  rsvd4;
+        __be16  src_port_msk;
+} __packed;
+
+struct mlx4_net_trans_rule_hw_ipv4 {
+        u8      size;
+        u8      rsvd;
+        __be16  id;
+        __be32  rsvd1;
+        __be32  dst_ip;
+        __be32  dst_ip_msk;
+        __be32  src_ip;
+        __be32  src_ip_msk;
+} __packed;
+
+struct _rule_hw {
+        union {
+                struct {
+                        u8 size;
+                        u8 rsvd;
+                        __be16 id;
+                };
+                struct mlx4_net_trans_rule_hw_eth eth;
+                struct mlx4_net_trans_rule_hw_ib ib;
+                struct mlx4_net_trans_rule_hw_ipv4 ipv4;
+                struct mlx4_net_trans_rule_hw_tcp_udp tcp_udp;
+        };
+};
+
 struct mlx4_priv {
         struct mlx4_dev         dev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 94ceddd17ab2..293c9e820c49 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -42,6 +42,7 @@
 #include <linux/mlx4/cmd.h>
 #include <linux/mlx4/qp.h>
 #include <linux/if_ether.h>
+#include <linux/etherdevice.h>
 
 #include "mlx4.h"
 #include "fw.h"
@@ -2776,18 +2777,133 @@ ex_put:
         return err;
 }
 
+/*
+ * MAC validation for Flow Steering rules.
+ * VF can attach rules only with a mac address which is assigned to it.
+ */
+static int validate_eth_header_mac(int slave, struct _rule_hw *eth_header,
+                                   struct list_head *rlist)
+{
+        struct mac_res *res, *tmp;
+        __be64 be_mac;
+
+        /* make sure it isn't multicast or broadcast mac*/
+        if (!is_multicast_ether_addr(eth_header->eth.dst_mac) &&
+            !is_broadcast_ether_addr(eth_header->eth.dst_mac)) {
+                list_for_each_entry_safe(res, tmp, rlist, list) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        if (!memcmp(&be_mac, eth_header->eth.dst_mac, ETH_ALEN))
+                                return 0;
+                }
+                pr_err("MAC %pM doesn't belong to VF %d, Steering rule rejected\n",
+                       eth_header->eth.dst_mac, slave);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+/*
+ * In case of missing eth header, append eth header with a MAC address
+ * assigned to the VF.
+ */
+static int add_eth_header(struct mlx4_dev *dev, int slave,
+                          struct mlx4_cmd_mailbox *inbox,
+                          struct list_head *rlist, int header_id)
+{
+        struct mac_res *res, *tmp;
+        u8 port;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct mlx4_net_trans_rule_hw_eth *eth_header;
+        struct mlx4_net_trans_rule_hw_ipv4 *ip_header;
+        struct mlx4_net_trans_rule_hw_tcp_udp *l4_header;
+        __be64 be_mac = 0;
+        __be64 mac_msk = cpu_to_be64(MLX4_MAC_MASK << 16);
+
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        port = be32_to_cpu(ctrl->vf_vep_port) & 0xff;
+        eth_header = (struct mlx4_net_trans_rule_hw_eth *)(ctrl + 1);
+
+        /* Clear a space in the inbox for eth header */
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+                ip_header =
+                        (struct mlx4_net_trans_rule_hw_ipv4 *)(eth_header + 1);
+                memmove(ip_header, eth_header,
+                        sizeof(*ip_header) + sizeof(*l4_header));
+                break;
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                l4_header = (struct mlx4_net_trans_rule_hw_tcp_udp *)
+                            (eth_header + 1);
+                memmove(l4_header, eth_header, sizeof(*l4_header));
+                break;
+        default:
+                return -EINVAL;
+        }
+        list_for_each_entry_safe(res, tmp, rlist, list) {
+                if (port == res->port) {
+                        be_mac = cpu_to_be64(res->mac << 16);
+                        break;
+                }
+        }
+        if (!be_mac) {
+                pr_err("Failed adding eth header to FS rule, Can't find matching MAC for port %d .\n",
+                       port);
+                return -EINVAL;
+        }
+
+        memset(eth_header, 0, sizeof(*eth_header));
+        eth_header->size = sizeof(*eth_header) >> 2;
+        eth_header->id = cpu_to_be16(__sw_id_hw[MLX4_NET_TRANS_RULE_ID_ETH]);
+        memcpy(eth_header->dst_mac, &be_mac, ETH_ALEN);
+        memcpy(eth_header->dst_mac_msk, &mac_msk, ETH_ALEN);
+
+        return 0;
+
+}
+
 int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                                          struct mlx4_vhcr *vhcr,
                                          struct mlx4_cmd_mailbox *inbox,
                                          struct mlx4_cmd_mailbox *outbox,
                                          struct mlx4_cmd_info *cmd)
 {
+
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        struct mlx4_resource_tracker *tracker = &priv->mfunc.master.res_tracker;
+        struct list_head *rlist = &tracker->slave_list[slave].res_list[RES_MAC];
         int err;
+        struct mlx4_net_trans_rule_hw_ctrl *ctrl;
+        struct _rule_hw  *rule_header;
+        int header_id;
 
         if (dev->caps.steering_mode !=
             MLX4_STEERING_MODE_DEVICE_MANAGED)
                 return -EOPNOTSUPP;
 
+        ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
+        rule_header = (struct _rule_hw *)(ctrl + 1);
+        header_id = map_hw_to_sw_id(be16_to_cpu(rule_header->id));
+
+        switch (header_id) {
+        case MLX4_NET_TRANS_RULE_ID_ETH:
+                if (validate_eth_header_mac(slave, rule_header, rlist))
+                        return -EINVAL;
+                break;
+        case MLX4_NET_TRANS_RULE_ID_IPV4:
+        case MLX4_NET_TRANS_RULE_ID_TCP:
+        case MLX4_NET_TRANS_RULE_ID_UDP:
+                pr_warn("Can't attach FS rule without L2 headers, adding L2 header.\n");
+                if (add_eth_header(dev, slave, inbox, rlist, header_id))
+                        return -EINVAL;
+                vhcr->in_modifier +=
+                        sizeof(struct mlx4_net_trans_rule_hw_eth) >> 2;
+                break;
+        default:
+                pr_err("Corrupted mailbox.\n");
+                return -EINVAL;
+        }
+
         err = mlx4_cmd_imm(dev, inbox->dma, &vhcr->out_param,
                            vhcr->in_modifier, 0,
                            MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A,
diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
index c42bbb16cdae..a688a2ddcfd6 100644
--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -722,10 +722,8 @@ static int octeon_mgmt_init_phy(struct net_device *netdev)
                                    octeon_mgmt_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
 
-        if (IS_ERR(p->phydev)) {
-                p->phydev = NULL;
+        if (!p->phydev)
                 return -1;
-        }
 
         phy_start_aneg(p->phydev);
 
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index e559dfa06d6a..6fa74d530e44 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1101,9 +1101,9 @@ static int pasemi_mac_phy_init(struct net_device *dev)
         phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
                                 PHY_INTERFACE_MODE_SGMII);
 
-        if (IS_ERR(phydev)) {
+        if (!phydev) {
                 printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
-                return PTR_ERR(phydev);
+                return -ENODEV;
         }
 
         mac->phydev = phydev;
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index fdc5ca0f7b64..df450616ab37 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1378,6 +1378,10 @@ static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)
         struct pci_dev *root = pdev->bus->self;
         u32 aer_pos;
 
+        /* root bus? */
+        if (!root)
+                return;
+
         if (adapter->ahw.board_type != NETXEN_BRDTYPE_P3_4_GB_MM &&
                 adapter->ahw.board_type != NETXEN_BRDTYPE_P3_10G_TP)
                 return;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index b8ead696141e..2a179d087207 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -15,7 +15,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 
         do {
                 /* give atleast 1ms for firmware to respond */
-                msleep(1);
+                mdelay(1);
 
                 if (++timeout > QLCNIC_OS_CRB_RETRY_COUNT)
                         return QLCNIC_CDRP_RSP_TIMEOUT;
@@ -601,7 +601,7 @@ void qlcnic_fw_destroy_ctx(struct qlcnic_adapter *adapter)
                 qlcnic_fw_cmd_destroy_tx_ctx(adapter);
 
                 /* Allow dma queues to drain after context reset */
-                msleep(20);
+                mdelay(20);
         }
 }
 
diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
index bb8c8222122b..4d15bf413bdc 100644
--- a/drivers/net/ethernet/seeq/sgiseeq.c
+++ b/drivers/net/ethernet/seeq/sgiseeq.c
@@ -751,6 +751,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
         sp->srings = sr;
         sp->rx_desc = sp->srings->rxvector;
         sp->tx_desc = sp->srings->txvector;
+        spin_lock_init(&sp->tx_lock);
 
         /* A couple calculations now, saves many cycles later. */
         setup_rx_ring(dev, sp->rx_desc, SEEQ_RX_BUFFERS);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index c136162e6473..3be88331d17a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1066,7 +1066,7 @@ static int stmmac_open(struct net_device *dev)
         } else
                 priv->tm->enable = 1;
 #endif
-        clk_enable(priv->stmmac_clk);
+        clk_prepare_enable(priv->stmmac_clk);
 
         stmmac_check_ether_addr(priv);
 
@@ -1188,7 +1188,7 @@ open_error:
         if (priv->phydev)
                 phy_disconnect(priv->phydev);
 
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 
         return ret;
 }
@@ -1246,7 +1246,7 @@ static int stmmac_release(struct net_device *dev)
 #ifdef CONFIG_STMMAC_DEBUG_FS
         stmmac_exit_fs();
 #endif
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 
         return 0;
 }
@@ -2178,7 +2178,7 @@ int stmmac_suspend(struct net_device *ndev)
         else {
                 stmmac_set_mac(priv->ioaddr, false);
                 /* Disable clock in case of PWM is off */
-                clk_disable(priv->stmmac_clk);
+                clk_disable_unprepare(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
         return 0;
@@ -2203,7 +2203,7 @@ int stmmac_resume(struct net_device *ndev)
                 priv->hw->mac->pmt(priv->ioaddr, 0);
         else
                 /* enable the clk prevously disabled */
-                clk_enable(priv->stmmac_clk);
+                clk_prepare_enable(priv->stmmac_clk);
 
         netif_device_attach(ndev);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
index 2a0e1abde7e7..4ccd4e2977b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
@@ -97,19 +97,19 @@ static struct clk *timer_clock;
 static void stmmac_tmu_start(unsigned int new_freq)
 {
         clk_set_rate(timer_clock, new_freq);
-        clk_enable(timer_clock);
+        clk_prepare_enable(timer_clock);
 }
 
 static void stmmac_tmu_stop(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
 }
 
 int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 {
         timer_clock = clk_get(NULL, TMU_CHANNEL);
 
-        if (timer_clock == NULL)
+        if (IS_ERR(timer_clock))
                 return -1;
 
         if (tmu2_register_user(stmmac_timer_handler, (void *)dev) < 0) {
@@ -126,7 +126,7 @@ int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 
 int stmmac_close_ext_timer(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
         tmu2_unregister_user();
         clk_put(timer_clock);
         return 0;
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 256eddf1f75a..795109425568 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -280,7 +280,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
         }
 
         clk = clk_get(NULL, "irda_clk");
-        if (!clk) {
+        if (IS_ERR(clk)) {
                 dev_err(dev, "can not get irda_clk\n");
                 return -EIO;
         }
diff --git a/drivers/net/phy/bcm87xx.c b/drivers/net/phy/bcm87xx.c
index 2346b38b9837..799789518e87 100644
--- a/drivers/net/phy/bcm87xx.c
+++ b/drivers/net/phy/bcm87xx.c
@@ -229,3 +229,5 @@ static void __exit bcm87xx_exit(void)
                 ARRAY_SIZE(bcm87xx_driver));
 }
 module_exit(bcm87xx_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf287e0eb408..2165d5fdb8c0 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -21,6 +21,12 @@
 #include <linux/phy.h>
 #include <linux/micrel_phy.h>
 
+/* Operation Mode Strap Override */
+#define MII_KSZPHY_OMSO                         0x16
+#define KSZPHY_OMSO_B_CAST_OFF                  (1 << 9)
+#define KSZPHY_OMSO_RMII_OVERRIDE               (1 << 1)
+#define KSZPHY_OMSO_MII_OVERRIDE                (1 << 0)
+
 /* general Interrupt control/status reg in vendor specific block. */
 #define MII_KSZPHY_INTCS                        0x1B
 #define KSZPHY_INTCS_JABBER                     (1 << 15)
@@ -101,6 +107,13 @@ static int kszphy_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int ksz8021_config_init(struct phy_device *phydev)
+{
+        const u16 val = KSZPHY_OMSO_B_CAST_OFF | KSZPHY_OMSO_RMII_OVERRIDE;
+        phy_write(phydev, MII_KSZPHY_OMSO, val);
+        return 0;
+}
+
 static int ks8051_config_init(struct phy_device *phydev)
 {
         int regval;
@@ -128,9 +141,22 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = ks8737_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8041,
+        .phy_id         = PHY_ID_KSZ8021,
+        .phy_id_mask    = 0x00ffffff,
+        .name           = "Micrel KSZ8021",
+        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = ksz8021_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_KSZ8041,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8041",
+        .name           = "Micrel KSZ8041",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -141,9 +167,9 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8051,
+        .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8051",
+        .name           = "Micrel KSZ8051",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -154,8 +180,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8001,
-        .name           = "Micrel KS8001 or KS8721",
+        .phy_id         = PHY_ID_KSZ8001,
+        .name           = "Micrel KSZ8001 or KS8721",
         .phy_id_mask    = 0x00ffffff,
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -201,10 +227,11 @@ MODULE_LICENSE("GPL");
 
 static struct mdio_device_id __maybe_unused micrel_tbl[] = {
         { PHY_ID_KSZ9021, 0x000ffffe },
-        { PHY_ID_KS8001, 0x00ffffff },
+        { PHY_ID_KSZ8001, 0x00ffffff },
         { PHY_ID_KS8737, 0x00fffff0 },
-        { PHY_ID_KS8041, 0x00fffff0 },
-        { PHY_ID_KS8051, 0x00fffff0 },
+        { PHY_ID_KSZ8021, 0x00ffffff },
+        { PHY_ID_KSZ8041, 0x00fffff0 },
+        { PHY_ID_KSZ8051, 0x00fffff0 },
         { }
 };
 
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 6d6192316b30..88e3991464e7 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -56,6 +56,32 @@ static int smsc_phy_config_init(struct phy_device *phydev)
         return smsc_phy_ack_interrupt (phydev);
 }
 
+static int lan87xx_config_init(struct phy_device *phydev)
+{
+        /*
+         * Make sure the EDPWRDOWN bit is NOT set. Setting this bit on
+         * LAN8710/LAN8720 PHY causes the PHY to misbehave, likely due
+         * to a bug on the chip.
+         *
+         * When the system is powered on with the network cable being
+         * disconnected all the way until after ifconfig ethX up is
+         * issued for the LAN port with this PHY, connecting the cable
+         * afterwards does not cause LINK change detection, while the
+         * expected behavior is the Link UP being detected.
+         */
+        int rc = phy_read(phydev, MII_LAN83C185_CTRL_STATUS);
+        if (rc < 0)
+                return rc;
+
+        rc &= ~MII_LAN83C185_EDPWRDOWN;
+
+        rc = phy_write(phydev, MII_LAN83C185_CTRL_STATUS, rc);
+        if (rc < 0)
+                return rc;
+
+        return smsc_phy_ack_interrupt(phydev);
+}
+
 static int lan911x_config_init(struct phy_device *phydev)
 {
         return smsc_phy_ack_interrupt(phydev);
@@ -162,7 +188,7 @@ static struct phy_driver smsc_phy_driver[] = {
         /* basic functions */
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
-        .config_init    = smsc_phy_config_init,
+        .config_init    = lan87xx_config_init,
 
         /* IRQ related */
         .ack_interrupt  = smsc_phy_ack_interrupt,
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index cbf7047decc0..20f31d0d1536 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -570,7 +570,7 @@ static int pppoe_release(struct socket *sock)
 
         po = pppox_sk(sk);
 
-        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                 dev_put(po->pppoe_dev);
                 po->pppoe_dev = NULL;
         }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 341b65dbbcd3..f8cd61f449a4 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -848,7 +848,7 @@ static struct netpoll_info *team_netpoll_info(struct team *team)
 }
 #endif
 
-static void __team_port_change_check(struct team_port *port, bool linkup);
+static void __team_port_change_port_added(struct team_port *port, bool linkup);
 
 static int team_port_add(struct team *team, struct net_device *port_dev)
 {
@@ -948,7 +948,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
         team_port_enable(team, port);
         list_add_tail_rcu(&port->list, &team->port_list);
         __team_compute_features(team);
-        __team_port_change_check(port, !!netif_carrier_ok(port_dev));
+        __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
         __team_options_change_check(team);
 
         netdev_info(dev, "Port device %s added\n", portname);
@@ -983,6 +983,8 @@ err_set_mtu:
         return err;
 }
 
+static void __team_port_change_port_removed(struct team_port *port);
+
 static int team_port_del(struct team *team, struct net_device *port_dev)
 {
         struct net_device *dev = team->dev;
@@ -999,8 +1001,7 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
         __team_option_inst_mark_removed_port(team, port);
         __team_options_change_check(team);
         __team_option_inst_del_port(team, port);
-        port->removed = true;
-        __team_port_change_check(port, false);
+        __team_port_change_port_removed(port);
         team_port_disable(team, port);
         list_del_rcu(&port->list);
         netdev_rx_handler_unregister(port_dev);
@@ -1652,8 +1653,8 @@ static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
 
         hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq,
                           &team_nl_family, 0, TEAM_CMD_NOOP);
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
+        if (!hdr) {
+                err = -EMSGSIZE;
                 goto err_msg_put;
         }
 
@@ -1847,8 +1848,8 @@ start_again:
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags | NLM_F_MULTI,
                           TEAM_CMD_OPTIONS_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2067,8 +2068,8 @@ static int team_nl_fill_port_list_get(struct sk_buff *skb,
 
         hdr = genlmsg_put(skb, pid, seq, &team_nl_family, flags,
                           TEAM_CMD_PORT_LIST_GET);
-        if (IS_ERR(hdr))
-                return PTR_ERR(hdr);
+        if (!hdr)
+                return -EMSGSIZE;
 
         if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
                 goto nla_put_failure;
@@ -2251,13 +2252,11 @@ static void __team_options_change_check(struct team *team)
 }
 
 /* rtnl lock is held */
-static void __team_port_change_check(struct team_port *port, bool linkup)
+
+static void __team_port_change_send(struct team_port *port, bool linkup)
 {
         int err;
 
-        if (!port->removed && port->state.linkup == linkup)
-                return;
-
         port->changed = true;
         port->state.linkup = linkup;
         team_refresh_port_linkup(port);
@@ -2282,6 +2281,23 @@ send_event:
 
 }
 
+static void __team_port_change_check(struct team_port *port, bool linkup)
+{
+        if (port->state.linkup != linkup)
+                __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_added(struct team_port *port, bool linkup)
+{
+        __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_removed(struct team_port *port)
+{
+        port->removed = true;
+        __team_port_change_send(port, false);
+}
+
 static void team_port_change_check(struct team_port *port, bool linkup)
 {
         struct team *team = port->team;
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 4fd48df6b989..32e31c5c5dc6 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -962,6 +962,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x2001, 0x3c05),
         .driver_info = (unsigned long) &ax88772_info,
 }, {
+       // DLink DUB-E100 H/W Ver C1
+       USB_DEVICE (0x2001, 0x1a02),
+       .driver_info = (unsigned long) &ax88772_info,
+}, {
         // Linksys USB1000
         USB_DEVICE (0x1737, 0x0039),
         .driver_info = (unsigned long) &ax88178_info,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index adfab3fc5478..3543c9e57824 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -297,7 +297,7 @@ static int qmi_wwan_suspend(struct usb_interface *intf, pm_message_t message)
         if (ret < 0)
                 goto err;
 
-        if (info->subdriver && info->subdriver->suspend)
+        if (intf == info->control && info->subdriver && info->subdriver->suspend)
                 ret = info->subdriver->suspend(intf, message);
         if (ret < 0)
                 usbnet_resume(intf);
@@ -310,13 +310,14 @@ static int qmi_wwan_resume(struct usb_interface *intf)
         struct usbnet *dev = usb_get_intfdata(intf);
         struct qmi_wwan_state *info = (void *)&dev->data;
         int ret = 0;
+        bool callsub = (intf == info->control && info->subdriver && info->subdriver->resume);
 
-        if (info->subdriver && info->subdriver->resume)
+        if (callsub)
                 ret = info->subdriver->resume(intf);
         if (ret < 0)
                 goto err;
         ret = usbnet_resume(intf);
-        if (ret < 0 && info->subdriver && info->subdriver->resume && info->subdriver->suspend)
+        if (ret < 0 && callsub && info->subdriver->suspend)
                 info->subdriver->suspend(intf, PMSG_SUSPEND);
 err:
         return ret;
@@ -365,16 +366,20 @@ static const struct usb_device_id products[] = {
         },
 
         /* 2. Combined interface devices matching on class+protocol */
+        {       /* Huawei E367 and possibly others in "Windows mode" */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 7),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* Huawei E392, E398 and possibly others in "Windows mode" */
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
-        {       /* Pantech UML290 */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
+        {       /* Pantech UML290, P4200 and more */
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
         {       /* Pantech UML290 - newer firmware */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_shared,
         },
 
@@ -382,6 +387,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
         {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
         {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
         {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
         {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
         {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
@@ -398,7 +404,6 @@ static const struct usb_device_id products[] = {
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
         {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)},    /* HP un2400 Gobi Modem Device */
-        {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)},    /* HP un2430 Mobile Broadband Module */
         {QMI_GOBI1K_DEVICE(0x04da, 0x250d)},    /* Panasonic Gobi Modem device */
         {QMI_GOBI1K_DEVICE(0x413c, 0x8172)},    /* Dell Gobi Modem device */
         {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel Gobi Modem device */
@@ -440,6 +445,7 @@ static const struct usb_device_id products[] = {
         {QMI_GOBI_DEVICE(0x16d8, 0x8002)},      /* CMDTech Gobi 2000 Modem device (VU922) */
         {QMI_GOBI_DEVICE(0x05c6, 0x9205)},      /* Gobi 2000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x9013)},      /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
+        {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
         {QMI_GOBI_DEVICE(0x1199, 0x9015)},      /* Sierra Wireless Gobi 3000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x9019)},      /* Sierra Wireless Gobi 3000 Modem device */
         {QMI_GOBI_DEVICE(0x1199, 0x901b)},      /* Sierra Wireless MC7770 */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 7be49ea60b6d..8e22417fa6c1 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -656,7 +656,7 @@ static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
                 return -EIO;
         }
 
-        *datap = *attrdata;
+        *datap = le16_to_cpu(*attrdata);
 
         kfree(attrdata);
         return result;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f5ab6e613ec8..376143e8a1aa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -1253,6 +1253,7 @@ static struct usb_driver smsc75xx_driver = {
         .probe          = usbnet_probe,
         .suspend        = usbnet_suspend,
         .resume         = usbnet_resume,
+        .reset_resume   = usbnet_resume,
         .disconnect     = usbnet_disconnect,
         .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fd4b26d46fd5..fc9f578a1e25 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1201,19 +1201,26 @@ deferred:
 }
 EXPORT_SYMBOL_GPL(usbnet_start_xmit);
 
-static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
 {
         struct urb      *urb;
         int             i;
+        int             ret = 0;
 
         /* don't refill the queue all at once */
         for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
                 urb = usb_alloc_urb(0, flags);
                 if (urb != NULL) {
-                        if (rx_submit(dev, urb, flags) == -ENOLINK)
-                                return;
+                        ret = rx_submit(dev, urb, flags);
+                        if (ret)
+                                goto err;
+                } else {
+                        ret = -ENOMEM;
+                        goto err;
                 }
         }
+err:
+        return ret;
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1257,7 +1264,8 @@ static void usbnet_bh (unsigned long param)
                 int     temp = dev->rxq.qlen;
 
                 if (temp < RX_QLEN(dev)) {
-                        rx_alloc_submit(dev, GFP_ATOMIC);
+                        if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
+                                return;
                         if (temp != dev->rxq.qlen)
                                 netif_dbg(dev, link, dev->net,
                                           "rxqlen %d --> %d\n",
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index aaaca9aa2293..3f575afd8cfc 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -10,6 +10,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/cdev.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 2588848f4a82..d066f2516e47 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -2982,6 +2982,10 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
         case EEP_RX_MASK:
                 return pBase->txrxMask & 0xf;
         case EEP_PAPRD:
+                if (AR_SREV_9462(ah))
+                        return false;
+                if (!ah->config.enable_paprd);
+                        return false;
                 return !!(pBase->featureEnable & BIT(5));
         case EEP_CHAIN_MASK_REDUCE:
                 return (pBase->miscConfiguration >> 0x3) & 0x1;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 2c9f7d7ed4cc..0ed3846f9cbb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -142,6 +142,7 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         };
         int training_power;
         int i, val;
+        u32 am2pm_mask = ah->paprd_ratemask;
 
         if (IS_CHAN_2GHZ(ah->curchan))
                 training_power = ar9003_get_training_power_2g(ah);
@@ -158,10 +159,13 @@ static int ar9003_paprd_setup_single_table(struct ath_hw *ah)
         }
         ah->paprd_training_power = training_power;
 
+        if (AR_SREV_9330(ah))
+                am2pm_mask = 0;
+
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2AM, AR_PHY_PAPRD_AM2AM_MASK,
                       ah->paprd_ratemask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_AM2PM, AR_PHY_PAPRD_AM2PM_MASK,
-                      ah->paprd_ratemask);
+                      am2pm_mask);
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_HT40, AR_PHY_PAPRD_HT40_MASK,
                       ah->paprd_ratemask_ht40);
 
@@ -782,6 +786,102 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
 }
 EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
 
+static bool ar9003_paprd_retrain_pa_in(struct ath_hw *ah,
+                                       struct ath9k_hw_cal_data *caldata,
+                                       int chain)
+{
+        u32 *pa_in = caldata->pa_table[chain];
+        int capdiv_offset, quick_drop_offset;
+        int capdiv2g, quick_drop;
+        int count = 0;
+        int i;
+
+        if (!AR_SREV_9485(ah) && !AR_SREV_9330(ah))
+                return false;
+
+        capdiv2g = REG_READ_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                                  AR_PHY_65NM_CH0_TXRF3_CAPDIV2G);
+
+        quick_drop = REG_READ_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                                    AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP);
+
+        if (quick_drop)
+                quick_drop -= 0x40;
+
+        for (i = 0; i < NUM_BIN + 1; i++) {
+                if (pa_in[i] == 1400)
+                        count++;
+        }
+
+        if (AR_SREV_9485(ah)) {
+                if (pa_in[23] < 800) {
+                        capdiv_offset = (int)((1000 - pa_in[23] + 75) / 150);
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 7) {
+                                capdiv2g = 7;
+                                if (pa_in[23] < 600) {
+                                        quick_drop++;
+                                        if (quick_drop > 0)
+                                                quick_drop = 0;
+                                }
+                        }
+                } else if (pa_in[23] == 1400) {
+                        quick_drop_offset = min_t(int, count / 3, 2);
+                        quick_drop += quick_drop_offset;
+                        capdiv2g += quick_drop_offset / 2;
+
+                        if (capdiv2g > 7)
+                                capdiv2g = 7;
+
+                        if (quick_drop > 0) {
+                                quick_drop = 0;
+                                capdiv2g -= quick_drop_offset;
+                                if (capdiv2g < 0)
+                                        capdiv2g = 0;
+                        }
+                } else {
+                        return false;
+                }
+        } else if (AR_SREV_9330(ah)) {
+                if (pa_in[23] < 1000) {
+                        capdiv_offset = (1000 - pa_in[23]) / 100;
+                        capdiv2g += capdiv_offset;
+                        if (capdiv_offset > 3) {
+                                capdiv_offset = 1;
+                                quick_drop--;
+                        }
+
+                        capdiv2g += capdiv_offset;
+                        if (capdiv2g > 6)
+                                capdiv2g = 6;
+                        if (quick_drop < -4)
+                                quick_drop = -4;
+                } else if (pa_in[23] == 1400) {
+                        if (count > 3) {
+                                quick_drop++;
+                                capdiv2g -= count / 4;
+                                if (quick_drop > -2)
+                                        quick_drop = -2;
+                        } else {
+                                capdiv2g--;
+                        }
+
+                        if (capdiv2g < 0)
+                                capdiv2g = 0;
+                } else {
+                        return false;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_TXRF3,
+                      AR_PHY_65NM_CH0_TXRF3_CAPDIV2G, capdiv2g);
+        REG_RMW_FIELD(ah, AR_PHY_PAPRD_TRAINER_CNTL3,
+                      AR_PHY_PAPRD_TRAINER_CNTL3_CF_PAPRD_QUICK_DROP,
+                      quick_drop);
+
+        return true;
+}
+
 int ar9003_paprd_create_curve(struct ath_hw *ah,
                               struct ath9k_hw_cal_data *caldata, int chain)
 {
@@ -817,6 +917,9 @@ int ar9003_paprd_create_curve(struct ath_hw *ah,
         if (!create_pa_curve(data_L, data_U, pa_table, small_signal_gain))
                 status = -2;
 
+        if (ar9003_paprd_retrain_pa_in(ah, caldata, chain))
+                status = -EINPROGRESS;
+
         REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
                     AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 7bfbaf065a43..84d3d4956861 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -625,6 +625,10 @@
 #define AR_PHY_AIC_CTRL_4_B0    (AR_SM_BASE + 0x4c0)
 #define AR_PHY_AIC_STAT_2_B0    (AR_SM_BASE + 0x4cc)
 
+#define AR_PHY_65NM_CH0_TXRF3       0x16048
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G          0x0000001e
+#define AR_PHY_65NM_CH0_TXRF3_CAPDIV2G_S        1
+
 #define AR_PHY_65NM_CH0_SYNTH4      0x1608c
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   (AR_SREV_9462(ah) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S (AR_SREV_9462(ah) ? 0 : 1)
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 68b643c8943c..c8ef30127adb 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1577,6 +1577,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                             sc->debug.debugfs_phy, sc, &fops_tx_chainmask);
         debugfs_create_file("disable_ani", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc, &fops_disable_ani);
+        debugfs_create_bool("paprd", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
+                            &sc->sc_ah->config.enable_paprd);
         debugfs_create_file("regidx", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                             sc, &fops_regidx);
         debugfs_create_file("regval", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index bacdb8fb4ef4..9f83f71742a5 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -341,7 +341,8 @@ void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
 
-        ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
+        if (btcoex->hw_timer_enabled)
+                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
 }
 
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 60b6a9daff7e..4faf0a395876 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -463,9 +463,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
                 ah->config.spurchans[i][1] = AR_NO_SPUR;
         }
 
-        /* PAPRD needs some more work to be enabled */
-        ah->config.paprd_disable = 1;
-
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -978,9 +975,6 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
         else
                 imr_reg |= AR_IMR_TXOK;
 
-        if (opmode == NL80211_IFTYPE_AP)
-                imr_reg |= AR_IMR_MIB;
-
         ENABLE_REGWRITE_BUFFER(ah);
 
         REG_WRITE(ah, AR_IMR, imr_reg);
@@ -1778,6 +1772,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
+        } else if (caldata) {
+                caldata->paprd_packet_sent = false;
         }
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
 
@@ -2501,9 +2497,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (!ah->config.paprd_disable &&
-                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
-                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
                 if (AR_SREV_9280_20(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index ce7332c64efb..de6968fc64f4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -236,7 +236,6 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_LDPC                       = BIT(6),
         ATH9K_HW_CAP_FASTCLOCK                  = BIT(7),
         ATH9K_HW_CAP_SGI_20                     = BIT(8),
-        ATH9K_HW_CAP_PAPRD                      = BIT(9),
         ATH9K_HW_CAP_ANT_DIV_COMB               = BIT(10),
         ATH9K_HW_CAP_2GHZ                       = BIT(11),
         ATH9K_HW_CAP_5GHZ                       = BIT(12),
@@ -287,12 +286,12 @@ struct ath9k_ops_config {
         u8 pcie_clock_req;
         u32 pcie_waen;
         u8 analog_shiftreg;
-        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
         u32 cck_trig_low;
         u32 enable_ani;
+        u32 enable_paprd;
         int serialize_regmode;
         bool rx_intr_mitigation;
         bool tx_intr_mitigation;
@@ -405,6 +404,7 @@ struct ath9k_hw_cal_data {
         int8_t iCoff;
         int8_t qCoff;
         bool rtt_done;
+        bool paprd_packet_sent;
         bool paprd_done;
         bool nfcal_pending;
         bool nfcal_interference;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index d4549e9aac5c..7b88b9c39ccd 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -254,8 +254,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int chain_ok = 0;
         int chain;
         int len = 1800;
+        int ret;
 
-        if (!caldata)
+        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done)
                 return;
 
         ath9k_ps_wakeup(sc);
@@ -282,13 +283,6 @@ void ath_paprd_calibrate(struct work_struct *work)
                         continue;
 
                 chain_ok = 0;
-
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD frame for thermal measurement on chain %d\n",
-                        chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
-
                 ar9003_paprd_setup_gain_table(ah, chain);
 
                 ath_dbg(common, CALIBRATE,
@@ -302,7 +296,13 @@ void ath_paprd_calibrate(struct work_struct *work)
                         break;
                 }
 
-                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
+                ret = ar9003_paprd_create_curve(ah, caldata, chain);
+                if (ret == -EINPROGRESS) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD curve on chain %d needs to be re-trained\n",
+                                chain);
+                        break;
+                } else if (ret) {
                         ath_dbg(common, CALIBRATE,
                                 "PAPRD create curve failed on chain %d\n",
                                 chain);
@@ -423,7 +423,7 @@ set_timer:
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
+        if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD) && ah->caldata) {
                 if (!ah->caldata->paprd_done)
                         ieee80211_queue_work(sc->hw, &sc->paprd_work);
                 else if (!ah->paprd_table_write_done)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 2c9da6b2ecb1..0d4155aec48d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2018,6 +2018,9 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
+        if (sc->sc_ah->caldata)
+                sc->sc_ah->caldata->paprd_packet_sent = true;
+
         if (!(tx_flags & ATH_TX_ERROR))
                 /* Frame was ACKed */
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 3876c7ea54f4..7a28d21ac389 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -34,8 +34,8 @@ config B43_BCMA
 config B43_BCMA_EXTRA
         bool "Hardware support that overlaps with the brcmsmac driver"
         depends on B43_BCMA
-        default n if BRCMSMAC || BRCMSMAC_MODULE
-        default y
+        default n if BRCMSMAC
+        default y
 
 config B43_SSB
         bool
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 49765d34b4e0..7c4ee72f9d56 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -638,6 +638,8 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 
                 oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
                                        GFP_KERNEL);
+                if (!oobirq_entry)
+                        return -ENOMEM;
                 oobirq_entry->irq = res->start;
                 oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
                 list_add_tail(&oobirq_entry->list, &oobirq_lh);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 2621dd3d7dcd..6f70953f0bad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
 {
         char iovbuf[32];
         int retcode;
+        __le32 arp_mode_le;
 
-        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+        arp_mode_le = cpu_to_le32(arp_mode);
+        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
+                        sizeof(iovbuf));
         retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                    iovbuf, sizeof(iovbuf));
         retcode = retcode >= 0 ? 0 : retcode;
@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
 {
         char iovbuf[32];
         int retcode;
+        __le32 arp_enable_le;
 
-        brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
+        arp_enable_le = cpu_to_le32(arp_enable);
+
+        brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
                         iovbuf, sizeof(iovbuf));
         retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                    iovbuf, sizeof(iovbuf));
@@ -800,10 +806,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
         char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];      /*  Room for
                                  "event_msgs" + '\0' + bitvec  */
         char buf[128], *ptr;
-        u32 roaming = 1;
-        uint bcn_timeout = 3;
-        int scan_assoc_time = 40;
-        int scan_unassoc_time = 40;
+        __le32 roaming_le = cpu_to_le32(1);
+        __le32 bcn_timeout_le = cpu_to_le32(3);
+        __le32 scan_assoc_time_le = cpu_to_le32(40);
+        __le32 scan_unassoc_time_le = cpu_to_le32(40);
         int i;
         struct brcmf_bus_dcmd *cmdlst;
         struct list_head *cur, *q;
@@ -829,14 +835,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
 
         /* Setup timeout if Beacons are lost and roam is off to report
                  link down */
-        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
                     sizeof(iovbuf));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                   sizeof(iovbuf));
 
         /* Enable/Disable build-in roaming to allowed ext supplicant to take
                  of romaing */
-        brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
+        brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
                       iovbuf, sizeof(iovbuf));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                   sizeof(iovbuf));
@@ -848,9 +854,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
                                   sizeof(iovbuf));
 
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-                         (char *)&scan_assoc_time, sizeof(scan_assoc_time));
+                 (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
         brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-                         (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
+                 (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
 
         /* Set and enable ARP offload feature */
         brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a299d42da8e7..58f89fa9c9f8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -519,7 +519,7 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         else
                 devinfo->bus_pub.bus->dstats.tx_errors++;
 
-        dev_kfree_skb(req->skb);
+        brcmu_pkt_buf_free_skb(req->skb);
         req->skb = NULL;
         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 
@@ -540,7 +540,7 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 devinfo->bus_pub.bus->dstats.rx_packets++;
         } else {
                 devinfo->bus_pub.bus->dstats.rx_errors++;
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                 return;
         }
@@ -550,13 +550,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
                         brcmf_dbg(ERROR, "rx protocol error\n");
                         brcmu_pkt_buf_free_skb(skb);
+                        brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
                         devinfo->bus_pub.bus->dstats.rx_errors++;
                 } else {
                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
                         brcmf_usb_rx_refill(devinfo, req);
                 }
         } else {
-                dev_kfree_skb(skb);
+                brcmu_pkt_buf_free_skb(skb);
+                brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
         return;
 
@@ -581,14 +583,13 @@ static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
                           req);
-        req->urb->transfer_flags |= URB_ZERO_PACKET;
         req->devinfo = devinfo;
+        brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
 
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (ret == 0) {
-                brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
-        } else {
-                dev_kfree_skb(req->skb);
+        if (ret) {
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
         }
@@ -683,23 +684,22 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 
         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
         if (!req) {
+                brcmu_pkt_buf_free_skb(skb);
                 brcmf_dbg(ERROR, "no req to send\n");
                 return -ENOMEM;
         }
-        if (!req->urb) {
-                brcmf_dbg(ERROR, "no urb for req %p\n", req);
-                return -ENOBUFS;
-        }
 
         req->skb = skb;
         req->devinfo = devinfo;
         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
                           skb->data, skb->len, brcmf_usb_tx_complete, req);
         req->urb->transfer_flags |= URB_ZERO_PACKET;
+        brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
-        if (!ret) {
-                brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
-        } else {
+        if (ret) {
+                brcmf_dbg(ERROR, "brcmf_usb_tx usb_submit_urb FAILED\n");
+                brcmf_usb_del_fromq(devinfo, req);
+                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28c5fbb4af26..50b5553b6964 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le,
         params_le->active_time = cpu_to_le32(-1);
         params_le->passive_time = cpu_to_le32(-1);
         params_le->home_time = cpu_to_le32(-1);
-        if (ssid && ssid->SSID_len)
-                memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
+        if (ssid && ssid->SSID_len) {
+                params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
+                memcpy(&params_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
+        }
 }
 
 static s32
@@ -1876,16 +1878,17 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
-                scb_val.val = cpu_to_le32(0);
+                memset(&scb_val, 0, sizeof(scb_val));
                 err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_RSSI, &scb_val,
                                       sizeof(struct brcmf_scb_val_le));
-                if (err)
+                if (err) {
                         WL_ERR("Could not get rssi (%d)\n", err);
-
-                rssi = le32_to_cpu(scb_val.val);
-                sinfo->filled |= STATION_INFO_SIGNAL;
-                sinfo->signal = rssi;
-                WL_CONN("RSSI %d dBm\n", rssi);
+                } else {
+                        rssi = le32_to_cpu(scb_val.val);
+                        sinfo->filled |= STATION_INFO_SIGNAL;
+                        sinfo->signal = rssi;
+                        WL_CONN("RSSI %d dBm\n", rssi);
+                }
         }
 
 done:
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 7ed7d7577024..64a48f06d68b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -77,7 +77,7 @@
                                          NL80211_RRF_NO_IBSS)
 
 static const struct ieee80211_regdomain brcms_regdom_x2 = {
-        .n_reg_rules = 7,
+        .n_reg_rules = 6,
         .alpha2 = "X2",
         .reg_rules = {
                 BRCM_2GHZ_2412_2462,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index e316ca4632b1..063ecaff5b56 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1439,6 +1439,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         return err;
 
 err_free_irq:
+        trans_pcie->irq_requested = false;
         free_irq(trans_pcie->irq, trans);
 error:
         iwl_free_isr_ict(trans);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index e970897f6ab5..4cb234349fbf 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1326,6 +1326,11 @@ static int if_sdio_suspend(struct device *dev)
 
         mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
 
+        /* If we're powered off anyway, just let the mmc layer remove the
+         * card. */
+        if (!lbs_iface_active(card->priv))
+                return -ENOSYS;
+
         dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
                  sdio_func_id(func), flags);
 
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index c68adec3cc8b..565527aee0ea 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -170,7 +170,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         cmd_code = le16_to_cpu(host_cmd->command);
         cmd_size = le16_to_cpu(host_cmd->size);
 
-        skb_trim(cmd_node->cmd_skb, cmd_size);
+        /* Adjust skb length */
+        if (cmd_node->cmd_skb->len > cmd_size)
+                /*
+                 * cmd_size is less than sizeof(struct host_cmd_ds_command).
+                 * Trim off the unused portion.
+                 */
+                skb_trim(cmd_node->cmd_skb, cmd_size);
+        else if (cmd_node->cmd_skb->len < cmd_size)
+                /*
+                 * cmd_size is larger than sizeof(struct host_cmd_ds_command)
+                 * because we have appended custom IE TLV. Increase skb length
+                 * accordingly.
+                 */
+                skb_put(cmd_node->cmd_skb, cmd_size - cmd_node->cmd_skb->len);
 
         do_gettimeofday(&tstamp);
         dev_dbg(adapter->dev, "cmd: DNLD_CMD: (%lu.%lu): %#x, act %#x, len %d,"
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 8b9dbd76a252..64328af496f5 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2400pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index d3a4a68cc439..7564ae992b73 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -670,6 +670,7 @@
 #define GPIOCSR_BIT5                    FIELD32(0x00000020)
 #define GPIOCSR_BIT6                    FIELD32(0x00000040)
 #define GPIOCSR_BIT7                    FIELD32(0x00000080)
+#define GPIOCSR_BIT8                    FIELD32(0x00000100)
 
 /*
  * BBPPCSR: BBP Pin control register.
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index d2cf8a4bc8b5..3de0406735f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+        rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 3aae36bb0a9e..89fee311d8fd 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
         u16 reg;
 
         rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-        return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
+        return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
 }
 
 #ifdef CONFIG_RT2X00_LIB_LEDS
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u16 reg;
 
         /*
          * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
+        rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2500usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index b493306a7eed..196bd5103e4f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -189,14 +189,15 @@
  * MAC_CSR19: GPIO control register.
  */
 #define MAC_CSR19                       0x0426
-#define MAC_CSR19_BIT0                  FIELD32(0x0001)
-#define MAC_CSR19_BIT1                  FIELD32(0x0002)
-#define MAC_CSR19_BIT2                  FIELD32(0x0004)
-#define MAC_CSR19_BIT3                  FIELD32(0x0008)
-#define MAC_CSR19_BIT4                  FIELD32(0x0010)
-#define MAC_CSR19_BIT5                  FIELD32(0x0020)
-#define MAC_CSR19_BIT6                  FIELD32(0x0040)
-#define MAC_CSR19_BIT7                  FIELD32(0x0080)
+#define MAC_CSR19_BIT0                  FIELD16(0x0001)
+#define MAC_CSR19_BIT1                  FIELD16(0x0002)
+#define MAC_CSR19_BIT2                  FIELD16(0x0004)
+#define MAC_CSR19_BIT3                  FIELD16(0x0008)
+#define MAC_CSR19_BIT4                  FIELD16(0x0010)
+#define MAC_CSR19_BIT5                  FIELD16(0x0020)
+#define MAC_CSR19_BIT6                  FIELD16(0x0040)
+#define MAC_CSR19_BIT7                  FIELD16(0x0080)
+#define MAC_CSR19_BIT8                  FIELD16(0x0100)
 
 /*
  * MAC_CSR20: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index cb8c2aca54e4..b93516d832fb 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -4089,6 +4089,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
                 msleep(1);
                 rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+                rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL, 0);
                 rt2x00_set_field32(&reg, LDO_CFG0_BGSEL, 1);
                 rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
         }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 98aa426a3564..4765bbd654cd 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -983,6 +983,7 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -996,6 +997,14 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6cf336595e25..6b4226b71618 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
         skb_pull(entry->skb, RXINFO_DESC_SIZE);
 
         /*
-         * FIXME: we need to check for rx_pkt_len validity
+         * Check for rx_pkt_len validity. Return if invalid, leaving
+         * rxdesc->size zeroed out by the upper level.
          */
+        if (unlikely(rx_pkt_len == 0 ||
+                        rx_pkt_len > entry->queue->data_size)) {
+                ERROR(entry->queue->rt2x00dev,
+                        "Bad frame size %d, forcing to 0\n", rx_pkt_len);
+                return;
+        }
+
         rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
 
         /*
@@ -736,6 +744,7 @@ static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -749,6 +758,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+        rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt2800_probe_hw_mode(rt2x00dev);
@@ -1157,6 +1174,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1690, 0x0744) },
         { USB_DEVICE(0x1690, 0x0761) },
         { USB_DEVICE(0x1690, 0x0764) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x179d) },
         /* Cisco */
         { USB_DEVICE(0x167b, 0x4001) },
         /* EnGenius */
@@ -1222,7 +1241,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1760) },
         { USB_DEVICE(0x0b05, 0x1761) },
         { USB_DEVICE(0x0b05, 0x1790) },
-        { USB_DEVICE(0x0b05, 0x179d) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262) },
         { USB_DEVICE(0x13d3, 0x3284) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index a6b88bd4a1a5..3f07e36f462b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
          */
         if (unlikely(rxdesc.size == 0 ||
                      rxdesc.size > entry->queue->data_size)) {
-                WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
+                ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
                         rxdesc.size, entry->queue->data_size);
                 dev_kfree_skb(entry->skb);
                 goto renew_skb;
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 3f7bc5cadf9a..b8ec96163922 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Disable power saving.
@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt61pci_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index e3cd6db76b0e..8f3da5a56766 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
 
 /*
  * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ba6e434b859d..248436c13ce0 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
+        u32 reg;
 
         /*
          * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * Enable rfkill polling by setting GPIO direction of the
+         * rfkill switch GPIO pin correctly.
+         */
+        rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
+        rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
+
+        /*
          * Initialize hw specifications.
          */
         retval = rt73usb_probe_hw_mode(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 9f6b470414d3..df1cc116b83b 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10                 FIELD32(0x00000400)
 #define MAC_CSR13_BIT11                 FIELD32(0x00000800)
 #define MAC_CSR13_BIT12                 FIELD32(0x00001000)
+#define MAC_CSR13_BIT13                 FIELD32(0x00002000)
+#define MAC_CSR13_BIT14                 FIELD32(0x00004000)
+#define MAC_CSR13_BIT15                 FIELD32(0x00008000)
 
 /*
  * MAC_CSR14: LED control register.
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 44febfde9493..8a7b864faca3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -315,7 +315,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
         u16 box_reg = 0, box_extreg = 0;
         u8 u1b_tmp;
         bool isfw_read = false;
-        bool bwrite_sucess = false;
+        bool bwrite_success = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
         u8 boxcontent[4], boxextcontent[2];
@@ -354,7 +354,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
                 }
         }
 
-        while (!bwrite_sucess) {
+        while (!bwrite_success) {
                 wait_writeh2c_limmit--;
                 if (wait_writeh2c_limmit == 0) {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@ -491,7 +491,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
                         break;
                 }
 
-                bwrite_sucess = true;
+                bwrite_success = true;
 
                 rtlhal->last_hmeboxnum = boxnum + 1;
                 if (rtlhal->last_hmeboxnum == 4)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 04c3aef8a4f6..2925094b2d91 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -117,6 +117,7 @@
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_92C_BITMASK                BIT(0)
+#define CHIP_UNKNOWN                    BIT(7)
 #define CHIP_92C_1T2R                   0x03
 #define CHIP_92C                        0x01
 #define CHIP_88C                        0x00
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index bd0da7ef290b..dd4bb0950a57 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -994,8 +994,16 @@ static enum version_8192c _rtl92ce_read_chip_version(struct ieee80211_hw *hw)
                 version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
                            VERSION_A_CHIP_88C;
         } else {
-                version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
-                           VERSION_B_CHIP_88C;
+                version = (enum version_8192c) (CHIP_VER_B |
+                                ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
+                                ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
+                if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
+                     CHIP_VER_RTL_MASK)) {
+                        version = (enum version_8192c)(version |
+                                   ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
+                                   ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
+                                   CHIP_VENDOR_UMC));
+                }
         }
 
         switch (version) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 3aa927f8b9b9..7d8f96405f42 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
 
         /* request fw */
         if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
-            !IS_92C_SERIAL(rtlhal->version))
+            !IS_92C_SERIAL(rtlhal->version)) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
-        else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
+        } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
+                pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
+        }
 
         rtlpriv->max_fw_size = 0x4000;
         pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
index 895ae6c1f354..eb22dccc418b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -365,7 +365,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
         u8 u1b_tmp;
         bool isfw_read = false;
         u8 buf_index = 0;
-        bool bwrite_sucess = false;
+        bool bwrite_success = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
         u8 boxcontent[4], boxextcontent[2];
@@ -408,7 +408,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
                         break;
                 }
         }
-        while (!bwrite_sucess) {
+        while (!bwrite_success) {
                 wait_writeh2c_limmit--;
                 if (wait_writeh2c_limmit == 0) {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@ -515,7 +515,7 @@ static void _rtl92d_fill_h2c_command(struct ieee80211_hw *hw,
                                  "switch case not processed\n");
                         break;
                 }
-                bwrite_sucess = true;
+                bwrite_success = true;
                 rtlhal->last_hmeboxnum = boxnum + 1;
                 if (rtlhal->last_hmeboxnum == 4)
                         rtlhal->last_hmeboxnum = 0;
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index b8ef8ddcc292..8aa73fac6ad4 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -451,14 +451,9 @@ static void wq_sync_buffer(struct work_struct *work)
 {
         struct oprofile_cpu_buffer *b =
                 container_of(work, struct oprofile_cpu_buffer, work.work);
-        if (b->cpu != smp_processor_id()) {
-                printk(KERN_DEBUG "WQ on CPU%d, prefer CPU%d\n",
-                       smp_processor_id(), b->cpu);
-
-                if (!cpu_online(b->cpu)) {
-                        cancel_delayed_work(&b->work);
-                        return;
-                }
+        if (b->cpu != smp_processor_id() && !cpu_online(b->cpu)) {
+                cancel_delayed_work(&b->work);
+                return;
         }
         sync_buffer(b->cpu);
 
diff --git a/drivers/pci/.gitignore b/drivers/pci/.gitignore
deleted file mode 100644
index f297ca8d313e..000000000000
--- a/drivers/pci/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-classlist.h
-devlist.h
-gen-devlist
-
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 3782e1cd3697..934d861a3235 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -2196,10 +2196,8 @@ static int __init acer_wmi_init(void)
                 interface->capability &= ~ACER_CAP_BRIGHTNESS;
                 pr_info("Brightness must be controlled by acpi video driver\n");
         } else {
-#ifdef CONFIG_ACPI_VIDEO
                 pr_info("Disabling ACPI video driver\n");
                 acpi_video_unregister();
-#endif
         }
 
         if (wmi_has_guid(WMID_GUID3)) {
diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
index dfb1a92ce949..db8f63841b42 100644
--- a/drivers/platform/x86/apple-gmux.c
+++ b/drivers/platform/x86/apple-gmux.c
@@ -101,7 +101,7 @@ static void gmux_pio_write32(struct apple_gmux_data *gmux_data, int port,
 
         for (i = 0; i < 4; i++) {
                 tmpval = (val >> (i * 8)) & 0xff;
-                outb(tmpval, port + i);
+                outb(tmpval, gmux_data->iostart + port + i);
         }
 }
 
@@ -142,8 +142,9 @@ static u8 gmux_index_read8(struct apple_gmux_data *gmux_data, int port)
         u8 val;
 
         mutex_lock(&gmux_data->index_lock);
-        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
         gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
         val = inb(gmux_data->iostart + GMUX_PORT_VALUE);
         mutex_unlock(&gmux_data->index_lock);
 
@@ -166,8 +167,9 @@ static u32 gmux_index_read32(struct apple_gmux_data *gmux_data, int port)
         u32 val;
 
         mutex_lock(&gmux_data->index_lock);
-        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
         gmux_index_wait_ready(gmux_data);
+        outb((port & 0xff), gmux_data->iostart + GMUX_PORT_READ);
+        gmux_index_wait_complete(gmux_data);
         val = inl(gmux_data->iostart + GMUX_PORT_VALUE);
         mutex_unlock(&gmux_data->index_lock);
 
@@ -461,18 +463,22 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
         ver_release = gmux_read8(gmux_data, GMUX_PORT_VERSION_RELEASE);
         if (ver_major == 0xff && ver_minor == 0xff && ver_release == 0xff) {
                 if (gmux_is_indexed(gmux_data)) {
+                        u32 version;
                         mutex_init(&gmux_data->index_lock);
                         gmux_data->indexed = true;
+                        version = gmux_read32(gmux_data,
+                                GMUX_PORT_VERSION_MAJOR);
+                        ver_major = (version >> 24) & 0xff;
+                        ver_minor = (version >> 16) & 0xff;
+                        ver_release = (version >> 8) & 0xff;
                 } else {
                         pr_info("gmux device not present\n");
                         ret = -ENODEV;
                         goto err_release;
                 }
-                pr_info("Found indexed gmux\n");
-        } else {
-                pr_info("Found gmux version %d.%d.%d\n", ver_major, ver_minor,
-                        ver_release);
         }
+        pr_info("Found gmux version %d.%d.%d [%s]\n", ver_major, ver_minor,
+                ver_release, (gmux_data->indexed ? "indexed" : "classic"));
 
         memset(&props, 0, sizeof(props));
         props.type = BACKLIGHT_PLATFORM;
@@ -505,9 +511,7 @@ static int __devinit gmux_probe(struct pnp_dev *pnp,
          * Disable the other backlight choices.
          */
         acpi_video_dmi_promote_vendor();
-#if defined (CONFIG_ACPI_VIDEO) || defined (CONFIG_ACPI_VIDEO_MODULE)
         acpi_video_unregister();
-#endif
         apple_bl_unregister();
 
         gmux_data->power_state = VGA_SWITCHEROO_ON;
@@ -593,9 +597,7 @@ static void __devexit gmux_remove(struct pnp_dev *pnp)
         kfree(gmux_data);
 
         acpi_video_dmi_demote_vendor();
-#if defined (CONFIG_ACPI_VIDEO) || defined (CONFIG_ACPI_VIDEO_MODULE)
         acpi_video_register();
-#endif
         apple_bl_register();
 }
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index e38f91be0b10..4b568df56643 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -85,7 +85,7 @@ static char *wled_type = "unknown";
 static char *bled_type = "unknown";
 
 module_param(wled_type, charp, 0444);
-MODULE_PARM_DESC(wlan_status, "Set the wled type on boot "
+MODULE_PARM_DESC(wled_type, "Set the wled type on boot "
                  "(unknown, led or rfkill). "
                  "default is unknown");
 
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device *dev,
          * The significance of others is yet to be found.
          * If we don't find the method, we assume the device are present.
          */
-        rv = acpi_evaluate_integer(asus->handle, "HRWS", NULL, &temp);
+        rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
         if (!ACPI_FAILURE(rv))
-                len += sprintf(page + len, "HRWS value         : %#x\n",
+                len += sprintf(page + len, "HWRS value         : %#x\n",
                                (uint) temp);
         /*
          * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
          * The significance of others is yet to be found.
          */
         status =
-            acpi_evaluate_integer(asus->handle, "HRWS", NULL, &hwrs_result);
+            acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
         if (!ACPI_FAILURE(status))
-                pr_notice("  HRWS returned %x", (int)hwrs_result);
+                pr_notice("  HWRS returned %x", (int)hwrs_result);
 
         if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
                 asus->have_rsts = true;
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 2eb9fe8e8efd..c0e9ff489b24 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -47,9 +47,7 @@
 #include <linux/thermal.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 
 #include "asus-wmi.h"
 
@@ -1704,10 +1702,8 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (asus->driver->quirks->wmi_backlight_power)
                 acpi_video_dmi_promote_vendor();
         if (!acpi_video_backlight_support()) {
-#ifdef CONFIG_ACPI_VIDEO
                 pr_info("Disabling ACPI video driver\n");
                 acpi_video_unregister();
-#endif
                 err = asus_wmi_backlight_init(asus);
                 if (err && err != -ENODEV)
                         goto fail_backlight;
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index dab91b48d22c..5ca264179f4e 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -610,12 +610,12 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
 
                 if (!bus) {
                         pr_warn("Unable to find PCI bus 1?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) {
                         pr_err("Unable to read PCI config space?\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 absent = (l == 0xffffffff);
@@ -627,7 +627,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                 absent ? "absent" : "present");
                         pr_warn("skipped wireless hotplug as probably "
                                 "inappropriate for this model\n");
-                        goto out_unlock;
+                        goto out_put_dev;
                 }
 
                 if (!blocked) {
@@ -635,7 +635,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                         if (dev) {
                                 /* Device already present */
                                 pci_dev_put(dev);
-                                goto out_unlock;
+                                goto out_put_dev;
                         }
                         dev = pci_scan_single_device(bus, 0);
                         if (dev) {
@@ -650,6 +650,8 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
                                 pci_dev_put(dev);
                         }
                 }
+out_put_dev:
+                pci_dev_put(port);
         }
 
 out_unlock:
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index c1ca7bcebb66..dd90d15f5210 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -26,9 +26,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
-#ifdef CONFIG_ACPI_VIDEO
 #include <acpi/video.h>
-#endif
 
 /*
  * This driver is needed because a number of Samsung laptops do not hook
@@ -1558,9 +1556,7 @@ static int __init samsung_init(void)
                 samsung->handle_backlight = false;
         } else if (samsung->quirks->broken_acpi_video) {
                 pr_info("Disabling ACPI video driver\n");
-#ifdef CONFIG_ACPI_VIDEO
                 acpi_video_unregister();
-#endif
         }
 #endif
 
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 80e377949314..52daaa816e53 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -545,7 +545,7 @@ TPACPI_HANDLE(hkey, ec, "\\_SB.HKEY",	/* 600e/x, 770e, 770x */
  */
 
 static int acpi_evalf(acpi_handle handle,
-                      void *res, char *method, char *fmt, ...)
+                      int *res, char *method, char *fmt, ...)
 {
         char *fmt0 = fmt;
         struct acpi_object_list params;
@@ -606,7 +606,7 @@ static int acpi_evalf(acpi_handle handle,
                 success = (status == AE_OK &&
                            out_obj.type == ACPI_TYPE_INTEGER);
                 if (success && res)
-                        *(int *)res = out_obj.integer.value;
+                        *res = out_obj.integer.value;
                 break;
         case 'v':               /* void */
                 success = status == AE_OK;
@@ -7386,17 +7386,18 @@ static int fan_get_status(u8 *status)
          * Add TPACPI_FAN_RD_ACPI_FANS ? */
 
         switch (fan_status_access_mode) {
-        case TPACPI_FAN_RD_ACPI_GFAN:
+        case TPACPI_FAN_RD_ACPI_GFAN: {
                 /* 570, 600e/x, 770e, 770x */
+                int res;
 
-                if (unlikely(!acpi_evalf(gfan_handle, &s, NULL, "d")))
+                if (unlikely(!acpi_evalf(gfan_handle, &res, NULL, "d")))
                         return -EIO;
 
                 if (likely(status))
-                        *status = s & 0x07;
+                        *status = res & 0x07;
 
                 break;
-
+        }
         case TPACPI_FAN_RD_TPEC:
                 /* all except 570, 600e/x, 770e, 770x */
                 if (unlikely(!acpi_ec_read(fan_status_offset, &s)))
diff --git a/drivers/pwm/pwm-tiecap.c b/drivers/pwm/pwm-tiecap.c
index 0b66d0f25922..4b6688909fee 100644
--- a/drivers/pwm/pwm-tiecap.c
+++ b/drivers/pwm/pwm-tiecap.c
@@ -100,6 +100,13 @@ static int ecap_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                 writel(period_cycles, pc->mmio_base + CAP3);
         }
 
+        if (!test_bit(PWMF_ENABLED, &pwm->flags)) {
+                reg_val = readw(pc->mmio_base + ECCTL2);
+                /* Disable APWM mode to put APWM output Low */
+                reg_val &= ~ECCTL2_APWM_MODE;
+                writew(reg_val, pc->mmio_base + ECCTL2);
+        }
+
         pm_runtime_put_sync(pc->chip.dev);
         return 0;
 }
diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index c3756d1be194..b1996bcd5b78 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -104,6 +104,7 @@ struct ehrpwm_pwm_chip {
         struct pwm_chip chip;
         unsigned int    clk_rate;
         void __iomem    *mmio_base;
+        unsigned long period_cycles[NUM_PWM_CHANNEL];
 };
 
 static inline struct ehrpwm_pwm_chip *to_ehrpwm_pwm_chip(struct pwm_chip *chip)
@@ -210,6 +211,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         unsigned long long c;
         unsigned long period_cycles, duty_cycles;
         unsigned short ps_divval, tb_divval;
+        int i;
 
         if (period_ns < 0 || duty_ns < 0 || period_ns > NSEC_PER_SEC)
                 return -ERANGE;
@@ -229,6 +231,28 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                 duty_cycles = (unsigned long)c;
         }
 
+        /*
+         * Period values should be same for multiple PWM channels as IP uses
+         * same period register for multiple channels.
+         */
+        for (i = 0; i < NUM_PWM_CHANNEL; i++) {
+                if (pc->period_cycles[i] &&
+                                (pc->period_cycles[i] != period_cycles)) {
+                        /*
+                         * Allow channel to reconfigure period if no other
+                         * channels being configured.
+                         */
+                        if (i == pwm->hwpwm)
+                                continue;
+
+                        dev_err(chip->dev, "Period value conflicts with channel %d\n",
+                                        i);
+                        return -EINVAL;
+                }
+        }
+
+        pc->period_cycles[pwm->hwpwm] = period_cycles;
+
         /* Configure clock prescaler to support Low frequency PWM wave */
         if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
                                 &tb_divval)) {
@@ -320,10 +344,15 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 
 static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
 {
+        struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
         if (test_bit(PWMF_ENABLED, &pwm->flags)) {
                 dev_warn(chip->dev, "Removing PWM device without disabling\n");
                 pm_runtime_put_sync(chip->dev);
         }
+
+        /* set period value to zero on free */
+        pc->period_cycles[pwm->hwpwm] = 0;
 }
 
 static const struct pwm_ops ehrpwm_pwm_ops = {
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index 4e932cc695e9..e98a5e7827df 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -33,9 +33,8 @@ config REGULATOR_DUMMY
         help
           If this option is enabled then when a regulator lookup fails
           and the board has not specified that it has provided full
-          constraints then the regulator core will provide an always
-          enabled dummy regulator will be provided, allowing consumer
-          drivers to continue.
+          constraints the regulator core will provide an always
+          enabled dummy regulator, allowing consumer drivers to continue.
 
           A warning will be generated when this substitution is done.
 
@@ -50,11 +49,11 @@ config REGULATOR_VIRTUAL_CONSUMER
         tristate "Virtual regulator consumer support"
         help
           This driver provides a virtual consumer for the voltage and
-          current regulator API which provides sysfs controls for
-          configuring the supplies requested.  This is mainly useful
-          for test purposes.
+          current regulator API which provides sysfs controls for
+          configuring the supplies requested.  This is mainly useful
+          for test purposes.
 
-          If unsure, say no.
+          If unsure, say no.
 
 config REGULATOR_USERSPACE_CONSUMER
         tristate "Userspace regulator consumer support"
@@ -63,7 +62,7 @@ config REGULATOR_USERSPACE_CONSUMER
           from user space. Userspace consumer driver provides ability to
           control power supplies for such devices.
 
-          If unsure, say no.
+          If unsure, say no.
 
 config REGULATOR_GPIO
         tristate "GPIO regulator support"
@@ -110,6 +109,17 @@ config REGULATOR_DA9052
           This driver supports the voltage regulators of DA9052-BC and
           DA9053-AA/Bx PMIC.
 
+config REGULATOR_FAN53555
+        tristate "Fairchild FAN53555 Regulator"
+        depends on I2C
+        select REGMAP_I2C
+        help
+          This driver supports Fairchild FAN53555 Digitally Programmable
+          TinyBuck Regulator. The FAN53555 is a step-down switching voltage
+          regulator that delivers a digitally programmable output from an
+          input voltage supply of 2.5V to 5.5V. The output voltage is
+          programmed through an I2C interface.
+
 config REGULATOR_ANATOP
         tristate "Freescale i.MX on-chip ANATOP LDO regulators"
         depends on MFD_ANATOP
@@ -172,6 +182,14 @@ config REGULATOR_MAX8660
           This driver controls a Maxim 8660/8661 voltage output
           regulator via I2C bus.
 
+config REGULATOR_MAX8907
+        tristate "Maxim 8907 voltage regulator"
+        depends on MFD_MAX8907
+        help
+          This driver controls a Maxim 8907 voltage output regulator
+          via I2C bus. The provided regulator is suitable for Tegra
+          chip to control Step-Down DC-DC and LDOs.
+
 config REGULATOR_MAX8925
         tristate "Maxim MAX8925 Power Management IC"
         depends on MFD_MAX8925
@@ -247,7 +265,7 @@ config REGULATOR_LP8788
 
 config REGULATOR_PCF50633
         tristate "NXP PCF50633 regulator driver"
-        depends on MFD_PCF50633
+        depends on MFD_PCF50633
         help
          Say Y here to support the voltage regulators and convertors
          on PCF50633
@@ -416,7 +434,7 @@ config REGULATOR_WM8350
         depends on MFD_WM8350
         help
           This driver provides support for the voltage and current regulators
-          of the WM8350 AudioPlus PMIC.
+          of the WM8350 AudioPlus PMIC.
 
 config REGULATOR_WM8400
         tristate "Wolfson Microelectronics WM8400 AudioPlus PMIC"
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 3342615cf25e..e431eed8a878 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_REGULATOR_DA903X)	+= da903x.o
 obj-$(CONFIG_REGULATOR_DA9052)  += da9052-regulator.o
 obj-$(CONFIG_REGULATOR_DBX500_PRCMU) += dbx500-prcmu.o
 obj-$(CONFIG_REGULATOR_DB8500_PRCMU) += db8500-prcmu.o
+obj-$(CONFIG_REGULATOR_FAN53555) += fan53555.o
 obj-$(CONFIG_REGULATOR_GPIO) += gpio-regulator.o
 obj-$(CONFIG_REGULATOR_ISL6271A) += isl6271a-regulator.o
 obj-$(CONFIG_REGULATOR_LP3971) += lp3971.o
@@ -30,6 +31,7 @@ obj-$(CONFIG_REGULATOR_LP8788) += lp8788-ldo.o
 obj-$(CONFIG_REGULATOR_MAX1586) += max1586.o
 obj-$(CONFIG_REGULATOR_MAX8649) += max8649.o
 obj-$(CONFIG_REGULATOR_MAX8660) += max8660.o
+obj-$(CONFIG_REGULATOR_MAX8907) += max8907-regulator.o
 obj-$(CONFIG_REGULATOR_MAX8925) += max8925-regulator.o
 obj-$(CONFIG_REGULATOR_MAX8952) += max8952.o
 obj-$(CONFIG_REGULATOR_MAX8997) += max8997.o
diff --git a/drivers/regulator/aat2870-regulator.c b/drivers/regulator/aat2870-regulator.c
index 6f45bfd22e83..167c93f21981 100644
--- a/drivers/regulator/aat2870-regulator.c
+++ b/drivers/regulator/aat2870-regulator.c
@@ -162,7 +162,7 @@ static struct aat2870_regulator *aat2870_get_regulator(int id)
 static int aat2870_regulator_probe(struct platform_device *pdev)
 {
         struct aat2870_regulator *ri;
-        struct regulator_config config = { 0 };
+        struct regulator_config config = { };
         struct regulator_dev *rdev;
 
         ri = aat2870_get_regulator(pdev->id);
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index c151fd5d8c97..65ad2b36ce36 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -347,17 +347,11 @@ static int ab3100_get_voltage_regulator_external(struct regulator_dev *reg)
         return abreg->plfdata->external_voltage;
 }
 
-static int ab3100_get_fixed_voltage_regulator(struct regulator_dev *reg)
-{
-        return reg->desc->min_uV;
-}
-
 static struct regulator_ops regulator_ops_fixed = {
         .list_voltage = regulator_list_voltage_linear,
         .enable      = ab3100_enable_regulator,
         .disable     = ab3100_disable_regulator,
         .is_enabled  = ab3100_is_enabled_regulator,
-        .get_voltage = ab3100_get_fixed_voltage_regulator,
 };
 
 static struct regulator_ops regulator_ops_variable = {
diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
index 10f2f4d4d190..e3d1d063025a 100644
--- a/drivers/regulator/ab8500.c
+++ b/drivers/regulator/ab8500.c
@@ -37,6 +37,7 @@
  * @voltage_bank: bank to control regulator voltage
  * @voltage_reg: register to control regulator voltage
  * @voltage_mask: mask to control regulator voltage
+ * @voltage_shift: shift to control regulator voltage
  * @delay: startup/set voltage delay in us
  */
 struct ab8500_regulator_info {
@@ -50,6 +51,7 @@ struct ab8500_regulator_info {
         u8 voltage_bank;
         u8 voltage_reg;
         u8 voltage_mask;
+        u8 voltage_shift;
         unsigned int delay;
 };
 
@@ -195,17 +197,14 @@ static int ab8500_regulator_get_voltage_sel(struct regulator_dev *rdev)
         }
 
         dev_vdbg(rdev_get_dev(rdev),
-                "%s-get_voltage (bank, reg, mask, value): 0x%x, 0x%x, 0x%x,"
-                " 0x%x\n",
-                info->desc.name, info->voltage_bank, info->voltage_reg,
-                info->voltage_mask, regval);
+                "%s-get_voltage (bank, reg, mask, shift, value): "
+                "0x%x, 0x%x, 0x%x, 0x%x, 0x%x\n",
+                info->desc.name, info->voltage_bank,
+                info->voltage_reg, info->voltage_mask,
+                info->voltage_shift, regval);
 
-        /* vintcore has a different layout */
         val = regval & info->voltage_mask;
-        if (info->desc.id == AB8500_LDO_INTCORE)
-                return val >> 0x3;
-        else
-                return val;
+        return val >> info->voltage_shift;
 }
 
 static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
@@ -221,7 +220,7 @@ static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
         }
 
         /* set the registers for the request */
-        regval = (u8)selector;
+        regval = (u8)selector << info->voltage_shift;
         ret = abx500_mask_and_set_register_interruptible(info->dev,
                         info->voltage_bank, info->voltage_reg,
                         info->voltage_mask, regval);
@@ -238,13 +237,6 @@ static int ab8500_regulator_set_voltage_sel(struct regulator_dev *rdev,
         return ret;
 }
 
-static int ab8500_regulator_enable_time(struct regulator_dev *rdev)
-{
-        struct ab8500_regulator_info *info = rdev_get_drvdata(rdev);
-
-        return info->delay;
-}
-
 static int ab8500_regulator_set_voltage_time_sel(struct regulator_dev *rdev,
                                              unsigned int old_sel,
                                              unsigned int new_sel)
@@ -261,22 +253,14 @@ static struct regulator_ops ab8500_regulator_ops = {
         .get_voltage_sel = ab8500_regulator_get_voltage_sel,
         .set_voltage_sel = ab8500_regulator_set_voltage_sel,
         .list_voltage   = regulator_list_voltage_table,
-        .enable_time    = ab8500_regulator_enable_time,
         .set_voltage_time_sel = ab8500_regulator_set_voltage_time_sel,
 };
 
-static int ab8500_fixed_get_voltage(struct regulator_dev *rdev)
-{
-        return rdev->desc->min_uV;
-}
-
 static struct regulator_ops ab8500_regulator_fixed_ops = {
         .enable         = ab8500_regulator_enable,
         .disable        = ab8500_regulator_disable,
         .is_enabled     = ab8500_regulator_is_enabled,
-        .get_voltage    = ab8500_fixed_get_voltage,
         .list_voltage   = regulator_list_voltage_linear,
-        .enable_time    = ab8500_regulator_enable_time,
 };
 
 static struct ab8500_regulator_info
@@ -358,6 +342,7 @@ static struct ab8500_regulator_info
                 .voltage_bank           = 0x03,
                 .voltage_reg            = 0x80,
                 .voltage_mask           = 0x38,
+                .voltage_shift          = 3,
         },
 
         /*
@@ -374,6 +359,7 @@ static struct ab8500_regulator_info
                         .owner          = THIS_MODULE,
                         .n_voltages     = 1,
                         .min_uV         = 2000000,
+                        .enable_time    = 10000,
                 },
                 .delay                  = 10000,
                 .update_bank            = 0x03,
diff --git a/drivers/regulator/arizona-ldo1.c b/drivers/regulator/arizona-ldo1.c
index c8f95c07adb6..d184aa35abcb 100644
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -39,6 +39,8 @@ static struct regulator_ops arizona_ldo1_ops = {
         .map_voltage = regulator_map_voltage_linear,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 };
 
 static const struct regulator_desc arizona_ldo1 = {
@@ -49,9 +51,11 @@ static const struct regulator_desc arizona_ldo1 = {
 
         .vsel_reg = ARIZONA_LDO1_CONTROL_1,
         .vsel_mask = ARIZONA_LDO1_VSEL_MASK,
+        .bypass_reg = ARIZONA_LDO1_CONTROL_1,
+        .bypass_mask = ARIZONA_LDO1_BYPASS,
         .min_uV = 900000,
         .uV_step = 50000,
-        .n_voltages = 7,
+        .n_voltages = 6,
 
         .owner = THIS_MODULE,
 };
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index 450a069aa9b6..d9b1f82cc5bd 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -82,6 +82,9 @@ static struct regulator_ops arizona_micsupp_ops = {
 
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = regulator_set_voltage_sel_regmap,
+
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 };
 
 static const struct regulator_desc arizona_micsupp = {
@@ -95,6 +98,8 @@ static const struct regulator_desc arizona_micsupp = {
         .vsel_mask = ARIZONA_LDO2_VSEL_MASK,
         .enable_reg = ARIZONA_MIC_CHARGE_PUMP_1,
         .enable_mask = ARIZONA_CPMIC_ENA,
+        .bypass_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .bypass_mask = ARIZONA_CPMIC_BYPASS,
 
         .owner = THIS_MODULE,
 };
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 48385318175a..2e0352dc26bd 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -77,6 +77,7 @@ struct regulator {
         struct device *dev;
         struct list_head list;
         unsigned int always_on:1;
+        unsigned int bypass:1;
         int uA_load;
         int min_uV;
         int max_uV;
@@ -394,6 +395,9 @@ static ssize_t regulator_status_show(struct device *dev,
         case REGULATOR_STATUS_STANDBY:
                 label = "standby";
                 break;
+        case REGULATOR_STATUS_BYPASS:
+                label = "bypass";
+                break;
         case REGULATOR_STATUS_UNDEFINED:
                 label = "undefined";
                 break;
@@ -585,6 +589,27 @@ static ssize_t regulator_suspend_standby_state_show(struct device *dev,
 static DEVICE_ATTR(suspend_standby_state, 0444,
                 regulator_suspend_standby_state_show, NULL);
 
+static ssize_t regulator_bypass_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct regulator_dev *rdev = dev_get_drvdata(dev);
+        const char *report;
+        bool bypass;
+        int ret;
+
+        ret = rdev->desc->ops->get_bypass(rdev, &bypass);
+
+        if (ret != 0)
+                report = "unknown";
+        else if (bypass)
+                report = "enabled";
+        else
+                report = "disabled";
+
+        return sprintf(buf, "%s\n", report);
+}
+static DEVICE_ATTR(bypass, 0444,
+                   regulator_bypass_show, NULL);
 
 /*
  * These are the only attributes are present for all regulators.
@@ -778,6 +803,9 @@ static void print_constraints(struct regulator_dev *rdev)
         if (constraints->valid_modes_mask & REGULATOR_MODE_STANDBY)
                 count += sprintf(buf + count, "standby");
 
+        if (!count)
+                sprintf(buf, "no parameters");
+
         rdev_info(rdev, "%s\n", buf);
 
         if ((constraints->min_uV != constraints->max_uV) &&
@@ -974,6 +1002,7 @@ static int set_supply(struct regulator_dev *rdev,
                 err = -ENOMEM;
                 return err;
         }
+        supply_rdev->open_count++;
 
         return 0;
 }
@@ -1720,6 +1749,9 @@ int regulator_disable_deferred(struct regulator *regulator, int ms)
         if (regulator->always_on)
                 return 0;
 
+        if (!ms)
+                return regulator_disable(regulator);
+
         mutex_lock(&rdev->mutex);
         rdev->deferred_disables++;
         mutex_unlock(&rdev->mutex);
@@ -2178,9 +2210,12 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
                 }
         }
 
-        if (ret == 0 && best_val >= 0)
+        if (ret == 0 && best_val >= 0) {
+                unsigned long data = best_val;
+
                 _notifier_call_chain(rdev, REGULATOR_EVENT_VOLTAGE_CHANGE,
-                                     (void *)best_val);
+                                     (void *)data);
+        }
 
         trace_regulator_set_voltage_complete(rdev_get_name(rdev), best_val);
 
@@ -2291,8 +2326,8 @@ int regulator_set_voltage_time(struct regulator *regulator,
 EXPORT_SYMBOL_GPL(regulator_set_voltage_time);
 
 /**
- *regulator_set_voltage_time_sel - get raise/fall time
- * @regulator: regulator source
+ * regulator_set_voltage_time_sel - get raise/fall time
+ * @rdev: regulator source device
  * @old_selector: selector for starting voltage
  * @new_selector: selector for target voltage
  *
@@ -2388,6 +2423,8 @@ static int _regulator_get_voltage(struct regulator_dev *rdev)
                 ret = rdev->desc->ops->list_voltage(rdev, sel);
         } else if (rdev->desc->ops->get_voltage) {
                 ret = rdev->desc->ops->get_voltage(rdev);
+        } else if (rdev->desc->ops->list_voltage) {
+                ret = rdev->desc->ops->list_voltage(rdev, 0);
         } else {
                 return -EINVAL;
         }
@@ -2674,6 +2711,100 @@ out:
 EXPORT_SYMBOL_GPL(regulator_set_optimum_mode);
 
 /**
+ * regulator_set_bypass_regmap - Default set_bypass() using regmap
+ *
+ * @rdev: device to operate on.
+ * @enable: state to set.
+ */
+int regulator_set_bypass_regmap(struct regulator_dev *rdev, bool enable)
+{
+        unsigned int val;
+
+        if (enable)
+                val = rdev->desc->bypass_mask;
+        else
+                val = 0;
+
+        return regmap_update_bits(rdev->regmap, rdev->desc->bypass_reg,
+                                  rdev->desc->bypass_mask, val);
+}
+EXPORT_SYMBOL_GPL(regulator_set_bypass_regmap);
+
+/**
+ * regulator_get_bypass_regmap - Default get_bypass() using regmap
+ *
+ * @rdev: device to operate on.
+ * @enable: current state.
+ */
+int regulator_get_bypass_regmap(struct regulator_dev *rdev, bool *enable)
+{
+        unsigned int val;
+        int ret;
+
+        ret = regmap_read(rdev->regmap, rdev->desc->bypass_reg, &val);
+        if (ret != 0)
+                return ret;
+
+        *enable = val & rdev->desc->bypass_mask;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(regulator_get_bypass_regmap);
+
+/**
+ * regulator_allow_bypass - allow the regulator to go into bypass mode
+ *
+ * @regulator: Regulator to configure
+ * @allow: enable or disable bypass mode
+ *
+ * Allow the regulator to go into bypass mode if all other consumers
+ * for the regulator also enable bypass mode and the machine
+ * constraints allow this.  Bypass mode means that the regulator is
+ * simply passing the input directly to the output with no regulation.
+ */
+int regulator_allow_bypass(struct regulator *regulator, bool enable)
+{
+        struct regulator_dev *rdev = regulator->rdev;
+        int ret = 0;
+
+        if (!rdev->desc->ops->set_bypass)
+                return 0;
+
+        if (rdev->constraints &&
+            !(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_BYPASS))
+                return 0;
+
+        mutex_lock(&rdev->mutex);
+
+        if (enable && !regulator->bypass) {
+                rdev->bypass_count++;
+
+                if (rdev->bypass_count == rdev->open_count) {
+                        ret = rdev->desc->ops->set_bypass(rdev, enable);
+                        if (ret != 0)
+                                rdev->bypass_count--;
+                }
+
+        } else if (!enable && regulator->bypass) {
+                rdev->bypass_count--;
+
+                if (rdev->bypass_count != rdev->open_count) {
+                        ret = rdev->desc->ops->set_bypass(rdev, enable);
+                        if (ret != 0)
+                                rdev->bypass_count++;
+                }
+        }
+
+        if (ret == 0)
+                regulator->bypass = enable;
+
+        mutex_unlock(&rdev->mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(regulator_allow_bypass);
+
+/**
  * regulator_register_notifier - register regulator event notifier
  * @regulator: regulator source
  * @nb: notifier block
@@ -3011,7 +3142,8 @@ static int add_regulator_attributes(struct regulator_dev *rdev)
 
         /* some attributes need specific methods to be displayed */
         if ((ops->get_voltage && ops->get_voltage(rdev) >= 0) ||
-            (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0)) {
+            (ops->get_voltage_sel && ops->get_voltage_sel(rdev) >= 0) ||
+            (ops->list_voltage && ops->list_voltage(rdev, 0) >= 0)) {
                 status = device_create_file(dev, &dev_attr_microvolts);
                 if (status < 0)
                         return status;
@@ -3036,6 +3168,11 @@ static int add_regulator_attributes(struct regulator_dev *rdev)
                 if (status < 0)
                         return status;
         }
+        if (ops->get_bypass) {
+                status = device_create_file(dev, &dev_attr_bypass);
+                if (status < 0)
+                        return status;
+        }
 
         /* some attributes are type-specific */
         if (rdev->desc->type == REGULATOR_CURRENT) {
@@ -3124,6 +3261,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
                            &rdev->use_count);
         debugfs_create_u32("open_count", 0444, rdev->debugfs,
                            &rdev->open_count);
+        debugfs_create_u32("bypass_count", 0444, rdev->debugfs,
+                           &rdev->bypass_count);
 }
 
 /**
@@ -3189,8 +3328,10 @@ regulator_register(const struct regulator_desc *regulator_desc,
         rdev->desc = regulator_desc;
         if (config->regmap)
                 rdev->regmap = config->regmap;
-        else
+        else if (dev_get_regmap(dev, NULL))
                 rdev->regmap = dev_get_regmap(dev, NULL);
+        else if (dev->parent)
+                rdev->regmap = dev_get_regmap(dev->parent, NULL);
         INIT_LIST_HEAD(&rdev->consumer_list);
         INIT_LIST_HEAD(&rdev->list);
         BLOCKING_INIT_NOTIFIER_HEAD(&rdev->notifier);
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 903299cf15cf..27355b1199e5 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -133,8 +133,8 @@ static int da9052_dcdc_set_current_limit(struct regulator_dev *rdev, int min_uA,
             max_uA < da9052_current_limits[row][DA9052_MIN_UA])
                 return -EINVAL;
 
-        for (i = 0; i < DA9052_CURRENT_RANGE; i++) {
-                if (min_uA <= da9052_current_limits[row][i]) {
+        for (i = DA9052_CURRENT_RANGE - 1; i >= 0; i--) {
+                if (da9052_current_limits[row][i] <= max_uA) {
                         reg_val = i;
                         break;
                 }
diff --git a/drivers/regulator/dummy.c b/drivers/regulator/dummy.c
index 86f655c7f7a1..03a1d7c11ef2 100644
--- a/drivers/regulator/dummy.c
+++ b/drivers/regulator/dummy.c
@@ -30,7 +30,7 @@ static struct regulator_init_data dummy_initdata;
 static struct regulator_ops dummy_ops;
 
 static struct regulator_desc dummy_desc = {
-        .name = "dummy",
+        .name = "regulator-dummy",
         .id = -1,
         .type = REGULATOR_VOLTAGE,
         .owner = THIS_MODULE,
diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
new file mode 100644
index 000000000000..339f4d732e97
--- /dev/null
+++ b/drivers/regulator/fan53555.c
@@ -0,0 +1,322 @@
+/*
+ * FAN53555 Fairchild Digitally Programmable TinyBuck Regulator Driver.
+ *
+ * Supported Part Numbers:
+ * FAN53555UC00X/01X/03X/04X/05X
+ *
+ * Copyright (c) 2012 Marvell Technology Ltd.
+ * Yunfan Zhang <yfzhang@marvell.com>
+ *
+ * This package is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/module.h>
+#include <linux/param.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/regmap.h>
+#include <linux/regulator/fan53555.h>
+
+/* Voltage setting */
+#define FAN53555_VSEL0          0x00
+#define FAN53555_VSEL1          0x01
+/* Control register */
+#define FAN53555_CONTROL        0x02
+/* IC Type */
+#define FAN53555_ID1            0x03
+/* IC mask version */
+#define FAN53555_ID2            0x04
+/* Monitor register */
+#define FAN53555_MONITOR        0x05
+
+/* VSEL bit definitions */
+#define VSEL_BUCK_EN    (1 << 7)
+#define VSEL_MODE               (1 << 6)
+#define VSEL_NSEL_MASK  0x3F
+/* Chip ID and Verison */
+#define DIE_ID          0x0F    /* ID1 */
+#define DIE_REV         0x0F    /* ID2 */
+/* Control bit definitions */
+#define CTL_OUTPUT_DISCHG       (1 << 7)
+#define CTL_SLEW_MASK           (0x7 << 4)
+#define CTL_SLEW_SHIFT          4
+#define CTL_RESET                       (1 << 2)
+
+#define FAN53555_NVOLTAGES      64      /* Numbers of voltages */
+
+/* IC Type */
+enum {
+        FAN53555_CHIP_ID_00 = 0,
+        FAN53555_CHIP_ID_01,
+        FAN53555_CHIP_ID_02,
+        FAN53555_CHIP_ID_03,
+        FAN53555_CHIP_ID_04,
+        FAN53555_CHIP_ID_05,
+};
+
+struct fan53555_device_info {
+        struct regmap *regmap;
+        struct device *dev;
+        struct regulator_desc desc;
+        struct regulator_dev *rdev;
+        struct regulator_init_data *regulator;
+        /* IC Type and Rev */
+        int chip_id;
+        int chip_rev;
+        /* Voltage setting register */
+        unsigned int vol_reg;
+        unsigned int sleep_reg;
+        /* Voltage range and step(linear) */
+        unsigned int vsel_min;
+        unsigned int vsel_step;
+        /* Voltage slew rate limiting */
+        unsigned int slew_rate;
+        /* Sleep voltage cache */
+        unsigned int sleep_vol_cache;
+};
+
+static int fan53555_set_suspend_voltage(struct regulator_dev *rdev, int uV)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+        int ret;
+
+        if (di->sleep_vol_cache == uV)
+                return 0;
+        ret = regulator_map_voltage_linear(rdev, uV, uV);
+        if (ret < 0)
+                return -EINVAL;
+        ret = regmap_update_bits(di->regmap, di->sleep_reg,
+                                        VSEL_NSEL_MASK, ret);
+        if (ret < 0)
+                return -EINVAL;
+        /* Cache the sleep voltage setting.
+         * Might not be the real voltage which is rounded */
+        di->sleep_vol_cache = uV;
+
+        return 0;
+}
+
+static int fan53555_set_mode(struct regulator_dev *rdev, unsigned int mode)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+
+        switch (mode) {
+        case REGULATOR_MODE_FAST:
+                regmap_update_bits(di->regmap, di->vol_reg,
+                                VSEL_MODE, VSEL_MODE);
+                break;
+        case REGULATOR_MODE_NORMAL:
+                regmap_update_bits(di->regmap, di->vol_reg, VSEL_MODE, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static unsigned int fan53555_get_mode(struct regulator_dev *rdev)
+{
+        struct fan53555_device_info *di = rdev_get_drvdata(rdev);
+        unsigned int val;
+        int ret = 0;
+
+        ret = regmap_read(di->regmap, di->vol_reg, &val);
+        if (ret < 0)
+                return ret;
+        if (val & VSEL_MODE)
+                return REGULATOR_MODE_FAST;
+        else
+                return REGULATOR_MODE_NORMAL;
+}
+
+static struct regulator_ops fan53555_regulator_ops = {
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .map_voltage = regulator_map_voltage_linear,
+        .list_voltage = regulator_list_voltage_linear,
+        .set_suspend_voltage = fan53555_set_suspend_voltage,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .set_mode = fan53555_set_mode,
+        .get_mode = fan53555_get_mode,
+};
+
+/* For 00,01,03,05 options:
+ * VOUT = 0.60V + NSELx * 10mV, from 0.60 to 1.23V.
+ * For 04 option:
+ * VOUT = 0.603V + NSELx * 12.826mV, from 0.603 to 1.411V.
+ * */
+static int fan53555_device_setup(struct fan53555_device_info *di,
+                                struct fan53555_platform_data *pdata)
+{
+        unsigned int reg, data, mask;
+
+        /* Setup voltage control register */
+        switch (pdata->sleep_vsel_id) {
+        case FAN53555_VSEL_ID_0:
+                di->sleep_reg = FAN53555_VSEL0;
+                di->vol_reg = FAN53555_VSEL1;
+                break;
+        case FAN53555_VSEL_ID_1:
+                di->sleep_reg = FAN53555_VSEL1;
+                di->vol_reg = FAN53555_VSEL0;
+                break;
+        default:
+                dev_err(di->dev, "Invalid VSEL ID!\n");
+                return -EINVAL;
+        }
+        /* Init voltage range and step */
+        switch (di->chip_id) {
+        case FAN53555_CHIP_ID_00:
+        case FAN53555_CHIP_ID_01:
+        case FAN53555_CHIP_ID_03:
+        case FAN53555_CHIP_ID_05:
+                di->vsel_min = 600000;
+                di->vsel_step = 10000;
+                break;
+        case FAN53555_CHIP_ID_04:
+                di->vsel_min = 603000;
+                di->vsel_step = 12826;
+                break;
+        default:
+                dev_err(di->dev,
+                        "Chip ID[%d]\n not supported!\n", di->chip_id);
+                return -EINVAL;
+        }
+        /* Init slew rate */
+        if (pdata->slew_rate & 0x7)
+                di->slew_rate = pdata->slew_rate;
+        else
+                di->slew_rate = FAN53555_SLEW_RATE_64MV;
+        reg = FAN53555_CONTROL;
+        data = di->slew_rate << CTL_SLEW_SHIFT;
+        mask = CTL_SLEW_MASK;
+        return regmap_update_bits(di->regmap, reg, mask, data);
+}
+
+static int fan53555_regulator_register(struct fan53555_device_info *di,
+                        struct regulator_config *config)
+{
+        struct regulator_desc *rdesc = &di->desc;
+
+        rdesc->name = "fan53555-reg";
+        rdesc->ops = &fan53555_regulator_ops;
+        rdesc->type = REGULATOR_VOLTAGE;
+        rdesc->n_voltages = FAN53555_NVOLTAGES;
+        rdesc->enable_reg = di->vol_reg;
+        rdesc->enable_mask = VSEL_BUCK_EN;
+        rdesc->min_uV = di->vsel_min;
+        rdesc->uV_step = di->vsel_step;
+        rdesc->vsel_reg = di->vol_reg;
+        rdesc->vsel_mask = VSEL_NSEL_MASK;
+        rdesc->owner = THIS_MODULE;
+
+        di->rdev = regulator_register(&di->desc, config);
+        if (IS_ERR(di->rdev))
+                return PTR_ERR(di->rdev);
+        return 0;
+
+}
+
+static struct regmap_config fan53555_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
+
+static int __devinit fan53555_regulator_probe(struct i2c_client *client,
+                                const struct i2c_device_id *id)
+{
+        struct fan53555_device_info *di;
+        struct fan53555_platform_data *pdata;
+        struct regulator_config config = { };
+        unsigned int val;
+        int ret;
+
+        pdata = client->dev.platform_data;
+        if (!pdata || !pdata->regulator) {
+                dev_err(&client->dev, "Platform data not found!\n");
+                return -ENODEV;
+        }
+
+        di = devm_kzalloc(&client->dev, sizeof(struct fan53555_device_info),
+                                        GFP_KERNEL);
+        if (!di) {
+                dev_err(&client->dev, "Failed to allocate device info data!\n");
+                return -ENOMEM;
+        }
+        di->regmap = devm_regmap_init_i2c(client, &fan53555_regmap_config);
+        if (IS_ERR(di->regmap)) {
+                dev_err(&client->dev, "Failed to allocate regmap!\n");
+                return PTR_ERR(di->regmap);
+        }
+        di->dev = &client->dev;
+        di->regulator = pdata->regulator;
+        i2c_set_clientdata(client, di);
+        /* Get chip ID */
+        ret = regmap_read(di->regmap, FAN53555_ID1, &val);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to get chip ID!\n");
+                return -ENODEV;
+        }
+        di->chip_id = val & DIE_ID;
+        /* Get chip revision */
+        ret = regmap_read(di->regmap, FAN53555_ID2, &val);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to get chip Rev!\n");
+                return -ENODEV;
+        }
+        di->chip_rev = val & DIE_REV;
+        dev_info(&client->dev, "FAN53555 Option[%d] Rev[%d] Detected!\n",
+                                di->chip_id, di->chip_rev);
+        /* Device init */
+        ret = fan53555_device_setup(di, pdata);
+        if (ret < 0) {
+                dev_err(&client->dev, "Failed to setup device!\n");
+                return ret;
+        }
+        /* Register regulator */
+        config.dev = di->dev;
+        config.init_data = di->regulator;
+        config.regmap = di->regmap;
+        config.driver_data = di;
+        ret = fan53555_regulator_register(di, &config);
+        if (ret < 0)
+                dev_err(&client->dev, "Failed to register regulator!\n");
+        return ret;
+
+}
+
+static int __devexit fan53555_regulator_remove(struct i2c_client *client)
+{
+        struct fan53555_device_info *di = i2c_get_clientdata(client);
+
+        regulator_unregister(di->rdev);
+        return 0;
+}
+
+static const struct i2c_device_id fan53555_id[] = {
+        {"fan53555", -1},
+        { },
+};
+
+static struct i2c_driver fan53555_regulator_driver = {
+        .driver = {
+                .name = "fan53555-regulator",
+        },
+        .probe = fan53555_regulator_probe,
+        .remove = __devexit_p(fan53555_regulator_remove),
+        .id_table = fan53555_id,
+};
+
+module_i2c_driver(fan53555_regulator_driver);
+
+MODULE_AUTHOR("Yunfan Zhang <yfzhang@marvell.com>");
+MODULE_DESCRIPTION("FAN53555 regulator driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index 1d145a07ada9..d8ecf49a5777 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -73,13 +73,7 @@ static struct regulator_ops isl_core_ops = {
         .map_voltage    = regulator_map_voltage_linear,
 };
 
-static int isl6271a_get_fixed_voltage(struct regulator_dev *dev)
-{
-        return dev->desc->min_uV;
-}
-
 static struct regulator_ops isl_fixed_ops = {
-        .get_voltage    = isl6271a_get_fixed_voltage,
         .list_voltage   = regulator_list_voltage_linear,
 };
 
diff --git a/drivers/regulator/lp872x.c b/drivers/regulator/lp872x.c
index 212c38eaba70..708f4b6a17dc 100644
--- a/drivers/regulator/lp872x.c
+++ b/drivers/regulator/lp872x.c
@@ -86,6 +86,10 @@
 #define EXTERN_DVS_USED                 0
 #define MAX_DELAY                       6
 
+/* Default DVS Mode */
+#define LP8720_DEFAULT_DVS              0
+#define LP8725_DEFAULT_DVS              BIT(2)
+
 /* dump registers in regmap-debugfs */
 #define MAX_REGISTERS                   0x0F
 
@@ -269,9 +273,9 @@ static int lp872x_regulator_enable_time(struct regulator_dev *rdev)
         return val > MAX_DELAY ? 0 : val * time_step_us;
 }
 
-static void lp872x_set_dvs(struct lp872x *lp, int gpio)
+static void lp872x_set_dvs(struct lp872x *lp, enum lp872x_dvs_sel dvs_sel,
+                        int gpio)
 {
-        enum lp872x_dvs_sel dvs_sel = lp->pdata->dvs->vsel;
         enum lp872x_dvs_state state;
 
         state = dvs_sel == SEL_V1 ? DVS_HIGH : DVS_LOW;
@@ -339,10 +343,10 @@ static int lp872x_buck_set_voltage_sel(struct regulator_dev *rdev,
         struct lp872x *lp = rdev_get_drvdata(rdev);
         enum lp872x_regulator_id buck = rdev_get_id(rdev);
         u8 addr, mask = LP872X_VOUT_M;
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
+        struct lp872x_dvs *dvs = lp->pdata ? lp->pdata->dvs : NULL;
 
         if (dvs && gpio_is_valid(dvs->gpio))
-                lp872x_set_dvs(lp, dvs->gpio);
+                lp872x_set_dvs(lp, dvs->vsel, dvs->gpio);
 
         addr = lp872x_select_buck_vout_addr(lp, buck);
         if (!lp872x_is_valid_buck_addr(addr))
@@ -374,8 +378,8 @@ static int lp8725_buck_set_current_limit(struct regulator_dev *rdev,
 {
         struct lp872x *lp = rdev_get_drvdata(rdev);
         enum lp872x_regulator_id buck = rdev_get_id(rdev);
-        int i, max = ARRAY_SIZE(lp8725_buck_uA);
-        u8 addr, val;
+        int i;
+        u8 addr;
 
         switch (buck) {
         case LP8725_ID_BUCK1:
@@ -388,17 +392,15 @@ static int lp8725_buck_set_current_limit(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
-        for (i = 0 ; i < max ; i++)
+        for (i = ARRAY_SIZE(lp8725_buck_uA) - 1 ; i >= 0; i--) {
                 if (lp8725_buck_uA[i] >= min_uA &&
                         lp8725_buck_uA[i] <= max_uA)
-                        break;
-
-        if (i == max)
-                return -EINVAL;
-
-        val = i << LP8725_BUCK_CL_S;
+                        return lp872x_update_bits(lp, addr,
+                                                  LP8725_BUCK_CL_M,
+                                                  i << LP8725_BUCK_CL_S);
+        }
 
-        return lp872x_update_bits(lp, addr, LP8725_BUCK_CL_M, val);
+        return -EINVAL;
 }
 
 static int lp8725_buck_get_current_limit(struct regulator_dev *rdev)
@@ -727,39 +729,16 @@ static struct regulator_desc lp8725_regulator_desc[] = {
         },
 };
 
-static int lp872x_check_dvs_validity(struct lp872x *lp)
-{
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
-        u8 val = 0;
-        int ret;
-
-        ret = lp872x_read_byte(lp, LP872X_GENERAL_CFG, &val);
-        if (ret)
-                return ret;
-
-        ret = 0;
-        if (lp->chipid == LP8720) {
-                if (val & LP8720_EXT_DVS_M)
-                        ret = dvs ? 0 : -EINVAL;
-        } else {
-                if ((val & LP8725_DVS1_M) == EXTERN_DVS_USED)
-                        ret = dvs ? 0 : -EINVAL;
-        }
-
-        return ret;
-}
-
 static int lp872x_init_dvs(struct lp872x *lp)
 {
         int ret, gpio;
-        struct lp872x_dvs *dvs = lp->pdata->dvs;
+        struct lp872x_dvs *dvs = lp->pdata ? lp->pdata->dvs : NULL;
         enum lp872x_dvs_state pinstate;
+        u8 mask[] = { LP8720_EXT_DVS_M, LP8725_DVS1_M | LP8725_DVS2_M };
+        u8 default_dvs_mode[] = { LP8720_DEFAULT_DVS, LP8725_DEFAULT_DVS };
 
-        ret = lp872x_check_dvs_validity(lp);
-        if (ret) {
-                dev_warn(lp->dev, "invalid dvs data: %d\n", ret);
-                return ret;
-        }
+        if (!dvs)
+                goto set_default_dvs_mode;
 
         gpio = dvs->gpio;
         if (!gpio_is_valid(gpio)) {
@@ -778,6 +757,10 @@ static int lp872x_init_dvs(struct lp872x *lp)
         lp->dvs_gpio = gpio;
 
         return 0;
+
+set_default_dvs_mode:
+        return lp872x_update_bits(lp, LP872X_GENERAL_CFG, mask[lp->chipid],
+                                default_dvs_mode[lp->chipid]);
 }
 
 static int lp872x_config(struct lp872x *lp)
@@ -785,24 +768,29 @@ static int lp872x_config(struct lp872x *lp)
         struct lp872x_platform_data *pdata = lp->pdata;
         int ret;
 
-        if (!pdata->update_config)
-                return 0;
+        if (!pdata || !pdata->update_config)
+                goto init_dvs;
 
         ret = lp872x_write_byte(lp, LP872X_GENERAL_CFG, pdata->general_config);
         if (ret)
                 return ret;
 
+init_dvs:
         return lp872x_init_dvs(lp);
 }
 
 static struct regulator_init_data
 *lp872x_find_regulator_init_data(int id, struct lp872x *lp)
 {
+        struct lp872x_platform_data *pdata = lp->pdata;
         int i;
 
+        if (!pdata)
+                return NULL;
+
         for (i = 0; i < lp->num_regulators; i++) {
-                if (lp->pdata->regulator_data[i].id == id)
-                        return lp->pdata->regulator_data[i].init_data;
+                if (pdata->regulator_data[i].id == id)
+                        return pdata->regulator_data[i].init_data;
         }
 
         return NULL;
@@ -863,18 +851,12 @@ static const struct regmap_config lp872x_regmap_config = {
 static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
 {
         struct lp872x *lp;
-        struct lp872x_platform_data *pdata = cl->dev.platform_data;
         int ret, size, num_regulators;
         const int lp872x_num_regulators[] = {
                 [LP8720] = LP8720_NUM_REGULATORS,
                 [LP8725] = LP8725_NUM_REGULATORS,
         };
 
-        if (!pdata) {
-                dev_err(&cl->dev, "no platform data\n");
-                return -EINVAL;
-        }
-
         lp = devm_kzalloc(&cl->dev, sizeof(struct lp872x), GFP_KERNEL);
         if (!lp)
                 goto err_mem;
@@ -894,7 +876,7 @@ static int lp872x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
         }
 
         lp->dev = &cl->dev;
-        lp->pdata = pdata;
+        lp->pdata = cl->dev.platform_data;
         lp->chipid = id->driver_data;
         lp->num_regulators = num_regulators;
         i2c_set_clientdata(cl, lp);
diff --git a/drivers/regulator/lp8788-buck.c b/drivers/regulator/lp8788-buck.c
index 6356e821400f..ba3e0aa402de 100644
--- a/drivers/regulator/lp8788-buck.c
+++ b/drivers/regulator/lp8788-buck.c
@@ -69,6 +69,9 @@
 #define PIN_HIGH                        1
 #define ENABLE_TIME_USEC                32
 
+#define BUCK_FPWM_MASK(x)               (1 << (x))
+#define BUCK_FPWM_SHIFT(x)              (x)
+
 enum lp8788_dvs_state {
         DVS_LOW  = GPIOF_OUT_INIT_LOW,
         DVS_HIGH = GPIOF_OUT_INIT_HIGH,
@@ -86,15 +89,9 @@ enum lp8788_buck_id {
         BUCK4,
 };
 
-struct lp8788_pwm_map {
-        u8 mask;
-        u8 shift;
-};
-
 struct lp8788_buck {
         struct lp8788 *lp;
         struct regulator_dev *regulator;
-        struct lp8788_pwm_map *pmap;
         void *dvs;
 };
 
@@ -106,29 +103,6 @@ static const int lp8788_buck_vtbl[] = {
         1950000, 2000000,
 };
 
-/* buck pwm mode selection : used for set/get_mode in regulator ops
- * @forced pwm : fast mode
- * @auto pwm   : normal mode
- */
-static struct lp8788_pwm_map buck_pmap[] = {
-        [BUCK1] = {
-                .mask = LP8788_FPWM_BUCK1_M,
-                .shift = LP8788_FPWM_BUCK1_S,
-        },
-        [BUCK2] = {
-                .mask = LP8788_FPWM_BUCK2_M,
-                .shift = LP8788_FPWM_BUCK2_S,
-        },
-        [BUCK3] = {
-                .mask = LP8788_FPWM_BUCK3_M,
-                .shift = LP8788_FPWM_BUCK3_S,
-        },
-        [BUCK4] = {
-                .mask = LP8788_FPWM_BUCK4_M,
-                .shift = LP8788_FPWM_BUCK4_S,
-        },
-};
-
 static const u8 buck1_vout_addr[] = {
         LP8788_BUCK1_VOUT0, LP8788_BUCK1_VOUT1,
         LP8788_BUCK1_VOUT2, LP8788_BUCK1_VOUT3,
@@ -347,41 +321,37 @@ static int lp8788_buck_enable_time(struct regulator_dev *rdev)
 static int lp8788_buck_set_mode(struct regulator_dev *rdev, unsigned int mode)
 {
         struct lp8788_buck *buck = rdev_get_drvdata(rdev);
-        struct lp8788_pwm_map *pmap = buck->pmap;
-        u8 val;
-
-        if (!pmap)
-                return -EINVAL;
+        enum lp8788_buck_id id = rdev_get_id(rdev);
+        u8 mask, val;
 
+        mask = BUCK_FPWM_MASK(id);
         switch (mode) {
         case REGULATOR_MODE_FAST:
-                val = LP8788_FORCE_PWM << pmap->shift;
+                val = LP8788_FORCE_PWM << BUCK_FPWM_SHIFT(id);
                 break;
         case REGULATOR_MODE_NORMAL:
-                val = LP8788_AUTO_PWM << pmap->shift;
+                val = LP8788_AUTO_PWM << BUCK_FPWM_SHIFT(id);
                 break;
         default:
                 return -EINVAL;
         }
 
-        return lp8788_update_bits(buck->lp, LP8788_BUCK_PWM, pmap->mask, val);
+        return lp8788_update_bits(buck->lp, LP8788_BUCK_PWM, mask, val);
 }
 
 static unsigned int lp8788_buck_get_mode(struct regulator_dev *rdev)
 {
         struct lp8788_buck *buck = rdev_get_drvdata(rdev);
-        struct lp8788_pwm_map *pmap = buck->pmap;
+        enum lp8788_buck_id id = rdev_get_id(rdev);
         u8 val;
         int ret;
 
-        if (!pmap)
-                return -EINVAL;
-
         ret = lp8788_read_byte(buck->lp, LP8788_BUCK_PWM, &val);
         if (ret)
                 return ret;
 
-        return val & pmap->mask ? REGULATOR_MODE_FAST : REGULATOR_MODE_NORMAL;
+        return val & BUCK_FPWM_MASK(id) ?
+                                REGULATOR_MODE_FAST : REGULATOR_MODE_NORMAL;
 }
 
 static struct regulator_ops lp8788_buck12_ops = {
@@ -459,27 +429,6 @@ static struct regulator_desc lp8788_buck_desc[] = {
         },
 };
 
-static int lp8788_set_default_dvs_ctrl_mode(struct lp8788 *lp,
-                                        enum lp8788_buck_id id)
-{
-        u8 mask, val;
-
-        switch (id) {
-        case BUCK1:
-                mask = LP8788_BUCK1_DVS_SEL_M;
-                val  = LP8788_BUCK1_DVS_I2C;
-                break;
-        case BUCK2:
-                mask = LP8788_BUCK2_DVS_SEL_M;
-                val  = LP8788_BUCK2_DVS_I2C;
-                break;
-        default:
-                return 0;
-        }
-
-        return lp8788_update_bits(lp, LP8788_BUCK_DVS_SEL, mask, val);
-}
-
 static int _gpio_request(struct lp8788_buck *buck, int gpio, char *name)
 {
         struct device *dev = buck->lp->dev;
@@ -530,6 +479,7 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
         struct lp8788_platform_data *pdata = buck->lp->pdata;
         u8 mask[] = { LP8788_BUCK1_DVS_SEL_M, LP8788_BUCK2_DVS_SEL_M };
         u8 val[]  = { LP8788_BUCK1_DVS_PIN, LP8788_BUCK2_DVS_PIN };
+        u8 default_dvs_mode[] = { LP8788_BUCK1_DVS_I2C, LP8788_BUCK2_DVS_I2C };
 
         /* no dvs for buck3, 4 */
         if (id == BUCK3 || id == BUCK4)
@@ -550,7 +500,8 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
                                 val[id]);
 
 set_default_dvs_mode:
-        return lp8788_set_default_dvs_ctrl_mode(buck->lp, id);
+        return lp8788_update_bits(buck->lp, LP8788_BUCK_DVS_SEL, mask[id],
+                                  default_dvs_mode[id]);
 }
 
 static __devinit int lp8788_buck_probe(struct platform_device *pdev)
@@ -567,7 +518,6 @@ static __devinit int lp8788_buck_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         buck->lp = lp;
-        buck->pmap = &buck_pmap[id];
 
         ret = lp8788_init_dvs(buck, id);
         if (ret)
diff --git a/drivers/regulator/lp8788-ldo.c b/drivers/regulator/lp8788-ldo.c
index d2122e41a96d..6796eeb47dc6 100644
--- a/drivers/regulator/lp8788-ldo.c
+++ b/drivers/regulator/lp8788-ldo.c
@@ -496,6 +496,7 @@ static struct regulator_desc lp8788_dldo_desc[] = {
                 .name = "dldo12",
                 .id = DLDO12,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -521,6 +522,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo2",
                 .id = ALDO2,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -530,6 +532,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo3",
                 .id = ALDO3,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -539,6 +542,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo4",
                 .id = ALDO4,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_B,
@@ -548,6 +552,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo5",
                 .id = ALDO5,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -583,6 +588,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo8",
                 .id = ALDO8,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -592,6 +598,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo9",
                 .id = ALDO9,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
@@ -601,6 +608,7 @@ static struct regulator_desc lp8788_aldo_desc[] = {
                 .name = "aldo10",
                 .id = ALDO10,
                 .ops = &lp8788_ldo_voltage_fixed_ops,
+                .n_voltages = 1,
                 .type = REGULATOR_VOLTAGE,
                 .owner = THIS_MODULE,
                 .enable_reg = LP8788_EN_LDO_C,
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index c564af6f05a3..2a67d08658ad 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -66,7 +66,7 @@ enum max77686_ramp_rate {
 };
 
 struct max77686_data {
-        struct regulator_dev **rdev;
+        struct regulator_dev *rdev[MAX77686_REGULATORS];
 };
 
 static int max77686_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
@@ -265,6 +265,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
                 rmatch.of_node = NULL;
                 of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
                 rdata[i].initdata = rmatch.init_data;
+                rdata[i].of_node = rmatch.of_node;
         }
 
         pdata->regulators = rdata;
@@ -283,10 +284,8 @@ static __devinit int max77686_pmic_probe(struct platform_device *pdev)
 {
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct max77686_platform_data *pdata = dev_get_platdata(iodev->dev);
-        struct regulator_dev **rdev;
         struct max77686_data *max77686;
-        int i,  size;
-        int ret = 0;
+        int i, ret = 0;
         struct regulator_config config = { };
 
         dev_dbg(&pdev->dev, "%s\n", __func__);
@@ -313,45 +312,38 @@ static __devinit int max77686_pmic_probe(struct platform_device *pdev)
         if (!max77686)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * MAX77686_REGULATORS;
-        max77686->rdev = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
-        if (!max77686->rdev)
-                return -ENOMEM;
-
-        rdev = max77686->rdev;
         config.dev = &pdev->dev;
         config.regmap = iodev->regmap;
         platform_set_drvdata(pdev, max77686);
 
         for (i = 0; i < MAX77686_REGULATORS; i++) {
                 config.init_data = pdata->regulators[i].initdata;
+                config.of_node = pdata->regulators[i].of_node;
 
-                rdev[i] = regulator_register(&regulators[i], &config);
-                if (IS_ERR(rdev[i])) {
-                        ret = PTR_ERR(rdev[i]);
+                max77686->rdev[i] = regulator_register(&regulators[i], &config);
+                if (IS_ERR(max77686->rdev[i])) {
+                        ret = PTR_ERR(max77686->rdev[i]);
                         dev_err(&pdev->dev,
                                 "regulator init failed for %d\n", i);
-                                rdev[i] = NULL;
-                                goto err;
+                        max77686->rdev[i] = NULL;
+                        goto err;
                 }
         }
 
         return 0;
 err:
         while (--i >= 0)
-                regulator_unregister(rdev[i]);
+                regulator_unregister(max77686->rdev[i]);
         return ret;
 }
 
 static int __devexit max77686_pmic_remove(struct platform_device *pdev)
 {
         struct max77686_data *max77686 = platform_get_drvdata(pdev);
-        struct regulator_dev **rdev = max77686->rdev;
         int i;
 
         for (i = 0; i < MAX77686_REGULATORS; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(max77686->rdev[i]);
 
         return 0;
 }
diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
new file mode 100644
index 000000000000..af7607515ab9
--- /dev/null
+++ b/drivers/regulator/max8907-regulator.c
@@ -0,0 +1,408 @@
+/*
+ * max8907-regulator.c -- support regulators in max8907
+ *
+ * Copyright (C) 2010 Gyungoh Yoo <jack.yoo@maxim-ic.com>
+ * Copyright (C) 2010-2012, NVIDIA CORPORATION. All rights reserved.
+ *
+ * Portions based on drivers/regulator/tps65910-regulator.c,
+ *     Copyright 2010 Texas Instruments Inc.
+ *     Author: Graeme Gregory <gg@slimlogic.co.uk>
+ *     Author: Jorge Eduardo Candelaria <jedu@slimlogic.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/mfd/core.h>
+#include <linux/mfd/max8907.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+
+#define MAX8907_II2RR_VERSION_MASK      0xF0
+#define MAX8907_II2RR_VERSION_REV_A     0x00
+#define MAX8907_II2RR_VERSION_REV_B     0x10
+#define MAX8907_II2RR_VERSION_REV_C     0x30
+
+struct max8907_regulator {
+        struct regulator_desc desc[MAX8907_NUM_REGULATORS];
+        struct regulator_dev *rdev[MAX8907_NUM_REGULATORS];
+};
+
+#define REG_MBATT() \
+        [MAX8907_MBATT] = { \
+                .name = "MBATT", \
+                .supply_name = "mbatt", \
+                .id = MAX8907_MBATT, \
+                .ops = &max8907_mbatt_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+        }
+
+#define REG_LDO(ids, supply, base, min, max, step) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = ((max) - (min)) / (step) + 1, \
+                .ops = &max8907_ldo_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (min), \
+                .uV_step = (step), \
+                .vsel_reg = (base) + MAX8907_VOUT, \
+                .vsel_mask = 0x3f, \
+                .enable_reg = (base) + MAX8907_CTL, \
+                .enable_mask = MAX8907_MASK_LDO_EN, \
+        }
+
+#define REG_FIXED(ids, supply, voltage) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = 1, \
+                .ops = &max8907_fixed_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (voltage), \
+        }
+
+#define REG_OUT5V(ids, supply, base, voltage) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = 1, \
+                .ops = &max8907_out5v_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (voltage), \
+                .enable_reg = (base), \
+                .enable_mask = MAX8907_MASK_OUT5V_EN, \
+        }
+
+#define REG_BBAT(ids, supply, base, min, max, step) \
+        [MAX8907_##ids] = { \
+                .name = #ids, \
+                .supply_name = supply, \
+                .id = MAX8907_##ids, \
+                .n_voltages = ((max) - (min)) / (step) + 1, \
+                .ops = &max8907_bbat_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                .min_uV = (min), \
+                .uV_step = (step), \
+                .vsel_reg = (base), \
+                .vsel_mask = MAX8907_MASK_VBBATTCV, \
+        }
+
+#define LDO_750_50(id, supply, base) REG_LDO(id, supply, (base), \
+                        750000, 3900000, 50000)
+#define LDO_650_25(id, supply, base) REG_LDO(id, supply, (base), \
+                        650000, 2225000, 25000)
+
+static struct regulator_ops max8907_mbatt_ops = {
+};
+
+static struct regulator_ops max8907_ldo_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+};
+
+static struct regulator_ops max8907_ldo_hwctl_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+};
+
+static struct regulator_ops max8907_fixed_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+};
+
+static struct regulator_ops max8907_out5v_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+};
+
+static struct regulator_ops max8907_out5v_hwctl_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+};
+
+static struct regulator_ops max8907_bbat_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+};
+
+static struct regulator_desc max8907_regulators[] = {
+        REG_MBATT(),
+        REG_LDO(SD1, "in-v1", MAX8907_REG_SDCTL1, 650000, 2225000, 25000),
+        REG_LDO(SD2, "in-v2", MAX8907_REG_SDCTL2, 637500, 1425000, 12500),
+        REG_LDO(SD3, "in-v3", MAX8907_REG_SDCTL3, 750000, 3900000, 50000),
+        LDO_750_50(LDO1, "in1", MAX8907_REG_LDOCTL1),
+        LDO_650_25(LDO2, "in2", MAX8907_REG_LDOCTL2),
+        LDO_650_25(LDO3, "in3", MAX8907_REG_LDOCTL3),
+        LDO_750_50(LDO4, "in4", MAX8907_REG_LDOCTL4),
+        LDO_750_50(LDO5, "in5", MAX8907_REG_LDOCTL5),
+        LDO_750_50(LDO6, "in6", MAX8907_REG_LDOCTL6),
+        LDO_750_50(LDO7, "in7", MAX8907_REG_LDOCTL7),
+        LDO_750_50(LDO8, "in8", MAX8907_REG_LDOCTL8),
+        LDO_750_50(LDO9, "in9", MAX8907_REG_LDOCTL9),
+        LDO_750_50(LDO10, "in10", MAX8907_REG_LDOCTL10),
+        LDO_750_50(LDO11, "in11", MAX8907_REG_LDOCTL11),
+        LDO_750_50(LDO12, "in12", MAX8907_REG_LDOCTL12),
+        LDO_750_50(LDO13, "in13", MAX8907_REG_LDOCTL13),
+        LDO_750_50(LDO14, "in14", MAX8907_REG_LDOCTL14),
+        LDO_750_50(LDO15, "in15", MAX8907_REG_LDOCTL15),
+        LDO_750_50(LDO16, "in16", MAX8907_REG_LDOCTL16),
+        LDO_650_25(LDO17, "in17", MAX8907_REG_LDOCTL17),
+        LDO_650_25(LDO18, "in18", MAX8907_REG_LDOCTL18),
+        LDO_750_50(LDO19, "in19", MAX8907_REG_LDOCTL19),
+        LDO_750_50(LDO20, "in20", MAX8907_REG_LDOCTL20),
+        REG_OUT5V(OUT5V, "mbatt", MAX8907_REG_OUT5VEN, 5000000),
+        REG_OUT5V(OUT33V, "mbatt",  MAX8907_REG_OUT33VEN, 3300000),
+        REG_BBAT(BBAT, "MBATT", MAX8907_REG_BBAT_CNFG,
+                                                2400000, 3000000, 200000),
+        REG_FIXED(SDBY, "MBATT", 1200000),
+        REG_FIXED(VRTC, "MBATT", 3300000),
+};
+
+#ifdef CONFIG_OF
+
+#define MATCH(_name, _id) \
+        [MAX8907_##_id] = { \
+                .name = #_name, \
+                .driver_data = (void *)&max8907_regulators[MAX8907_##_id], \
+        }
+
+static struct of_regulator_match max8907_matches[] = {
+        MATCH(mbatt, MBATT),
+        MATCH(sd1, SD1),
+        MATCH(sd2, SD2),
+        MATCH(sd3, SD3),
+        MATCH(ldo1, LDO1),
+        MATCH(ldo2, LDO2),
+        MATCH(ldo3, LDO3),
+        MATCH(ldo4, LDO4),
+        MATCH(ldo5, LDO5),
+        MATCH(ldo6, LDO6),
+        MATCH(ldo7, LDO7),
+        MATCH(ldo8, LDO8),
+        MATCH(ldo9, LDO9),
+        MATCH(ldo10, LDO10),
+        MATCH(ldo11, LDO11),
+        MATCH(ldo12, LDO12),
+        MATCH(ldo13, LDO13),
+        MATCH(ldo14, LDO14),
+        MATCH(ldo15, LDO15),
+        MATCH(ldo16, LDO16),
+        MATCH(ldo17, LDO17),
+        MATCH(ldo18, LDO18),
+        MATCH(ldo19, LDO19),
+        MATCH(ldo20, LDO20),
+        MATCH(out5v, OUT5V),
+        MATCH(out33v, OUT33V),
+        MATCH(bbat, BBAT),
+        MATCH(sdby, SDBY),
+        MATCH(vrtc, VRTC),
+};
+
+static int max8907_regulator_parse_dt(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.parent->of_node;
+        struct device_node *regulators;
+        int ret;
+
+        if (!pdev->dev.parent->of_node)
+                return 0;
+
+        regulators = of_find_node_by_name(np, "regulators");
+        if (!regulators) {
+                dev_err(&pdev->dev, "regulators node not found\n");
+                return -EINVAL;
+        }
+
+        ret = of_regulator_match(pdev->dev.parent, regulators,
+                                 max8907_matches,
+                                 ARRAY_SIZE(max8907_matches));
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
+                        ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return max8907_matches[index].init_data;
+}
+
+static inline struct device_node *match_of_node(int index)
+{
+        return max8907_matches[index].of_node;
+}
+#else
+static int max8907_regulator_parse_dt(struct platform_device *pdev)
+{
+        return 0;
+}
+
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return NULL;
+}
+
+static inline struct device_node *match_of_node(int index)
+{
+        return NULL;
+}
+#endif
+
+static __devinit int max8907_regulator_probe(struct platform_device *pdev)
+{
+        struct max8907 *max8907 = dev_get_drvdata(pdev->dev.parent);
+        struct max8907_platform_data *pdata = dev_get_platdata(max8907->dev);
+        int ret;
+        struct max8907_regulator *pmic;
+        unsigned int val;
+        int i;
+        struct regulator_config config = {};
+        struct regulator_init_data *idata;
+        const char *mbatt_rail_name = NULL;
+
+        ret = max8907_regulator_parse_dt(pdev);
+        if (ret)
+                return ret;
+
+        pmic = devm_kzalloc(&pdev->dev, sizeof(*pmic), GFP_KERNEL);
+        if (!pmic) {
+                dev_err(&pdev->dev, "Failed to alloc pmic\n");
+                return -ENOMEM;
+        }
+        platform_set_drvdata(pdev, pmic);
+
+        memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc));
+
+        /* Backwards compatibility with MAX8907B; SD1 uses different voltages */
+        regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
+        if ((val & MAX8907_II2RR_VERSION_MASK) ==
+            MAX8907_II2RR_VERSION_REV_B) {
+                pmic->desc[MAX8907_SD1].min_uV = 637500;
+                pmic->desc[MAX8907_SD1].uV_step = 12500;
+                pmic->desc[MAX8907_SD1].n_voltages =
+                                                (1425000 - 637500) / 12500 + 1;
+        }
+
+        for (i = 0; i < MAX8907_NUM_REGULATORS; i++) {
+                config.dev = pdev->dev.parent;
+                if (pdata)
+                        idata = pdata->init_data[i];
+                else
+                        idata = match_init_data(i);
+                config.init_data = idata;
+                config.driver_data = pmic;
+                config.regmap = max8907->regmap_gen;
+                config.of_node = match_of_node(i);
+
+                switch (pmic->desc[i].id) {
+                case MAX8907_MBATT:
+                        if (idata && idata->constraints.name)
+                                mbatt_rail_name = idata->constraints.name;
+                        else
+                                mbatt_rail_name = pmic->desc[i].name;
+                        break;
+                case MAX8907_BBAT:
+                case MAX8907_SDBY:
+                case MAX8907_VRTC:
+                        idata->supply_regulator = mbatt_rail_name;
+                        break;
+                }
+
+                if (pmic->desc[i].ops == &max8907_ldo_ops) {
+                        regmap_read(config.regmap, pmic->desc[i].enable_reg,
+                                    &val);
+                        if ((val & MAX8907_MASK_LDO_SEQ) !=
+                            MAX8907_MASK_LDO_SEQ)
+                                pmic->desc[i].ops = &max8907_ldo_hwctl_ops;
+                } else if (pmic->desc[i].ops == &max8907_out5v_ops) {
+                        regmap_read(config.regmap, pmic->desc[i].enable_reg,
+                                    &val);
+                        if ((val & (MAX8907_MASK_OUT5V_VINEN |
+                                                MAX8907_MASK_OUT5V_ENSRC)) !=
+                            MAX8907_MASK_OUT5V_ENSRC)
+                                pmic->desc[i].ops = &max8907_out5v_hwctl_ops;
+                }
+
+                pmic->rdev[i] = regulator_register(&pmic->desc[i], &config);
+                if (IS_ERR(pmic->rdev[i])) {
+                        dev_err(&pdev->dev,
+                                "failed to register %s regulator\n",
+                                pmic->desc[i].name);
+                        ret = PTR_ERR(pmic->rdev[i]);
+                        goto err_unregister_regulator;
+                }
+        }
+
+        return 0;
+
+err_unregister_regulator:
+        while (--i >= 0)
+                regulator_unregister(pmic->rdev[i]);
+        return ret;
+}
+
+static __devexit int max8907_regulator_remove(struct platform_device *pdev)
+{
+        struct max8907_regulator *pmic = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < MAX8907_NUM_REGULATORS; i++)
+                regulator_unregister(pmic->rdev[i]);
+
+        return 0;
+}
+
+static struct platform_driver max8907_regulator_driver = {
+        .driver = {
+                   .name = "max8907-regulator",
+                   .owner = THIS_MODULE,
+                   },
+        .probe = max8907_regulator_probe,
+        .remove = __devexit_p(max8907_regulator_remove),
+};
+
+static int __init max8907_regulator_init(void)
+{
+        return platform_driver_register(&max8907_regulator_driver);
+}
+
+subsys_initcall(max8907_regulator_init);
+
+static void __exit max8907_reg_exit(void)
+{
+        platform_driver_unregister(&max8907_regulator_driver);
+}
+
+module_exit(max8907_reg_exit);
+
+MODULE_DESCRIPTION("MAX8907 regulator driver");
+MODULE_AUTHOR("Gyungoh Yoo <jack.yoo@maxim-ic.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:max8907-regulator");
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
index 4932e3449fe1..0801a6d0c122 100644
--- a/drivers/regulator/mc13783-regulator.c
+++ b/drivers/regulator/mc13783-regulator.c
@@ -21,6 +21,30 @@
 #include <linux/module.h>
 #include "mc13xxx.h"
 
+#define MC13783_REG_SWITCHERS0                  24
+/* Enable does not exist for SW1A */
+#define MC13783_REG_SWITCHERS0_SW1AEN                   0
+#define MC13783_REG_SWITCHERS0_SW1AVSEL                 0
+#define MC13783_REG_SWITCHERS0_SW1AVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS1                  25
+/* Enable does not exist for SW1B */
+#define MC13783_REG_SWITCHERS1_SW1BEN                   0
+#define MC13783_REG_SWITCHERS1_SW1BVSEL                 0
+#define MC13783_REG_SWITCHERS1_SW1BVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS2                  26
+/* Enable does not exist for SW2A */
+#define MC13783_REG_SWITCHERS2_SW2AEN                   0
+#define MC13783_REG_SWITCHERS2_SW2AVSEL                 0
+#define MC13783_REG_SWITCHERS2_SW2AVSEL_M               (63 << 0)
+
+#define MC13783_REG_SWITCHERS3                  27
+/* Enable does not exist for SW2B */
+#define MC13783_REG_SWITCHERS3_SW2BEN                   0
+#define MC13783_REG_SWITCHERS3_SW2BVSEL                 0
+#define MC13783_REG_SWITCHERS3_SW2BVSEL_M               (63 << 0)
+
 #define MC13783_REG_SWITCHERS5                  29
 #define MC13783_REG_SWITCHERS5_SW3EN                    (1 << 20)
 #define MC13783_REG_SWITCHERS5_SW3VSEL                  18
@@ -93,6 +117,44 @@
 
 
 /* Voltage Values */
+static const int mc13783_sw1x_val[] = {
+        900000, 925000, 950000, 975000,
+        1000000, 1025000, 1050000, 1075000,
+        1100000, 1125000, 1150000, 1175000,
+        1200000, 1225000, 1250000, 1275000,
+        1300000, 1325000, 1350000, 1375000,
+        1400000, 1425000, 1450000, 1475000,
+        1500000, 1525000, 1550000, 1575000,
+        1600000, 1625000, 1650000, 1675000,
+        1700000, 1700000, 1700000, 1700000,
+        1800000, 1800000, 1800000, 1800000,
+        1850000, 1850000, 1850000, 1850000,
+        2000000, 2000000, 2000000, 2000000,
+        2100000, 2100000, 2100000, 2100000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+};
+
+static const int mc13783_sw2x_val[] = {
+        900000, 925000, 950000, 975000,
+        1000000, 1025000, 1050000, 1075000,
+        1100000, 1125000, 1150000, 1175000,
+        1200000, 1225000, 1250000, 1275000,
+        1300000, 1325000, 1350000, 1375000,
+        1400000, 1425000, 1450000, 1475000,
+        1500000, 1525000, 1550000, 1575000,
+        1600000, 1625000, 1650000, 1675000,
+        1700000, 1700000, 1700000, 1700000,
+        1800000, 1800000, 1800000, 1800000,
+        1900000, 1900000, 1900000, 1900000,
+        2000000, 2000000, 2000000, 2000000,
+        2100000, 2100000, 2100000, 2100000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+        2200000, 2200000, 2200000, 2200000,
+};
+
 static const unsigned int mc13783_sw3_val[] = {
         5000000, 5000000, 5000000, 5500000,
 };
@@ -188,6 +250,10 @@ static struct regulator_ops mc13783_gpo_regulator_ops;
         MC13783_DEFINE(REG, _name, _reg, _vsel_reg, _voltages)
 
 static struct mc13xxx_regulator mc13783_regulators[] = {
+        MC13783_DEFINE_SW(SW1A, SWITCHERS0, SWITCHERS0, mc13783_sw1x_val),
+        MC13783_DEFINE_SW(SW1B, SWITCHERS1, SWITCHERS1, mc13783_sw1x_val),
+        MC13783_DEFINE_SW(SW2A, SWITCHERS2, SWITCHERS2, mc13783_sw2x_val),
+        MC13783_DEFINE_SW(SW2B, SWITCHERS3, SWITCHERS3, mc13783_sw2x_val),
         MC13783_DEFINE_SW(SW3, SWITCHERS5, SWITCHERS5, mc13783_sw3_val),
 
         MC13783_FIXED_DEFINE(REG, VAUDIO, REGULATORMODE0, mc13783_vaudio_val),
@@ -238,9 +304,10 @@ static int mc13783_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
 
         BUG_ON(val & ~mask);
 
+        mc13xxx_lock(priv->mc13xxx);
         ret = mc13xxx_reg_read(mc13783, MC13783_REG_POWERMISC, &valread);
         if (ret)
-                return ret;
+                goto out;
 
         /* Update the stored state for Power Gates. */
         priv->powermisc_pwgt_state =
@@ -253,7 +320,10 @@ static int mc13783_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
         valread = (valread & ~MC13783_REG_POWERMISC_PWGTSPI_M) |
                                                 priv->powermisc_pwgt_state;
 
-        return mc13xxx_reg_write(mc13783, MC13783_REG_POWERMISC, valread);
+        ret = mc13xxx_reg_write(mc13783, MC13783_REG_POWERMISC, valread);
+out:
+        mc13xxx_unlock(priv->mc13xxx);
+        return ret;
 }
 
 static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
@@ -261,7 +331,6 @@ static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         struct mc13xxx_regulator *mc13xxx_regulators = priv->mc13xxx_regulators;
         int id = rdev_get_id(rdev);
-        int ret;
         u32 en_val = mc13xxx_regulators[id].enable_bit;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -271,12 +340,8 @@ static int mc13783_gpo_regulator_enable(struct regulator_dev *rdev)
             id == MC13783_REG_PWGT2SPI)
                 en_val = 0;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
+        return mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
                                         en_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
@@ -284,7 +349,6 @@ static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         struct mc13xxx_regulator *mc13xxx_regulators = priv->mc13xxx_regulators;
         int id = rdev_get_id(rdev);
-        int ret;
         u32 dis_val = 0;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -294,12 +358,8 @@ static int mc13783_gpo_regulator_disable(struct regulator_dev *rdev)
             id == MC13783_REG_PWGT2SPI)
                 dis_val = mc13xxx_regulators[id].enable_bit;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
+        return mc13783_powermisc_rmw(priv, mc13xxx_regulators[id].enable_bit,
                                         dis_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13783_gpo_regulator_is_enabled(struct regulator_dev *rdev)
@@ -330,7 +390,6 @@ static struct regulator_ops mc13783_gpo_regulator_ops = {
         .is_enabled = mc13783_gpo_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 
 static int __devinit mc13783_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
index b388b746452e..1fa63812f7ac 100644
--- a/drivers/regulator/mc13892-regulator.c
+++ b/drivers/regulator/mc13892-regulator.c
@@ -305,9 +305,10 @@ static int mc13892_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
 
         BUG_ON(val & ~mask);
 
+        mc13xxx_lock(priv->mc13xxx);
         ret = mc13xxx_reg_read(mc13892, MC13892_POWERMISC, &valread);
         if (ret)
-                return ret;
+                goto out;
 
         /* Update the stored state for Power Gates. */
         priv->powermisc_pwgt_state =
@@ -320,14 +321,16 @@ static int mc13892_powermisc_rmw(struct mc13xxx_regulator_priv *priv, u32 mask,
         valread = (valread & ~MC13892_POWERMISC_PWGTSPI_M) |
                 priv->powermisc_pwgt_state;
 
-        return mc13xxx_reg_write(mc13892, MC13892_POWERMISC, valread);
+        ret = mc13xxx_reg_write(mc13892, MC13892_POWERMISC, valread);
+out:
+        mc13xxx_unlock(priv->mc13xxx);
+        return ret;
 }
 
 static int mc13892_gpo_regulator_enable(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int id = rdev_get_id(rdev);
-        int ret;
         u32 en_val = mc13892_regulators[id].enable_bit;
         u32 mask = mc13892_regulators[id].enable_bit;
 
@@ -340,18 +343,13 @@ static int mc13892_gpo_regulator_enable(struct regulator_dev *rdev)
         if (id == MC13892_GPO4)
                 mask |= MC13892_POWERMISC_GPO4ADINEN;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13892_powermisc_rmw(priv, mask, en_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
+        return mc13892_powermisc_rmw(priv, mask, en_val);
 }
 
 static int mc13892_gpo_regulator_disable(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int id = rdev_get_id(rdev);
-        int ret;
         u32 dis_val = 0;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
@@ -360,12 +358,8 @@ static int mc13892_gpo_regulator_disable(struct regulator_dev *rdev)
         if (id == MC13892_PWGT1SPI || id == MC13892_PWGT2SPI)
                 dis_val = mc13892_regulators[id].enable_bit;
 
-        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13892_powermisc_rmw(priv, mc13892_regulators[id].enable_bit,
+        return mc13892_powermisc_rmw(priv, mc13892_regulators[id].enable_bit,
                 dis_val);
-        mc13xxx_unlock(priv->mc13xxx);
-
-        return ret;
 }
 
 static int mc13892_gpo_regulator_is_enabled(struct regulator_dev *rdev)
@@ -396,14 +390,13 @@ static struct regulator_ops mc13892_gpo_regulator_ops = {
         .is_enabled = mc13892_gpo_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 
-static int mc13892_sw_regulator_get_voltage(struct regulator_dev *rdev)
+static int mc13892_sw_regulator_get_voltage_sel(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int ret, id = rdev_get_id(rdev);
-        unsigned int val, hi;
+        unsigned int val;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
 
@@ -414,17 +407,11 @@ static int mc13892_sw_regulator_get_voltage(struct regulator_dev *rdev)
         if (ret)
                 return ret;
 
-        hi  = val & MC13892_SWITCHERS0_SWxHI;
         val = (val & mc13892_regulators[id].vsel_mask)
                 >> mc13892_regulators[id].vsel_shift;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d val: %d\n", __func__, id, val);
 
-        if (hi)
-                val = (25000 * val) + 1100000;
-        else
-                val = (25000 * val) + 600000;
-
         return val;
 }
 
@@ -432,37 +419,25 @@ static int mc13892_sw_regulator_set_voltage_sel(struct regulator_dev *rdev,
                                                 unsigned selector)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
-        int hi, value, mask, id = rdev_get_id(rdev);
-        u32 valread;
+        int volt, mask, id = rdev_get_id(rdev);
+        u32 reg_value;
         int ret;
 
-        value = rdev->desc->volt_table[selector];
+        volt = rdev->desc->volt_table[selector];
+        mask = mc13892_regulators[id].vsel_mask;
+        reg_value = selector << mc13892_regulators[id].vsel_shift;
+
+        if (volt > 1375000) {
+                mask |= MC13892_SWITCHERS0_SWxHI;
+                reg_value |= MC13892_SWITCHERS0_SWxHI;
+        } else if (volt < 1100000) {
+                mask |= MC13892_SWITCHERS0_SWxHI;
+                reg_value &= ~MC13892_SWITCHERS0_SWxHI;
+        }
 
         mc13xxx_lock(priv->mc13xxx);
-        ret = mc13xxx_reg_read(priv->mc13xxx,
-                mc13892_regulators[id].vsel_reg, &valread);
-        if (ret)
-                goto err;
-
-        if (value > 1375000)
-                hi = 1;
-        else if (value < 1100000)
-                hi = 0;
-        else
-                hi = valread & MC13892_SWITCHERS0_SWxHI;
-
-        if (hi) {
-                value = (value - 1100000) / 25000;
-                value |= MC13892_SWITCHERS0_SWxHI;
-        } else
-                value = (value - 600000) / 25000;
-
-        mask = mc13892_regulators[id].vsel_mask | MC13892_SWITCHERS0_SWxHI;
-        valread = (valread & ~mask) |
-                        (value << mc13892_regulators[id].vsel_shift);
-        ret = mc13xxx_reg_write(priv->mc13xxx, mc13892_regulators[id].vsel_reg,
-                        valread);
-err:
+        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].reg, mask,
+                              reg_value);
         mc13xxx_unlock(priv->mc13xxx);
 
         return ret;
@@ -471,7 +446,7 @@ err:
 static struct regulator_ops mc13892_sw_regulator_ops = {
         .list_voltage = regulator_list_voltage_table,
         .set_voltage_sel = mc13892_sw_regulator_set_voltage_sel,
-        .get_voltage = mc13892_sw_regulator_get_voltage,
+        .get_voltage_sel = mc13892_sw_regulator_get_voltage_sel,
 };
 
 static int mc13892_vcam_set_mode(struct regulator_dev *rdev, unsigned int mode)
diff --git a/drivers/regulator/mc13xxx-regulator-core.c b/drivers/regulator/mc13xxx-regulator-core.c
index d6eda28ca5d0..88cbb832d555 100644
--- a/drivers/regulator/mc13xxx-regulator-core.c
+++ b/drivers/regulator/mc13xxx-regulator-core.c
@@ -143,30 +143,21 @@ int mc13xxx_fixed_regulator_set_voltage(struct regulator_dev *rdev, int min_uV,
                 __func__, id, min_uV, max_uV);
 
         if (min_uV <= rdev->desc->volt_table[0] &&
-            rdev->desc->volt_table[0] <= max_uV)
+            rdev->desc->volt_table[0] <= max_uV) {
+                *selector = 0;
                 return 0;
-        else
+        } else {
                 return -EINVAL;
+        }
 }
 EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_set_voltage);
 
-int mc13xxx_fixed_regulator_get_voltage(struct regulator_dev *rdev)
-{
-        int id = rdev_get_id(rdev);
-
-        dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
-
-        return rdev->desc->volt_table[0];
-}
-EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_get_voltage);
-
 struct regulator_ops mc13xxx_fixed_regulator_ops = {
         .enable = mc13xxx_regulator_enable,
         .disable = mc13xxx_regulator_disable,
         .is_enabled = mc13xxx_regulator_is_enabled,
         .list_voltage = regulator_list_voltage_table,
         .set_voltage = mc13xxx_fixed_regulator_set_voltage,
-        .get_voltage = mc13xxx_fixed_regulator_get_voltage,
 };
 EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_ops);
 
diff --git a/drivers/regulator/mc13xxx.h b/drivers/regulator/mc13xxx.h
index eaff5510b6df..06c8903f182a 100644
--- a/drivers/regulator/mc13xxx.h
+++ b/drivers/regulator/mc13xxx.h
@@ -34,7 +34,6 @@ struct mc13xxx_regulator_priv {
 
 extern int mc13xxx_fixed_regulator_set_voltage(struct regulator_dev *rdev,
                 int min_uV, int max_uV, unsigned *selector);
-extern int mc13xxx_fixed_regulator_get_voltage(struct regulator_dev *rdev);
 
 #ifdef CONFIG_OF
 extern int mc13xxx_get_num_regulators_dt(struct platform_device *pdev);
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 3e4106f2bda9..6f684916fd79 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -92,16 +92,18 @@ struct regulator_init_data *of_get_regulator_init_data(struct device *dev,
 EXPORT_SYMBOL_GPL(of_get_regulator_init_data);
 
 /**
- * of_regulator_match - extract regulator init data when node
- * property "regulator-compatible" matches with the regulator name.
+ * of_regulator_match - extract multiple regulator init data from device tree.
  * @dev: device requesting the data
  * @node: parent device node of the regulators
  * @matches: match table for the regulators
  * @num_matches: number of entries in match table
  *
- * This function uses a match table specified by the regulator driver and
- * looks up the corresponding init data in the device tree  if
- * regulator-compatible matches. Note that the match table is modified
+ * This function uses a match table specified by the regulator driver to
+ * parse regulator init data from the device tree. @node is expected to
+ * contain a set of child nodes, each providing the init data for one
+ * regulator. The data parsed from a child node will be matched to a regulator
+ * based on either the deprecated property regulator-compatible if present,
+ * or otherwise the child node's name. Note that the match table is modified
  * in place.
  *
  * Returns the number of matches found or a negative error code on failure.
@@ -112,26 +114,23 @@ int of_regulator_match(struct device *dev, struct device_node *node,
 {
         unsigned int count = 0;
         unsigned int i;
-        const char *regulator_comp;
+        const char *name;
         struct device_node *child;
 
         if (!dev || !node)
                 return -EINVAL;
 
         for_each_child_of_node(node, child) {
-                regulator_comp = of_get_property(child,
+                name = of_get_property(child,
                                         "regulator-compatible", NULL);
-                if (!regulator_comp) {
-                        dev_err(dev, "regulator-compatible is missing for node %s\n",
-                                child->name);
-                        continue;
-                }
+                if (!name)
+                        name = child->name;
                 for (i = 0; i < num_matches; i++) {
                         struct of_regulator_match *match = &matches[i];
                         if (match->of_node)
                                 continue;
 
-                        if (strcmp(match->name, regulator_comp))
+                        if (strcmp(match->name, name))
                                 continue;
 
                         match->init_data =
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 46c7e88f8381..2ba7502fa3b2 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -443,44 +443,6 @@ static int palmas_list_voltage_ldo(struct regulator_dev *dev,
         return  850000 + (selector * 50000);
 }
 
-static int palmas_get_voltage_ldo_sel(struct regulator_dev *dev)
-{
-        struct palmas_pmic *pmic = rdev_get_drvdata(dev);
-        int id = rdev_get_id(dev);
-        int selector;
-        unsigned int reg;
-        unsigned int addr;
-
-        addr = palmas_regs_info[id].vsel_addr;
-
-        palmas_ldo_read(pmic->palmas, addr, &reg);
-
-        selector = reg & PALMAS_LDO1_VOLTAGE_VSEL_MASK;
-
-        /* Adjust selector to match list_voltage ranges */
-        if (selector > 49)
-                selector = 49;
-
-        return selector;
-}
-
-static int palmas_set_voltage_ldo_sel(struct regulator_dev *dev,
-                unsigned selector)
-{
-        struct palmas_pmic *pmic = rdev_get_drvdata(dev);
-        int id = rdev_get_id(dev);
-        unsigned int reg = 0;
-        unsigned int addr;
-
-        addr = palmas_regs_info[id].vsel_addr;
-
-        reg = selector;
-
-        palmas_ldo_write(pmic->palmas, addr, reg);
-
-        return 0;
-}
-
 static int palmas_map_voltage_ldo(struct regulator_dev *rdev,
                 int min_uV, int max_uV)
 {
@@ -505,8 +467,8 @@ static struct regulator_ops palmas_ops_ldo = {
         .is_enabled             = palmas_is_enabled_ldo,
         .enable                 = regulator_enable_regmap,
         .disable                = regulator_disable_regmap,
-        .get_voltage_sel        = palmas_get_voltage_ldo_sel,
-        .set_voltage_sel        = palmas_set_voltage_ldo_sel,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
+        .set_voltage_sel        = regulator_set_voltage_sel_regmap,
         .list_voltage           = palmas_list_voltage_ldo,
         .map_voltage            = palmas_map_voltage_ldo,
 };
@@ -757,6 +719,9 @@ static __devinit int palmas_probe(struct platform_device *pdev)
 
                 pmic->desc[id].type = REGULATOR_VOLTAGE;
                 pmic->desc[id].owner = THIS_MODULE;
+                pmic->desc[id].vsel_reg = PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
+                                                palmas_regs_info[id].vsel_addr);
+                pmic->desc[id].vsel_mask = PALMAS_LDO1_VOLTAGE_VSEL_MASK;
                 pmic->desc[id].enable_reg = PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
                                                 palmas_regs_info[id].ctrl_addr);
                 pmic->desc[id].enable_mask = PALMAS_LDO1_CTRL_MODE_ACTIVE;
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 4669dc9ac74a..926f9c8f2fac 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -24,7 +24,7 @@
 #include <linux/mfd/samsung/s2mps11.h>
 
 struct s2mps11_info {
-        struct regulator_dev **rdev;
+        struct regulator_dev *rdev[S2MPS11_REGULATOR_MAX];
 
         int ramp_delay2;
         int ramp_delay34;
@@ -236,9 +236,8 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
         struct regulator_config config = { };
-        struct regulator_dev **rdev;
         struct s2mps11_info *s2mps11;
-        int i, ret, size;
+        int i, ret;
         unsigned char ramp_enable, ramp_reg = 0;
 
         if (!pdata) {
@@ -251,13 +250,6 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         if (!s2mps11)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * S2MPS11_REGULATOR_MAX;
-        s2mps11->rdev = devm_kzalloc(&pdev->dev, size, GFP_KERNEL);
-        if (!s2mps11->rdev) {
-                return -ENOMEM;
-        }
-
-        rdev = s2mps11->rdev;
         platform_set_drvdata(pdev, s2mps11);
 
         s2mps11->ramp_delay2 = pdata->buck2_ramp_delay;
@@ -297,12 +289,12 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
                 config.init_data = pdata->regulators[i].initdata;
                 config.driver_data = s2mps11;
 
-                rdev[i] = regulator_register(&regulators[i], &config);
-                if (IS_ERR(rdev[i])) {
-                        ret = PTR_ERR(rdev[i]);
+                s2mps11->rdev[i] = regulator_register(&regulators[i], &config);
+                if (IS_ERR(s2mps11->rdev[i])) {
+                        ret = PTR_ERR(s2mps11->rdev[i]);
                         dev_err(&pdev->dev, "regulator init failed for %d\n",
                                 i);
-                        rdev[i] = NULL;
+                        s2mps11->rdev[i] = NULL;
                         goto err;
                 }
         }
@@ -310,8 +302,7 @@ static __devinit int s2mps11_pmic_probe(struct platform_device *pdev)
         return 0;
 err:
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(s2mps11->rdev[i]);
 
         return ret;
 }
@@ -319,12 +310,10 @@ err:
 static int __devexit s2mps11_pmic_remove(struct platform_device *pdev)
 {
         struct s2mps11_info *s2mps11 = platform_get_drvdata(pdev);
-        struct regulator_dev **rdev = s2mps11->rdev;
         int i;
 
         for (i = 0; i < S2MPS11_REGULATOR_MAX; i++)
-                if (rdev[i])
-                        regulator_unregister(rdev[i]);
+                regulator_unregister(s2mps11->rdev[i]);
 
         return 0;
 }
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 6caa222af77a..ab00cab905b7 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -22,6 +22,7 @@
 #include <linux/err.h>
 #include <linux/platform_device.h>
 
+#include <linux/regulator/of_regulator.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
 #include <linux/mfd/tps65217.h>
@@ -281,37 +282,130 @@ static const struct regulator_desc regulators[] = {
                            NULL),
 };
 
+#ifdef CONFIG_OF
+static struct of_regulator_match reg_matches[] = {
+        { .name = "dcdc1", .driver_data = (void *)TPS65217_DCDC_1 },
+        { .name = "dcdc2", .driver_data = (void *)TPS65217_DCDC_2 },
+        { .name = "dcdc3", .driver_data = (void *)TPS65217_DCDC_3 },
+        { .name = "ldo1", .driver_data = (void *)TPS65217_LDO_1 },
+        { .name = "ldo2", .driver_data = (void *)TPS65217_LDO_2 },
+        { .name = "ldo3", .driver_data = (void *)TPS65217_LDO_3 },
+        { .name = "ldo4", .driver_data = (void *)TPS65217_LDO_4 },
+};
+
+static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
+{
+        struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
+        struct device_node *node = tps->dev->of_node;
+        struct tps65217_board *pdata;
+        struct device_node *regs;
+        int i, count;
+
+        regs = of_find_node_by_name(node, "regulators");
+        if (!regs)
+                return NULL;
+
+        count = of_regulator_match(pdev->dev.parent, regs,
+                                reg_matches, TPS65217_NUM_REGULATOR);
+        of_node_put(regs);
+        if ((count < 0) || (count > TPS65217_NUM_REGULATOR))
+                return NULL;
+
+        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+        if (!pdata)
+                return NULL;
+
+        for (i = 0; i < count; i++) {
+                if (!reg_matches[i].init_data || !reg_matches[i].of_node)
+                        continue;
+
+                pdata->tps65217_init_data[i] = reg_matches[i].init_data;
+                pdata->of_node[i] = reg_matches[i].of_node;
+        }
+
+        return pdata;
+}
+#else
+static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
+{
+        return NULL;
+}
+#endif
+
 static int __devinit tps65217_regulator_probe(struct platform_device *pdev)
 {
+        struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
+        struct tps65217_board *pdata = dev_get_platdata(tps->dev);
+        struct regulator_init_data *reg_data;
         struct regulator_dev *rdev;
-        struct tps65217 *tps;
-        struct tps_info *info = &tps65217_pmic_regs[pdev->id];
         struct regulator_config config = { };
+        int i, ret;
 
-        /* Already set by core driver */
-        tps = dev_to_tps65217(pdev->dev.parent);
-        tps->info[pdev->id] = info;
+        if (tps->dev->of_node)
+                pdata = tps65217_parse_dt(pdev);
 
-        config.dev = &pdev->dev;
-        config.of_node = pdev->dev.of_node;
-        config.init_data = pdev->dev.platform_data;
-        config.driver_data = tps;
+        if (!pdata) {
+                dev_err(&pdev->dev, "Platform data not found\n");
+                return -EINVAL;
+        }
 
-        rdev = regulator_register(&regulators[pdev->id], &config);
-        if (IS_ERR(rdev))
-                return PTR_ERR(rdev);
+        if (tps65217_chip_id(tps) != TPS65217) {
+                dev_err(&pdev->dev, "Invalid tps chip version\n");
+                return -ENODEV;
+        }
 
-        platform_set_drvdata(pdev, rdev);
+        platform_set_drvdata(pdev, tps);
 
+        for (i = 0; i < TPS65217_NUM_REGULATOR; i++) {
+
+                reg_data = pdata->tps65217_init_data[i];
+
+                /*
+                 * Regulator API handles empty constraints but not NULL
+                 * constraints
+                 */
+                if (!reg_data)
+                        continue;
+
+                /* Register the regulators */
+                tps->info[i] = &tps65217_pmic_regs[i];
+
+                config.dev = tps->dev;
+                config.init_data = reg_data;
+                config.driver_data = tps;
+                config.regmap = tps->regmap;
+                if (tps->dev->of_node)
+                        config.of_node = pdata->of_node[i];
+
+                rdev = regulator_register(&regulators[i], &config);
+                if (IS_ERR(rdev)) {
+                        dev_err(tps->dev, "failed to register %s regulator\n",
+                                pdev->name);
+                        ret = PTR_ERR(rdev);
+                        goto err_unregister_regulator;
+                }
+
+                /* Save regulator for cleanup */
+                tps->rdev[i] = rdev;
+        }
         return 0;
+
+err_unregister_regulator:
+        while (--i >= 0)
+                regulator_unregister(tps->rdev[i]);
+
+        return ret;
 }
 
 static int __devexit tps65217_regulator_remove(struct platform_device *pdev)
 {
-        struct regulator_dev *rdev = platform_get_drvdata(pdev);
+        struct tps65217 *tps = platform_get_drvdata(pdev);
+        unsigned int i;
+
+        for (i = 0; i < TPS65217_NUM_REGULATOR; i++)
+                regulator_unregister(tps->rdev[i]);
 
         platform_set_drvdata(pdev, NULL);
-        regulator_unregister(rdev);
 
         return 0;
 }
diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c
index 947ece933d90..058d2f2675e9 100644
--- a/drivers/regulator/tps6524x-regulator.c
+++ b/drivers/regulator/tps6524x-regulator.c
@@ -502,15 +502,13 @@ static int set_current_limit(struct regulator_dev *rdev, int min_uA,
         if (info->n_ilimsels == 1)
                 return -EINVAL;
 
-        for (i = 0; i < info->n_ilimsels; i++)
+        for (i = info->n_ilimsels - 1; i >= 0; i--) {
                 if (min_uA <= info->ilimsels[i] &&
                     max_uA >= info->ilimsels[i])
-                        break;
-
-        if (i >= info->n_ilimsels)
-                return -EINVAL;
+                        return write_field(hw, &info->ilimsel, i);
+        }
 
-        return write_field(hw, &info->ilimsel, i);
+        return -EINVAL;
 }
 
 static int get_current_limit(struct regulator_dev *rdev)
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index 19241fc30050..ce1e7cb8d513 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -57,9 +57,6 @@
 struct tps6586x_regulator {
         struct regulator_desc desc;
 
-        int volt_reg;
-        int volt_shift;
-        int volt_nbits;
         int enable_bit[2];
         int enable_reg[2];
 
@@ -81,10 +78,10 @@ static int tps6586x_set_voltage_sel(struct regulator_dev *rdev,
         int ret, val, rid = rdev_get_id(rdev);
         uint8_t mask;
 
-        val = selector << ri->volt_shift;
-        mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
+        val = selector << (ffs(rdev->desc->vsel_mask) - 1);
+        mask = rdev->desc->vsel_mask;
 
-        ret = tps6586x_update(parent, ri->volt_reg, val, mask);
+        ret = tps6586x_update(parent, rdev->desc->vsel_reg, val, mask);
         if (ret)
                 return ret;
 
@@ -100,66 +97,17 @@ static int tps6586x_set_voltage_sel(struct regulator_dev *rdev,
         return ret;
 }
 
-static int tps6586x_get_voltage_sel(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-        uint8_t val, mask;
-        int ret;
-
-        ret = tps6586x_read(parent, ri->volt_reg, &val);
-        if (ret)
-                return ret;
-
-        mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
-        val = (val & mask) >> ri->volt_shift;
-
-        if (val >= ri->desc.n_voltages)
-                BUG();
-
-        return val;
-}
-
-static int tps6586x_regulator_enable(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-
-        return tps6586x_set_bits(parent, ri->enable_reg[0],
-                                 1 << ri->enable_bit[0]);
-}
-
-static int tps6586x_regulator_disable(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-
-        return tps6586x_clr_bits(parent, ri->enable_reg[0],
-                                 1 << ri->enable_bit[0]);
-}
-
-static int tps6586x_regulator_is_enabled(struct regulator_dev *rdev)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-        uint8_t reg_val;
-        int ret;
-
-        ret = tps6586x_read(parent, ri->enable_reg[0], &reg_val);
-        if (ret)
-                return ret;
-
-        return !!(reg_val & (1 << ri->enable_bit[0]));
-}
-
 static struct regulator_ops tps6586x_regulator_ops = {
         .list_voltage = regulator_list_voltage_table,
-        .get_voltage_sel = tps6586x_get_voltage_sel,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .set_voltage_sel = tps6586x_set_voltage_sel,
 
-        .is_enabled = tps6586x_regulator_is_enabled,
-        .enable = tps6586x_regulator_enable,
-        .disable = tps6586x_regulator_disable,
+        .is_enabled = regulator_is_enabled_regmap,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+};
+
+static struct regulator_ops tps6586x_sys_regulator_ops = {
 };
 
 static const unsigned int tps6586x_ldo0_voltages[] = {
@@ -202,10 +150,11 @@ static const unsigned int tps6586x_dvm_voltages[] = {
                 .n_voltages = ARRAY_SIZE(tps6586x_##vdata##_voltages),  \
                 .volt_table = tps6586x_##vdata##_voltages,              \
                 .owner  = THIS_MODULE,                                  \
+                .enable_reg = TPS6586X_SUPPLY##ereg0,                   \
+                .enable_mask = 1 << (ebit0),                            \
+                .vsel_reg = TPS6586X_##vreg,                            \
+                .vsel_mask = ((1 << (nbits)) - 1) << (shift),           \
         },                                                              \
-        .volt_reg       = TPS6586X_##vreg,                              \
-        .volt_shift     = (shift),                                      \
-        .volt_nbits     = (nbits),                                      \
         .enable_reg[0]  = TPS6586X_SUPPLY##ereg0,                       \
         .enable_bit[0]  = (ebit0),                                      \
         .enable_reg[1]  = TPS6586X_SUPPLY##ereg1,                       \
@@ -230,15 +179,28 @@ static const unsigned int tps6586x_dvm_voltages[] = {
         TPS6586X_REGULATOR_DVM_GOREG(goreg, gobit)                      \
 }
 
+#define TPS6586X_SYS_REGULATOR()                                        \
+{                                                                       \
+        .desc   = {                                                     \
+                .supply_name = "sys",                                   \
+                .name   = "REG-SYS",                                    \
+                .ops    = &tps6586x_sys_regulator_ops,                  \
+                .type   = REGULATOR_VOLTAGE,                            \
+                .id     = TPS6586X_ID_SYS,                              \
+                .owner  = THIS_MODULE,                                  \
+        },                                                              \
+}
+
 static struct tps6586x_regulator tps6586x_regulator[] = {
+        TPS6586X_SYS_REGULATOR(),
         TPS6586X_LDO(LDO_0, "vinldo01", ldo0, SUPPLYV1, 5, 3, ENC, 0, END, 0),
         TPS6586X_LDO(LDO_3, "vinldo23", ldo, SUPPLYV4, 0, 3, ENC, 2, END, 2),
-        TPS6586X_LDO(LDO_5, NULL, ldo, SUPPLYV6, 0, 3, ENE, 6, ENE, 6),
+        TPS6586X_LDO(LDO_5, "REG-SYS", ldo, SUPPLYV6, 0, 3, ENE, 6, ENE, 6),
         TPS6586X_LDO(LDO_6, "vinldo678", ldo, SUPPLYV3, 0, 3, ENC, 4, END, 4),
         TPS6586X_LDO(LDO_7, "vinldo678", ldo, SUPPLYV3, 3, 3, ENC, 5, END, 5),
         TPS6586X_LDO(LDO_8, "vinldo678", ldo, SUPPLYV2, 5, 3, ENC, 6, END, 6),
         TPS6586X_LDO(LDO_9, "vinldo9", ldo, SUPPLYV6, 3, 3, ENE, 7, ENE, 7),
-        TPS6586X_LDO(LDO_RTC, NULL, ldo, SUPPLYV4, 3, 3, V4, 7, V4, 7),
+        TPS6586X_LDO(LDO_RTC, "REG-SYS", ldo, SUPPLYV4, 3, 3, V4, 7, V4, 7),
         TPS6586X_LDO(LDO_1, "vinldo01", dvm, SUPPLYV1, 0, 5, ENC, 1, END, 1),
         TPS6586X_LDO(SM_2, "vin-sm2", sm2, SUPPLYV2, 0, 5, ENC, 7, END, 7),
 
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index 77a71a5c17c3..7eb986a40746 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -10,6 +10,8 @@
  */
 
 #include <linux/module.h>
+#include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
@@ -624,18 +626,9 @@ static int twlfixed_list_voltage(struct regulator_dev *rdev, unsigned index)
         return info->min_mV * 1000;
 }
 
-static int twlfixed_get_voltage(struct regulator_dev *rdev)
-{
-        struct twlreg_info      *info = rdev_get_drvdata(rdev);
-
-        return info->min_mV * 1000;
-}
-
 static struct regulator_ops twl4030fixed_ops = {
         .list_voltage   = twlfixed_list_voltage,
 
-        .get_voltage    = twlfixed_get_voltage,
-
         .enable         = twl4030reg_enable,
         .disable        = twl4030reg_disable,
         .is_enabled     = twl4030reg_is_enabled,
@@ -648,8 +641,6 @@ static struct regulator_ops twl4030fixed_ops = {
 static struct regulator_ops twl6030fixed_ops = {
         .list_voltage   = twlfixed_list_voltage,
 
-        .get_voltage    = twlfixed_get_voltage,
-
         .enable         = twl6030reg_enable,
         .disable        = twl6030reg_disable,
         .is_enabled     = twl6030reg_is_enabled,
@@ -659,13 +650,6 @@ static struct regulator_ops twl6030fixed_ops = {
         .get_status     = twl6030reg_get_status,
 };
 
-static struct regulator_ops twl6030_fixed_resource = {
-        .enable         = twl6030reg_enable,
-        .disable        = twl6030reg_disable,
-        .is_enabled     = twl6030reg_is_enabled,
-        .get_status     = twl6030reg_get_status,
-};
-
 /*
  * SMPS status and control
  */
@@ -757,37 +741,32 @@ static int twl6030smps_list_voltage(struct regulator_dev *rdev, unsigned index)
         return voltage;
 }
 
-static int
-twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
-                        unsigned int *selector)
+static int twl6030smps_map_voltage(struct regulator_dev *rdev, int min_uV,
+                                   int max_uV)
 {
-        struct twlreg_info      *info = rdev_get_drvdata(rdev);
-        int     vsel = 0;
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
+        int vsel = 0;
 
         switch (info->flags) {
         case 0:
                 if (min_uV == 0)
                         vsel = 0;
                 else if ((min_uV >= 600000) && (min_uV <= 1300000)) {
-                        int calc_uV;
                         vsel = DIV_ROUND_UP(min_uV - 600000, 12500);
                         vsel++;
-                        calc_uV = twl6030smps_list_voltage(rdev, vsel);
-                        if (calc_uV > max_uV)
-                                return -EINVAL;
                 }
                 /* Values 1..57 for vsel are linear and can be calculated
                  * values 58..62 are non linear.
                  */
-                else if ((min_uV > 1900000) && (max_uV >= 2100000))
+                else if ((min_uV > 1900000) && (min_uV <= 2100000))
                         vsel = 62;
-                else if ((min_uV > 1800000) && (max_uV >= 1900000))
+                else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1500000) && (max_uV >= 1800000))
+                else if ((min_uV > 1500000) && (min_uV <= 1800000))
                         vsel = 60;
-                else if ((min_uV > 1350000) && (max_uV >= 1500000))
+                else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
-                else if ((min_uV > 1300000) && (max_uV >= 1350000))
+                else if ((min_uV > 1300000) && (min_uV <= 1350000))
                         vsel = 58;
                 else
                         return -EINVAL;
@@ -796,25 +775,21 @@ twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
                 if (min_uV == 0)
                         vsel = 0;
                 else if ((min_uV >= 700000) && (min_uV <= 1420000)) {
-                        int calc_uV;
                         vsel = DIV_ROUND_UP(min_uV - 700000, 12500);
                         vsel++;
-                        calc_uV = twl6030smps_list_voltage(rdev, vsel);
-                        if (calc_uV > max_uV)
-                                return -EINVAL;
                 }
                 /* Values 1..57 for vsel are linear and can be calculated
                  * values 58..62 are non linear.
                  */
-                else if ((min_uV > 1900000) && (max_uV >= 2100000))
+                else if ((min_uV > 1900000) && (min_uV <= 2100000))
                         vsel = 62;
-                else if ((min_uV > 1800000) && (max_uV >= 1900000))
+                else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1350000) && (max_uV >= 1800000))
+                else if ((min_uV > 1350000) && (min_uV <= 1800000))
                         vsel = 60;
-                else if ((min_uV > 1350000) && (max_uV >= 1500000))
+                else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
-                else if ((min_uV > 1300000) && (max_uV >= 1350000))
+                else if ((min_uV > 1300000) && (min_uV <= 1350000))
                         vsel = 58;
                 else
                         return -EINVAL;
@@ -830,17 +805,23 @@ twl6030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
         case SMPS_OFFSET_EN|SMPS_EXTENDED_EN:
                 if (min_uV == 0) {
                         vsel = 0;
-                } else if ((min_uV >= 2161000) && (max_uV <= 4321000)) {
+                } else if ((min_uV >= 2161000) && (min_uV <= 4321000)) {
                         vsel = DIV_ROUND_UP(min_uV - 2161000, 38600);
                         vsel++;
                 }
                 break;
         }
 
-        *selector = vsel;
+        return vsel;
+}
+
+static int twl6030smps_set_voltage_sel(struct regulator_dev *rdev,
+                                       unsigned int selector)
+{
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
 
         return twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_VOLTAGE_SMPS,
-                                                        vsel);
+                            selector);
 }
 
 static int twl6030smps_get_voltage_sel(struct regulator_dev *rdev)
@@ -852,8 +833,9 @@ static int twl6030smps_get_voltage_sel(struct regulator_dev *rdev)
 
 static struct regulator_ops twlsmps_ops = {
         .list_voltage           = twl6030smps_list_voltage,
+        .map_voltage            = twl6030smps_map_voltage,
 
-        .set_voltage            = twl6030smps_set_voltage,
+        .set_voltage_sel        = twl6030smps_set_voltage_sel,
         .get_voltage_sel        = twl6030smps_get_voltage_sel,
 
         .enable                 = twl6030reg_enable,
@@ -876,7 +858,7 @@ static struct regulator_ops twlsmps_ops = {
                         0x0, TWL6030, twl6030fixed_ops)
 
 #define TWL4030_ADJUSTABLE_LDO(label, offset, num, turnon_delay, remap_conf) \
-static struct twlreg_info TWL4030_INFO_##label = { \
+static const struct twlreg_info TWL4030_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .table_len = ARRAY_SIZE(label##_VSEL_table), \
@@ -894,7 +876,7 @@ static struct twlreg_info TWL4030_INFO_##label = { \
         }
 
 #define TWL4030_ADJUSTABLE_SMPS(label, offset, num, turnon_delay, remap_conf) \
-static struct twlreg_info TWL4030_INFO_##label = { \
+static const struct twlreg_info TWL4030_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .remap = remap_conf, \
@@ -909,7 +891,7 @@ static struct twlreg_info TWL4030_INFO_##label = { \
         }
 
 #define TWL6030_ADJUSTABLE_SMPS(label) \
-static struct twlreg_info TWL6030_INFO_##label = { \
+static const struct twlreg_info TWL6030_INFO_##label = { \
         .desc = { \
                 .name = #label, \
                 .id = TWL6030_REG_##label, \
@@ -920,7 +902,7 @@ static struct twlreg_info TWL6030_INFO_##label = { \
         }
 
 #define TWL6030_ADJUSTABLE_LDO(label, offset, min_mVolts, max_mVolts) \
-static struct twlreg_info TWL6030_INFO_##label = { \
+static const struct twlreg_info TWL6030_INFO_##label = { \
         .base = offset, \
         .min_mV = min_mVolts, \
         .max_mV = max_mVolts, \
@@ -935,7 +917,7 @@ static struct twlreg_info TWL6030_INFO_##label = { \
         }
 
 #define TWL6025_ADJUSTABLE_LDO(label, offset, min_mVolts, max_mVolts) \
-static struct twlreg_info TWL6025_INFO_##label = { \
+static const struct twlreg_info TWL6025_INFO_##label = { \
         .base = offset, \
         .min_mV = min_mVolts, \
         .max_mV = max_mVolts, \
@@ -951,7 +933,7 @@ static struct twlreg_info TWL6025_INFO_##label = { \
 
 #define TWL_FIXED_LDO(label, offset, mVolts, num, turnon_delay, remap_conf, \
                 family, operations) \
-static struct twlreg_info TWLFIXED_INFO_##label = { \
+static const struct twlreg_info TWLFIXED_INFO_##label = { \
         .base = offset, \
         .id = num, \
         .min_mV = mVolts, \
@@ -981,7 +963,7 @@ static struct twlreg_info TWLRES_INFO_##label = { \
         }
 
 #define TWL6025_ADJUSTABLE_SMPS(label, offset) \
-static struct twlreg_info TWLSMPS_INFO_##label = { \
+static const struct twlreg_info TWLSMPS_INFO_##label = { \
         .base = offset, \
         .min_mV = 600, \
         .max_mV = 2100, \
@@ -1138,6 +1120,7 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 {
         int                             i, id;
         struct twlreg_info              *info;
+        const struct twlreg_info        *template;
         struct regulator_init_data      *initdata;
         struct regulation_constraints   *c;
         struct regulator_dev            *rdev;
@@ -1147,17 +1130,17 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 
         match = of_match_device(twl_of_match, &pdev->dev);
         if (match) {
-                info = match->data;
-                id = info->desc.id;
+                template = match->data;
+                id = template->desc.id;
                 initdata = of_get_regulator_init_data(&pdev->dev,
                                                       pdev->dev.of_node);
                 drvdata = NULL;
         } else {
                 id = pdev->id;
                 initdata = pdev->dev.platform_data;
-                for (i = 0, info = NULL; i < ARRAY_SIZE(twl_of_match); i++) {
-                        info = twl_of_match[i].data;
-                        if (info && info->desc.id == id)
+                for (i = 0, template = NULL; i < ARRAY_SIZE(twl_of_match); i++) {
+                        template = twl_of_match[i].data;
+                        if (template && template->desc.id == id)
                                 break;
                 }
                 if (i == ARRAY_SIZE(twl_of_match))
@@ -1168,12 +1151,16 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
                         return -EINVAL;
         }
 
-        if (!info)
+        if (!template)
                 return -ENODEV;
 
         if (!initdata)
                 return -EINVAL;
 
+        info = kmemdup(template, sizeof (*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
         if (drvdata) {
                 /* copy the driver data into regulator data */
                 info->features = drvdata->features;
@@ -1234,6 +1221,7 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
         if (IS_ERR(rdev)) {
                 dev_err(&pdev->dev, "can't register %s, %ld\n",
                                 info->desc.name, PTR_ERR(rdev));
+                kfree(info);
                 return PTR_ERR(rdev);
         }
         platform_set_drvdata(pdev, rdev);
@@ -1255,7 +1243,11 @@ static int __devinit twlreg_probe(struct platform_device *pdev)
 
 static int __devexit twlreg_remove(struct platform_device *pdev)
 {
-        regulator_unregister(platform_get_drvdata(pdev));
+        struct regulator_dev *rdev = platform_get_drvdata(pdev);
+        struct twlreg_info *info = rdev->reg_data;
+
+        regulator_unregister(rdev);
+        kfree(info);
         return 0;
 }
 
diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 7413885be01b..90cbcc683704 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -339,16 +339,15 @@ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
         u16 reg = dcdc->base + WM831X_DCDC_CONTROL_2;
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(wm831x_dcdc_ilim); i++) {
+        for (i = ARRAY_SIZE(wm831x_dcdc_ilim) - 1; i >= 0; i--) {
                 if ((min_uA <= wm831x_dcdc_ilim[i]) &&
                     (wm831x_dcdc_ilim[i] <= max_uA))
-                        break;
+                        return wm831x_set_bits(wm831x, reg,
+                                               WM831X_DC1_HC_THR_MASK,
+                                                i << WM831X_DC1_HC_THR_SHIFT);
         }
-        if (i == ARRAY_SIZE(wm831x_dcdc_ilim))
-                return -EINVAL;
 
-        return wm831x_set_bits(wm831x, reg, WM831X_DC1_HC_THR_MASK,
-                               i << WM831X_DC1_HC_THR_SHIFT);
+        return -EINVAL;
 }
 
 static int wm831x_buckv_get_current_limit(struct regulator_dev *rdev)
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 5cb70ca1e98d..9af512672be1 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -205,6 +205,8 @@ static int wm831x_gp_ldo_get_status(struct regulator_dev *rdev)
 
         /* Is it reporting under voltage? */
         ret = wm831x_reg_read(wm831x, WM831X_LDO_UV_STATUS);
+        if (ret < 0)
+                return ret;
         if (ret & mask)
                 return REGULATOR_STATUS_ERROR;
 
@@ -237,6 +239,8 @@ static struct regulator_ops wm831x_gp_ldo_ops = {
         .set_mode = wm831x_gp_ldo_set_mode,
         .get_status = wm831x_gp_ldo_get_status,
         .get_optimum_mode = wm831x_gp_ldo_get_optimum_mode,
+        .get_bypass = regulator_get_bypass_regmap,
+        .set_bypass = regulator_set_bypass_regmap,
 
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
@@ -293,6 +297,8 @@ static __devinit int wm831x_gp_ldo_probe(struct platform_device *pdev)
         ldo->desc.vsel_mask = WM831X_LDO1_ON_VSEL_MASK;
         ldo->desc.enable_reg = WM831X_LDO_ENABLE;
         ldo->desc.enable_mask = 1 << id;
+        ldo->desc.bypass_reg = ldo->base;
+        ldo->desc.bypass_mask = WM831X_LDO1_SWI;
 
         config.dev = pdev->dev.parent;
         if (pdata)
@@ -469,6 +475,8 @@ static int wm831x_aldo_get_status(struct regulator_dev *rdev)
 
         /* Is it reporting under voltage? */
         ret = wm831x_reg_read(wm831x, WM831X_LDO_UV_STATUS);
+        if (ret < 0)
+                return ret;
         if (ret & mask)
                 return REGULATOR_STATUS_ERROR;
 
@@ -488,6 +496,8 @@ static struct regulator_ops wm831x_aldo_ops = {
         .get_mode = wm831x_aldo_get_mode,
         .set_mode = wm831x_aldo_set_mode,
         .get_status = wm831x_aldo_get_status,
+        .set_bypass = regulator_set_bypass_regmap,
+        .get_bypass = regulator_get_bypass_regmap,
 
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
@@ -544,6 +554,8 @@ static __devinit int wm831x_aldo_probe(struct platform_device *pdev)
         ldo->desc.vsel_mask = WM831X_LDO7_ON_VSEL_MASK;
         ldo->desc.enable_reg = WM831X_LDO_ENABLE;
         ldo->desc.enable_mask = 1 << id;
+        ldo->desc.bypass_reg = ldo->base;
+        ldo->desc.bypass_mask = WM831X_LDO7_SWI;
 
         config.dev = pdev->dev.parent;
         if (pdata)
diff --git a/drivers/regulator/wm8400-regulator.c b/drivers/regulator/wm8400-regulator.c
index 9035dd053611..27c746ef0636 100644
--- a/drivers/regulator/wm8400-regulator.c
+++ b/drivers/regulator/wm8400-regulator.c
@@ -120,13 +120,8 @@ static int wm8400_dcdc_set_mode(struct regulator_dev *dev, unsigned int mode)
 
         case REGULATOR_MODE_IDLE:
                 /* Datasheet: standby */
-                ret = wm8400_set_bits(wm8400, WM8400_DCDC1_CONTROL_1 + offset,
-                                      WM8400_DC1_ACTIVE, 0);
-                if (ret != 0)
-                        return ret;
                 return wm8400_set_bits(wm8400, WM8400_DCDC1_CONTROL_1 + offset,
-                                       WM8400_DC1_SLEEP, 0);
-
+                                       WM8400_DC1_ACTIVE | WM8400_DC1_SLEEP, 0);
         default:
                 return -EINVAL;
         }
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 590cfafc7c17..1859f71372e2 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -1008,8 +1008,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
         return 0;
 
 free_coherent:
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE, bufs_va,
-                                        vrp->bufs_dma);
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
+                                        bufs_va, vrp->bufs_dma);
 vqs_del:
         vdev->config->del_vqs(vrp->vdev);
 free_vrp:
@@ -1043,7 +1043,7 @@ static void __devexit rpmsg_remove(struct virtio_device *vdev)
 
         vdev->config->del_vqs(vrp->vdev);
 
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE,
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
                                         vrp->rbufs, vrp->bufs_dma);
 
         kfree(vrp);
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index c5d06fe83bba..9277d945bf48 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        /* ensure interrupts are disabled, bootloaders can be strange */
+        ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
+        if (ret < 0)
+                dev_warn(&pdev->dev, "unable to disable interrupt\n");
+
         /* init cached IRQ enable bits */
         ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
         if (ret < 0)
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 8e477bb1f3f6..4a3b62326183 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -70,3 +70,21 @@ config DASD_EER
           This driver provides a character device interface to the
           DASD extended error reporting. This is only needed if you want to
           use applications written for the EER facility.
+
+config SCM_BLOCK
+        def_tristate m
+        prompt "Support for Storage Class Memory"
+        depends on S390 && BLOCK && EADM_SCH && SCM_BUS
+        help
+          Block device driver for Storage Class Memory (SCM). This driver
+          provides a block device interface for each available SCM increment.
+
+          To compile this driver as a module, choose M here: the
+          module will be called scm_block.
+
+config SCM_BLOCK_CLUSTER_WRITE
+        def_bool y
+        prompt "SCM force cluster writes"
+        depends on SCM_BLOCK
+        help
+          Force writes to Storage Class Memory (SCM) to be in done in clusters.
diff --git a/drivers/s390/block/Makefile b/drivers/s390/block/Makefile
index 0a89e080b389..c2f4e673e031 100644
--- a/drivers/s390/block/Makefile
+++ b/drivers/s390/block/Makefile
@@ -17,3 +17,9 @@ obj-$(CONFIG_DASD_ECKD) += dasd_eckd_mod.o
 obj-$(CONFIG_DASD_FBA)  += dasd_fba_mod.o
 obj-$(CONFIG_BLK_DEV_XPRAM) += xpram.o
 obj-$(CONFIG_DCSSBLK) += dcssblk.o
+
+scm_block-objs := scm_drv.o scm_blk.o
+ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+scm_block-objs += scm_blk_cluster.o
+endif
+obj-$(CONFIG_SCM_BLOCK) += scm_block.o
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 15370a2c5ff0..0595c763dafd 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -534,11 +534,11 @@ static void dasd_change_state(struct dasd_device *device)
         if (rc)
                 device->target = device->state;
 
-        if (device->state == device->target)
-                wake_up(&dasd_init_waitq);
-
         /* let user-space know that the device status changed */
         kobject_uevent(&device->cdev->dev.kobj, KOBJ_CHANGE);
+
+        if (device->state == device->target)
+                wake_up(&dasd_init_waitq);
 }
 
 /*
@@ -2157,6 +2157,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                     test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
                     (!dasd_eer_enabled(device))) {
                         cqr->status = DASD_CQR_FAILED;
+                        cqr->intrc = -EAGAIN;
                         continue;
                 }
                 /* Don't try to start requests if device is stopped */
@@ -3270,6 +3271,16 @@ void dasd_generic_path_event(struct ccw_device *cdev, int *path_event)
                         dasd_schedule_device_bh(device);
                 }
                 if (path_event[chp] & PE_PATHGROUP_ESTABLISHED) {
+                        if (!(device->path_data.opm & eventlpm) &&
+                            !(device->path_data.tbvpm & eventlpm)) {
+                                /*
+                                 * we can not establish a pathgroup on an
+                                 * unavailable path, so trigger a path
+                                 * verification first
+                                 */
+                                device->path_data.tbvpm |= eventlpm;
+                                dasd_schedule_device_bh(device);
+                        }
                         DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                                       "Pathgroup re-established\n");
                         if (device->discipline->kick_validate)
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 157defe5e069..6b556995bb33 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -384,6 +384,29 @@ static void _remove_device_from_lcu(struct alias_lcu *lcu,
                 group->next = NULL;
 };
 
+static int
+suborder_not_supported(struct dasd_ccw_req *cqr)
+{
+        char *sense;
+        char reason;
+        char msg_format;
+        char msg_no;
+
+        sense = dasd_get_sense(&cqr->irb);
+        if (!sense)
+                return 0;
+
+        reason = sense[0];
+        msg_format = (sense[7] & 0xF0);
+        msg_no = (sense[7] & 0x0F);
+
+        /* command reject, Format 0 MSG 4 - invalid parameter */
+        if ((reason == 0x80) && (msg_format == 0x00) && (msg_no == 0x04))
+                return 1;
+
+        return 0;
+}
+
 static int read_unit_address_configuration(struct dasd_device *device,
                                            struct alias_lcu *lcu)
 {
@@ -435,6 +458,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
 
         do {
                 rc = dasd_sleep_on(cqr);
+                if (rc && suborder_not_supported(cqr))
+                        return -EOPNOTSUPP;
         } while (rc && (cqr->retries > 0));
         if (rc) {
                 spin_lock_irqsave(&lcu->lock, flags);
@@ -521,7 +546,7 @@ static void lcu_update_work(struct work_struct *work)
          * processing the data
          */
         spin_lock_irqsave(&lcu->lock, flags);
-        if (rc || (lcu->flags & NEED_UAC_UPDATE)) {
+        if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
                 DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
                             " alias data in lcu (rc = %d), retry later", rc);
                 schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 2fb2b9ea97ec..108332b44d98 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -20,6 +20,7 @@
 #include <linux/compat.h>
 #include <linux/init.h>
 
+#include <asm/css_chars.h>
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
@@ -31,8 +32,6 @@
 
 #include "dasd_int.h"
 #include "dasd_eckd.h"
-#include "../cio/chsc.h"
-
 
 #ifdef PRINTK_HEADER
 #undef PRINTK_HEADER
@@ -140,6 +139,10 @@ dasd_eckd_set_online(struct ccw_device *cdev)
 static const int sizes_trk0[] = { 28, 148, 84 };
 #define LABEL_SIZE 140
 
+/* head and record addresses of count_area read in analysis ccw */
+static const int count_area_head[] = { 0, 0, 0, 0, 2 };
+static const int count_area_rec[] = { 1, 2, 3, 4, 1 };
+
 static inline unsigned int
 round_up_multiple(unsigned int no, unsigned int mult)
 {
@@ -212,7 +215,7 @@ check_XRC (struct ccw1         *de_ccw,
 
         rc = get_sync_clock(&data->ep_sys_time);
         /* Ignore return code if sync clock is switched off. */
-        if (rc == -ENOSYS || rc == -EACCES)
+        if (rc == -EOPNOTSUPP || rc == -EACCES)
                 rc = 0;
 
         de_ccw->count = sizeof(struct DE_eckd_data);
@@ -323,7 +326,7 @@ static int check_XRC_on_prefix(struct PFX_eckd_data *pfxdata,
 
         rc = get_sync_clock(&pfxdata->define_extent.ep_sys_time);
         /* Ignore return code if sync clock is switched off. */
-        if (rc == -ENOSYS || rc == -EACCES)
+        if (rc == -EOPNOTSUPP || rc == -EACCES)
                 rc = 0;
         return rc;
 }
@@ -1507,7 +1510,8 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
  * call might change behaviour of DASD devices.
  */
 static int
-dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
+dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav,
+                  unsigned long flags)
 {
         struct dasd_ccw_req *cqr;
         int rc;
@@ -1516,10 +1520,19 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
         if (IS_ERR(cqr))
                 return PTR_ERR(cqr);
 
+        /*
+         * set flags e.g. turn on failfast, to prevent blocking
+         * the calling function should handle failed requests
+         */
+        cqr->flags |= flags;
+
         rc = dasd_sleep_on(cqr);
         if (!rc)
                 /* trigger CIO to reprobe devices */
                 css_schedule_reprobe();
+        else if (cqr->intrc == -EAGAIN)
+                rc = -EAGAIN;
+
         dasd_sfree_request(cqr, cqr->memdev);
         return rc;
 }
@@ -1527,7 +1540,8 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
 /*
  * Valide storage server of current device.
  */
-static void dasd_eckd_validate_server(struct dasd_device *device)
+static int dasd_eckd_validate_server(struct dasd_device *device,
+                                     unsigned long flags)
 {
         int rc;
         struct dasd_eckd_private *private;
@@ -1536,17 +1550,18 @@ static void dasd_eckd_validate_server(struct dasd_device *device)
         private = (struct dasd_eckd_private *) device->private;
         if (private->uid.type == UA_BASE_PAV_ALIAS ||
             private->uid.type == UA_HYPER_PAV_ALIAS)
-                return;
+                return 0;
         if (dasd_nopav || MACHINE_IS_VM)
                 enable_pav = 0;
         else
                 enable_pav = 1;
-        rc = dasd_eckd_psf_ssc(device, enable_pav);
+        rc = dasd_eckd_psf_ssc(device, enable_pav, flags);
 
         /* may be requested feature is not available on server,
          * therefore just report error and go ahead */
         DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "PSF-SSC for SSID %04x "
                         "returned rc=%d", private->uid.ssid, rc);
+        return rc;
 }
 
 /*
@@ -1556,7 +1571,13 @@ static void dasd_eckd_do_validate_server(struct work_struct *work)
 {
         struct dasd_device *device = container_of(work, struct dasd_device,
                                                   kick_validate);
-        dasd_eckd_validate_server(device);
+        if (dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST)
+            == -EAGAIN) {
+                /* schedule worker again if failed */
+                schedule_work(&device->kick_validate);
+                return;
+        }
+
         dasd_put_device(device);
 }
 
@@ -1685,7 +1706,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         if (rc)
                 goto out_err2;
 
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, 0);
 
         /* device may report different configuration data after LCU setup */
         rc = dasd_eckd_read_conf(device);
@@ -1922,7 +1943,10 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
         count_area = NULL;
         for (i = 0; i < 3; i++) {
                 if (private->count_area[i].kl != 4 ||
-                    private->count_area[i].dl != dasd_eckd_cdl_reclen(i) - 4) {
+                    private->count_area[i].dl != dasd_eckd_cdl_reclen(i) - 4 ||
+                    private->count_area[i].cyl != 0 ||
+                    private->count_area[i].head != count_area_head[i] ||
+                    private->count_area[i].record != count_area_rec[i]) {
                         private->uses_cdl = 0;
                         break;
                 }
@@ -1934,7 +1958,10 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
                 for (i = 0; i < 5; i++) {
                         if ((private->count_area[i].kl != 0) ||
                             (private->count_area[i].dl !=
-                             private->count_area[0].dl))
+                             private->count_area[0].dl) ||
+                            private->count_area[i].cyl !=  0 ||
+                            private->count_area[i].head != count_area_head[i] ||
+                            private->count_area[i].record != count_area_rec[i])
                                 break;
                 }
                 if (i == 5)
@@ -4153,7 +4180,7 @@ static int dasd_eckd_restore_device(struct dasd_device *device)
         rc = dasd_alias_make_device_known_to_lcu(device);
         if (rc)
                 return rc;
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST);
 
         /* RE-Read Configuration Data */
         rc = dasd_eckd_read_conf(device);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 654c6921a6d4..8252f37d04ed 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -292,12 +292,12 @@ out:
 #else
 static int dasd_ioctl_reset_profile(struct dasd_block *block)
 {
-        return -ENOSYS;
+        return -ENOTTY;
 }
 
 static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
 {
-        return -ENOSYS;
+        return -ENOTTY;
 }
 #endif
 
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
new file mode 100644
index 000000000000..9978ad4433cb
--- /dev/null
+++ b/drivers/s390/block/scm_blk.c
@@ -0,0 +1,445 @@
+/*
+ * Block driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#define KMSG_COMPONENT "scm_block"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+debug_info_t *scm_debug;
+static int scm_major;
+static DEFINE_SPINLOCK(list_lock);
+static LIST_HEAD(inactive_requests);
+static unsigned int nr_requests = 64;
+static atomic_t nr_devices = ATOMIC_INIT(0);
+module_param(nr_requests, uint, S_IRUGO);
+MODULE_PARM_DESC(nr_requests, "Number of parallel requests.");
+
+MODULE_DESCRIPTION("Block driver for s390 storage class memory.");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("scm:scmdev*");
+
+static void __scm_free_rq(struct scm_request *scmrq)
+{
+        struct aob_rq_header *aobrq = to_aobrq(scmrq);
+
+        free_page((unsigned long) scmrq->aob);
+        free_page((unsigned long) scmrq->aidaw);
+        __scm_free_rq_cluster(scmrq);
+        kfree(aobrq);
+}
+
+static void scm_free_rqs(void)
+{
+        struct list_head *iter, *safe;
+        struct scm_request *scmrq;
+
+        spin_lock_irq(&list_lock);
+        list_for_each_safe(iter, safe, &inactive_requests) {
+                scmrq = list_entry(iter, struct scm_request, list);
+                list_del(&scmrq->list);
+                __scm_free_rq(scmrq);
+        }
+        spin_unlock_irq(&list_lock);
+}
+
+static int __scm_alloc_rq(void)
+{
+        struct aob_rq_header *aobrq;
+        struct scm_request *scmrq;
+
+        aobrq = kzalloc(sizeof(*aobrq) + sizeof(*scmrq), GFP_KERNEL);
+        if (!aobrq)
+                return -ENOMEM;
+
+        scmrq = (void *) aobrq->data;
+        scmrq->aidaw = (void *) get_zeroed_page(GFP_DMA);
+        scmrq->aob = (void *) get_zeroed_page(GFP_DMA);
+        if (!scmrq->aob || !scmrq->aidaw) {
+                __scm_free_rq(scmrq);
+                return -ENOMEM;
+        }
+
+        if (__scm_alloc_rq_cluster(scmrq)) {
+                __scm_free_rq(scmrq);
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&scmrq->list);
+        spin_lock_irq(&list_lock);
+        list_add(&scmrq->list, &inactive_requests);
+        spin_unlock_irq(&list_lock);
+
+        return 0;
+}
+
+static int scm_alloc_rqs(unsigned int nrqs)
+{
+        int ret = 0;
+
+        while (nrqs-- && !ret)
+                ret = __scm_alloc_rq();
+
+        return ret;
+}
+
+static struct scm_request *scm_request_fetch(void)
+{
+        struct scm_request *scmrq = NULL;
+
+        spin_lock(&list_lock);
+        if (list_empty(&inactive_requests))
+                goto out;
+        scmrq = list_first_entry(&inactive_requests, struct scm_request, list);
+        list_del(&scmrq->list);
+out:
+        spin_unlock(&list_lock);
+        return scmrq;
+}
+
+static void scm_request_done(struct scm_request *scmrq)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_add(&scmrq->list, &inactive_requests);
+        spin_unlock_irqrestore(&list_lock, flags);
+}
+
+static int scm_open(struct block_device *blkdev, fmode_t mode)
+{
+        return scm_get_ref();
+}
+
+static int scm_release(struct gendisk *gendisk, fmode_t mode)
+{
+        scm_put_ref();
+        return 0;
+}
+
+static const struct block_device_operations scm_blk_devops = {
+        .owner = THIS_MODULE,
+        .open = scm_open,
+        .release = scm_release,
+};
+
+static void scm_request_prepare(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_device *scmdev = bdev->gendisk->private_data;
+        struct aidaw *aidaw = scmrq->aidaw;
+        struct msb *msb = &scmrq->aob->msb[0];
+        struct req_iterator iter;
+        struct bio_vec *bv;
+
+        msb->bs = MSB_BS_4K;
+        scmrq->aob->request.msb_count = 1;
+        msb->scm_addr = scmdev->address +
+                ((u64) blk_rq_pos(scmrq->request) << 9);
+        msb->oc = (rq_data_dir(scmrq->request) == READ) ?
+                MSB_OC_READ : MSB_OC_WRITE;
+        msb->flags |= MSB_FLAG_IDA;
+        msb->data_addr = (u64) aidaw;
+
+        rq_for_each_segment(bv, scmrq->request, iter) {
+                WARN_ON(bv->bv_offset);
+                msb->blk_count += bv->bv_len >> 12;
+                aidaw->data_addr = (u64) page_address(bv->bv_page);
+                aidaw++;
+        }
+}
+
+static inline void scm_request_init(struct scm_blk_dev *bdev,
+                                    struct scm_request *scmrq,
+                                    struct request *req)
+{
+        struct aob_rq_header *aobrq = to_aobrq(scmrq);
+        struct aob *aob = scmrq->aob;
+
+        memset(aob, 0, sizeof(*aob));
+        memset(scmrq->aidaw, 0, PAGE_SIZE);
+        aobrq->scmdev = bdev->scmdev;
+        aob->request.cmd_code = ARQB_CMD_MOVE;
+        aob->request.data = (u64) aobrq;
+        scmrq->request = req;
+        scmrq->bdev = bdev;
+        scmrq->retries = 4;
+        scmrq->error = 0;
+        scm_request_cluster_init(scmrq);
+}
+
+static void scm_ensure_queue_restart(struct scm_blk_dev *bdev)
+{
+        if (atomic_read(&bdev->queued_reqs)) {
+                /* Queue restart is triggered by the next interrupt. */
+                return;
+        }
+        blk_delay_queue(bdev->rq, SCM_QUEUE_DELAY);
+}
+
+void scm_request_requeue(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+
+        scm_release_cluster(scmrq);
+        blk_requeue_request(bdev->rq, scmrq->request);
+        scm_request_done(scmrq);
+        scm_ensure_queue_restart(bdev);
+}
+
+void scm_request_finish(struct scm_request *scmrq)
+{
+        scm_release_cluster(scmrq);
+        blk_end_request_all(scmrq->request, scmrq->error);
+        scm_request_done(scmrq);
+}
+
+static void scm_blk_request(struct request_queue *rq)
+{
+        struct scm_device *scmdev = rq->queuedata;
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
+        struct scm_request *scmrq;
+        struct request *req;
+        int ret;
+
+        while ((req = blk_peek_request(rq))) {
+                if (req->cmd_type != REQ_TYPE_FS)
+                        continue;
+
+                scmrq = scm_request_fetch();
+                if (!scmrq) {
+                        SCM_LOG(5, "no request");
+                        scm_ensure_queue_restart(bdev);
+                        return;
+                }
+                scm_request_init(bdev, scmrq, req);
+                if (!scm_reserve_cluster(scmrq)) {
+                        SCM_LOG(5, "cluster busy");
+                        scm_request_done(scmrq);
+                        return;
+                }
+                if (scm_need_cluster_request(scmrq)) {
+                        blk_start_request(req);
+                        scm_initiate_cluster_request(scmrq);
+                        return;
+                }
+                scm_request_prepare(scmrq);
+                blk_start_request(req);
+
+                ret = scm_start_aob(scmrq->aob);
+                if (ret) {
+                        SCM_LOG(5, "no subchannel");
+                        scm_request_requeue(scmrq);
+                        return;
+                }
+                atomic_inc(&bdev->queued_reqs);
+        }
+}
+
+static void __scmrq_log_error(struct scm_request *scmrq)
+{
+        struct aob *aob = scmrq->aob;
+
+        if (scmrq->error == -ETIMEDOUT)
+                SCM_LOG(1, "Request timeout");
+        else {
+                SCM_LOG(1, "Request error");
+                SCM_LOG_HEX(1, &aob->response, sizeof(aob->response));
+        }
+        if (scmrq->retries)
+                SCM_LOG(1, "Retry request");
+        else
+                pr_err("An I/O operation to SCM failed with rc=%d\n",
+                       scmrq->error);
+}
+
+void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
+{
+        struct scm_request *scmrq = data;
+        struct scm_blk_dev *bdev = scmrq->bdev;
+
+        scmrq->error = error;
+        if (error)
+                __scmrq_log_error(scmrq);
+
+        spin_lock(&bdev->lock);
+        list_add_tail(&scmrq->list, &bdev->finished_requests);
+        spin_unlock(&bdev->lock);
+        tasklet_hi_schedule(&bdev->tasklet);
+}
+
+static void scm_blk_tasklet(struct scm_blk_dev *bdev)
+{
+        struct scm_request *scmrq;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bdev->lock, flags);
+        while (!list_empty(&bdev->finished_requests)) {
+                scmrq = list_first_entry(&bdev->finished_requests,
+                                         struct scm_request, list);
+                list_del(&scmrq->list);
+                spin_unlock_irqrestore(&bdev->lock, flags);
+
+                if (scmrq->error && scmrq->retries-- > 0) {
+                        if (scm_start_aob(scmrq->aob)) {
+                                spin_lock_irqsave(&bdev->rq_lock, flags);
+                                scm_request_requeue(scmrq);
+                                spin_unlock_irqrestore(&bdev->rq_lock, flags);
+                        }
+                        /* Request restarted or requeued, handle next. */
+                        spin_lock_irqsave(&bdev->lock, flags);
+                        continue;
+                }
+
+                if (scm_test_cluster_request(scmrq)) {
+                        scm_cluster_request_irq(scmrq);
+                        spin_lock_irqsave(&bdev->lock, flags);
+                        continue;
+                }
+
+                scm_request_finish(scmrq);
+                atomic_dec(&bdev->queued_reqs);
+                spin_lock_irqsave(&bdev->lock, flags);
+        }
+        spin_unlock_irqrestore(&bdev->lock, flags);
+        /* Look out for more requests. */
+        blk_run_queue(bdev->rq);
+}
+
+int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
+{
+        struct request_queue *rq;
+        int len, ret = -ENOMEM;
+        unsigned int devindex, nr_max_blk;
+
+        devindex = atomic_inc_return(&nr_devices) - 1;
+        /* scma..scmz + scmaa..scmzz */
+        if (devindex > 701) {
+                ret = -ENODEV;
+                goto out;
+        }
+
+        bdev->scmdev = scmdev;
+        spin_lock_init(&bdev->rq_lock);
+        spin_lock_init(&bdev->lock);
+        INIT_LIST_HEAD(&bdev->finished_requests);
+        atomic_set(&bdev->queued_reqs, 0);
+        tasklet_init(&bdev->tasklet,
+                     (void (*)(unsigned long)) scm_blk_tasklet,
+                     (unsigned long) bdev);
+
+        rq = blk_init_queue(scm_blk_request, &bdev->rq_lock);
+        if (!rq)
+                goto out;
+
+        bdev->rq = rq;
+        nr_max_blk = min(scmdev->nr_max_block,
+                         (unsigned int) (PAGE_SIZE / sizeof(struct aidaw)));
+
+        blk_queue_logical_block_size(rq, 1 << 12);
+        blk_queue_max_hw_sectors(rq, nr_max_blk << 3); /* 8 * 512 = blk_size */
+        blk_queue_max_segments(rq, nr_max_blk);
+        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, rq);
+        scm_blk_dev_cluster_setup(bdev);
+
+        bdev->gendisk = alloc_disk(SCM_NR_PARTS);
+        if (!bdev->gendisk)
+                goto out_queue;
+
+        rq->queuedata = scmdev;
+        bdev->gendisk->driverfs_dev = &scmdev->dev;
+        bdev->gendisk->private_data = scmdev;
+        bdev->gendisk->fops = &scm_blk_devops;
+        bdev->gendisk->queue = rq;
+        bdev->gendisk->major = scm_major;
+        bdev->gendisk->first_minor = devindex * SCM_NR_PARTS;
+
+        len = snprintf(bdev->gendisk->disk_name, DISK_NAME_LEN, "scm");
+        if (devindex > 25) {
+                len += snprintf(bdev->gendisk->disk_name + len,
+                                DISK_NAME_LEN - len, "%c",
+                                'a' + (devindex / 26) - 1);
+                devindex = devindex % 26;
+        }
+        snprintf(bdev->gendisk->disk_name + len, DISK_NAME_LEN - len, "%c",
+                 'a' + devindex);
+
+        /* 512 byte sectors */
+        set_capacity(bdev->gendisk, scmdev->size >> 9);
+        add_disk(bdev->gendisk);
+        return 0;
+
+out_queue:
+        blk_cleanup_queue(rq);
+out:
+        atomic_dec(&nr_devices);
+        return ret;
+}
+
+void scm_blk_dev_cleanup(struct scm_blk_dev *bdev)
+{
+        tasklet_kill(&bdev->tasklet);
+        del_gendisk(bdev->gendisk);
+        blk_cleanup_queue(bdev->gendisk->queue);
+        put_disk(bdev->gendisk);
+}
+
+static int __init scm_blk_init(void)
+{
+        int ret = -EINVAL;
+
+        if (!scm_cluster_size_valid())
+                goto out;
+
+        ret = register_blkdev(0, "scm");
+        if (ret < 0)
+                goto out;
+
+        scm_major = ret;
+        if (scm_alloc_rqs(nr_requests))
+                goto out_unreg;
+
+        scm_debug = debug_register("scm_log", 16, 1, 16);
+        if (!scm_debug)
+                goto out_free;
+
+        debug_register_view(scm_debug, &debug_hex_ascii_view);
+        debug_set_level(scm_debug, 2);
+
+        ret = scm_drv_init();
+        if (ret)
+                goto out_dbf;
+
+        return ret;
+
+out_dbf:
+        debug_unregister(scm_debug);
+out_free:
+        scm_free_rqs();
+out_unreg:
+        unregister_blkdev(scm_major, "scm");
+out:
+        return ret;
+}
+module_init(scm_blk_init);
+
+static void __exit scm_blk_cleanup(void)
+{
+        scm_drv_cleanup();
+        debug_unregister(scm_debug);
+        scm_free_rqs();
+        unregister_blkdev(scm_major, "scm");
+}
+module_exit(scm_blk_cleanup);
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
new file mode 100644
index 000000000000..7ac6bad919ef
--- /dev/null
+++ b/drivers/s390/block/scm_blk.h
@@ -0,0 +1,117 @@
+#ifndef SCM_BLK_H
+#define SCM_BLK_H
+
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/list.h>
+
+#include <asm/debug.h>
+#include <asm/eadm.h>
+
+#define SCM_NR_PARTS 8
+#define SCM_QUEUE_DELAY 5
+
+struct scm_blk_dev {
+        struct tasklet_struct tasklet;
+        struct request_queue *rq;
+        struct gendisk *gendisk;
+        struct scm_device *scmdev;
+        spinlock_t rq_lock;     /* guard the request queue */
+        spinlock_t lock;        /* guard the rest of the blockdev */
+        atomic_t queued_reqs;
+        struct list_head finished_requests;
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+        struct list_head cluster_list;
+#endif
+};
+
+struct scm_request {
+        struct scm_blk_dev *bdev;
+        struct request *request;
+        struct aidaw *aidaw;
+        struct aob *aob;
+        struct list_head list;
+        u8 retries;
+        int error;
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+        struct {
+                enum {CLUSTER_NONE, CLUSTER_READ, CLUSTER_WRITE} state;
+                struct list_head list;
+                void **buf;
+        } cluster;
+#endif
+};
+
+#define to_aobrq(rq) container_of((void *) rq, struct aob_rq_header, data)
+
+int scm_blk_dev_setup(struct scm_blk_dev *, struct scm_device *);
+void scm_blk_dev_cleanup(struct scm_blk_dev *);
+void scm_blk_irq(struct scm_device *, void *, int);
+
+void scm_request_finish(struct scm_request *);
+void scm_request_requeue(struct scm_request *);
+
+int scm_drv_init(void);
+void scm_drv_cleanup(void);
+
+#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
+void __scm_free_rq_cluster(struct scm_request *);
+int __scm_alloc_rq_cluster(struct scm_request *);
+void scm_request_cluster_init(struct scm_request *);
+bool scm_reserve_cluster(struct scm_request *);
+void scm_release_cluster(struct scm_request *);
+void scm_blk_dev_cluster_setup(struct scm_blk_dev *);
+bool scm_need_cluster_request(struct scm_request *);
+void scm_initiate_cluster_request(struct scm_request *);
+void scm_cluster_request_irq(struct scm_request *);
+bool scm_test_cluster_request(struct scm_request *);
+bool scm_cluster_size_valid(void);
+#else
+#define __scm_free_rq_cluster(scmrq) {}
+#define __scm_alloc_rq_cluster(scmrq) 0
+#define scm_request_cluster_init(scmrq) {}
+#define scm_reserve_cluster(scmrq) true
+#define scm_release_cluster(scmrq) {}
+#define scm_blk_dev_cluster_setup(bdev) {}
+#define scm_need_cluster_request(scmrq) false
+#define scm_initiate_cluster_request(scmrq) {}
+#define scm_cluster_request_irq(scmrq) {}
+#define scm_test_cluster_request(scmrq) false
+#define scm_cluster_size_valid() true
+#endif
+
+extern debug_info_t *scm_debug;
+
+#define SCM_LOG(imp, txt) do {                                  \
+                debug_text_event(scm_debug, imp, txt);          \
+        } while (0)
+
+static inline void SCM_LOG_HEX(int level, void *data, int length)
+{
+        if (level > scm_debug->level)
+                return;
+        while (length > 0) {
+                debug_event(scm_debug, level, data, length);
+                length -= scm_debug->buf_size;
+                data += scm_debug->buf_size;
+        }
+}
+
+static inline void SCM_LOG_STATE(int level, struct scm_device *scmdev)
+{
+        struct {
+                u64 address;
+                u8 oper_state;
+                u8 rank;
+        } __packed data = {
+                .address = scmdev->address,
+                .oper_state = scmdev->attrs.oper_state,
+                .rank = scmdev->attrs.rank,
+        };
+
+        SCM_LOG_HEX(level, &data, sizeof(data));
+}
+
+#endif /* SCM_BLK_H */
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
new file mode 100644
index 000000000000..f4bb61b0cea1
--- /dev/null
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -0,0 +1,228 @@
+/*
+ * Block driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/blkdev.h>
+#include <linux/genhd.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+static unsigned int write_cluster_size = 64;
+module_param(write_cluster_size, uint, S_IRUGO);
+MODULE_PARM_DESC(write_cluster_size,
+                 "Number of pages used for contiguous writes.");
+
+#define CLUSTER_SIZE (write_cluster_size * PAGE_SIZE)
+
+void __scm_free_rq_cluster(struct scm_request *scmrq)
+{
+        int i;
+
+        if (!scmrq->cluster.buf)
+                return;
+
+        for (i = 0; i < 2 * write_cluster_size; i++)
+                free_page((unsigned long) scmrq->cluster.buf[i]);
+
+        kfree(scmrq->cluster.buf);
+}
+
+int __scm_alloc_rq_cluster(struct scm_request *scmrq)
+{
+        int i;
+
+        scmrq->cluster.buf = kzalloc(sizeof(void *) * 2 * write_cluster_size,
+                                 GFP_KERNEL);
+        if (!scmrq->cluster.buf)
+                return -ENOMEM;
+
+        for (i = 0; i < 2 * write_cluster_size; i++) {
+                scmrq->cluster.buf[i] = (void *) get_zeroed_page(GFP_DMA);
+                if (!scmrq->cluster.buf[i])
+                        return -ENOMEM;
+        }
+        INIT_LIST_HEAD(&scmrq->cluster.list);
+        return 0;
+}
+
+void scm_request_cluster_init(struct scm_request *scmrq)
+{
+        scmrq->cluster.state = CLUSTER_NONE;
+}
+
+static bool clusters_intersect(struct scm_request *A, struct scm_request *B)
+{
+        unsigned long firstA, lastA, firstB, lastB;
+
+        firstA = ((u64) blk_rq_pos(A->request) << 9) / CLUSTER_SIZE;
+        lastA = (((u64) blk_rq_pos(A->request) << 9) +
+                    blk_rq_bytes(A->request) - 1) / CLUSTER_SIZE;
+
+        firstB = ((u64) blk_rq_pos(B->request) << 9) / CLUSTER_SIZE;
+        lastB = (((u64) blk_rq_pos(B->request) << 9) +
+                    blk_rq_bytes(B->request) - 1) / CLUSTER_SIZE;
+
+        return (firstB <= lastA && firstA <= lastB);
+}
+
+bool scm_reserve_cluster(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_request *iter;
+
+        if (write_cluster_size == 0)
+                return true;
+
+        spin_lock(&bdev->lock);
+        list_for_each_entry(iter, &bdev->cluster_list, cluster.list) {
+                if (clusters_intersect(scmrq, iter) &&
+                    (rq_data_dir(scmrq->request) == WRITE ||
+                     rq_data_dir(iter->request) == WRITE)) {
+                        spin_unlock(&bdev->lock);
+                        return false;
+                }
+        }
+        list_add(&scmrq->cluster.list, &bdev->cluster_list);
+        spin_unlock(&bdev->lock);
+
+        return true;
+}
+
+void scm_release_cluster(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+
+        if (write_cluster_size == 0)
+                return;
+
+        spin_lock_irqsave(&bdev->lock, flags);
+        list_del(&scmrq->cluster.list);
+        spin_unlock_irqrestore(&bdev->lock, flags);
+}
+
+void scm_blk_dev_cluster_setup(struct scm_blk_dev *bdev)
+{
+        INIT_LIST_HEAD(&bdev->cluster_list);
+        blk_queue_io_opt(bdev->rq, CLUSTER_SIZE);
+}
+
+static void scm_prepare_cluster_request(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        struct scm_device *scmdev = bdev->gendisk->private_data;
+        struct request *req = scmrq->request;
+        struct aidaw *aidaw = scmrq->aidaw;
+        struct msb *msb = &scmrq->aob->msb[0];
+        struct req_iterator iter;
+        struct bio_vec *bv;
+        int i = 0;
+        u64 addr;
+
+        switch (scmrq->cluster.state) {
+        case CLUSTER_NONE:
+                scmrq->cluster.state = CLUSTER_READ;
+                /* fall through */
+        case CLUSTER_READ:
+                scmrq->aob->request.msb_count = 1;
+                msb->bs = MSB_BS_4K;
+                msb->oc = MSB_OC_READ;
+                msb->flags = MSB_FLAG_IDA;
+                msb->data_addr = (u64) aidaw;
+                msb->blk_count = write_cluster_size;
+
+                addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
+                msb->scm_addr = round_down(addr, CLUSTER_SIZE);
+
+                if (msb->scm_addr !=
+                    round_down(addr + (u64) blk_rq_bytes(req) - 1,
+                               CLUSTER_SIZE))
+                        msb->blk_count = 2 * write_cluster_size;
+
+                for (i = 0; i < msb->blk_count; i++) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                }
+
+                break;
+        case CLUSTER_WRITE:
+                msb->oc = MSB_OC_WRITE;
+
+                for (addr = msb->scm_addr;
+                     addr < scmdev->address + ((u64) blk_rq_pos(req) << 9);
+                     addr += PAGE_SIZE) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                        i++;
+                }
+                rq_for_each_segment(bv, req, iter) {
+                        aidaw->data_addr = (u64) page_address(bv->bv_page);
+                        aidaw++;
+                        i++;
+                }
+                for (; i < msb->blk_count; i++) {
+                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
+                        aidaw++;
+                }
+                break;
+        }
+}
+
+bool scm_need_cluster_request(struct scm_request *scmrq)
+{
+        if (rq_data_dir(scmrq->request) == READ)
+                return false;
+
+        return blk_rq_bytes(scmrq->request) < CLUSTER_SIZE;
+}
+
+/* Called with queue lock held. */
+void scm_initiate_cluster_request(struct scm_request *scmrq)
+{
+        scm_prepare_cluster_request(scmrq);
+        if (scm_start_aob(scmrq->aob))
+                scm_request_requeue(scmrq);
+}
+
+bool scm_test_cluster_request(struct scm_request *scmrq)
+{
+        return scmrq->cluster.state != CLUSTER_NONE;
+}
+
+void scm_cluster_request_irq(struct scm_request *scmrq)
+{
+        struct scm_blk_dev *bdev = scmrq->bdev;
+        unsigned long flags;
+
+        switch (scmrq->cluster.state) {
+        case CLUSTER_NONE:
+                BUG();
+                break;
+        case CLUSTER_READ:
+                if (scmrq->error) {
+                        scm_request_finish(scmrq);
+                        break;
+                }
+                scmrq->cluster.state = CLUSTER_WRITE;
+                spin_lock_irqsave(&bdev->rq_lock, flags);
+                scm_initiate_cluster_request(scmrq);
+                spin_unlock_irqrestore(&bdev->rq_lock, flags);
+                break;
+        case CLUSTER_WRITE:
+                scm_request_finish(scmrq);
+                break;
+        }
+}
+
+bool scm_cluster_size_valid(void)
+{
+        return write_cluster_size == 0 || write_cluster_size == 32 ||
+                write_cluster_size == 64 || write_cluster_size == 128;
+}
diff --git a/drivers/s390/block/scm_drv.c b/drivers/s390/block/scm_drv.c
new file mode 100644
index 000000000000..9fa0a908607b
--- /dev/null
+++ b/drivers/s390/block/scm_drv.c
@@ -0,0 +1,81 @@
+/*
+ * Device driver for s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#define KMSG_COMPONENT "scm_block"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <asm/eadm.h>
+#include "scm_blk.h"
+
+static void notify(struct scm_device *scmdev)
+{
+        pr_info("%lu: The capabilities of the SCM increment changed\n",
+                (unsigned long) scmdev->address);
+        SCM_LOG(2, "State changed");
+        SCM_LOG_STATE(2, scmdev);
+}
+
+static int scm_probe(struct scm_device *scmdev)
+{
+        struct scm_blk_dev *bdev;
+        int ret;
+
+        SCM_LOG(2, "probe");
+        SCM_LOG_STATE(2, scmdev);
+
+        if (scmdev->attrs.oper_state != OP_STATE_GOOD)
+                return -EINVAL;
+
+        bdev = kzalloc(sizeof(*bdev), GFP_KERNEL);
+        if (!bdev)
+                return -ENOMEM;
+
+        dev_set_drvdata(&scmdev->dev, bdev);
+        ret = scm_blk_dev_setup(bdev, scmdev);
+        if (ret) {
+                dev_set_drvdata(&scmdev->dev, NULL);
+                kfree(bdev);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static int scm_remove(struct scm_device *scmdev)
+{
+        struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
+
+        scm_blk_dev_cleanup(bdev);
+        dev_set_drvdata(&scmdev->dev, NULL);
+        kfree(bdev);
+
+        return 0;
+}
+
+static struct scm_driver scm_drv = {
+        .drv = {
+                .name = "scm_block",
+                .owner = THIS_MODULE,
+        },
+        .notify = notify,
+        .probe = scm_probe,
+        .remove = scm_remove,
+        .handler = scm_blk_irq,
+};
+
+int __init scm_drv_init(void)
+{
+        return scm_driver_register(&scm_drv);
+}
+
+void scm_drv_cleanup(void)
+{
+        scm_driver_unregister(&scm_drv);
+}
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index bb07577e8fd4..699fd3e363df 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -35,7 +35,6 @@ static struct raw3270_fn con3270_fn;
  */
 struct con3270 {
         struct raw3270_view view;
-        spinlock_t lock;
         struct list_head freemem;       /* list of free memory for strings. */
 
         /* Output stuff. */
diff --git a/drivers/s390/char/monreader.c b/drivers/s390/char/monreader.c
index 5b8b8592d311..f4ff515db251 100644
--- a/drivers/s390/char/monreader.c
+++ b/drivers/s390/char/monreader.c
@@ -571,8 +571,11 @@ static int __init mon_init(void)
         if (rc)
                 goto out_iucv;
         monreader_device = kzalloc(sizeof(struct device), GFP_KERNEL);
-        if (!monreader_device)
+        if (!monreader_device) {
+                rc = -ENOMEM;
                 goto out_driver;
+        }
+
         dev_set_name(monreader_device, "monreader-dev");
         monreader_device->bus = &iucv_bus;
         monreader_device->parent = iucv_root;
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 3fcc000efc53..4fa21f7e2308 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -334,7 +334,7 @@ sclp_dispatch_evbufs(struct sccb_header *sccb)
                         reg->receiver_fn(evbuf);
                         spin_lock_irqsave(&sclp_lock, flags);
                 } else if (reg == NULL)
-                        rc = -ENOSYS;
+                        rc = -EOPNOTSUPP;
         }
         spin_unlock_irqrestore(&sclp_lock, flags);
         return rc;
diff --git a/drivers/s390/char/sclp_rw.c b/drivers/s390/char/sclp_rw.c
index 4be63be73445..3b13d58fe87b 100644
--- a/drivers/s390/char/sclp_rw.c
+++ b/drivers/s390/char/sclp_rw.c
@@ -463,7 +463,7 @@ sclp_emit_buffer(struct sclp_buffer *buffer,
                 /* Use write priority message */
                 sccb->msg_buf.header.type = EVTYP_PMSGCMD;
         else
-                return -ENOSYS;
+                return -EOPNOTSUPP;
         buffer->request.command = SCLP_CMDW_WRITE_EVENT_DATA;
         buffer->request.status = SCLP_REQ_FILLED;
         buffer->request.callback = sclp_writedata_callback;
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index c06be6cc2fc3..ea664dd4f56d 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -15,7 +15,6 @@
 #include <asm/ccwdev.h>
 #include <asm/debug.h>
 #include <asm/idals.h>
-#include <linux/blkdev.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mtio.h>
diff --git a/drivers/s390/char/tape_std.h b/drivers/s390/char/tape_std.h
index c5816ad9ed7d..8c760c036832 100644
--- a/drivers/s390/char/tape_std.h
+++ b/drivers/s390/char/tape_std.h
@@ -100,11 +100,7 @@ struct tape_request *tape_std_read_block(struct tape_device *, size_t);
 void tape_std_read_backward(struct tape_device *device,
                             struct tape_request *request);
 struct tape_request *tape_std_write_block(struct tape_device *, size_t);
-struct tape_request *tape_std_bread(struct tape_device *, struct request *);
-void tape_std_free_bread(struct tape_request *);
 void tape_std_check_locate(struct tape_device *, struct tape_request *);
-struct tape_request *tape_std_bwrite(struct request *,
-                                     struct tape_device *, int);
 
 /* Some non-mtop commands. */
 int tape_std_assign(struct tape_device *);
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index c131bc40f962..9b3a24e8d3a0 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -321,7 +321,7 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
          * only allow for blocking reads to be open
          */
         if (filp->f_flags & O_NONBLOCK)
-                return -ENOSYS;
+                return -EOPNOTSUPP;
 
         /* Besure this device hasn't already been opened */
         spin_lock_bh(&logptr->priv_lock);
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index e1b700a19648..8c4a386e97f6 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -8,6 +8,8 @@ ccw_device-objs += device.o device_fsm.o device_ops.o
 ccw_device-objs += device_id.o device_pgid.o device_status.o
 obj-y += ccw_device.o cmf.o
 obj-$(CONFIG_CHSC_SCH) += chsc_sch.o
+obj-$(CONFIG_EADM_SCH) += eadm_sch.o
+obj-$(CONFIG_SCM_BUS) += scm.o
 obj-$(CONFIG_CCWGROUP) += ccwgroup.o
 
 qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_setup.o
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index cfe0c087fe5c..4d51a7c4eb8b 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -52,6 +52,11 @@ int chsc_error_from_response(int response)
                 return -EINVAL;
         case 0x0004:
                 return -EOPNOTSUPP;
+        case 0x000b:
+                return -EBUSY;
+        case 0x0100:
+        case 0x0102:
+                return -ENOMEM;
         default:
                 return -EIO;
         }
@@ -393,6 +398,20 @@ static void chsc_process_sei_chp_config(struct chsc_sei_area *sei_area)
         }
 }
 
+static void chsc_process_sei_scm_change(struct chsc_sei_area *sei_area)
+{
+        int ret;
+
+        CIO_CRW_EVENT(4, "chsc: scm change notification\n");
+        if (sei_area->rs != 7)
+                return;
+
+        ret = scm_update_information();
+        if (ret)
+                CIO_CRW_EVENT(0, "chsc: updating change notification"
+                              " failed (rc=%d).\n", ret);
+}
+
 static void chsc_process_sei(struct chsc_sei_area *sei_area)
 {
         /* Check if we might have lost some information. */
@@ -414,6 +433,9 @@ static void chsc_process_sei(struct chsc_sei_area *sei_area)
         case 8: /* channel-path-configuration notification */
                 chsc_process_sei_chp_config(sei_area);
                 break;
+        case 12: /* scm change notification */
+                chsc_process_sei_scm_change(sei_area);
+                break;
         default: /* other stuff */
                 CIO_CRW_EVENT(4, "chsc: unhandled sei content code %d\n",
                               sei_area->cc);
@@ -1047,3 +1069,33 @@ out:
         return rc;
 }
 EXPORT_SYMBOL_GPL(chsc_siosl);
+
+/**
+ * chsc_scm_info() - store SCM information (SSI)
+ * @scm_area: request and response block for SSI
+ * @token: continuation token
+ *
+ * Returns 0 on success.
+ */
+int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token)
+{
+        int ccode, ret;
+
+        memset(scm_area, 0, sizeof(*scm_area));
+        scm_area->request.length = 0x0020;
+        scm_area->request.code = 0x004C;
+        scm_area->reqtok = token;
+
+        ccode = chsc(scm_area);
+        if (ccode > 0) {
+                ret = (ccode == 3) ? -ENODEV : -EBUSY;
+                goto out;
+        }
+        ret = chsc_error_from_response(scm_area->response.code);
+        if (ret != 0)
+                CIO_MSG_EVENT(2, "chsc: scm info failed (rc=%04x)\n",
+                              scm_area->response.code);
+out:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(chsc_scm_info);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 3f15b2aaeaea..662dab4b93e6 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <linux/device.h>
+#include <asm/css_chars.h>
 #include <asm/chpid.h>
 #include <asm/chsc.h>
 #include <asm/schid.h>
@@ -118,4 +119,46 @@ int chsc_error_from_response(int response);
 
 int chsc_siosl(struct subchannel_id schid);
 
+/* Functions and definitions to query storage-class memory. */
+struct sale {
+        u64 sa;
+        u32 p:4;
+        u32 op_state:4;
+        u32 data_state:4;
+        u32 rank:4;
+        u32 r:1;
+        u32:7;
+        u32 rid:8;
+        u32:32;
+} __packed;
+
+struct chsc_scm_info {
+        struct chsc_header request;
+        u32:32;
+        u64 reqtok;
+        u32 reserved1[4];
+        struct chsc_header response;
+        u64:56;
+        u8 rq;
+        u32 mbc;
+        u64 msa;
+        u16 is;
+        u16 mmc;
+        u32 mci;
+        u64 nr_scm_ini;
+        u64 nr_scm_unini;
+        u32 reserved2[10];
+        u64 restok;
+        struct sale scmal[248];
+} __packed;
+
+int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
+
+#ifdef CONFIG_SCM_BUS
+int scm_update_information(void);
+#else /* CONFIG_SCM_BUS */
+#define scm_update_information() 0
+#endif /* CONFIG_SCM_BUS */
+
+
 #endif
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 33d1ef703593..8e927b9f285f 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -1029,7 +1029,7 @@ extern void do_reipl_asm(__u32 schid);
 /* Make sure all subchannels are quiet before we re-ipl an lpar. */
 void reipl_ccw_dev(struct ccw_dev_id *devid)
 {
-        struct subchannel_id schid;
+        struct subchannel_id uninitialized_var(schid);
 
         s390_reset_system(NULL, NULL);
         if (reipl_find_schid(devid, &schid) != 0)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 21908e67bf67..b4d572f65f07 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -445,6 +445,7 @@ void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo)
                 put_device(&sch->dev);
         }
 }
+EXPORT_SYMBOL_GPL(css_sched_sch_todo);
 
 static void css_sch_todo(struct work_struct *work)
 {
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index ed25c8740a9c..fc916f5d7314 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1426,6 +1426,8 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
                 return IO_SCH_REPROBE;
         if (cdev->online)
                 return IO_SCH_VERIFY;
+        if (cdev->private->state == DEV_STATE_NOT_OPER)
+                return IO_SCH_UNREG_ATTACH;
         return IO_SCH_NOP;
 }
 
@@ -1519,11 +1521,14 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                         goto out;
                 break;
         case IO_SCH_UNREG_ATTACH:
+                spin_lock_irqsave(sch->lock, flags);
                 if (cdev->private->flags.resuming) {
                         /* Device will be handled later. */
                         rc = 0;
-                        goto out;
+                        goto out_unlock;
                 }
+                sch_set_cdev(sch, NULL);
+                spin_unlock_irqrestore(sch->lock, flags);
                 /* Unregister ccw device. */
                 ccw_device_unregister(cdev);
                 break;
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
new file mode 100644
index 000000000000..6c9673400464
--- /dev/null
+++ b/drivers/s390/cio/eadm_sch.c
@@ -0,0 +1,401 @@
+/*
+ * Driver for s390 eadm subchannels
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/kernel_stat.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+
+#include <asm/css_chars.h>
+#include <asm/debug.h>
+#include <asm/isc.h>
+#include <asm/cio.h>
+#include <asm/scsw.h>
+#include <asm/eadm.h>
+
+#include "eadm_sch.h"
+#include "ioasm.h"
+#include "cio.h"
+#include "css.h"
+#include "orb.h"
+
+MODULE_DESCRIPTION("driver for s390 eadm subchannels");
+MODULE_LICENSE("GPL");
+
+#define EADM_TIMEOUT (5 * HZ)
+static DEFINE_SPINLOCK(list_lock);
+static LIST_HEAD(eadm_list);
+
+static debug_info_t *eadm_debug;
+
+#define EADM_LOG(imp, txt) do {                                 \
+                debug_text_event(eadm_debug, imp, txt);         \
+        } while (0)
+
+static void EADM_LOG_HEX(int level, void *data, int length)
+{
+        if (level > eadm_debug->level)
+                return;
+        while (length > 0) {
+                debug_event(eadm_debug, level, data, length);
+                length -= eadm_debug->buf_size;
+                data += eadm_debug->buf_size;
+        }
+}
+
+static void orb_init(union orb *orb)
+{
+        memset(orb, 0, sizeof(union orb));
+        orb->eadm.compat1 = 1;
+        orb->eadm.compat2 = 1;
+        orb->eadm.fmt = 1;
+        orb->eadm.x = 1;
+}
+
+static int eadm_subchannel_start(struct subchannel *sch, struct aob *aob)
+{
+        union orb *orb = &get_eadm_private(sch)->orb;
+        int cc;
+
+        orb_init(orb);
+        orb->eadm.aob = (u32)__pa(aob);
+        orb->eadm.intparm = (u32)(addr_t)sch;
+        orb->eadm.key = PAGE_DEFAULT_KEY >> 4;
+
+        EADM_LOG(6, "start");
+        EADM_LOG_HEX(6, &sch->schid, sizeof(sch->schid));
+
+        cc = ssch(sch->schid, orb);
+        switch (cc) {
+        case 0:
+                sch->schib.scsw.eadm.actl |= SCSW_ACTL_START_PEND;
+                break;
+        case 1:         /* status pending */
+        case 2:         /* busy */
+                return -EBUSY;
+        case 3:         /* not operational */
+                return -ENODEV;
+        }
+        return 0;
+}
+
+static int eadm_subchannel_clear(struct subchannel *sch)
+{
+        int cc;
+
+        cc = csch(sch->schid);
+        if (cc)
+                return -ENODEV;
+
+        sch->schib.scsw.eadm.actl |= SCSW_ACTL_CLEAR_PEND;
+        return 0;
+}
+
+static void eadm_subchannel_timeout(unsigned long data)
+{
+        struct subchannel *sch = (struct subchannel *) data;
+
+        spin_lock_irq(sch->lock);
+        EADM_LOG(1, "timeout");
+        EADM_LOG_HEX(1, &sch->schid, sizeof(sch->schid));
+        if (eadm_subchannel_clear(sch))
+                EADM_LOG(0, "clear failed");
+        spin_unlock_irq(sch->lock);
+}
+
+static void eadm_subchannel_set_timeout(struct subchannel *sch, int expires)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+
+        if (expires == 0) {
+                del_timer(&private->timer);
+                return;
+        }
+        if (timer_pending(&private->timer)) {
+                if (mod_timer(&private->timer, jiffies + expires))
+                        return;
+        }
+        private->timer.function = eadm_subchannel_timeout;
+        private->timer.data = (unsigned long) sch;
+        private->timer.expires = jiffies + expires;
+        add_timer(&private->timer);
+}
+
+static void eadm_subchannel_irq(struct subchannel *sch)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+        struct eadm_scsw *scsw = &sch->schib.scsw.eadm;
+        struct irb *irb = (struct irb *)&S390_lowcore.irb;
+        int error = 0;
+
+        EADM_LOG(6, "irq");
+        EADM_LOG_HEX(6, irb, sizeof(*irb));
+
+        kstat_cpu(smp_processor_id()).irqs[IOINT_ADM]++;
+
+        if ((scsw->stctl & (SCSW_STCTL_ALERT_STATUS | SCSW_STCTL_STATUS_PEND))
+            && scsw->eswf == 1 && irb->esw.eadm.erw.r)
+                error = -EIO;
+
+        if (scsw->fctl & SCSW_FCTL_CLEAR_FUNC)
+                error = -ETIMEDOUT;
+
+        eadm_subchannel_set_timeout(sch, 0);
+
+        if (private->state != EADM_BUSY) {
+                EADM_LOG(1, "irq unsol");
+                EADM_LOG_HEX(1, irb, sizeof(*irb));
+                private->state = EADM_NOT_OPER;
+                css_sched_sch_todo(sch, SCH_TODO_EVAL);
+                return;
+        }
+        scm_irq_handler((struct aob *)(unsigned long)scsw->aob, error);
+        private->state = EADM_IDLE;
+}
+
+static struct subchannel *eadm_get_idle_sch(void)
+{
+        struct eadm_private *private;
+        struct subchannel *sch;
+        unsigned long flags;
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_for_each_entry(private, &eadm_list, head) {
+                sch = private->sch;
+                spin_lock(sch->lock);
+                if (private->state == EADM_IDLE) {
+                        private->state = EADM_BUSY;
+                        list_move_tail(&private->head, &eadm_list);
+                        spin_unlock(sch->lock);
+                        spin_unlock_irqrestore(&list_lock, flags);
+
+                        return sch;
+                }
+                spin_unlock(sch->lock);
+        }
+        spin_unlock_irqrestore(&list_lock, flags);
+
+        return NULL;
+}
+
+static int eadm_start_aob(struct aob *aob)
+{
+        struct eadm_private *private;
+        struct subchannel *sch;
+        unsigned long flags;
+        int ret;
+
+        sch = eadm_get_idle_sch();
+        if (!sch)
+                return -EBUSY;
+
+        spin_lock_irqsave(sch->lock, flags);
+        eadm_subchannel_set_timeout(sch, EADM_TIMEOUT);
+        ret = eadm_subchannel_start(sch, aob);
+        if (!ret)
+                goto out_unlock;
+
+        /* Handle start subchannel failure. */
+        eadm_subchannel_set_timeout(sch, 0);
+        private = get_eadm_private(sch);
+        private->state = EADM_NOT_OPER;
+        css_sched_sch_todo(sch, SCH_TODO_EVAL);
+
+out_unlock:
+        spin_unlock_irqrestore(sch->lock, flags);
+
+        return ret;
+}
+
+static int eadm_subchannel_probe(struct subchannel *sch)
+{
+        struct eadm_private *private;
+        int ret;
+
+        private = kzalloc(sizeof(*private), GFP_KERNEL | GFP_DMA);
+        if (!private)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&private->head);
+        init_timer(&private->timer);
+
+        spin_lock_irq(sch->lock);
+        set_eadm_private(sch, private);
+        private->state = EADM_IDLE;
+        private->sch = sch;
+        sch->isc = EADM_SCH_ISC;
+        ret = cio_enable_subchannel(sch, (u32)(unsigned long)sch);
+        if (ret) {
+                set_eadm_private(sch, NULL);
+                spin_unlock_irq(sch->lock);
+                kfree(private);
+                goto out;
+        }
+        spin_unlock_irq(sch->lock);
+
+        spin_lock_irq(&list_lock);
+        list_add(&private->head, &eadm_list);
+        spin_unlock_irq(&list_lock);
+
+        if (dev_get_uevent_suppress(&sch->dev)) {
+                dev_set_uevent_suppress(&sch->dev, 0);
+                kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
+        }
+out:
+        return ret;
+}
+
+static void eadm_quiesce(struct subchannel *sch)
+{
+        int ret;
+
+        do {
+                spin_lock_irq(sch->lock);
+                ret = cio_disable_subchannel(sch);
+                spin_unlock_irq(sch->lock);
+        } while (ret == -EBUSY);
+}
+
+static int eadm_subchannel_remove(struct subchannel *sch)
+{
+        struct eadm_private *private = get_eadm_private(sch);
+
+        spin_lock_irq(&list_lock);
+        list_del(&private->head);
+        spin_unlock_irq(&list_lock);
+
+        eadm_quiesce(sch);
+
+        spin_lock_irq(sch->lock);
+        set_eadm_private(sch, NULL);
+        spin_unlock_irq(sch->lock);
+
+        kfree(private);
+
+        return 0;
+}
+
+static void eadm_subchannel_shutdown(struct subchannel *sch)
+{
+        eadm_quiesce(sch);
+}
+
+static int eadm_subchannel_freeze(struct subchannel *sch)
+{
+        return cio_disable_subchannel(sch);
+}
+
+static int eadm_subchannel_restore(struct subchannel *sch)
+{
+        return cio_enable_subchannel(sch, (u32)(unsigned long)sch);
+}
+
+/**
+ * eadm_subchannel_sch_event - process subchannel event
+ * @sch: subchannel
+ * @process: non-zero if function is called in process context
+ *
+ * An unspecified event occurred for this subchannel. Adjust data according
+ * to the current operational state of the subchannel. Return zero when the
+ * event has been handled sufficiently or -EAGAIN when this function should
+ * be called again in process context.
+ */
+static int eadm_subchannel_sch_event(struct subchannel *sch, int process)
+{
+        struct eadm_private *private;
+        unsigned long flags;
+        int ret = 0;
+
+        spin_lock_irqsave(sch->lock, flags);
+        if (!device_is_registered(&sch->dev))
+                goto out_unlock;
+
+        if (work_pending(&sch->todo_work))
+                goto out_unlock;
+
+        if (cio_update_schib(sch)) {
+                css_sched_sch_todo(sch, SCH_TODO_UNREG);
+                goto out_unlock;
+        }
+        private = get_eadm_private(sch);
+        if (private->state == EADM_NOT_OPER)
+                private->state = EADM_IDLE;
+
+out_unlock:
+        spin_unlock_irqrestore(sch->lock, flags);
+
+        return ret;
+}
+
+static struct css_device_id eadm_subchannel_ids[] = {
+        { .match_flags = 0x1, .type = SUBCHANNEL_TYPE_ADM, },
+        { /* end of list */ },
+};
+MODULE_DEVICE_TABLE(css, eadm_subchannel_ids);
+
+static struct css_driver eadm_subchannel_driver = {
+        .drv = {
+                .name = "eadm_subchannel",
+                .owner = THIS_MODULE,
+        },
+        .subchannel_type = eadm_subchannel_ids,
+        .irq = eadm_subchannel_irq,
+        .probe = eadm_subchannel_probe,
+        .remove = eadm_subchannel_remove,
+        .shutdown = eadm_subchannel_shutdown,
+        .sch_event = eadm_subchannel_sch_event,
+        .freeze = eadm_subchannel_freeze,
+        .thaw = eadm_subchannel_restore,
+        .restore = eadm_subchannel_restore,
+};
+
+static struct eadm_ops eadm_ops = {
+        .eadm_start = eadm_start_aob,
+        .owner = THIS_MODULE,
+};
+
+static int __init eadm_sch_init(void)
+{
+        int ret;
+
+        if (!css_general_characteristics.eadm)
+                return -ENXIO;
+
+        eadm_debug = debug_register("eadm_log", 16, 1, 16);
+        if (!eadm_debug)
+                return -ENOMEM;
+
+        debug_register_view(eadm_debug, &debug_hex_ascii_view);
+        debug_set_level(eadm_debug, 2);
+
+        isc_register(EADM_SCH_ISC);
+        ret = css_driver_register(&eadm_subchannel_driver);
+        if (ret)
+                goto cleanup;
+
+        register_eadm_ops(&eadm_ops);
+        return ret;
+
+cleanup:
+        isc_unregister(EADM_SCH_ISC);
+        debug_unregister(eadm_debug);
+        return ret;
+}
+
+static void __exit eadm_sch_exit(void)
+{
+        unregister_eadm_ops(&eadm_ops);
+        css_driver_unregister(&eadm_subchannel_driver);
+        isc_unregister(EADM_SCH_ISC);
+        debug_unregister(eadm_debug);
+}
+module_init(eadm_sch_init);
+module_exit(eadm_sch_exit);
diff --git a/drivers/s390/cio/eadm_sch.h b/drivers/s390/cio/eadm_sch.h
new file mode 100644
index 000000000000..2779be093982
--- /dev/null
+++ b/drivers/s390/cio/eadm_sch.h
@@ -0,0 +1,20 @@
+#ifndef EADM_SCH_H
+#define EADM_SCH_H
+
+#include <linux/device.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include "orb.h"
+
+struct eadm_private {
+        union orb orb;
+        enum {EADM_IDLE, EADM_BUSY, EADM_NOT_OPER} state;
+        struct timer_list timer;
+        struct list_head head;
+        struct subchannel *sch;
+} __aligned(8);
+
+#define get_eadm_private(n) ((struct eadm_private *)dev_get_drvdata(&n->dev))
+#define set_eadm_private(n, p) (dev_set_drvdata(&n->dev, p))
+
+#endif
diff --git a/drivers/s390/cio/orb.h b/drivers/s390/cio/orb.h
index 45a9865c2b36..7a640530e7f5 100644
--- a/drivers/s390/cio/orb.h
+++ b/drivers/s390/cio/orb.h
@@ -59,9 +59,33 @@ struct tm_orb {
         u32:32;
 }  __packed __aligned(4);
 
+/*
+ * eadm operation request block
+ */
+struct eadm_orb {
+        u32 intparm;
+        u32 key:4;
+        u32:4;
+        u32 compat1:1;
+        u32 compat2:1;
+        u32:21;
+        u32 x:1;
+        u32 aob;
+        u32 css_prio:8;
+        u32:8;
+        u32 scm_prio:8;
+        u32:8;
+        u32:29;
+        u32 fmt:3;
+        u32:32;
+        u32:32;
+        u32:32;
+}  __packed __aligned(4);
+
 union orb {
         struct cmd_orb cmd;
         struct tm_orb tm;
+        struct eadm_orb eadm;
 }  __packed __aligned(4);
 
 #endif /* S390_ORB_H */
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index e1f646800ddb..7f8b973da298 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -37,10 +37,14 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 debug_text_event(qdio_dbf_setup, DBF_ERR, debug_buffer); \
         } while (0)
 
-#define DBF_HEX(addr, len) \
-        do { \
-                debug_event(qdio_dbf_setup, DBF_ERR, (void*)(addr), len); \
-        } while (0)
+static inline void DBF_HEX(void *addr, int len)
+{
+        while (len > 0) {
+                debug_event(qdio_dbf_setup, DBF_ERR, addr, len);
+                len -= qdio_dbf_setup->buf_size;
+                addr += qdio_dbf_setup->buf_size;
+        }
+}
 
 #define DBF_ERROR(text...) \
         do { \
@@ -49,11 +53,14 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 debug_text_event(qdio_dbf_error, DBF_ERR, debug_buffer); \
         } while (0)
 
-#define DBF_ERROR_HEX(addr, len) \
-        do { \
-                debug_event(qdio_dbf_error, DBF_ERR, (void*)(addr), len); \
-        } while (0)
-
+static inline void DBF_ERROR_HEX(void *addr, int len)
+{
+        while (len > 0) {
+                debug_event(qdio_dbf_error, DBF_ERR, addr, len);
+                len -= qdio_dbf_error->buf_size;
+                addr += qdio_dbf_error->buf_size;
+        }
+}
 
 #define DBF_DEV_EVENT(level, device, text...) \
         do { \
@@ -64,10 +71,15 @@ static inline int qdio_dbf_passes(debug_info_t *dbf_grp, int level)
                 } \
         } while (0)
 
-#define DBF_DEV_HEX(level, device, addr, len) \
-        do { \
-                debug_event(device->debug_area, level, (void*)(addr), len); \
-        } while (0)
+static inline void DBF_DEV_HEX(struct qdio_irq *dev, void *addr,
+                               int len, int level)
+{
+        while (len > 0) {
+                debug_event(dev->debug_area, level, addr, len);
+                len -= dev->debug_area->buf_size;
+                addr += dev->debug_area->buf_size;
+        }
+}
 
 void qdio_allocate_dbf(struct qdio_initialize *init_data,
                        struct qdio_irq *irq_ptr);
diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
new file mode 100644
index 000000000000..bcf20f3aa51b
--- /dev/null
+++ b/drivers/s390/cio/scm.c
@@ -0,0 +1,317 @@
+/*
+ * Recognize and maintain s390 storage class memory.
+ *
+ * Copyright IBM Corp. 2012
+ * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
+ */
+
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <asm/eadm.h>
+#include "chsc.h"
+
+static struct device *scm_root;
+static struct eadm_ops *eadm_ops;
+static DEFINE_MUTEX(eadm_ops_mutex);
+
+#define to_scm_dev(n) container_of(n, struct scm_device, dev)
+#define to_scm_drv(d) container_of(d, struct scm_driver, drv)
+
+static int scmdev_probe(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+
+        return scmdrv->probe ? scmdrv->probe(scmdev) : -ENODEV;
+}
+
+static int scmdev_remove(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct scm_driver *scmdrv = to_scm_drv(dev->driver);
+
+        return scmdrv->remove ? scmdrv->remove(scmdev) : -ENODEV;
+}
+
+static int scmdev_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        return add_uevent_var(env, "MODALIAS=scm:scmdev");
+}
+
+static struct bus_type scm_bus_type = {
+        .name  = "scm",
+        .probe = scmdev_probe,
+        .remove = scmdev_remove,
+        .uevent = scmdev_uevent,
+};
+
+/**
+ * scm_driver_register() - register a scm driver
+ * @scmdrv: driver to be registered
+ */
+int scm_driver_register(struct scm_driver *scmdrv)
+{
+        struct device_driver *drv = &scmdrv->drv;
+
+        drv->bus = &scm_bus_type;
+
+        return driver_register(drv);
+}
+EXPORT_SYMBOL_GPL(scm_driver_register);
+
+/**
+ * scm_driver_unregister() - deregister a scm driver
+ * @scmdrv: driver to be deregistered
+ */
+void scm_driver_unregister(struct scm_driver *scmdrv)
+{
+        driver_unregister(&scmdrv->drv);
+}
+EXPORT_SYMBOL_GPL(scm_driver_unregister);
+
+int scm_get_ref(void)
+{
+        int ret = 0;
+
+        mutex_lock(&eadm_ops_mutex);
+        if (!eadm_ops || !try_module_get(eadm_ops->owner))
+                ret = -ENOENT;
+        mutex_unlock(&eadm_ops_mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(scm_get_ref);
+
+void scm_put_ref(void)
+{
+        mutex_lock(&eadm_ops_mutex);
+        module_put(eadm_ops->owner);
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(scm_put_ref);
+
+void register_eadm_ops(struct eadm_ops *ops)
+{
+        mutex_lock(&eadm_ops_mutex);
+        eadm_ops = ops;
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(register_eadm_ops);
+
+void unregister_eadm_ops(struct eadm_ops *ops)
+{
+        mutex_lock(&eadm_ops_mutex);
+        eadm_ops = NULL;
+        mutex_unlock(&eadm_ops_mutex);
+}
+EXPORT_SYMBOL_GPL(unregister_eadm_ops);
+
+int scm_start_aob(struct aob *aob)
+{
+        return eadm_ops->eadm_start(aob);
+}
+EXPORT_SYMBOL_GPL(scm_start_aob);
+
+void scm_irq_handler(struct aob *aob, int error)
+{
+        struct aob_rq_header *aobrq = (void *) aob->request.data;
+        struct scm_device *scmdev = aobrq->scmdev;
+        struct scm_driver *scmdrv = to_scm_drv(scmdev->dev.driver);
+
+        scmdrv->handler(scmdev, aobrq->data, error);
+}
+EXPORT_SYMBOL_GPL(scm_irq_handler);
+
+#define scm_attr(name)                                                  \
+static ssize_t show_##name(struct device *dev,                          \
+               struct device_attribute *attr, char *buf)                \
+{                                                                       \
+        struct scm_device *scmdev = to_scm_dev(dev);                    \
+        int ret;                                                        \
+                                                                        \
+        device_lock(dev);                                               \
+        ret = sprintf(buf, "%u\n", scmdev->attrs.name);                 \
+        device_unlock(dev);                                             \
+                                                                        \
+        return ret;                                                     \
+}                                                                       \
+static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL);
+
+scm_attr(persistence);
+scm_attr(oper_state);
+scm_attr(data_state);
+scm_attr(rank);
+scm_attr(release);
+scm_attr(res_id);
+
+static struct attribute *scmdev_attrs[] = {
+        &dev_attr_persistence.attr,
+        &dev_attr_oper_state.attr,
+        &dev_attr_data_state.attr,
+        &dev_attr_rank.attr,
+        &dev_attr_release.attr,
+        &dev_attr_res_id.attr,
+        NULL,
+};
+
+static struct attribute_group scmdev_attr_group = {
+        .attrs = scmdev_attrs,
+};
+
+static const struct attribute_group *scmdev_attr_groups[] = {
+        &scmdev_attr_group,
+        NULL,
+};
+
+static void scmdev_release(struct device *dev)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+
+        kfree(scmdev);
+}
+
+static void scmdev_setup(struct scm_device *scmdev, struct sale *sale,
+                         unsigned int size, unsigned int max_blk_count)
+{
+        dev_set_name(&scmdev->dev, "%016llx", (unsigned long long) sale->sa);
+        scmdev->nr_max_block = max_blk_count;
+        scmdev->address = sale->sa;
+        scmdev->size = 1UL << size;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.persistence = sale->p;
+        scmdev->attrs.oper_state = sale->op_state;
+        scmdev->attrs.data_state = sale->data_state;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.release = sale->r;
+        scmdev->attrs.res_id = sale->rid;
+        scmdev->dev.parent = scm_root;
+        scmdev->dev.bus = &scm_bus_type;
+        scmdev->dev.release = scmdev_release;
+        scmdev->dev.groups = scmdev_attr_groups;
+}
+
+/*
+ * Check for state-changes, notify the driver and userspace.
+ */
+static void scmdev_update(struct scm_device *scmdev, struct sale *sale)
+{
+        struct scm_driver *scmdrv;
+        bool changed;
+
+        device_lock(&scmdev->dev);
+        changed = scmdev->attrs.rank != sale->rank ||
+                  scmdev->attrs.oper_state != sale->op_state;
+        scmdev->attrs.rank = sale->rank;
+        scmdev->attrs.oper_state = sale->op_state;
+        if (!scmdev->dev.driver)
+                goto out;
+        scmdrv = to_scm_drv(scmdev->dev.driver);
+        if (changed && scmdrv->notify)
+                scmdrv->notify(scmdev);
+out:
+        device_unlock(&scmdev->dev);
+        if (changed)
+                kobject_uevent(&scmdev->dev.kobj, KOBJ_CHANGE);
+}
+
+static int check_address(struct device *dev, void *data)
+{
+        struct scm_device *scmdev = to_scm_dev(dev);
+        struct sale *sale = data;
+
+        return scmdev->address == sale->sa;
+}
+
+static struct scm_device *scmdev_find(struct sale *sale)
+{
+        struct device *dev;
+
+        dev = bus_find_device(&scm_bus_type, NULL, sale, check_address);
+
+        return dev ? to_scm_dev(dev) : NULL;
+}
+
+static int scm_add(struct chsc_scm_info *scm_info, size_t num)
+{
+        struct sale *sale, *scmal = scm_info->scmal;
+        struct scm_device *scmdev;
+        int ret;
+
+        for (sale = scmal; sale < scmal + num; sale++) {
+                scmdev = scmdev_find(sale);
+                if (scmdev) {
+                        scmdev_update(scmdev, sale);
+                        /* Release reference from scm_find(). */
+                        put_device(&scmdev->dev);
+                        continue;
+                }
+                scmdev = kzalloc(sizeof(*scmdev), GFP_KERNEL);
+                if (!scmdev)
+                        return -ENODEV;
+                scmdev_setup(scmdev, sale, scm_info->is, scm_info->mbc);
+                ret = device_register(&scmdev->dev);
+                if (ret) {
+                        /* Release reference from device_initialize(). */
+                        put_device(&scmdev->dev);
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
+int scm_update_information(void)
+{
+        struct chsc_scm_info *scm_info;
+        u64 token = 0;
+        size_t num;
+        int ret;
+
+        scm_info = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
+        if (!scm_info)
+                return -ENOMEM;
+
+        do {
+                ret = chsc_scm_info(scm_info, token);
+                if (ret)
+                        break;
+
+                num = (scm_info->response.length -
+                       (offsetof(struct chsc_scm_info, scmal) -
+                        offsetof(struct chsc_scm_info, response))
+                      ) / sizeof(struct sale);
+
+                ret = scm_add(scm_info, num);
+                if (ret)
+                        break;
+
+                token = scm_info->restok;
+        } while (token);
+
+        free_page((unsigned long)scm_info);
+
+        return ret;
+}
+
+static int __init scm_init(void)
+{
+        int ret;
+
+        ret = bus_register(&scm_bus_type);
+        if (ret)
+                return ret;
+
+        scm_root = root_device_register("scm");
+        if (IS_ERR(scm_root)) {
+                bus_unregister(&scm_bus_type);
+                return PTR_ERR(scm_root);
+        }
+
+        scm_update_information();
+        return 0;
+}
+subsys_initcall_sync(scm_init);
diff --git a/drivers/s390/crypto/Makefile b/drivers/s390/crypto/Makefile
index af3c7f16ea88..771faf7094d6 100644
--- a/drivers/s390/crypto/Makefile
+++ b/drivers/s390/crypto/Makefile
@@ -4,4 +4,5 @@
 
 ap-objs := ap_bus.o
 obj-$(CONFIG_ZCRYPT) += ap.o zcrypt_api.o zcrypt_pcicc.o zcrypt_pcixcc.o
-obj-$(CONFIG_ZCRYPT) += zcrypt_pcica.o zcrypt_cex2a.o
+obj-$(CONFIG_ZCRYPT) += zcrypt_pcica.o zcrypt_cex2a.o zcrypt_cex4.o
+obj-$(CONFIG_ZCRYPT) += zcrypt_msgtype6.o zcrypt_msgtype50.o
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index ae258a4b4e5e..7b865a7300e6 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2006
+ * Copyright IBM Corp. 2006, 2012
  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
  *            Martin Schwidefsky <schwidefsky@de.ibm.com>
  *            Ralph Wuerthner <rwuerthn@de.ibm.com>
@@ -62,13 +62,14 @@ static void ap_interrupt_handler(void *unused1, void *unused2);
 static void ap_reset(struct ap_device *ap_dev);
 static void ap_config_timeout(unsigned long ptr);
 static int ap_select_domain(void);
+static void ap_query_configuration(void);
 
 /*
  * Module description.
  */
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("Adjunct Processor Bus driver, "
-                   "Copyright IBM Corp. 2006");
+MODULE_DESCRIPTION("Adjunct Processor Bus driver, " \
+                   "Copyright IBM Corp. 2006, 2012");
 MODULE_LICENSE("GPL");
 
 /*
@@ -84,6 +85,7 @@ module_param_named(poll_thread, ap_thread_flag, int, 0000);
 MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 0 (off).");
 
 static struct device *ap_root_device = NULL;
+static struct ap_config_info *ap_configuration;
 static DEFINE_SPINLOCK(ap_device_list_lock);
 static LIST_HEAD(ap_device_list);
 
@@ -158,6 +160,19 @@ static int ap_interrupts_available(void)
 }
 
 /**
+ * ap_configuration_available(): Test if AP configuration
+ * information is available.
+ *
+ * Returns 1 if AP configuration information is available.
+ */
+#ifdef CONFIG_64BIT
+static int ap_configuration_available(void)
+{
+        return test_facility(2) && test_facility(12);
+}
+#endif
+
+/**
  * ap_test_queue(): Test adjunct processor queue.
  * @qid: The AP queue number
  * @queue_depth: Pointer to queue depth value
@@ -242,6 +257,26 @@ __ap_query_functions(ap_qid_t qid, unsigned int *functions)
 }
 #endif
 
+#ifdef CONFIG_64BIT
+static inline int __ap_query_configuration(struct ap_config_info *config)
+{
+        register unsigned long reg0 asm ("0") = 0x04000000UL;
+        register unsigned long reg1 asm ("1") = -EINVAL;
+        register unsigned char *reg2 asm ("2") = (unsigned char *)config;
+
+        asm volatile(
+                ".long 0xb2af0000\n"            /* PQAP(QCI) */
+                "0: la    %1,0\n"
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                : "+d" (reg0), "+d" (reg1), "+d" (reg2)
+                :
+                : "cc");
+
+        return reg1;
+}
+#endif
+
 /**
  * ap_query_functions(): Query supported functions.
  * @qid: The AP queue number
@@ -292,25 +327,6 @@ static int ap_query_functions(ap_qid_t qid, unsigned int *functions)
 }
 
 /**
- * ap_4096_commands_availablen(): Check for availability of 4096 bit RSA
- * support.
- * @qid: The AP queue number
- *
- * Returns 1 if 4096 bit RSA keys are support fo the AP, returns 0 if not.
- */
-int ap_4096_commands_available(ap_qid_t qid)
-{
-        unsigned int functions;
-
-        if (ap_query_functions(qid, &functions))
-                return 0;
-
-        return test_ap_facility(functions, 1) &&
-               test_ap_facility(functions, 2);
-}
-EXPORT_SYMBOL(ap_4096_commands_available);
-
-/**
  * ap_queue_enable_interruption(): Enable interruption on an AP.
  * @qid: The AP queue number
  * @ind: the notification indicator byte
@@ -657,6 +673,34 @@ static ssize_t ap_request_count_show(struct device *dev,
 
 static DEVICE_ATTR(request_count, 0444, ap_request_count_show, NULL);
 
+static ssize_t ap_requestq_count_show(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        int rc;
+
+        spin_lock_bh(&ap_dev->lock);
+        rc = snprintf(buf, PAGE_SIZE, "%d\n", ap_dev->requestq_count);
+        spin_unlock_bh(&ap_dev->lock);
+        return rc;
+}
+
+static DEVICE_ATTR(requestq_count, 0444, ap_requestq_count_show, NULL);
+
+static ssize_t ap_pendingq_count_show(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        int rc;
+
+        spin_lock_bh(&ap_dev->lock);
+        rc = snprintf(buf, PAGE_SIZE, "%d\n", ap_dev->pendingq_count);
+        spin_unlock_bh(&ap_dev->lock);
+        return rc;
+}
+
+static DEVICE_ATTR(pendingq_count, 0444, ap_pendingq_count_show, NULL);
+
 static ssize_t ap_modalias_show(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
@@ -665,11 +709,23 @@ static ssize_t ap_modalias_show(struct device *dev,
 
 static DEVICE_ATTR(modalias, 0444, ap_modalias_show, NULL);
 
+static ssize_t ap_functions_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct ap_device *ap_dev = to_ap_dev(dev);
+        return snprintf(buf, PAGE_SIZE, "0x%08X\n", ap_dev->functions);
+}
+
+static DEVICE_ATTR(ap_functions, 0444, ap_functions_show, NULL);
+
 static struct attribute *ap_dev_attrs[] = {
         &dev_attr_hwtype.attr,
         &dev_attr_depth.attr,
         &dev_attr_request_count.attr,
+        &dev_attr_requestq_count.attr,
+        &dev_attr_pendingq_count.attr,
         &dev_attr_modalias.attr,
+        &dev_attr_ap_functions.attr,
         NULL
 };
 static struct attribute_group ap_dev_attr_group = {
@@ -772,6 +828,7 @@ static int ap_bus_resume(struct device *dev)
                 ap_suspend_flag = 0;
                 if (!ap_interrupts_available())
                         ap_interrupt_indicator = NULL;
+                ap_query_configuration();
                 if (!user_set_domain) {
                         ap_domain_index = -1;
                         ap_select_domain();
@@ -895,6 +952,20 @@ void ap_driver_unregister(struct ap_driver *ap_drv)
 }
 EXPORT_SYMBOL(ap_driver_unregister);
 
+void ap_bus_force_rescan(void)
+{
+        /* Delete the AP bus rescan timer. */
+        del_timer(&ap_config_timer);
+
+        /* processing a synchonuous bus rescan */
+        ap_scan_bus(NULL);
+
+        /* Setup the AP bus rescan timer again. */
+        ap_config_timer.expires = jiffies + ap_config_time * HZ;
+        add_timer(&ap_config_timer);
+}
+EXPORT_SYMBOL(ap_bus_force_rescan);
+
 /*
  * AP bus attributes.
  */
@@ -997,6 +1068,65 @@ static struct bus_attribute *const ap_bus_attrs[] = {
         NULL,
 };
 
+static inline int ap_test_config(unsigned int *field, unsigned int nr)
+{
+        if (nr > 0xFFu)
+                return 0;
+        return ap_test_bit((field + (nr >> 5)), (nr & 0x1f));
+}
+
+/*
+ * ap_test_config_card_id(): Test, whether an AP card ID is configured.
+ * @id AP card ID
+ *
+ * Returns 0 if the card is not configured
+ *         1 if the card is configured or
+ *           if the configuration information is not available
+ */
+static inline int ap_test_config_card_id(unsigned int id)
+{
+        if (!ap_configuration)
+                return 1;
+        return ap_test_config(ap_configuration->apm, id);
+}
+
+/*
+ * ap_test_config_domain(): Test, whether an AP usage domain is configured.
+ * @domain AP usage domain ID
+ *
+ * Returns 0 if the usage domain is not configured
+ *         1 if the usage domain is configured or
+ *           if the configuration information is not available
+ */
+static inline int ap_test_config_domain(unsigned int domain)
+{
+        if (!ap_configuration)
+                return 1;
+        return ap_test_config(ap_configuration->aqm, domain);
+}
+
+/**
+ * ap_query_configuration(): Query AP configuration information.
+ *
+ * Query information of installed cards and configured domains from AP.
+ */
+static void ap_query_configuration(void)
+{
+#ifdef CONFIG_64BIT
+        if (ap_configuration_available()) {
+                if (!ap_configuration)
+                        ap_configuration =
+                                kzalloc(sizeof(struct ap_config_info),
+                                        GFP_KERNEL);
+                if (ap_configuration)
+                        __ap_query_configuration(ap_configuration);
+        } else
+                ap_configuration = NULL;
+#else
+        ap_configuration = NULL;
+#endif
+}
+
 /**
  * ap_select_domain(): Select an AP domain.
  *
@@ -1005,6 +1135,7 @@ static struct bus_attribute *const ap_bus_attrs[] = {
 static int ap_select_domain(void)
 {
         int queue_depth, device_type, count, max_count, best_domain;
+        ap_qid_t qid;
         int rc, i, j;
 
         /*
@@ -1018,9 +1149,13 @@ static int ap_select_domain(void)
         best_domain = -1;
         max_count = 0;
         for (i = 0; i < AP_DOMAINS; i++) {
+                if (!ap_test_config_domain(i))
+                        continue;
                 count = 0;
                 for (j = 0; j < AP_DEVICES; j++) {
-                        ap_qid_t qid = AP_MKQID(j, i);
+                        if (!ap_test_config_card_id(j))
+                                continue;
+                        qid = AP_MKQID(j, i);
                         rc = ap_query_queue(qid, &queue_depth, &device_type);
                         if (rc)
                                 continue;
@@ -1169,6 +1304,7 @@ static void ap_scan_bus(struct work_struct *unused)
         unsigned int device_functions;
         int rc, i;
 
+        ap_query_configuration();
         if (ap_select_domain() != 0)
                 return;
         for (i = 0; i < AP_DEVICES; i++) {
@@ -1176,7 +1312,10 @@ static void ap_scan_bus(struct work_struct *unused)
                 dev = bus_find_device(&ap_bus_type, NULL,
                                       (void *)(unsigned long)qid,
                                       __ap_scan_bus);
-                rc = ap_query_queue(qid, &queue_depth, &device_type);
+                if (ap_test_config_card_id(i))
+                        rc = ap_query_queue(qid, &queue_depth, &device_type);
+                else
+                        rc = -ENODEV;
                 if (dev) {
                         if (rc == -EBUSY) {
                                 set_current_state(TASK_UNINTERRUPTIBLE);
@@ -1217,29 +1356,22 @@ static void ap_scan_bus(struct work_struct *unused)
                             (unsigned long) ap_dev);
                 switch (device_type) {
                 case 0:
+                        /* device type probing for old cards */
                         if (ap_probe_device_type(ap_dev)) {
                                 kfree(ap_dev);
                                 continue;
                         }
                         break;
-                case 10:
-                        if (ap_query_functions(qid, &device_functions)) {
-                                kfree(ap_dev);
-                                continue;
-                        }
-                        if (test_ap_facility(device_functions, 3))
-                                ap_dev->device_type = AP_DEVICE_TYPE_CEX3C;
-                        else if (test_ap_facility(device_functions, 4))
-                                ap_dev->device_type = AP_DEVICE_TYPE_CEX3A;
-                        else {
-                                kfree(ap_dev);
-                                continue;
-                        }
-                        break;
                 default:
                         ap_dev->device_type = device_type;
                 }
 
+                rc = ap_query_functions(qid, &device_functions);
+                if (!rc)
+                        ap_dev->functions = device_functions;
+                else
+                        ap_dev->functions = 0u;
+
                 ap_dev->device.bus = &ap_bus_type;
                 ap_dev->device.parent = ap_root_device;
                 if (dev_set_name(&ap_dev->device, "card%02x",
@@ -1785,6 +1917,7 @@ int __init ap_module_init(void)
                 goto out_root;
         }
 
+        ap_query_configuration();
         if (ap_select_domain() == 0)
                 ap_scan_bus(NULL);
 
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 52d61995af88..685f6cc022f9 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -1,5 +1,5 @@
 /*
- * Copyright IBM Corp. 2006
+ * Copyright IBM Corp. 2006, 2012
  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
  *            Martin Schwidefsky <schwidefsky@de.ibm.com>
  *            Ralph Wuerthner <rwuerthn@de.ibm.com>
@@ -83,13 +83,12 @@ int ap_queue_status_invalid_test(struct ap_queue_status *status)
         return !(memcmp(status, &invalid, sizeof(struct ap_queue_status)));
 }
 
-#define MAX_AP_FACILITY 31
-
-static inline int test_ap_facility(unsigned int function, unsigned int nr)
+#define AP_MAX_BITS 31
+static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
 {
-        if (nr > MAX_AP_FACILITY)
+        if (nr > AP_MAX_BITS)
                 return 0;
-        return function & (unsigned int)(0x80000000 >> nr);
+        return (*ptr & (0x80000000u >> nr)) != 0;
 }
 
 #define AP_RESPONSE_NORMAL              0x00
@@ -117,6 +116,15 @@ static inline int test_ap_facility(unsigned int function, unsigned int nr)
 #define AP_DEVICE_TYPE_CEX2C    7
 #define AP_DEVICE_TYPE_CEX3A    8
 #define AP_DEVICE_TYPE_CEX3C    9
+#define AP_DEVICE_TYPE_CEX4     10
+
+/*
+ * Known function facilities
+ */
+#define AP_FUNC_MEX4K 1
+#define AP_FUNC_CRT4K 2
+#define AP_FUNC_COPRO 3
+#define AP_FUNC_ACCEL 4
 
 /*
  * AP reset flag states
@@ -151,6 +159,7 @@ struct ap_device {
         ap_qid_t qid;                   /* AP queue id. */
         int queue_depth;                /* AP queue depth.*/
         int device_type;                /* AP device type. */
+        unsigned int functions;         /* AP device function bitfield. */
         int unregistered;               /* marks AP device as unregistered */
         struct timer_list timeout;      /* Timer for request timeouts. */
         int reset;                      /* Reset required after req. timeout. */
@@ -183,6 +192,17 @@ struct ap_message {
                         struct ap_message *);
 };
 
+struct ap_config_info {
+        unsigned int special_command:1;
+        unsigned int ap_extended:1;
+        unsigned char reserved1:6;
+        unsigned char reserved2[15];
+        unsigned int apm[8];            /* AP ID mask */
+        unsigned int aqm[8];            /* AP queue mask */
+        unsigned int adm[8];            /* AP domain mask */
+        unsigned char reserved4[16];
+} __packed;
+
 #define AP_DEVICE(dt)                                   \
         .dev_type=(dt),                                 \
         .match_flags=AP_DEVICE_ID_MATCH_DEVICE_TYPE,
@@ -211,10 +231,9 @@ int ap_recv(ap_qid_t, unsigned long long *, void *, size_t);
 void ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_msg);
 void ap_cancel_message(struct ap_device *ap_dev, struct ap_message *ap_msg);
 void ap_flush_queue(struct ap_device *ap_dev);
+void ap_bus_force_rescan(void);
 
 int ap_module_init(void);
 void ap_module_exit(void);
 
-int ap_4096_commands_available(ap_qid_t qid);
-
 #endif /* _AP_BUS_H_ */
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 2f94132246a1..31cfaa556072 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -1,7 +1,7 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *             Cornelia Huck <cornelia.huck@de.ibm.com>
@@ -9,6 +9,7 @@
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -37,25 +38,39 @@
 #include <linux/atomic.h>
 #include <asm/uaccess.h>
 #include <linux/hw_random.h>
+#include <linux/debugfs.h>
+#include <asm/debug.h>
 
+#include "zcrypt_debug.h"
 #include "zcrypt_api.h"
 
 /*
  * Module description.
  */
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("Cryptographic Coprocessor interface, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("Cryptographic Coprocessor interface, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static DEFINE_SPINLOCK(zcrypt_device_lock);
 static LIST_HEAD(zcrypt_device_list);
 static int zcrypt_device_count = 0;
 static atomic_t zcrypt_open_count = ATOMIC_INIT(0);
+static atomic_t zcrypt_rescan_count = ATOMIC_INIT(0);
+
+atomic_t zcrypt_rescan_req = ATOMIC_INIT(0);
+EXPORT_SYMBOL(zcrypt_rescan_req);
 
 static int zcrypt_rng_device_add(void);
 static void zcrypt_rng_device_remove(void);
 
+static DEFINE_SPINLOCK(zcrypt_ops_list_lock);
+static LIST_HEAD(zcrypt_ops_list);
+
+static debug_info_t *zcrypt_dbf_common;
+static debug_info_t *zcrypt_dbf_devices;
+static struct dentry *debugfs_root;
+
 /*
  * Device attributes common for all crypto devices.
  */
@@ -85,6 +100,8 @@ static ssize_t zcrypt_online_store(struct device *dev,
         if (sscanf(buf, "%d\n", &online) != 1 || online < 0 || online > 1)
                 return -EINVAL;
         zdev->online = online;
+        ZCRYPT_DBF_DEV(DBF_INFO, zdev, "dev%04xo%dman", zdev->ap_dev->qid,
+                       zdev->online);
         if (!online)
                 ap_flush_queue(zdev->ap_dev);
         return count;
@@ -103,6 +120,24 @@ static struct attribute_group zcrypt_device_attr_group = {
 };
 
 /**
+ * Process a rescan of the transport layer.
+ *
+ * Returns 1, if the rescan has been processed, otherwise 0.
+ */
+static inline int zcrypt_process_rescan(void)
+{
+        if (atomic_read(&zcrypt_rescan_req)) {
+                atomic_set(&zcrypt_rescan_req, 0);
+                atomic_inc(&zcrypt_rescan_count);
+                ap_bus_force_rescan();
+                ZCRYPT_DBF_COMMON(DBF_INFO, "rescan%07d",
+                                  atomic_inc_return(&zcrypt_rescan_count));
+                return 1;
+        }
+        return 0;
+}
+
+/**
  * __zcrypt_increase_preference(): Increase preference of a crypto device.
  * @zdev: Pointer the crypto device
  *
@@ -190,6 +225,7 @@ struct zcrypt_device *zcrypt_device_alloc(size_t max_response_size)
         zdev->reply.length = max_response_size;
         spin_lock_init(&zdev->lock);
         INIT_LIST_HEAD(&zdev->list);
+        zdev->dbf_area = zcrypt_dbf_devices;
         return zdev;
 
 out_free:
@@ -215,6 +251,8 @@ int zcrypt_device_register(struct zcrypt_device *zdev)
 {
         int rc;
 
+        if (!zdev->ops)
+                return -ENODEV;
         rc = sysfs_create_group(&zdev->ap_dev->device.kobj,
                                 &zcrypt_device_attr_group);
         if (rc)
@@ -223,6 +261,8 @@ int zcrypt_device_register(struct zcrypt_device *zdev)
         kref_init(&zdev->refcount);
         spin_lock_bh(&zcrypt_device_lock);
         zdev->online = 1;       /* New devices are online by default. */
+        ZCRYPT_DBF_DEV(DBF_INFO, zdev, "dev%04xo%dreg", zdev->ap_dev->qid,
+                       zdev->online);
         list_add_tail(&zdev->list, &zcrypt_device_list);
         __zcrypt_increase_preference(zdev);
         zcrypt_device_count++;
@@ -269,6 +309,67 @@ void zcrypt_device_unregister(struct zcrypt_device *zdev)
 }
 EXPORT_SYMBOL(zcrypt_device_unregister);
 
+void zcrypt_msgtype_register(struct zcrypt_ops *zops)
+{
+        if (zops->owner) {
+                spin_lock_bh(&zcrypt_ops_list_lock);
+                list_add_tail(&zops->list, &zcrypt_ops_list);
+                spin_unlock_bh(&zcrypt_ops_list_lock);
+        }
+}
+EXPORT_SYMBOL(zcrypt_msgtype_register);
+
+void zcrypt_msgtype_unregister(struct zcrypt_ops *zops)
+{
+        spin_lock_bh(&zcrypt_ops_list_lock);
+        list_del_init(&zops->list);
+        spin_unlock_bh(&zcrypt_ops_list_lock);
+}
+EXPORT_SYMBOL(zcrypt_msgtype_unregister);
+
+static inline
+struct zcrypt_ops *__ops_lookup(unsigned char *name, int variant)
+{
+        struct zcrypt_ops *zops;
+        int found = 0;
+
+        spin_lock_bh(&zcrypt_ops_list_lock);
+        list_for_each_entry(zops, &zcrypt_ops_list, list) {
+                if ((zops->variant == variant) &&
+                    (!strncmp(zops->owner->name, name, MODULE_NAME_LEN))) {
+                        found = 1;
+                        break;
+                }
+        }
+        spin_unlock_bh(&zcrypt_ops_list_lock);
+
+        if (!found)
+                return NULL;
+        return zops;
+}
+
+struct zcrypt_ops *zcrypt_msgtype_request(unsigned char *name, int variant)
+{
+        struct zcrypt_ops *zops = NULL;
+
+        zops = __ops_lookup(name, variant);
+        if (!zops) {
+                request_module(name);
+                zops = __ops_lookup(name, variant);
+        }
+        if ((!zops) || (!try_module_get(zops->owner)))
+                return NULL;
+        return zops;
+}
+EXPORT_SYMBOL(zcrypt_msgtype_request);
+
+void zcrypt_msgtype_release(struct zcrypt_ops *zops)
+{
+        if (zops)
+                module_put(zops->owner);
+}
+EXPORT_SYMBOL(zcrypt_msgtype_release);
+
 /**
  * zcrypt_read (): Not supported beyond zcrypt 1.3.1.
  *
@@ -640,6 +741,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_rsa_modexpo(&mex);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_rsa_modexpo(&mex);
+                        } while (rc == -EAGAIN);
                 if (rc)
                         return rc;
                 return put_user(mex.outputdatalength, &umex->outputdatalength);
@@ -652,6 +758,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_rsa_crt(&crt);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_rsa_crt(&crt);
+                        } while (rc == -EAGAIN);
                 if (rc)
                         return rc;
                 return put_user(crt.outputdatalength, &ucrt->outputdatalength);
@@ -664,6 +775,11 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 do {
                         rc = zcrypt_send_cprb(&xcRB);
                 } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_send_cprb(&xcRB);
+                        } while (rc == -EAGAIN);
                 if (copy_to_user(uxcRB, &xcRB, sizeof(xcRB)))
                         return -EFAULT;
                 return rc;
@@ -770,10 +886,15 @@ static long trans_modexpo32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_rsa_modexpo(&mex64);
         } while (rc == -EAGAIN);
-        if (!rc)
-                rc = put_user(mex64.outputdatalength,
-                              &umex32->outputdatalength);
-        return rc;
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_rsa_modexpo(&mex64);
+                } while (rc == -EAGAIN);
+        if (rc)
+                return rc;
+        return put_user(mex64.outputdatalength,
+                        &umex32->outputdatalength);
 }
 
 struct compat_ica_rsa_modexpo_crt {
@@ -810,10 +931,15 @@ static long trans_modexpo_crt32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_rsa_crt(&crt64);
         } while (rc == -EAGAIN);
-        if (!rc)
-                rc = put_user(crt64.outputdatalength,
-                              &ucrt32->outputdatalength);
-        return rc;
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_rsa_crt(&crt64);
+                } while (rc == -EAGAIN);
+        if (rc)
+                return rc;
+        return put_user(crt64.outputdatalength,
+                        &ucrt32->outputdatalength);
 }
 
 struct compat_ica_xcRB {
@@ -869,6 +995,11 @@ static long trans_xcRB32(struct file *filp, unsigned int cmd,
         do {
                 rc = zcrypt_send_cprb(&xcRB64);
         } while (rc == -EAGAIN);
+        /* on failure: retry once again after a requested rescan */
+        if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                do {
+                        rc = zcrypt_send_cprb(&xcRB64);
+                } while (rc == -EAGAIN);
         xcRB32.reply_control_blk_length = xcRB64.reply_control_blk_length;
         xcRB32.reply_data_length = xcRB64.reply_data_length;
         xcRB32.status = xcRB64.status;
@@ -1126,6 +1257,9 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
          */
         if (zcrypt_rng_buffer_index == 0) {
                 rc = zcrypt_rng((char *) zcrypt_rng_buffer);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        rc = zcrypt_rng((char *) zcrypt_rng_buffer);
                 if (rc < 0)
                         return -EIO;
                 zcrypt_rng_buffer_index = rc / sizeof *data;
@@ -1178,6 +1312,30 @@ static void zcrypt_rng_device_remove(void)
         mutex_unlock(&zcrypt_rng_mutex);
 }
 
+int __init zcrypt_debug_init(void)
+{
+        debugfs_root = debugfs_create_dir("zcrypt", NULL);
+
+        zcrypt_dbf_common = debug_register("zcrypt_common", 1, 1, 16);
+        debug_register_view(zcrypt_dbf_common, &debug_hex_ascii_view);
+        debug_set_level(zcrypt_dbf_common, DBF_ERR);
+
+        zcrypt_dbf_devices = debug_register("zcrypt_devices", 1, 1, 16);
+        debug_register_view(zcrypt_dbf_devices, &debug_hex_ascii_view);
+        debug_set_level(zcrypt_dbf_devices, DBF_ERR);
+
+        return 0;
+}
+
+void zcrypt_debug_exit(void)
+{
+        debugfs_remove(debugfs_root);
+        if (zcrypt_dbf_common)
+                debug_unregister(zcrypt_dbf_common);
+        if (zcrypt_dbf_devices)
+                debug_unregister(zcrypt_dbf_devices);
+}
+
 /**
  * zcrypt_api_init(): Module initialization.
  *
@@ -1187,6 +1345,12 @@ int __init zcrypt_api_init(void)
 {
         int rc;
 
+        rc = zcrypt_debug_init();
+        if (rc)
+                goto out;
+
+        atomic_set(&zcrypt_rescan_req, 0);
+
         /* Register the request sprayer. */
         rc = misc_register(&zcrypt_misc_device);
         if (rc < 0)
@@ -1216,6 +1380,7 @@ void zcrypt_api_exit(void)
 {
         remove_proc_entry("driver/z90crypt", NULL);
         misc_deregister(&zcrypt_misc_device);
+        zcrypt_debug_exit();
 }
 
 module_init(zcrypt_api_init);
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 7a32c4bc8ef9..89632919c993 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -1,7 +1,7 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *             Cornelia Huck <cornelia.huck@de.ibm.com>
@@ -9,6 +9,7 @@
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -28,8 +29,10 @@
 #ifndef _ZCRYPT_API_H_
 #define _ZCRYPT_API_H_
 
-#include "ap_bus.h"
+#include <linux/atomic.h>
+#include <asm/debug.h>
 #include <asm/zcrypt.h>
+#include "ap_bus.h"
 
 /* deprecated status calls */
 #define ICAZ90STATUS            _IOR(ZCRYPT_IOCTL_MAGIC, 0x10, struct ica_z90_status)
@@ -87,6 +90,9 @@ struct zcrypt_ops {
                                 struct ica_rsa_modexpo_crt *);
         long (*send_cprb)(struct zcrypt_device *, struct ica_xcRB *);
         long (*rng)(struct zcrypt_device *, char *);
+        struct list_head list;          /* zcrypt ops list. */
+        struct module *owner;
+        int variant;
 };
 
 struct zcrypt_device {
@@ -108,14 +114,23 @@ struct zcrypt_device {
 
         struct ap_message reply;        /* Per-device reply structure. */
         int max_exp_bit_length;
+
+        debug_info_t *dbf_area;         /* debugging */
 };
 
+/* transport layer rescanning */
+extern atomic_t zcrypt_rescan_req;
+
 struct zcrypt_device *zcrypt_device_alloc(size_t);
 void zcrypt_device_free(struct zcrypt_device *);
 void zcrypt_device_get(struct zcrypt_device *);
 int zcrypt_device_put(struct zcrypt_device *);
 int zcrypt_device_register(struct zcrypt_device *);
 void zcrypt_device_unregister(struct zcrypt_device *);
+void zcrypt_msgtype_register(struct zcrypt_ops *);
+void zcrypt_msgtype_unregister(struct zcrypt_ops *);
+struct zcrypt_ops *zcrypt_msgtype_request(unsigned char *, int);
+void zcrypt_msgtype_release(struct zcrypt_ops *);
 int zcrypt_api_init(void);
 void zcrypt_api_exit(void);
 
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
index 744c668f586c..1e849d6e1dfe 100644
--- a/drivers/s390/crypto/zcrypt_cex2a.c
+++ b/drivers/s390/crypto/zcrypt_cex2a.c
@@ -1,13 +1,14 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,6 +36,7 @@
 #include "zcrypt_api.h"
 #include "zcrypt_error.h"
 #include "zcrypt_cex2a.h"
+#include "zcrypt_msgtype50.h"
 
 #define CEX2A_MIN_MOD_SIZE        1     /*    8 bits    */
 #define CEX2A_MAX_MOD_SIZE      256     /* 2048 bits    */
@@ -63,14 +65,12 @@ static struct ap_device_id zcrypt_cex2a_ids[] = {
 
 MODULE_DEVICE_TABLE(ap, zcrypt_cex2a_ids);
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("CEX2A Cryptographic Coprocessor device driver, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("CEX2A Cryptographic Coprocessor device driver, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static int zcrypt_cex2a_probe(struct ap_device *ap_dev);
 static void zcrypt_cex2a_remove(struct ap_device *ap_dev);
-static void zcrypt_cex2a_receive(struct ap_device *, struct ap_message *,
-                                 struct ap_message *);
 
 static struct ap_driver zcrypt_cex2a_driver = {
         .probe = zcrypt_cex2a_probe,
@@ -80,344 +80,6 @@ static struct ap_driver zcrypt_cex2a_driver = {
 };
 
 /**
- * Convert a ICAMEX message to a type50 MEX message.
- *
- * @zdev: crypto device pointer
- * @zreq: crypto request pointer
- * @mex: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICAMEX_msg_to_type50MEX_msg(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo *mex)
-{
-        unsigned char *mod, *exp, *inp;
-        int mod_len;
-
-        mod_len = mex->inputdatalength;
-
-        if (mod_len <= 128) {
-                struct type50_meb1_msg *meb1 = ap_msg->message;
-                memset(meb1, 0, sizeof(*meb1));
-                ap_msg->length = sizeof(*meb1);
-                meb1->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb1->header.msg_len = sizeof(*meb1);
-                meb1->keyblock_type = TYPE50_MEB1_FMT;
-                mod = meb1->modulus + sizeof(meb1->modulus) - mod_len;
-                exp = meb1->exponent + sizeof(meb1->exponent) - mod_len;
-                inp = meb1->message + sizeof(meb1->message) - mod_len;
-        } else if (mod_len <= 256) {
-                struct type50_meb2_msg *meb2 = ap_msg->message;
-                memset(meb2, 0, sizeof(*meb2));
-                ap_msg->length = sizeof(*meb2);
-                meb2->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb2->header.msg_len = sizeof(*meb2);
-                meb2->keyblock_type = TYPE50_MEB2_FMT;
-                mod = meb2->modulus + sizeof(meb2->modulus) - mod_len;
-                exp = meb2->exponent + sizeof(meb2->exponent) - mod_len;
-                inp = meb2->message + sizeof(meb2->message) - mod_len;
-        } else {
-                /* mod_len > 256 = 4096 bit RSA Key */
-                struct type50_meb3_msg *meb3 = ap_msg->message;
-                memset(meb3, 0, sizeof(*meb3));
-                ap_msg->length = sizeof(*meb3);
-                meb3->header.msg_type_code = TYPE50_TYPE_CODE;
-                meb3->header.msg_len = sizeof(*meb3);
-                meb3->keyblock_type = TYPE50_MEB3_FMT;
-                mod = meb3->modulus + sizeof(meb3->modulus) - mod_len;
-                exp = meb3->exponent + sizeof(meb3->exponent) - mod_len;
-                inp = meb3->message + sizeof(meb3->message) - mod_len;
-        }
-
-        if (copy_from_user(mod, mex->n_modulus, mod_len) ||
-            copy_from_user(exp, mex->b_key, mod_len) ||
-            copy_from_user(inp, mex->inputdata, mod_len))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Convert a ICACRT message to a type50 CRT message.
- *
- * @zdev: crypto device pointer
- * @zreq: crypto request pointer
- * @crt: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICACRT_msg_to_type50CRT_msg(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo_crt *crt)
-{
-        int mod_len, short_len, long_len, long_offset, limit;
-        unsigned char *p, *q, *dp, *dq, *u, *inp;
-
-        mod_len = crt->inputdatalength;
-        short_len = mod_len / 2;
-        long_len = mod_len / 2 + 8;
-
-        /*
-         * CEX2A cannot handle p, dp, or U > 128 bytes.
-         * If we have one of these, we need to do extra checking.
-         * For CEX3A the limit is 256 bytes.
-         */
-        if (zdev->max_mod_size == CEX3A_MAX_MOD_SIZE)
-                limit = 256;
-        else
-                limit = 128;
-
-        if (long_len > limit) {
-                /*
-                 * zcrypt_rsa_crt already checked for the leading
-                 * zeroes of np_prime, bp_key and u_mult_inc.
-                 */
-                long_offset = long_len - limit;
-                long_len = limit;
-        } else
-                long_offset = 0;
-
-        /*
-         * Instead of doing extra work for p, dp, U > 64 bytes, we'll just use
-         * the larger message structure.
-         */
-        if (long_len <= 64) {
-                struct type50_crb1_msg *crb1 = ap_msg->message;
-                memset(crb1, 0, sizeof(*crb1));
-                ap_msg->length = sizeof(*crb1);
-                crb1->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb1->header.msg_len = sizeof(*crb1);
-                crb1->keyblock_type = TYPE50_CRB1_FMT;
-                p = crb1->p + sizeof(crb1->p) - long_len;
-                q = crb1->q + sizeof(crb1->q) - short_len;
-                dp = crb1->dp + sizeof(crb1->dp) - long_len;
-                dq = crb1->dq + sizeof(crb1->dq) - short_len;
-                u = crb1->u + sizeof(crb1->u) - long_len;
-                inp = crb1->message + sizeof(crb1->message) - mod_len;
-        } else if (long_len <= 128) {
-                struct type50_crb2_msg *crb2 = ap_msg->message;
-                memset(crb2, 0, sizeof(*crb2));
-                ap_msg->length = sizeof(*crb2);
-                crb2->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb2->header.msg_len = sizeof(*crb2);
-                crb2->keyblock_type = TYPE50_CRB2_FMT;
-                p = crb2->p + sizeof(crb2->p) - long_len;
-                q = crb2->q + sizeof(crb2->q) - short_len;
-                dp = crb2->dp + sizeof(crb2->dp) - long_len;
-                dq = crb2->dq + sizeof(crb2->dq) - short_len;
-                u = crb2->u + sizeof(crb2->u) - long_len;
-                inp = crb2->message + sizeof(crb2->message) - mod_len;
-        } else {
-                /* long_len >= 256 */
-                struct type50_crb3_msg *crb3 = ap_msg->message;
-                memset(crb3, 0, sizeof(*crb3));
-                ap_msg->length = sizeof(*crb3);
-                crb3->header.msg_type_code = TYPE50_TYPE_CODE;
-                crb3->header.msg_len = sizeof(*crb3);
-                crb3->keyblock_type = TYPE50_CRB3_FMT;
-                p = crb3->p + sizeof(crb3->p) - long_len;
-                q = crb3->q + sizeof(crb3->q) - short_len;
-                dp = crb3->dp + sizeof(crb3->dp) - long_len;
-                dq = crb3->dq + sizeof(crb3->dq) - short_len;
-                u = crb3->u + sizeof(crb3->u) - long_len;
-                inp = crb3->message + sizeof(crb3->message) - mod_len;
-        }
-
-        if (copy_from_user(p, crt->np_prime + long_offset, long_len) ||
-            copy_from_user(q, crt->nq_prime, short_len) ||
-            copy_from_user(dp, crt->bp_key + long_offset, long_len) ||
-            copy_from_user(dq, crt->bq_key, short_len) ||
-            copy_from_user(u, crt->u_mult_inv + long_offset, long_len) ||
-            copy_from_user(inp, crt->inputdata, mod_len))
-                return -EFAULT;
-
-        return 0;
-}
-
-/**
- * Copy results from a type 80 reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @data: pointer to user output data
- * @length: size of user output data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int convert_type80(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char __user *outputdata,
-                          unsigned int outputdatalength)
-{
-        struct type80_hdr *t80h = reply->message;
-        unsigned char *data;
-
-        if (t80h->len < sizeof(*t80h) + outputdatalength) {
-                /* The result is too short, the CEX2A card may not do that.. */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                BUG_ON(t80h->len > CEX2A_MAX_RESPONSE_SIZE);
-        else
-                BUG_ON(t80h->len > CEX3A_MAX_RESPONSE_SIZE);
-        data = reply->message + t80h->len - outputdatalength;
-        if (copy_to_user(outputdata, data, outputdatalength))
-                return -EFAULT;
-        return 0;
-}
-
-static int convert_response(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            char __user *outputdata,
-                            unsigned int outputdatalength)
-{
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return convert_error(zdev, reply);
-        case TYPE80_RSP_CODE:
-                return convert_type80(zdev, reply,
-                                      outputdata, outputdatalength);
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-/**
- * This function is called from the AP bus code after a crypto request
- * "msg" has finished with the reply message "reply".
- * It is called from tasklet context.
- * @ap_dev: pointer to the AP device
- * @msg: pointer to the AP message
- * @reply: pointer to the AP reply message
- */
-static void zcrypt_cex2a_receive(struct ap_device *ap_dev,
-                                 struct ap_message *msg,
-                                 struct ap_message *reply)
-{
-        static struct error_hdr error_reply = {
-                .type = TYPE82_RSP_CODE,
-                .reply_code = REP82_ERROR_MACHINE_FAILURE,
-        };
-        struct type80_hdr *t80h;
-        int length;
-
-        /* Copy the reply message to the request message buffer. */
-        if (IS_ERR(reply)) {
-                memcpy(msg->message, &error_reply, sizeof(error_reply));
-                goto out;
-        }
-        t80h = reply->message;
-        if (t80h->type == TYPE80_RSP_CODE) {
-                if (ap_dev->device_type == AP_DEVICE_TYPE_CEX2A)
-                        length = min(CEX2A_MAX_RESPONSE_SIZE, (int) t80h->len);
-                else
-                        length = min(CEX3A_MAX_RESPONSE_SIZE, (int) t80h->len);
-                memcpy(msg->message, reply->message, length);
-        } else
-                memcpy(msg->message, reply->message, sizeof error_reply);
-out:
-        complete((struct completion *) msg->private);
-}
-
-static atomic_t zcrypt_step = ATOMIC_INIT(0);
-
-/**
- * The request distributor calls this function if it picked the CEX2A
- * device to handle a modexpo request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        CEX2A device to the request distributor
- * @mex: pointer to the modexpo request buffer
- */
-static long zcrypt_cex2a_modexpo(struct zcrypt_device *zdev,
-                                 struct ica_rsa_modexpo *mex)
-{
-        struct ap_message ap_msg;
-        struct completion work;
-        int rc;
-
-        ap_init_message(&ap_msg);
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        else
-                ap_msg.message = kmalloc(CEX3A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_cex2a_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &work;
-        rc = ICAMEX_msg_to_type50MEX_msg(zdev, &ap_msg, mex);
-        if (rc)
-                goto out_free;
-        init_completion(&work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&work);
-        if (rc == 0)
-                rc = convert_response(zdev, &ap_msg, mex->outputdata,
-                                      mex->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the CEX2A
- * device to handle a modexpo_crt request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        CEX2A device to the request distributor
- * @crt: pointer to the modexpoc_crt request buffer
- */
-static long zcrypt_cex2a_modexpo_crt(struct zcrypt_device *zdev,
-                                     struct ica_rsa_modexpo_crt *crt)
-{
-        struct ap_message ap_msg;
-        struct completion work;
-        int rc;
-
-        ap_init_message(&ap_msg);
-        if (zdev->user_space_type == ZCRYPT_CEX2A)
-                ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        else
-                ap_msg.message = kmalloc(CEX3A_MAX_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_cex2a_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &work;
-        rc = ICACRT_msg_to_type50CRT_msg(zdev, &ap_msg, crt);
-        if (rc)
-                goto out_free;
-        init_completion(&work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&work);
-        if (rc == 0)
-                rc = convert_response(zdev, &ap_msg, crt->outputdata,
-                                      crt->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The crypto operations for a CEX2A card.
- */
-static struct zcrypt_ops zcrypt_cex2a_ops = {
-        .rsa_modexpo = zcrypt_cex2a_modexpo,
-        .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
-};
-
-/**
  * Probe function for CEX2A cards. It always accepts the AP device
  * since the bus_match already checked the hardware type.
  * @ap_dev: pointer to the AP device.
@@ -449,7 +111,8 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
                 zdev->min_mod_size = CEX2A_MIN_MOD_SIZE;
                 zdev->max_mod_size = CEX2A_MAX_MOD_SIZE;
                 zdev->max_exp_bit_length = CEX2A_MAX_MOD_SIZE;
-                if (ap_4096_commands_available(ap_dev->qid)) {
+                if (ap_test_bit(&ap_dev->functions, AP_FUNC_MEX4K) &&
+                    ap_test_bit(&ap_dev->functions, AP_FUNC_CRT4K)) {
                         zdev->max_mod_size = CEX3A_MAX_MOD_SIZE;
                         zdev->max_exp_bit_length = CEX3A_MAX_MOD_SIZE;
                 }
@@ -457,16 +120,18 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
                 zdev->speed_rating = CEX3A_SPEED_RATING;
                 break;
         }
-        if (zdev != NULL) {
-                zdev->ap_dev = ap_dev;
-                zdev->ops = &zcrypt_cex2a_ops;
-                zdev->online = 1;
-                ap_dev->reply = &zdev->reply;
-                ap_dev->private = zdev;
-                rc = zcrypt_device_register(zdev);
-        }
+        if (!zdev)
+                return -ENODEV;
+        zdev->ops = zcrypt_msgtype_request(MSGTYPE50_NAME,
+                                           MSGTYPE50_VARIANT_DEFAULT);
+        zdev->ap_dev = ap_dev;
+        zdev->online = 1;
+        ap_dev->reply = &zdev->reply;
+        ap_dev->private = zdev;
+        rc = zcrypt_device_register(zdev);
         if (rc) {
                 ap_dev->private = NULL;
+                zcrypt_msgtype_release(zdev->ops);
                 zcrypt_device_free(zdev);
         }
         return rc;
@@ -479,8 +144,10 @@ static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
 static void zcrypt_cex2a_remove(struct ap_device *ap_dev)
 {
         struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops = zdev->ops;
 
         zcrypt_device_unregister(zdev);
+        zcrypt_msgtype_release(zops);
 }
 
 int __init zcrypt_cex2a_init(void)
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
new file mode 100644
index 000000000000..ce1226398ac9
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -0,0 +1,149 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler <hd@linux.vnet.ibm.com>
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_msgtype6.h"
+#include "zcrypt_msgtype50.h"
+#include "zcrypt_error.h"
+#include "zcrypt_cex4.h"
+
+#define CEX4A_MIN_MOD_SIZE        1     /*    8 bits    */
+#define CEX4A_MAX_MOD_SIZE_2K   256     /* 2048 bits    */
+#define CEX4A_MAX_MOD_SIZE_4K   512     /* 4096 bits    */
+
+#define CEX4C_MIN_MOD_SIZE       16     /*  256 bits    */
+#define CEX4C_MAX_MOD_SIZE      512     /* 4096 bits    */
+
+#define CEX4A_SPEED_RATING      900      /* TODO new card, new speed rating */
+#define CEX4C_SPEED_RATING      6500     /* TODO new card, new speed rating */
+
+#define CEX4A_MAX_MESSAGE_SIZE  MSGTYPE50_CRB3_MAX_MSG_SIZE
+#define CEX4C_MAX_MESSAGE_SIZE  MSGTYPE06_MAX_MSG_SIZE
+
+#define CEX4_CLEANUP_TIME       (15*HZ)
+
+static struct ap_device_id zcrypt_cex4_ids[] = {
+        { AP_DEVICE(AP_DEVICE_TYPE_CEX4)  },
+        { /* end of list */ },
+};
+
+MODULE_DEVICE_TABLE(ap, zcrypt_cex4_ids);
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("CEX4 Cryptographic Card device driver, " \
+                   "Copyright IBM Corp. 2012");
+MODULE_LICENSE("GPL");
+
+static int zcrypt_cex4_probe(struct ap_device *ap_dev);
+static void zcrypt_cex4_remove(struct ap_device *ap_dev);
+
+static struct ap_driver zcrypt_cex4_driver = {
+        .probe = zcrypt_cex4_probe,
+        .remove = zcrypt_cex4_remove,
+        .ids = zcrypt_cex4_ids,
+        .request_timeout = CEX4_CLEANUP_TIME,
+};
+
+/**
+ * Probe function for CEX4 cards. It always accepts the AP device
+ * since the bus_match already checked the hardware type.
+ * @ap_dev: pointer to the AP device.
+ */
+static int zcrypt_cex4_probe(struct ap_device *ap_dev)
+{
+        struct zcrypt_device *zdev = NULL;
+        int rc = 0;
+
+        switch (ap_dev->device_type) {
+        case AP_DEVICE_TYPE_CEX4:
+                if (ap_test_bit(&ap_dev->functions, AP_FUNC_ACCEL)) {
+                        zdev = zcrypt_device_alloc(CEX4A_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4A";
+                        zdev->user_space_type = ZCRYPT_CEX3A;
+                        zdev->min_mod_size = CEX4A_MIN_MOD_SIZE;
+                        if (ap_test_bit(&ap_dev->functions, AP_FUNC_MEX4K) &&
+                            ap_test_bit(&ap_dev->functions, AP_FUNC_CRT4K)) {
+                                zdev->max_mod_size =
+                                        CEX4A_MAX_MOD_SIZE_4K;
+                                zdev->max_exp_bit_length =
+                                        CEX4A_MAX_MOD_SIZE_4K;
+                        } else {
+                                zdev->max_mod_size =
+                                        CEX4A_MAX_MOD_SIZE_2K;
+                                zdev->max_exp_bit_length =
+                                        CEX4A_MAX_MOD_SIZE_2K;
+                        }
+                        zdev->short_crt = 1;
+                        zdev->speed_rating = CEX4A_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE50_NAME,
+                                                           MSGTYPE50_VARIANT_DEFAULT);
+                } else if (ap_test_bit(&ap_dev->functions, AP_FUNC_COPRO)) {
+                        zdev = zcrypt_device_alloc(CEX4C_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4C";
+                        zdev->user_space_type = ZCRYPT_CEX3C;
+                        zdev->min_mod_size = CEX4C_MIN_MOD_SIZE;
+                        zdev->max_mod_size = CEX4C_MAX_MOD_SIZE;
+                        zdev->max_exp_bit_length = CEX4C_MAX_MOD_SIZE;
+                        zdev->short_crt = 0;
+                        zdev->speed_rating = CEX4C_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                           MSGTYPE06_VARIANT_DEFAULT);
+                }
+                break;
+        }
+        if (!zdev)
+                return -ENODEV;
+        zdev->ap_dev = ap_dev;
+        zdev->online = 1;
+        ap_dev->reply = &zdev->reply;
+        ap_dev->private = zdev;
+        rc = zcrypt_device_register(zdev);
+        if (rc) {
+                zcrypt_msgtype_release(zdev->ops);
+                ap_dev->private = NULL;
+                zcrypt_device_free(zdev);
+        }
+        return rc;
+}
+
+/**
+ * This is called to remove the extended CEX4 driver information
+ * if an AP device is removed.
+ */
+static void zcrypt_cex4_remove(struct ap_device *ap_dev)
+{
+        struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops;
+
+        if (zdev) {
+                zops = zdev->ops;
+                zcrypt_device_unregister(zdev);
+                zcrypt_msgtype_release(zops);
+        }
+}
+
+int __init zcrypt_cex4_init(void)
+{
+        return ap_driver_register(&zcrypt_cex4_driver, THIS_MODULE, "cex4");
+}
+
+void __exit zcrypt_cex4_exit(void)
+{
+        ap_driver_unregister(&zcrypt_cex4_driver);
+}
+
+module_init(zcrypt_cex4_init);
+module_exit(zcrypt_cex4_exit);
diff --git a/drivers/s390/crypto/zcrypt_cex4.h b/drivers/s390/crypto/zcrypt_cex4.h
new file mode 100644
index 000000000000..719571375ccc
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_cex4.h
@@ -0,0 +1,12 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler <hd@linux.vnet.ibm.com>
+ */
+
+#ifndef _ZCRYPT_CEX4_H_
+#define _ZCRYPT_CEX4_H_
+
+int zcrypt_cex4_init(void);
+void zcrypt_cex4_exit(void);
+
+#endif /* _ZCRYPT_CEX4_H_ */
diff --git a/drivers/s390/crypto/zcrypt_debug.h b/drivers/s390/crypto/zcrypt_debug.h
new file mode 100644
index 000000000000..841ea72e4a4e
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_debug.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright IBM Corp. 2012
+ *  Author(s): Holger Dengler (hd@linux.vnet.ibm.com)
+ */
+#ifndef ZCRYPT_DEBUG_H
+#define ZCRYPT_DEBUG_H
+
+#include <asm/debug.h>
+#include "zcrypt_api.h"
+
+/* that gives us 15 characters in the text event views */
+#define ZCRYPT_DBF_LEN  16
+
+/* sort out low debug levels early to avoid wasted sprints */
+static inline int zcrypt_dbf_passes(debug_info_t *dbf_grp, int level)
+{
+        return (level <= dbf_grp->level);
+}
+
+#define DBF_ERR         3       /* error conditions     */
+#define DBF_WARN        4       /* warning conditions   */
+#define DBF_INFO        6       /* informational        */
+
+#define RC2WARN(rc) ((rc) ? DBF_WARN : DBF_INFO)
+
+#define ZCRYPT_DBF_COMMON(level, text...) \
+        do { \
+                if (zcrypt_dbf_passes(zcrypt_dbf_common, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(zcrypt_dbf_common, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+#define ZCRYPT_DBF_DEVICES(level, text...) \
+        do { \
+                if (zcrypt_dbf_passes(zcrypt_dbf_devices, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(zcrypt_dbf_devices, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+#define ZCRYPT_DBF_DEV(level, device, text...) \
+        do { \
+                if (zcrypt_dbf_passes(device->dbf_area, level)) { \
+                        char debug_buffer[ZCRYPT_DBF_LEN]; \
+                        snprintf(debug_buffer, ZCRYPT_DBF_LEN, text); \
+                        debug_text_event(device->dbf_area, level, \
+                                         debug_buffer); \
+                } \
+        } while (0)
+
+int zcrypt_debug_init(void);
+void zcrypt_debug_exit(void);
+
+#endif /* ZCRYPT_DEBUG_H */
diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
index 0965e2626d18..0079b6617211 100644
--- a/drivers/s390/crypto/zcrypt_error.h
+++ b/drivers/s390/crypto/zcrypt_error.h
@@ -26,6 +26,8 @@
 #ifndef _ZCRYPT_ERROR_H_
 #define _ZCRYPT_ERROR_H_
 
+#include <linux/atomic.h>
+#include "zcrypt_debug.h"
 #include "zcrypt_api.h"
 
 /**
@@ -108,16 +110,27 @@ static inline int convert_error(struct zcrypt_device *zdev,
                  * and then repeat the request.
                  */
                 WARN_ON(1);
+                atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         case REP82_ERROR_TRANSPORT_FAIL:
         case REP82_ERROR_MACHINE_FAILURE:
         //   REP88_ERROR_MODULE_FAILURE         // '10' CEX2A
                 /* If a card fails disable it and repeat the request. */
+                atomic_set(&zcrypt_rescan_req, 1);
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN;
         default:
                 zdev->online = 0;
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid,
+                               zdev->online, ehdr->reply_code);
                 return -EAGAIN; /* repeat the request on a different device. */
         }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
new file mode 100644
index 000000000000..035b6dc31b71
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -0,0 +1,531 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_error.h"
+#include "zcrypt_msgtype50.h"
+
+#define CEX3A_MAX_MOD_SIZE      512     /* 4096 bits    */
+
+#define CEX2A_MAX_RESPONSE_SIZE 0x110   /* max outputdatalength + type80_hdr */
+
+#define CEX3A_MAX_RESPONSE_SIZE 0x210   /* 512 bit modulus
+                                         * (max outputdatalength) +
+                                         * type80_hdr*/
+
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("Cryptographic Accelerator (message type 50), " \
+                   "Copyright IBM Corp. 2001, 2012");
+MODULE_LICENSE("GPL");
+
+static void zcrypt_cex2a_receive(struct ap_device *, struct ap_message *,
+                                 struct ap_message *);
+
+/**
+ * The type 50 message family is associated with a CEX2A card.
+ *
+ * The four members of the family are described below.
+ *
+ * Note that all unsigned char arrays are right-justified and left-padded
+ * with zeroes.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type50_hdr {
+        unsigned char   reserved1;
+        unsigned char   msg_type_code;  /* 0x50 */
+        unsigned short  msg_len;
+        unsigned char   reserved2;
+        unsigned char   ignored;
+        unsigned short  reserved3;
+} __packed;
+
+#define TYPE50_TYPE_CODE        0x50
+
+#define TYPE50_MEB1_FMT         0x0001
+#define TYPE50_MEB2_FMT         0x0002
+#define TYPE50_MEB3_FMT         0x0003
+#define TYPE50_CRB1_FMT         0x0011
+#define TYPE50_CRB2_FMT         0x0012
+#define TYPE50_CRB3_FMT         0x0013
+
+/* Mod-Exp, with a small modulus */
+struct type50_meb1_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0001 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[128];
+        unsigned char   modulus[128];
+        unsigned char   message[128];
+} __packed;
+
+/* Mod-Exp, with a large modulus */
+struct type50_meb2_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0002 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[256];
+        unsigned char   modulus[256];
+        unsigned char   message[256];
+} __packed;
+
+/* Mod-Exp, with a larger modulus */
+struct type50_meb3_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0003 */
+        unsigned char   reserved[6];
+        unsigned char   exponent[512];
+        unsigned char   modulus[512];
+        unsigned char   message[512];
+} __packed;
+
+/* CRT, with a small modulus */
+struct type50_crb1_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0011 */
+        unsigned char   reserved[6];
+        unsigned char   p[64];
+        unsigned char   q[64];
+        unsigned char   dp[64];
+        unsigned char   dq[64];
+        unsigned char   u[64];
+        unsigned char   message[128];
+} __packed;
+
+/* CRT, with a large modulus */
+struct type50_crb2_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0012 */
+        unsigned char   reserved[6];
+        unsigned char   p[128];
+        unsigned char   q[128];
+        unsigned char   dp[128];
+        unsigned char   dq[128];
+        unsigned char   u[128];
+        unsigned char   message[256];
+} __packed;
+
+/* CRT, with a larger modulus */
+struct type50_crb3_msg {
+        struct type50_hdr header;
+        unsigned short  keyblock_type;  /* 0x0013 */
+        unsigned char   reserved[6];
+        unsigned char   p[256];
+        unsigned char   q[256];
+        unsigned char   dp[256];
+        unsigned char   dq[256];
+        unsigned char   u[256];
+        unsigned char   message[512];
+} __packed;
+
+/**
+ * The type 80 response family is associated with a CEX2A card.
+ *
+ * Note that all unsigned char arrays are right-justified and left-padded
+ * with zeroes.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+
+#define TYPE80_RSP_CODE 0x80
+
+struct type80_hdr {
+        unsigned char   reserved1;
+        unsigned char   type;           /* 0x80 */
+        unsigned short  len;
+        unsigned char   code;           /* 0x00 */
+        unsigned char   reserved2[3];
+        unsigned char   reserved3[8];
+} __packed;
+
+/**
+ * Convert a ICAMEX message to a type50 MEX message.
+ *
+ * @zdev: crypto device pointer
+ * @zreq: crypto request pointer
+ * @mex: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICAMEX_msg_to_type50MEX_msg(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo *mex)
+{
+        unsigned char *mod, *exp, *inp;
+        int mod_len;
+
+        mod_len = mex->inputdatalength;
+
+        if (mod_len <= 128) {
+                struct type50_meb1_msg *meb1 = ap_msg->message;
+                memset(meb1, 0, sizeof(*meb1));
+                ap_msg->length = sizeof(*meb1);
+                meb1->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb1->header.msg_len = sizeof(*meb1);
+                meb1->keyblock_type = TYPE50_MEB1_FMT;
+                mod = meb1->modulus + sizeof(meb1->modulus) - mod_len;
+                exp = meb1->exponent + sizeof(meb1->exponent) - mod_len;
+                inp = meb1->message + sizeof(meb1->message) - mod_len;
+        } else if (mod_len <= 256) {
+                struct type50_meb2_msg *meb2 = ap_msg->message;
+                memset(meb2, 0, sizeof(*meb2));
+                ap_msg->length = sizeof(*meb2);
+                meb2->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb2->header.msg_len = sizeof(*meb2);
+                meb2->keyblock_type = TYPE50_MEB2_FMT;
+                mod = meb2->modulus + sizeof(meb2->modulus) - mod_len;
+                exp = meb2->exponent + sizeof(meb2->exponent) - mod_len;
+                inp = meb2->message + sizeof(meb2->message) - mod_len;
+        } else {
+                /* mod_len > 256 = 4096 bit RSA Key */
+                struct type50_meb3_msg *meb3 = ap_msg->message;
+                memset(meb3, 0, sizeof(*meb3));
+                ap_msg->length = sizeof(*meb3);
+                meb3->header.msg_type_code = TYPE50_TYPE_CODE;
+                meb3->header.msg_len = sizeof(*meb3);
+                meb3->keyblock_type = TYPE50_MEB3_FMT;
+                mod = meb3->modulus + sizeof(meb3->modulus) - mod_len;
+                exp = meb3->exponent + sizeof(meb3->exponent) - mod_len;
+                inp = meb3->message + sizeof(meb3->message) - mod_len;
+        }
+
+        if (copy_from_user(mod, mex->n_modulus, mod_len) ||
+            copy_from_user(exp, mex->b_key, mod_len) ||
+            copy_from_user(inp, mex->inputdata, mod_len))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Convert a ICACRT message to a type50 CRT message.
+ *
+ * @zdev: crypto device pointer
+ * @zreq: crypto request pointer
+ * @crt: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICACRT_msg_to_type50CRT_msg(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo_crt *crt)
+{
+        int mod_len, short_len, long_len, long_offset, limit;
+        unsigned char *p, *q, *dp, *dq, *u, *inp;
+
+        mod_len = crt->inputdatalength;
+        short_len = mod_len / 2;
+        long_len = mod_len / 2 + 8;
+
+        /*
+         * CEX2A cannot handle p, dp, or U > 128 bytes.
+         * If we have one of these, we need to do extra checking.
+         * For CEX3A the limit is 256 bytes.
+         */
+        if (zdev->max_mod_size == CEX3A_MAX_MOD_SIZE)
+                limit = 256;
+        else
+                limit = 128;
+
+        if (long_len > limit) {
+                /*
+                 * zcrypt_rsa_crt already checked for the leading
+                 * zeroes of np_prime, bp_key and u_mult_inc.
+                 */
+                long_offset = long_len - limit;
+                long_len = limit;
+        } else
+                long_offset = 0;
+
+        /*
+         * Instead of doing extra work for p, dp, U > 64 bytes, we'll just use
+         * the larger message structure.
+         */
+        if (long_len <= 64) {
+                struct type50_crb1_msg *crb1 = ap_msg->message;
+                memset(crb1, 0, sizeof(*crb1));
+                ap_msg->length = sizeof(*crb1);
+                crb1->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb1->header.msg_len = sizeof(*crb1);
+                crb1->keyblock_type = TYPE50_CRB1_FMT;
+                p = crb1->p + sizeof(crb1->p) - long_len;
+                q = crb1->q + sizeof(crb1->q) - short_len;
+                dp = crb1->dp + sizeof(crb1->dp) - long_len;
+                dq = crb1->dq + sizeof(crb1->dq) - short_len;
+                u = crb1->u + sizeof(crb1->u) - long_len;
+                inp = crb1->message + sizeof(crb1->message) - mod_len;
+        } else if (long_len <= 128) {
+                struct type50_crb2_msg *crb2 = ap_msg->message;
+                memset(crb2, 0, sizeof(*crb2));
+                ap_msg->length = sizeof(*crb2);
+                crb2->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb2->header.msg_len = sizeof(*crb2);
+                crb2->keyblock_type = TYPE50_CRB2_FMT;
+                p = crb2->p + sizeof(crb2->p) - long_len;
+                q = crb2->q + sizeof(crb2->q) - short_len;
+                dp = crb2->dp + sizeof(crb2->dp) - long_len;
+                dq = crb2->dq + sizeof(crb2->dq) - short_len;
+                u = crb2->u + sizeof(crb2->u) - long_len;
+                inp = crb2->message + sizeof(crb2->message) - mod_len;
+        } else {
+                /* long_len >= 256 */
+                struct type50_crb3_msg *crb3 = ap_msg->message;
+                memset(crb3, 0, sizeof(*crb3));
+                ap_msg->length = sizeof(*crb3);
+                crb3->header.msg_type_code = TYPE50_TYPE_CODE;
+                crb3->header.msg_len = sizeof(*crb3);
+                crb3->keyblock_type = TYPE50_CRB3_FMT;
+                p = crb3->p + sizeof(crb3->p) - long_len;
+                q = crb3->q + sizeof(crb3->q) - short_len;
+                dp = crb3->dp + sizeof(crb3->dp) - long_len;
+                dq = crb3->dq + sizeof(crb3->dq) - short_len;
+                u = crb3->u + sizeof(crb3->u) - long_len;
+                inp = crb3->message + sizeof(crb3->message) - mod_len;
+        }
+
+        if (copy_from_user(p, crt->np_prime + long_offset, long_len) ||
+            copy_from_user(q, crt->nq_prime, short_len) ||
+            copy_from_user(dp, crt->bp_key + long_offset, long_len) ||
+            copy_from_user(dq, crt->bq_key, short_len) ||
+            copy_from_user(u, crt->u_mult_inv + long_offset, long_len) ||
+            copy_from_user(inp, crt->inputdata, mod_len))
+                return -EFAULT;
+
+        return 0;
+}
+
+/**
+ * Copy results from a type 80 reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @data: pointer to user output data
+ * @length: size of user output data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int convert_type80(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char __user *outputdata,
+                          unsigned int outputdatalength)
+{
+        struct type80_hdr *t80h = reply->message;
+        unsigned char *data;
+
+        if (t80h->len < sizeof(*t80h) + outputdatalength) {
+                /* The result is too short, the CEX2A card may not do that.. */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                BUG_ON(t80h->len > CEX2A_MAX_RESPONSE_SIZE);
+        else
+                BUG_ON(t80h->len > CEX3A_MAX_RESPONSE_SIZE);
+        data = reply->message + t80h->len - outputdatalength;
+        if (copy_to_user(outputdata, data, outputdatalength))
+                return -EFAULT;
+        return 0;
+}
+
+static int convert_response(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            char __user *outputdata,
+                            unsigned int outputdatalength)
+{
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE80_RSP_CODE:
+                return convert_type80(zdev, reply,
+                                      outputdata, outputdatalength);
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_cex2a_receive(struct ap_device *ap_dev,
+                                 struct ap_message *msg,
+                                 struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct type80_hdr *t80h;
+        int length;
+
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t80h = reply->message;
+        if (t80h->type == TYPE80_RSP_CODE) {
+                if (ap_dev->device_type == AP_DEVICE_TYPE_CEX2A)
+                        length = min_t(int,
+                                       CEX2A_MAX_RESPONSE_SIZE, t80h->len);
+                else
+                        length = min_t(int,
+                                       CEX3A_MAX_RESPONSE_SIZE, t80h->len);
+                memcpy(msg->message, reply->message, length);
+        } else
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+out:
+        complete((struct completion *) msg->private);
+}
+
+static atomic_t zcrypt_step = ATOMIC_INIT(0);
+
+/**
+ * The request distributor calls this function if it picked the CEX2A
+ * device to handle a modexpo request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX2A device to the request distributor
+ * @mex: pointer to the modexpo request buffer
+ */
+static long zcrypt_cex2a_modexpo(struct zcrypt_device *zdev,
+                                 struct ica_rsa_modexpo *mex)
+{
+        struct ap_message ap_msg;
+        struct completion work;
+        int rc;
+
+        ap_init_message(&ap_msg);
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                ap_msg.message = kmalloc(MSGTYPE50_CRB2_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        else
+                ap_msg.message = kmalloc(MSGTYPE50_CRB3_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_cex2a_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &work;
+        rc = ICAMEX_msg_to_type50MEX_msg(zdev, &ap_msg, mex);
+        if (rc)
+                goto out_free;
+        init_completion(&work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&work);
+        if (rc == 0)
+                rc = convert_response(zdev, &ap_msg, mex->outputdata,
+                                      mex->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the CEX2A
+ * device to handle a modexpo_crt request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX2A device to the request distributor
+ * @crt: pointer to the modexpoc_crt request buffer
+ */
+static long zcrypt_cex2a_modexpo_crt(struct zcrypt_device *zdev,
+                                     struct ica_rsa_modexpo_crt *crt)
+{
+        struct ap_message ap_msg;
+        struct completion work;
+        int rc;
+
+        ap_init_message(&ap_msg);
+        if (zdev->user_space_type == ZCRYPT_CEX2A)
+                ap_msg.message = kmalloc(MSGTYPE50_CRB2_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        else
+                ap_msg.message = kmalloc(MSGTYPE50_CRB3_MAX_MSG_SIZE,
+                                         GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_cex2a_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &work;
+        rc = ICACRT_msg_to_type50CRT_msg(zdev, &ap_msg, crt);
+        if (rc)
+                goto out_free;
+        init_completion(&work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&work);
+        if (rc == 0)
+                rc = convert_response(zdev, &ap_msg, crt->outputdata,
+                                      crt->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The crypto operations for message type 50.
+ */
+static struct zcrypt_ops zcrypt_msgtype50_ops = {
+        .rsa_modexpo = zcrypt_cex2a_modexpo,
+        .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE50_VARIANT_DEFAULT,
+};
+
+int __init zcrypt_msgtype50_init(void)
+{
+        zcrypt_msgtype_register(&zcrypt_msgtype50_ops);
+        return 0;
+}
+
+void __exit zcrypt_msgtype50_exit(void)
+{
+        zcrypt_msgtype_unregister(&zcrypt_msgtype50_ops);
+}
+
+module_init(zcrypt_msgtype50_init);
+module_exit(zcrypt_msgtype50_exit);
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.h b/drivers/s390/crypto/zcrypt_msgtype50.h
new file mode 100644
index 000000000000..e56dc72c7733
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype50.h
@@ -0,0 +1,39 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _ZCRYPT_MSGTYPE50_H_
+#define _ZCRYPT_MSGTYPE50_H_
+
+#define MSGTYPE50_NAME                  "zcrypt_msgtype50"
+#define MSGTYPE50_VARIANT_DEFAULT       0
+
+#define MSGTYPE50_CRB2_MAX_MSG_SIZE     0x390 /*sizeof(struct type50_crb2_msg)*/
+#define MSGTYPE50_CRB3_MAX_MSG_SIZE     0x710 /*sizeof(struct type50_crb3_msg)*/
+
+int zcrypt_msgtype50_init(void);
+void zcrypt_msgtype50_exit(void);
+
+#endif /* _ZCRYPT_MSGTYPE50_H_ */
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
new file mode 100644
index 000000000000..7d97fa5a26d0
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -0,0 +1,856 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+
+#include "ap_bus.h"
+#include "zcrypt_api.h"
+#include "zcrypt_error.h"
+#include "zcrypt_msgtype6.h"
+#include "zcrypt_cca_key.h"
+
+#define PCIXCC_MIN_MOD_SIZE_OLD  64     /*  512 bits    */
+#define PCIXCC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply      */
+
+#define CEIL4(x) ((((x)+3)/4)*4)
+
+struct response_type {
+        struct completion work;
+        int type;
+};
+#define PCIXCC_RESPONSE_TYPE_ICA  0
+#define PCIXCC_RESPONSE_TYPE_XCRB 1
+
+MODULE_AUTHOR("IBM Corporation");
+MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
+                   "Copyright IBM Corp. 2001, 2012");
+MODULE_LICENSE("GPL");
+
+static void zcrypt_msgtype6_receive(struct ap_device *, struct ap_message *,
+                                 struct ap_message *);
+
+/**
+ * CPRB
+ *        Note that all shorts, ints and longs are little-endian.
+ *        All pointer fields are 32-bits long, and mean nothing
+ *
+ *        A request CPRB is followed by a request_parameter_block.
+ *
+ *        The request (or reply) parameter block is organized thus:
+ *          function code
+ *          VUD block
+ *          key block
+ */
+struct CPRB {
+        unsigned short cprb_len;        /* CPRB length                   */
+        unsigned char cprb_ver_id;      /* CPRB version id.              */
+        unsigned char pad_000;          /* Alignment pad byte.           */
+        unsigned char srpi_rtcode[4];   /* SRPI return code LELONG       */
+        unsigned char srpi_verb;        /* SRPI verb type                */
+        unsigned char flags;            /* flags                         */
+        unsigned char func_id[2];       /* function id                   */
+        unsigned char checkpoint_flag;  /*                               */
+        unsigned char resv2;            /* reserved                      */
+        unsigned short req_parml;       /* request parameter buffer      */
+                                        /* length 16-bit little endian   */
+        unsigned char req_parmp[4];     /* request parameter buffer      *
+                                         * pointer (means nothing: the   *
+                                         * parameter buffer follows      *
+                                         * the CPRB).                    */
+        unsigned char req_datal[4];     /* request data buffer           */
+                                        /* length         ULELONG        */
+        unsigned char req_datap[4];     /* request data buffer           */
+                                        /* pointer                       */
+        unsigned short rpl_parml;       /* reply  parameter buffer       */
+                                        /* length 16-bit little endian   */
+        unsigned char pad_001[2];       /* Alignment pad bytes. ULESHORT */
+        unsigned char rpl_parmp[4];     /* reply parameter buffer        *
+                                         * pointer (means nothing: the   *
+                                         * parameter buffer follows      *
+                                         * the CPRB).                    */
+        unsigned char rpl_datal[4];     /* reply data buffer len ULELONG */
+        unsigned char rpl_datap[4];     /* reply data buffer             */
+                                        /* pointer                       */
+        unsigned short ccp_rscode;      /* server reason code   ULESHORT */
+        unsigned short ccp_rtcode;      /* server return code   ULESHORT */
+        unsigned char repd_parml[2];    /* replied parameter len ULESHORT*/
+        unsigned char mac_data_len[2];  /* Mac Data Length      ULESHORT */
+        unsigned char repd_datal[4];    /* replied data length  ULELONG  */
+        unsigned char req_pc[2];        /* PC identifier                 */
+        unsigned char res_origin[8];    /* resource origin               */
+        unsigned char mac_value[8];     /* Mac Value                     */
+        unsigned char logon_id[8];      /* Logon Identifier              */
+        unsigned char usage_domain[2];  /* cdx                           */
+        unsigned char resv3[18];        /* reserved for requestor        */
+        unsigned short svr_namel;       /* server name length  ULESHORT  */
+        unsigned char svr_name[8];      /* server name                   */
+} __packed;
+
+struct function_and_rules_block {
+        unsigned char function_code[2];
+        unsigned short ulen;
+        unsigned char only_rule[8];
+} __packed;
+
+/**
+ * The following is used to initialize the CPRBX passed to the PCIXCC/CEX2C
+ * card in a type6 message. The 3 fields that must be filled in at execution
+ * time are  req_parml, rpl_parml and usage_domain.
+ * Everything about this interface is ascii/big-endian, since the
+ * device does *not* have 'Intel inside'.
+ *
+ * The CPRBX is followed immediately by the parm block.
+ * The parm block contains:
+ * - function code ('PD' 0x5044 or 'PK' 0x504B)
+ * - rule block (one of:)
+ *   + 0x000A 'PKCS-1.2' (MCL2 'PD')
+ *   + 0x000A 'ZERO-PAD' (MCL2 'PK')
+ *   + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
+ *   + 0x000A 'MRP     ' (MCL3 'PK' or CEX2C 'PK')
+ * - VUD block
+ */
+static struct CPRBX static_cprbx = {
+        .cprb_len       =  0x00DC,
+        .cprb_ver_id    =  0x02,
+        .func_id        = {0x54, 0x32},
+};
+
+/**
+ * Convert a ICAMEX message to a type6 MEX message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @mex: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICAMEX_msg_to_type6MEX_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo *mex)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+                .agent_id       = {'C', 'A',},
+                .function_code  = {'P', 'K'},
+        };
+        static struct function_and_rules_block static_pke_fnr = {
+                .function_code  = {'P', 'K'},
+                .ulen           = 10,
+                .only_rule      = {'M', 'R', 'P', ' ', ' ', ' ', ' ', ' '}
+        };
+        static struct function_and_rules_block static_pke_fnr_MCL2 = {
+                .function_code  = {'P', 'K'},
+                .ulen           = 10,
+                .only_rule      = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                struct function_and_rules_block fr;
+                unsigned short length;
+                char text[0];
+        } __packed * msg = ap_msg->message;
+        int size;
+
+        /* VUD.ciphertext */
+        msg->length = mex->inputdatalength + 2;
+        if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
+                return -EFAULT;
+
+        /* Set up key which is located after the variable length text. */
+        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength, 1);
+        if (size < 0)
+                return size;
+        size += sizeof(*msg) + mex->inputdatalength;
+
+        /* message header, cprbx and f&r */
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.ToCardLen1 = size - sizeof(msg->hdr);
+        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
+
+        msg->cprbx = static_cprbx;
+        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
+        msg->cprbx.rpl_msgbl = msg->hdr.FromCardLen1;
+
+        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
+                static_pke_fnr_MCL2 : static_pke_fnr;
+
+        msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
+
+        ap_msg->length = size;
+        return 0;
+}
+
+/**
+ * Convert a ICACRT message to a type6 CRT message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @crt: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT.
+ */
+static int ICACRT_msg_to_type6CRT_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_rsa_modexpo_crt *crt)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+                .agent_id       = {'C', 'A',},
+                .function_code  = {'P', 'D'},
+        };
+        static struct function_and_rules_block static_pkd_fnr = {
+                .function_code  = {'P', 'D'},
+                .ulen           = 10,
+                .only_rule      = {'Z', 'E', 'R', 'O', '-', 'P', 'A', 'D'}
+        };
+
+        static struct function_and_rules_block static_pkd_fnr_MCL2 = {
+                .function_code  = {'P', 'D'},
+                .ulen           = 10,
+                .only_rule      = {'P', 'K', 'C', 'S', '-', '1', '.', '2'}
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                struct function_and_rules_block fr;
+                unsigned short length;
+                char text[0];
+        } __packed * msg = ap_msg->message;
+        int size;
+
+        /* VUD.ciphertext */
+        msg->length = crt->inputdatalength + 2;
+        if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
+                return -EFAULT;
+
+        /* Set up key which is located after the variable length text. */
+        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength, 1);
+        if (size < 0)
+                return size;
+        size += sizeof(*msg) + crt->inputdatalength;    /* total size of msg */
+
+        /* message header, cprbx and f&r */
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.ToCardLen1 = size -  sizeof(msg->hdr);
+        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
+
+        msg->cprbx = static_cprbx;
+        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
+        msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
+                size - sizeof(msg->hdr) - sizeof(msg->cprbx);
+
+        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
+                static_pkd_fnr_MCL2 : static_pkd_fnr;
+
+        ap_msg->length = size;
+        return 0;
+}
+
+/**
+ * Convert a XCRB message to a type6 CPRB message.
+ *
+ * @zdev: crypto device pointer
+ * @ap_msg: pointer to AP message
+ * @xcRB: pointer to user input data
+ *
+ * Returns 0 on success or -EFAULT, -EINVAL.
+ */
+struct type86_fmt2_msg {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+} __packed;
+
+static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ica_xcRB *xcRB)
+{
+        static struct type6_hdr static_type6_hdrX = {
+                .type           =  0x06,
+                .offset1        =  0x00000058,
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+        } __packed * msg = ap_msg->message;
+
+        int rcblen = CEIL4(xcRB->request_control_blk_length);
+        int replylen;
+        char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
+        char *function_code;
+
+        /* length checks */
+        ap_msg->length = sizeof(struct type6_hdr) +
+                CEIL4(xcRB->request_control_blk_length) +
+                xcRB->request_data_length;
+        if (ap_msg->length > MSGTYPE06_MAX_MSG_SIZE)
+                return -EINVAL;
+        replylen = sizeof(struct type86_fmt2_msg) +
+                CEIL4(xcRB->reply_control_blk_length) +
+                xcRB->reply_data_length;
+        if (replylen > MSGTYPE06_MAX_MSG_SIZE)
+                return -EINVAL;
+
+        /* prepare type6 header */
+        msg->hdr = static_type6_hdrX;
+        memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
+        msg->hdr.ToCardLen1 = xcRB->request_control_blk_length;
+        if (xcRB->request_data_length) {
+                msg->hdr.offset2 = msg->hdr.offset1 + rcblen;
+                msg->hdr.ToCardLen2 = xcRB->request_data_length;
+        }
+        msg->hdr.FromCardLen1 = xcRB->reply_control_blk_length;
+        msg->hdr.FromCardLen2 = xcRB->reply_data_length;
+
+        /* prepare CPRB */
+        if (copy_from_user(&(msg->cprbx), xcRB->request_control_blk_addr,
+                    xcRB->request_control_blk_length))
+                return -EFAULT;
+        if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
+            xcRB->request_control_blk_length)
+                return -EINVAL;
+        function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
+        memcpy(msg->hdr.function_code, function_code,
+               sizeof(msg->hdr.function_code));
+
+        if (memcmp(function_code, "US", 2) == 0)
+                ap_msg->special = 1;
+        else
+                ap_msg->special = 0;
+
+        /* copy data block */
+        if (xcRB->request_data_length &&
+            copy_from_user(req_data, xcRB->request_data_address,
+                xcRB->request_data_length))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Copy results from a type 86 ICA reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @data: pointer to user output data
+ * @length: size of user output data
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+struct type86x_reply {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+        struct CPRBX cprbx;
+        unsigned char pad[4];   /* 4 byte function code/rules block ? */
+        unsigned short length;
+        char text[0];
+} __packed;
+
+static int convert_type86_ica(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char __user *outputdata,
+                          unsigned int outputdatalength)
+{
+        static unsigned char static_pad[] = {
+                0x00, 0x02,
+                0x1B, 0x7B, 0x5D, 0xB5, 0x75, 0x01, 0x3D, 0xFD,
+                0x8D, 0xD1, 0xC7, 0x03, 0x2D, 0x09, 0x23, 0x57,
+                0x89, 0x49, 0xB9, 0x3F, 0xBB, 0x99, 0x41, 0x5B,
+                0x75, 0x21, 0x7B, 0x9D, 0x3B, 0x6B, 0x51, 0x39,
+                0xBB, 0x0D, 0x35, 0xB9, 0x89, 0x0F, 0x93, 0xA5,
+                0x0B, 0x47, 0xF1, 0xD3, 0xBB, 0xCB, 0xF1, 0x9D,
+                0x23, 0x73, 0x71, 0xFF, 0xF3, 0xF5, 0x45, 0xFB,
+                0x61, 0x29, 0x23, 0xFD, 0xF1, 0x29, 0x3F, 0x7F,
+                0x17, 0xB7, 0x1B, 0xA9, 0x19, 0xBD, 0x57, 0xA9,
+                0xD7, 0x95, 0xA3, 0xCB, 0xED, 0x1D, 0xDB, 0x45,
+                0x7D, 0x11, 0xD1, 0x51, 0x1B, 0xED, 0x71, 0xE9,
+                0xB1, 0xD1, 0xAB, 0xAB, 0x21, 0x2B, 0x1B, 0x9F,
+                0x3B, 0x9F, 0xF7, 0xF7, 0xBD, 0x63, 0xEB, 0xAD,
+                0xDF, 0xB3, 0x6F, 0x5B, 0xDB, 0x8D, 0xA9, 0x5D,
+                0xE3, 0x7D, 0x77, 0x49, 0x47, 0xF5, 0xA7, 0xFD,
+                0xAB, 0x2F, 0x27, 0x35, 0x77, 0xD3, 0x49, 0xC9,
+                0x09, 0xEB, 0xB1, 0xF9, 0xBF, 0x4B, 0xCB, 0x2B,
+                0xEB, 0xEB, 0x05, 0xFF, 0x7D, 0xC7, 0x91, 0x8B,
+                0x09, 0x83, 0xB9, 0xB9, 0x69, 0x33, 0x39, 0x6B,
+                0x79, 0x75, 0x19, 0xBF, 0xBB, 0x07, 0x1D, 0xBD,
+                0x29, 0xBF, 0x39, 0x95, 0x93, 0x1D, 0x35, 0xC7,
+                0xC9, 0x4D, 0xE5, 0x97, 0x0B, 0x43, 0x9B, 0xF1,
+                0x16, 0x93, 0x03, 0x1F, 0xA5, 0xFB, 0xDB, 0xF3,
+                0x27, 0x4F, 0x27, 0x61, 0x05, 0x1F, 0xB9, 0x23,
+                0x2F, 0xC3, 0x81, 0xA9, 0x23, 0x71, 0x55, 0x55,
+                0xEB, 0xED, 0x41, 0xE5, 0xF3, 0x11, 0xF1, 0x43,
+                0x69, 0x03, 0xBD, 0x0B, 0x37, 0x0F, 0x51, 0x8F,
+                0x0B, 0xB5, 0x89, 0x5B, 0x67, 0xA9, 0xD9, 0x4F,
+                0x01, 0xF9, 0x21, 0x77, 0x37, 0x73, 0x79, 0xC5,
+                0x7F, 0x51, 0xC1, 0xCF, 0x97, 0xA1, 0x75, 0xAD,
+                0x35, 0x9D, 0xD3, 0xD3, 0xA7, 0x9D, 0x5D, 0x41,
+                0x6F, 0x65, 0x1B, 0xCF, 0xA9, 0x87, 0x91, 0x09
+        };
+        struct type86x_reply *msg = reply->message;
+        unsigned short service_rc, service_rs;
+        unsigned int reply_len, pad_len;
+        char *data;
+
+        service_rc = msg->cprbx.ccp_rtcode;
+        if (unlikely(service_rc != 0)) {
+                service_rs = msg->cprbx.ccp_rscode;
+                if (service_rc == 8 && service_rs == 66)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 65)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 770)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 783) {
+                        zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE_OLD;
+                        return -EAGAIN;
+                }
+                if (service_rc == 12 && service_rs == 769)
+                        return -EINVAL;
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+        data = msg->text;
+        reply_len = msg->length - 2;
+        if (reply_len > outputdatalength)
+                return -EINVAL;
+        /*
+         * For all encipher requests, the length of the ciphertext (reply_len)
+         * will always equal the modulus length. For MEX decipher requests
+         * the output needs to get padded. Minimum pad size is 10.
+         *
+         * Currently, the cases where padding will be added is for:
+         * - PCIXCC_MCL2 using a CRT form token (since PKD didn't support
+         *   ZERO-PAD and CRT is only supported for PKD requests)
+         * - PCICC, always
+         */
+        pad_len = outputdatalength - reply_len;
+        if (pad_len > 0) {
+                if (pad_len < 10)
+                        return -EINVAL;
+                /* 'restore' padding left in the PCICC/PCIXCC card. */
+                if (copy_to_user(outputdata, static_pad, pad_len - 1))
+                        return -EFAULT;
+                if (put_user(0, outputdata + pad_len - 1))
+                        return -EFAULT;
+        }
+        /* Copy the crypto response to user space. */
+        if (copy_to_user(outputdata + pad_len, data, reply_len))
+                return -EFAULT;
+        return 0;
+}
+
+/**
+ * Copy results from a type 86 XCRB reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @xcRB: pointer to XCRB
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+static int convert_type86_xcrb(struct zcrypt_device *zdev,
+                               struct ap_message *reply,
+                               struct ica_xcRB *xcRB)
+{
+        struct type86_fmt2_msg *msg = reply->message;
+        char *data = reply->message;
+
+        /* Copy CPRB to user */
+        if (copy_to_user(xcRB->reply_control_blk_addr,
+                data + msg->fmt2.offset1, msg->fmt2.count1))
+                return -EFAULT;
+        xcRB->reply_control_blk_length = msg->fmt2.count1;
+
+        /* Copy data buffer to user */
+        if (msg->fmt2.count2)
+                if (copy_to_user(xcRB->reply_data_addr,
+                        data + msg->fmt2.offset2, msg->fmt2.count2))
+                        return -EFAULT;
+        xcRB->reply_data_length = msg->fmt2.count2;
+        return 0;
+}
+
+static int convert_type86_rng(struct zcrypt_device *zdev,
+                          struct ap_message *reply,
+                          char *buffer)
+{
+        struct {
+                struct type86_hdr hdr;
+                struct type86_fmt2_ext fmt2;
+                struct CPRBX cprbx;
+        } __packed * msg = reply->message;
+        char *data = reply->message;
+
+        if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
+                return -EINVAL;
+        memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
+        return msg->fmt2.count2;
+}
+
+static int convert_response_ica(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            char __user *outputdata,
+                            unsigned int outputdatalength)
+{
+        struct type86x_reply *msg = reply->message;
+
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->cprbx.ccp_rtcode &&
+                   (msg->cprbx.ccp_rscode == 0x14f) &&
+                   (outputdatalength > 256)) {
+                        if (zdev->max_exp_bit_length <= 17) {
+                                zdev->max_exp_bit_length = 17;
+                                return -EAGAIN;
+                        } else
+                                return -EINVAL;
+                }
+                if (msg->hdr.reply_code)
+                        return convert_error(zdev, reply);
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_ica(zdev, reply,
+                                                  outputdata, outputdatalength);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+static int convert_response_xcrb(struct zcrypt_device *zdev,
+                            struct ap_message *reply,
+                            struct ica_xcRB *xcRB)
+{
+        struct type86x_reply *msg = reply->message;
+
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *) reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code) {
+                        memcpy(&(xcRB->status), msg->fmt2.apfs, sizeof(u32));
+                        return convert_error(zdev, reply);
+                }
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_xcrb(zdev, reply, xcRB);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+static int convert_response_rng(struct zcrypt_device *zdev,
+                                 struct ap_message *reply,
+                                 char *data)
+{
+        struct type86x_reply *msg = reply->message;
+
+        switch (msg->hdr.type) {
+        case TYPE82_RSP_CODE:
+        case TYPE88_RSP_CODE:
+                return -EINVAL;
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code)
+                        return -EINVAL;
+                if (msg->cprbx.cprb_ver_id == 0x02)
+                        return convert_type86_rng(zdev, reply, data);
+                /* Fall through, no break, incorrect cprb version is an unknown
+                 * response */
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
+
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_msgtype6_receive(struct ap_device *ap_dev,
+                                  struct ap_message *msg,
+                                  struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct response_type *resp_type =
+                (struct response_type *) msg->private;
+        struct type86x_reply *t86r;
+        int length;
+
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t86r = reply->message;
+        if (t86r->hdr.type == TYPE86_RSP_CODE &&
+                 t86r->cprbx.cprb_ver_id == 0x02) {
+                switch (resp_type->type) {
+                case PCIXCC_RESPONSE_TYPE_ICA:
+                        length = sizeof(struct type86x_reply)
+                                + t86r->length - 2;
+                        length = min(PCIXCC_MAX_ICA_RESPONSE_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                case PCIXCC_RESPONSE_TYPE_XCRB:
+                        length = t86r->fmt2.offset2 + t86r->fmt2.count2;
+                        length = min(MSGTYPE06_MAX_MSG_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                default:
+                        memcpy(msg->message, &error_reply,
+                               sizeof(error_reply));
+                }
+        } else
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+out:
+        complete(&(resp_type->work));
+}
+
+static atomic_t zcrypt_step = ATOMIC_INIT(0);
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a modexpo request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @mex: pointer to the modexpo request buffer
+ */
+static long zcrypt_msgtype6_modexpo(struct zcrypt_device *zdev,
+                                  struct ica_rsa_modexpo *mex)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_ICA,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = ICAMEX_msg_to_type6MEX_msgX(zdev, &ap_msg, mex);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ica(zdev, &ap_msg, mex->outputdata,
+                                          mex->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        free_page((unsigned long) ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a modexpo_crt request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @crt: pointer to the modexpoc_crt request buffer
+ */
+static long zcrypt_msgtype6_modexpo_crt(struct zcrypt_device *zdev,
+                                      struct ica_rsa_modexpo_crt *crt)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_ICA,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = ICACRT_msg_to_type6CRT_msgX(zdev, &ap_msg, crt);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ica(zdev, &ap_msg, crt->outputdata,
+                                          crt->outputdatalength);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        free_page((unsigned long) ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to handle a send_cprb request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @xcRB: pointer to the send_cprb request buffer
+ */
+static long zcrypt_msgtype6_send_cprb(struct zcrypt_device *zdev,
+                                    struct ica_xcRB *xcRB)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_XCRB,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = XCRB_msg_to_type6CPRB_msgX(zdev, &ap_msg, xcRB);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_xcrb(zdev, &ap_msg, xcRB);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kzfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The request distributor calls this function if it picked the PCIXCC/CEX2C
+ * device to generate random data.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        PCIXCC/CEX2C device to the request distributor
+ * @buffer: pointer to a memory page to return random data
+ */
+
+static long zcrypt_msgtype6_rng(struct zcrypt_device *zdev,
+                                    char *buffer)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_XCRB,
+        };
+        int rc;
+
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rng_type6CPRB_msgX(zdev->ap_dev, &ap_msg, ZCRYPT_RNG_BUFFER_SIZE);
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_rng(zdev, &ap_msg, buffer);
+        else
+                /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+        kfree(ap_msg.message);
+        return rc;
+}
+
+/**
+ * The crypto operations for a PCIXCC/CEX2C card.
+ */
+static struct zcrypt_ops zcrypt_msgtype6_norng_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_NORNG,
+        .rsa_modexpo = zcrypt_msgtype6_modexpo,
+        .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
+        .send_cprb = zcrypt_msgtype6_send_cprb,
+};
+
+static struct zcrypt_ops zcrypt_msgtype6_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_DEFAULT,
+        .rsa_modexpo = zcrypt_msgtype6_modexpo,
+        .rsa_modexpo_crt = zcrypt_msgtype6_modexpo_crt,
+        .send_cprb = zcrypt_msgtype6_send_cprb,
+        .rng = zcrypt_msgtype6_rng,
+};
+
+int __init zcrypt_msgtype6_init(void)
+{
+        zcrypt_msgtype_register(&zcrypt_msgtype6_norng_ops);
+        zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
+        return 0;
+}
+
+void __exit zcrypt_msgtype6_exit(void)
+{
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_norng_ops);
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
+}
+
+module_init(zcrypt_msgtype6_init);
+module_exit(zcrypt_msgtype6_exit);
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.h b/drivers/s390/crypto/zcrypt_msgtype6.h
new file mode 100644
index 000000000000..1e500d3c0735
--- /dev/null
+++ b/drivers/s390/crypto/zcrypt_msgtype6.h
@@ -0,0 +1,169 @@
+/*
+ *  zcrypt 2.1.0
+ *
+ *  Copyright IBM Corp. 2001, 2012
+ *  Author(s): Robert Burroughs
+ *             Eric Rossman (edrossma@us.ibm.com)
+ *
+ *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
+ *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _ZCRYPT_MSGTYPE6_H_
+#define _ZCRYPT_MSGTYPE6_H_
+
+#include <asm/zcrypt.h>
+
+#define MSGTYPE06_NAME                  "zcrypt_msgtype6"
+#define MSGTYPE06_VARIANT_DEFAULT       0
+#define MSGTYPE06_VARIANT_NORNG         1
+
+#define MSGTYPE06_MAX_MSG_SIZE          (12*1024)
+
+/**
+ * The type 6 message family is associated with PCICC or PCIXCC cards.
+ *
+ * It contains a message header followed by a CPRB, both of which
+ * are described below.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type6_hdr {
+        unsigned char reserved1;        /* 0x00                         */
+        unsigned char type;             /* 0x06                         */
+        unsigned char reserved2[2];     /* 0x0000                       */
+        unsigned char right[4];         /* 0x00000000                   */
+        unsigned char reserved3[2];     /* 0x0000                       */
+        unsigned char reserved4[2];     /* 0x0000                       */
+        unsigned char apfs[4];          /* 0x00000000                   */
+        unsigned int  offset1;          /* 0x00000058 (offset to CPRB)  */
+        unsigned int  offset2;          /* 0x00000000                   */
+        unsigned int  offset3;          /* 0x00000000                   */
+        unsigned int  offset4;          /* 0x00000000                   */
+        unsigned char agent_id[16];     /* PCICC:                       */
+                                        /*    0x0100                    */
+                                        /*    0x4343412d4150504c202020  */
+                                        /*    0x010101                  */
+                                        /* PCIXCC:                      */
+                                        /*    0x4341000000000000        */
+                                        /*    0x0000000000000000        */
+        unsigned char rqid[2];          /* rqid.  internal to 603       */
+        unsigned char reserved5[2];     /* 0x0000                       */
+        unsigned char function_code[2]; /* for PKD, 0x5044 (ascii 'PD') */
+        unsigned char reserved6[2];     /* 0x0000                       */
+        unsigned int  ToCardLen1;       /* (request CPRB len + 3) & -4  */
+        unsigned int  ToCardLen2;       /* db len 0x00000000 for PKD    */
+        unsigned int  ToCardLen3;       /* 0x00000000                   */
+        unsigned int  ToCardLen4;       /* 0x00000000                   */
+        unsigned int  FromCardLen1;     /* response buffer length       */
+        unsigned int  FromCardLen2;     /* db len 0x00000000 for PKD    */
+        unsigned int  FromCardLen3;     /* 0x00000000                   */
+        unsigned int  FromCardLen4;     /* 0x00000000                   */
+} __packed;
+
+/**
+ * The type 86 message family is associated with PCICC and PCIXCC cards.
+ *
+ * It contains a message header followed by a CPRB.  The CPRB is
+ * the same as the request CPRB, which is described above.
+ *
+ * If format is 1, an error condition exists and no data beyond
+ * the 8-byte message header is of interest.
+ *
+ * The non-error message is shown below.
+ *
+ * Note that all reserved fields must be zeroes.
+ */
+struct type86_hdr {
+        unsigned char reserved1;        /* 0x00                         */
+        unsigned char type;             /* 0x86                         */
+        unsigned char format;           /* 0x01 (error) or 0x02 (ok)    */
+        unsigned char reserved2;        /* 0x00                         */
+        unsigned char reply_code;       /* reply code (see above)       */
+        unsigned char reserved3[3];     /* 0x000000                     */
+} __packed;
+
+#define TYPE86_RSP_CODE 0x86
+#define TYPE86_FMT2     0x02
+
+struct type86_fmt2_ext {
+        unsigned char     reserved[4];  /* 0x00000000                   */
+        unsigned char     apfs[4];      /* final status                 */
+        unsigned int      count1;       /* length of CPRB + parameters  */
+        unsigned int      offset1;      /* offset to CPRB               */
+        unsigned int      count2;       /* 0x00000000                   */
+        unsigned int      offset2;      /* db offset 0x00000000 for PKD */
+        unsigned int      count3;       /* 0x00000000                   */
+        unsigned int      offset3;      /* 0x00000000                   */
+        unsigned int      count4;       /* 0x00000000                   */
+        unsigned int      offset4;      /* 0x00000000                   */
+} __packed;
+
+/**
+ * Prepare a type6 CPRB message for random number generation
+ *
+ * @ap_dev: AP device pointer
+ * @ap_msg: pointer to AP message
+ */
+static inline void rng_type6CPRB_msgX(struct ap_device *ap_dev,
+                               struct ap_message *ap_msg,
+                               unsigned random_number_length)
+{
+        struct {
+                struct type6_hdr hdr;
+                struct CPRBX cprbx;
+                char function_code[2];
+                short int rule_length;
+                char rule[8];
+                short int verb_length;
+                short int key_length;
+        } __packed * msg = ap_msg->message;
+        static struct type6_hdr static_type6_hdrX = {
+                .type           = 0x06,
+                .offset1        = 0x00000058,
+                .agent_id       = {'C', 'A'},
+                .function_code  = {'R', 'L'},
+                .ToCardLen1     = sizeof(*msg) - sizeof(msg->hdr),
+                .FromCardLen1   = sizeof(*msg) - sizeof(msg->hdr),
+        };
+        static struct CPRBX local_cprbx = {
+                .cprb_len       = 0x00dc,
+                .cprb_ver_id    = 0x02,
+                .func_id        = {0x54, 0x32},
+                .req_parml      = sizeof(*msg) - sizeof(msg->hdr) -
+                                  sizeof(msg->cprbx),
+                .rpl_msgbl      = sizeof(*msg) - sizeof(msg->hdr),
+        };
+
+        msg->hdr = static_type6_hdrX;
+        msg->hdr.FromCardLen2 = random_number_length,
+        msg->cprbx = local_cprbx;
+        msg->cprbx.rpl_datal = random_number_length,
+        msg->cprbx.domain = AP_QID_QUEUE(ap_dev->qid);
+        memcpy(msg->function_code, msg->hdr.function_code, 0x02);
+        msg->rule_length = 0x0a;
+        memcpy(msg->rule, "RANDOM  ", 8);
+        msg->verb_length = 0x02;
+        msg->key_length = 0x02;
+        ap_msg->length = sizeof(*msg);
+}
+
+int zcrypt_msgtype6_init(void);
+void zcrypt_msgtype6_exit(void);
+
+#endif /* _ZCRYPT_MSGTYPE6_H_ */
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
index ccb4f8b60c75..c7275e303a0d 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.c
+++ b/drivers/s390/crypto/zcrypt_pcixcc.c
@@ -1,13 +1,14 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
  *                                Ralph Wuerthner <rwuerthn@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,9 +36,10 @@
 #include "ap_bus.h"
 #include "zcrypt_api.h"
 #include "zcrypt_error.h"
-#include "zcrypt_pcicc.h"
+#include "zcrypt_msgtype6.h"
 #include "zcrypt_pcixcc.h"
 #include "zcrypt_cca_key.h"
+#include "zcrypt_msgtype6.h"
 
 #define PCIXCC_MIN_MOD_SIZE      16     /*  128 bits    */
 #define PCIXCC_MIN_MOD_SIZE_OLD  64     /*  512 bits    */
@@ -75,14 +77,12 @@ static struct ap_device_id zcrypt_pcixcc_ids[] = {
 
 MODULE_DEVICE_TABLE(ap, zcrypt_pcixcc_ids);
 MODULE_AUTHOR("IBM Corporation");
-MODULE_DESCRIPTION("PCIXCC Cryptographic Coprocessor device driver, "
-                   "Copyright IBM Corp. 2001, 2006");
+MODULE_DESCRIPTION("PCIXCC Cryptographic Coprocessor device driver, " \
+                   "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
 static int zcrypt_pcixcc_probe(struct ap_device *ap_dev);
 static void zcrypt_pcixcc_remove(struct ap_device *ap_dev);
-static void zcrypt_pcixcc_receive(struct ap_device *, struct ap_message *,
-                                 struct ap_message *);
 
 static struct ap_driver zcrypt_pcixcc_driver = {
         .probe = zcrypt_pcixcc_probe,
@@ -92,766 +92,6 @@ static struct ap_driver zcrypt_pcixcc_driver = {
 };
 
 /**
- * The following is used to initialize the CPRBX passed to the PCIXCC/CEX2C
- * card in a type6 message. The 3 fields that must be filled in at execution
- * time are  req_parml, rpl_parml and usage_domain.
- * Everything about this interface is ascii/big-endian, since the
- * device does *not* have 'Intel inside'.
- *
- * The CPRBX is followed immediately by the parm block.
- * The parm block contains:
- * - function code ('PD' 0x5044 or 'PK' 0x504B)
- * - rule block (one of:)
- *   + 0x000A 'PKCS-1.2' (MCL2 'PD')
- *   + 0x000A 'ZERO-PAD' (MCL2 'PK')
- *   + 0x000A 'ZERO-PAD' (MCL3 'PD' or CEX2C 'PD')
- *   + 0x000A 'MRP     ' (MCL3 'PK' or CEX2C 'PK')
- * - VUD block
- */
-static struct CPRBX static_cprbx = {
-        .cprb_len       =  0x00DC,
-        .cprb_ver_id    =  0x02,
-        .func_id        = {0x54,0x32},
-};
-
-/**
- * Convert a ICAMEX message to a type6 MEX message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @mex: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICAMEX_msg_to_type6MEX_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo *mex)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-                .agent_id       = {'C','A',},
-                .function_code  = {'P','K'},
-        };
-        static struct function_and_rules_block static_pke_fnr = {
-                .function_code  = {'P','K'},
-                .ulen           = 10,
-                .only_rule      = {'M','R','P',' ',' ',' ',' ',' '}
-        };
-        static struct function_and_rules_block static_pke_fnr_MCL2 = {
-                .function_code  = {'P','K'},
-                .ulen           = 10,
-                .only_rule      = {'Z','E','R','O','-','P','A','D'}
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                struct function_and_rules_block fr;
-                unsigned short length;
-                char text[0];
-        } __attribute__((packed)) *msg = ap_msg->message;
-        int size;
-
-        /* VUD.ciphertext */
-        msg->length = mex->inputdatalength + 2;
-        if (copy_from_user(msg->text, mex->inputdata, mex->inputdatalength))
-                return -EFAULT;
-
-        /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength, 1);
-        if (size < 0)
-                return size;
-        size += sizeof(*msg) + mex->inputdatalength;
-
-        /* message header, cprbx and f&r */
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.ToCardLen1 = size - sizeof(msg->hdr);
-        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
-
-        msg->cprbx = static_cprbx;
-        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
-        msg->cprbx.rpl_msgbl = msg->hdr.FromCardLen1;
-
-        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
-                static_pke_fnr_MCL2 : static_pke_fnr;
-
-        msg->cprbx.req_parml = size - sizeof(msg->hdr) - sizeof(msg->cprbx);
-
-        ap_msg->length = size;
-        return 0;
-}
-
-/**
- * Convert a ICACRT message to a type6 CRT message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @crt: pointer to user input data
- *
- * Returns 0 on success or -EFAULT.
- */
-static int ICACRT_msg_to_type6CRT_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_rsa_modexpo_crt *crt)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-                .agent_id       = {'C','A',},
-                .function_code  = {'P','D'},
-        };
-        static struct function_and_rules_block static_pkd_fnr = {
-                .function_code  = {'P','D'},
-                .ulen           = 10,
-                .only_rule      = {'Z','E','R','O','-','P','A','D'}
-        };
-
-        static struct function_and_rules_block static_pkd_fnr_MCL2 = {
-                .function_code  = {'P','D'},
-                .ulen           = 10,
-                .only_rule      = {'P','K','C','S','-','1','.','2'}
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                struct function_and_rules_block fr;
-                unsigned short length;
-                char text[0];
-        } __attribute__((packed)) *msg = ap_msg->message;
-        int size;
-
-        /* VUD.ciphertext */
-        msg->length = crt->inputdatalength + 2;
-        if (copy_from_user(msg->text, crt->inputdata, crt->inputdatalength))
-                return -EFAULT;
-
-        /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength, 1);
-        if (size < 0)
-                return size;
-        size += sizeof(*msg) + crt->inputdatalength;    /* total size of msg */
-
-        /* message header, cprbx and f&r */
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.ToCardLen1 = size -  sizeof(msg->hdr);
-        msg->hdr.FromCardLen1 = PCIXCC_MAX_ICA_RESPONSE_SIZE - sizeof(msg->hdr);
-
-        msg->cprbx = static_cprbx;
-        msg->cprbx.domain = AP_QID_QUEUE(zdev->ap_dev->qid);
-        msg->cprbx.req_parml = msg->cprbx.rpl_msgbl =
-                size - sizeof(msg->hdr) - sizeof(msg->cprbx);
-
-        msg->fr = (zdev->user_space_type == ZCRYPT_PCIXCC_MCL2) ?
-                static_pkd_fnr_MCL2 : static_pkd_fnr;
-
-        ap_msg->length = size;
-        return 0;
-}
-
-/**
- * Convert a XCRB message to a type6 CPRB message.
- *
- * @zdev: crypto device pointer
- * @ap_msg: pointer to AP message
- * @xcRB: pointer to user input data
- *
- * Returns 0 on success or -EFAULT, -EINVAL.
- */
-struct type86_fmt2_msg {
-        struct type86_hdr hdr;
-        struct type86_fmt2_ext fmt2;
-} __attribute__((packed));
-
-static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
-                                       struct ap_message *ap_msg,
-                                       struct ica_xcRB *xcRB)
-{
-        static struct type6_hdr static_type6_hdrX = {
-                .type           =  0x06,
-                .offset1        =  0x00000058,
-        };
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-        } __attribute__((packed)) *msg = ap_msg->message;
-
-        int rcblen = CEIL4(xcRB->request_control_blk_length);
-        int replylen;
-        char *req_data = ap_msg->message + sizeof(struct type6_hdr) + rcblen;
-        char *function_code;
-
-        /* length checks */
-        ap_msg->length = sizeof(struct type6_hdr) +
-                CEIL4(xcRB->request_control_blk_length) +
-                xcRB->request_data_length;
-        if (ap_msg->length > PCIXCC_MAX_XCRB_MESSAGE_SIZE)
-                return -EINVAL;
-        replylen = sizeof(struct type86_fmt2_msg) +
-                CEIL4(xcRB->reply_control_blk_length) +
-                xcRB->reply_data_length;
-        if (replylen > PCIXCC_MAX_XCRB_MESSAGE_SIZE)
-                return -EINVAL;
-
-        /* prepare type6 header */
-        msg->hdr = static_type6_hdrX;
-        memcpy(msg->hdr.agent_id , &(xcRB->agent_ID), sizeof(xcRB->agent_ID));
-        msg->hdr.ToCardLen1 = xcRB->request_control_blk_length;
-        if (xcRB->request_data_length) {
-                msg->hdr.offset2 = msg->hdr.offset1 + rcblen;
-                msg->hdr.ToCardLen2 = xcRB->request_data_length;
-        }
-        msg->hdr.FromCardLen1 = xcRB->reply_control_blk_length;
-        msg->hdr.FromCardLen2 = xcRB->reply_data_length;
-
-        /* prepare CPRB */
-        if (copy_from_user(&(msg->cprbx), xcRB->request_control_blk_addr,
-                    xcRB->request_control_blk_length))
-                return -EFAULT;
-        if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
-            xcRB->request_control_blk_length)
-                return -EINVAL;
-        function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
-        memcpy(msg->hdr.function_code, function_code, sizeof(msg->hdr.function_code));
-
-        if (memcmp(function_code, "US", 2) == 0)
-                ap_msg->special = 1;
-        else
-                ap_msg->special = 0;
-
-        /* copy data block */
-        if (xcRB->request_data_length &&
-            copy_from_user(req_data, xcRB->request_data_address,
-                xcRB->request_data_length))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Prepare a type6 CPRB message for random number generation
- *
- * @ap_dev: AP device pointer
- * @ap_msg: pointer to AP message
- */
-static void rng_type6CPRB_msgX(struct ap_device *ap_dev,
-                               struct ap_message *ap_msg,
-                               unsigned random_number_length)
-{
-        struct {
-                struct type6_hdr hdr;
-                struct CPRBX cprbx;
-                char function_code[2];
-                short int rule_length;
-                char rule[8];
-                short int verb_length;
-                short int key_length;
-        } __attribute__((packed)) *msg = ap_msg->message;
-        static struct type6_hdr static_type6_hdrX = {
-                .type           = 0x06,
-                .offset1        = 0x00000058,
-                .agent_id       = {'C', 'A'},
-                .function_code  = {'R', 'L'},
-                .ToCardLen1     = sizeof *msg - sizeof(msg->hdr),
-                .FromCardLen1   = sizeof *msg - sizeof(msg->hdr),
-        };
-        static struct CPRBX local_cprbx = {
-                .cprb_len       = 0x00dc,
-                .cprb_ver_id    = 0x02,
-                .func_id        = {0x54, 0x32},
-                .req_parml      = sizeof *msg - sizeof(msg->hdr) -
-                                  sizeof(msg->cprbx),
-                .rpl_msgbl      = sizeof *msg - sizeof(msg->hdr),
-        };
-
-        msg->hdr = static_type6_hdrX;
-        msg->hdr.FromCardLen2 = random_number_length,
-        msg->cprbx = local_cprbx;
-        msg->cprbx.rpl_datal = random_number_length,
-        msg->cprbx.domain = AP_QID_QUEUE(ap_dev->qid);
-        memcpy(msg->function_code, msg->hdr.function_code, 0x02);
-        msg->rule_length = 0x0a;
-        memcpy(msg->rule, "RANDOM  ", 8);
-        msg->verb_length = 0x02;
-        msg->key_length = 0x02;
-        ap_msg->length = sizeof *msg;
-}
-
-/**
- * Copy results from a type 86 ICA reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @data: pointer to user output data
- * @length: size of user output data
- *
- * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
- */
-struct type86x_reply {
-        struct type86_hdr hdr;
-        struct type86_fmt2_ext fmt2;
-        struct CPRBX cprbx;
-        unsigned char pad[4];   /* 4 byte function code/rules block ? */
-        unsigned short length;
-        char text[0];
-} __attribute__((packed));
-
-static int convert_type86_ica(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char __user *outputdata,
-                          unsigned int outputdatalength)
-{
-        static unsigned char static_pad[] = {
-                0x00,0x02,
-                0x1B,0x7B,0x5D,0xB5,0x75,0x01,0x3D,0xFD,
-                0x8D,0xD1,0xC7,0x03,0x2D,0x09,0x23,0x57,
-                0x89,0x49,0xB9,0x3F,0xBB,0x99,0x41,0x5B,
-                0x75,0x21,0x7B,0x9D,0x3B,0x6B,0x51,0x39,
-                0xBB,0x0D,0x35,0xB9,0x89,0x0F,0x93,0xA5,
-                0x0B,0x47,0xF1,0xD3,0xBB,0xCB,0xF1,0x9D,
-                0x23,0x73,0x71,0xFF,0xF3,0xF5,0x45,0xFB,
-                0x61,0x29,0x23,0xFD,0xF1,0x29,0x3F,0x7F,
-                0x17,0xB7,0x1B,0xA9,0x19,0xBD,0x57,0xA9,
-                0xD7,0x95,0xA3,0xCB,0xED,0x1D,0xDB,0x45,
-                0x7D,0x11,0xD1,0x51,0x1B,0xED,0x71,0xE9,
-                0xB1,0xD1,0xAB,0xAB,0x21,0x2B,0x1B,0x9F,
-                0x3B,0x9F,0xF7,0xF7,0xBD,0x63,0xEB,0xAD,
-                0xDF,0xB3,0x6F,0x5B,0xDB,0x8D,0xA9,0x5D,
-                0xE3,0x7D,0x77,0x49,0x47,0xF5,0xA7,0xFD,
-                0xAB,0x2F,0x27,0x35,0x77,0xD3,0x49,0xC9,
-                0x09,0xEB,0xB1,0xF9,0xBF,0x4B,0xCB,0x2B,
-                0xEB,0xEB,0x05,0xFF,0x7D,0xC7,0x91,0x8B,
-                0x09,0x83,0xB9,0xB9,0x69,0x33,0x39,0x6B,
-                0x79,0x75,0x19,0xBF,0xBB,0x07,0x1D,0xBD,
-                0x29,0xBF,0x39,0x95,0x93,0x1D,0x35,0xC7,
-                0xC9,0x4D,0xE5,0x97,0x0B,0x43,0x9B,0xF1,
-                0x16,0x93,0x03,0x1F,0xA5,0xFB,0xDB,0xF3,
-                0x27,0x4F,0x27,0x61,0x05,0x1F,0xB9,0x23,
-                0x2F,0xC3,0x81,0xA9,0x23,0x71,0x55,0x55,
-                0xEB,0xED,0x41,0xE5,0xF3,0x11,0xF1,0x43,
-                0x69,0x03,0xBD,0x0B,0x37,0x0F,0x51,0x8F,
-                0x0B,0xB5,0x89,0x5B,0x67,0xA9,0xD9,0x4F,
-                0x01,0xF9,0x21,0x77,0x37,0x73,0x79,0xC5,
-                0x7F,0x51,0xC1,0xCF,0x97,0xA1,0x75,0xAD,
-                0x35,0x9D,0xD3,0xD3,0xA7,0x9D,0x5D,0x41,
-                0x6F,0x65,0x1B,0xCF,0xA9,0x87,0x91,0x09
-        };
-        struct type86x_reply *msg = reply->message;
-        unsigned short service_rc, service_rs;
-        unsigned int reply_len, pad_len;
-        char *data;
-
-        service_rc = msg->cprbx.ccp_rtcode;
-        if (unlikely(service_rc != 0)) {
-                service_rs = msg->cprbx.ccp_rscode;
-                if (service_rc == 8 && service_rs == 66)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 65)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 770)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 783) {
-                        zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE_OLD;
-                        return -EAGAIN;
-                }
-                if (service_rc == 12 && service_rs == 769)
-                        return -EINVAL;
-                if (service_rc == 8 && service_rs == 72)
-                        return -EINVAL;
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-        data = msg->text;
-        reply_len = msg->length - 2;
-        if (reply_len > outputdatalength)
-                return -EINVAL;
-        /*
-         * For all encipher requests, the length of the ciphertext (reply_len)
-         * will always equal the modulus length. For MEX decipher requests
-         * the output needs to get padded. Minimum pad size is 10.
-         *
-         * Currently, the cases where padding will be added is for:
-         * - PCIXCC_MCL2 using a CRT form token (since PKD didn't support
-         *   ZERO-PAD and CRT is only supported for PKD requests)
-         * - PCICC, always
-         */
-        pad_len = outputdatalength - reply_len;
-        if (pad_len > 0) {
-                if (pad_len < 10)
-                        return -EINVAL;
-                /* 'restore' padding left in the PCICC/PCIXCC card. */
-                if (copy_to_user(outputdata, static_pad, pad_len - 1))
-                        return -EFAULT;
-                if (put_user(0, outputdata + pad_len - 1))
-                        return -EFAULT;
-        }
-        /* Copy the crypto response to user space. */
-        if (copy_to_user(outputdata + pad_len, data, reply_len))
-                return -EFAULT;
-        return 0;
-}
-
-/**
- * Copy results from a type 86 XCRB reply message back to user space.
- *
- * @zdev: crypto device pointer
- * @reply: reply AP message.
- * @xcRB: pointer to XCRB
- *
- * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
- */
-static int convert_type86_xcrb(struct zcrypt_device *zdev,
-                               struct ap_message *reply,
-                               struct ica_xcRB *xcRB)
-{
-        struct type86_fmt2_msg *msg = reply->message;
-        char *data = reply->message;
-
-        /* Copy CPRB to user */
-        if (copy_to_user(xcRB->reply_control_blk_addr,
-                data + msg->fmt2.offset1, msg->fmt2.count1))
-                return -EFAULT;
-        xcRB->reply_control_blk_length = msg->fmt2.count1;
-
-        /* Copy data buffer to user */
-        if (msg->fmt2.count2)
-                if (copy_to_user(xcRB->reply_data_addr,
-                        data + msg->fmt2.offset2, msg->fmt2.count2))
-                        return -EFAULT;
-        xcRB->reply_data_length = msg->fmt2.count2;
-        return 0;
-}
-
-static int convert_type86_rng(struct zcrypt_device *zdev,
-                          struct ap_message *reply,
-                          char *buffer)
-{
-        struct {
-                struct type86_hdr hdr;
-                struct type86_fmt2_ext fmt2;
-                struct CPRBX cprbx;
-        } __attribute__((packed)) *msg = reply->message;
-        char *data = reply->message;
-
-        if (msg->cprbx.ccp_rtcode != 0 || msg->cprbx.ccp_rscode != 0)
-                return -EINVAL;
-        memcpy(buffer, data + msg->fmt2.offset2, msg->fmt2.count2);
-        return msg->fmt2.count2;
-}
-
-static int convert_response_ica(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            char __user *outputdata,
-                            unsigned int outputdatalength)
-{
-        struct type86x_reply *msg = reply->message;
-
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return convert_error(zdev, reply);
-        case TYPE86_RSP_CODE:
-                if (msg->cprbx.ccp_rtcode &&
-                   (msg->cprbx.ccp_rscode == 0x14f) &&
-                   (outputdatalength > 256)) {
-                        if (zdev->max_exp_bit_length <= 17) {
-                                zdev->max_exp_bit_length = 17;
-                                return -EAGAIN;
-                        } else
-                                return -EINVAL;
-                }
-                if (msg->hdr.reply_code)
-                        return convert_error(zdev, reply);
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_ica(zdev, reply,
-                                                  outputdata, outputdatalength);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-static int convert_response_xcrb(struct zcrypt_device *zdev,
-                            struct ap_message *reply,
-                            struct ica_xcRB *xcRB)
-{
-        struct type86x_reply *msg = reply->message;
-
-        /* Response type byte is the second byte in the response. */
-        switch (((unsigned char *) reply->message)[1]) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
-                return convert_error(zdev, reply);
-        case TYPE86_RSP_CODE:
-                if (msg->hdr.reply_code) {
-                        memcpy(&(xcRB->status), msg->fmt2.apfs, sizeof(u32));
-                        return convert_error(zdev, reply);
-                }
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_xcrb(zdev, reply, xcRB);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-static int convert_response_rng(struct zcrypt_device *zdev,
-                                 struct ap_message *reply,
-                                 char *data)
-{
-        struct type86x_reply *msg = reply->message;
-
-        switch (msg->hdr.type) {
-        case TYPE82_RSP_CODE:
-        case TYPE88_RSP_CODE:
-                return -EINVAL;
-        case TYPE86_RSP_CODE:
-                if (msg->hdr.reply_code)
-                        return -EINVAL;
-                if (msg->cprbx.cprb_ver_id == 0x02)
-                        return convert_type86_rng(zdev, reply, data);
-                /* Fall through, no break, incorrect cprb version is an unknown
-                 * response */
-        default: /* Unknown response type, this should NEVER EVER happen */
-                zdev->online = 0;
-                return -EAGAIN; /* repeat the request on a different device. */
-        }
-}
-
-/**
- * This function is called from the AP bus code after a crypto request
- * "msg" has finished with the reply message "reply".
- * It is called from tasklet context.
- * @ap_dev: pointer to the AP device
- * @msg: pointer to the AP message
- * @reply: pointer to the AP reply message
- */
-static void zcrypt_pcixcc_receive(struct ap_device *ap_dev,
-                                  struct ap_message *msg,
-                                  struct ap_message *reply)
-{
-        static struct error_hdr error_reply = {
-                .type = TYPE82_RSP_CODE,
-                .reply_code = REP82_ERROR_MACHINE_FAILURE,
-        };
-        struct response_type *resp_type =
-                (struct response_type *) msg->private;
-        struct type86x_reply *t86r;
-        int length;
-
-        /* Copy the reply message to the request message buffer. */
-        if (IS_ERR(reply)) {
-                memcpy(msg->message, &error_reply, sizeof(error_reply));
-                goto out;
-        }
-        t86r = reply->message;
-        if (t86r->hdr.type == TYPE86_RSP_CODE &&
-                 t86r->cprbx.cprb_ver_id == 0x02) {
-                switch (resp_type->type) {
-                case PCIXCC_RESPONSE_TYPE_ICA:
-                        length = sizeof(struct type86x_reply)
-                                + t86r->length - 2;
-                        length = min(PCIXCC_MAX_ICA_RESPONSE_SIZE, length);
-                        memcpy(msg->message, reply->message, length);
-                        break;
-                case PCIXCC_RESPONSE_TYPE_XCRB:
-                        length = t86r->fmt2.offset2 + t86r->fmt2.count2;
-                        length = min(PCIXCC_MAX_XCRB_MESSAGE_SIZE, length);
-                        memcpy(msg->message, reply->message, length);
-                        break;
-                default:
-                        memcpy(msg->message, &error_reply, sizeof error_reply);
-                }
-        } else
-                memcpy(msg->message, reply->message, sizeof error_reply);
-out:
-        complete(&(resp_type->work));
-}
-
-static atomic_t zcrypt_step = ATOMIC_INIT(0);
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a modexpo request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @mex: pointer to the modexpo request buffer
- */
-static long zcrypt_pcixcc_modexpo(struct zcrypt_device *zdev,
-                                  struct ica_rsa_modexpo *mex)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_ICA,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = ICAMEX_msg_to_type6MEX_msgX(zdev, &ap_msg, mex);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_ica(zdev, &ap_msg, mex->outputdata,
-                                          mex->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        free_page((unsigned long) ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a modexpo_crt request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @crt: pointer to the modexpoc_crt request buffer
- */
-static long zcrypt_pcixcc_modexpo_crt(struct zcrypt_device *zdev,
-                                      struct ica_rsa_modexpo_crt *crt)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_ICA,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = ICACRT_msg_to_type6CRT_msgX(zdev, &ap_msg, crt);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_ica(zdev, &ap_msg, crt->outputdata,
-                                          crt->outputdatalength);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        free_page((unsigned long) ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to handle a send_cprb request.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @xcRB: pointer to the send_cprb request buffer
- */
-static long zcrypt_pcixcc_send_cprb(struct zcrypt_device *zdev,
-                                    struct ica_xcRB *xcRB)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_XCRB,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rc = XCRB_msg_to_type6CPRB_msgX(zdev, &ap_msg, xcRB);
-        if (rc)
-                goto out_free;
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_xcrb(zdev, &ap_msg, xcRB);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-out_free:
-        kzfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The request distributor calls this function if it picked the PCIXCC/CEX2C
- * device to generate random data.
- * @zdev: pointer to zcrypt_device structure that identifies the
- *        PCIXCC/CEX2C device to the request distributor
- * @buffer: pointer to a memory page to return random data
- */
-
-static long zcrypt_pcixcc_rng(struct zcrypt_device *zdev,
-                                    char *buffer)
-{
-        struct ap_message ap_msg;
-        struct response_type resp_type = {
-                .type = PCIXCC_RESPONSE_TYPE_XCRB,
-        };
-        int rc;
-
-        ap_init_message(&ap_msg);
-        ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
-        if (!ap_msg.message)
-                return -ENOMEM;
-        ap_msg.receive = zcrypt_pcixcc_receive;
-        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
-                                atomic_inc_return(&zcrypt_step);
-        ap_msg.private = &resp_type;
-        rng_type6CPRB_msgX(zdev->ap_dev, &ap_msg, ZCRYPT_RNG_BUFFER_SIZE);
-        init_completion(&resp_type.work);
-        ap_queue_message(zdev->ap_dev, &ap_msg);
-        rc = wait_for_completion_interruptible(&resp_type.work);
-        if (rc == 0)
-                rc = convert_response_rng(zdev, &ap_msg, buffer);
-        else
-                /* Signal pending. */
-                ap_cancel_message(zdev->ap_dev, &ap_msg);
-        kfree(ap_msg.message);
-        return rc;
-}
-
-/**
- * The crypto operations for a PCIXCC/CEX2C card.
- */
-static struct zcrypt_ops zcrypt_pcixcc_ops = {
-        .rsa_modexpo = zcrypt_pcixcc_modexpo,
-        .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
-        .send_cprb = zcrypt_pcixcc_send_cprb,
-};
-
-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
-        .rsa_modexpo = zcrypt_pcixcc_modexpo,
-        .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
-        .send_cprb = zcrypt_pcixcc_send_cprb,
-        .rng = zcrypt_pcixcc_rng,
-};
-
-/**
  * Micro-code detection function. Its sends a message to a pcixcc card
  * to find out the microcode level.
  * @ap_dev: pointer to the AP device.
@@ -1083,9 +323,11 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
                 return rc;
         }
         if (rc)
-                zdev->ops = &zcrypt_pcixcc_with_rng_ops;
+                zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                   MSGTYPE06_VARIANT_DEFAULT);
         else
-                zdev->ops = &zcrypt_pcixcc_ops;
+                zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                   MSGTYPE06_VARIANT_NORNG);
         ap_dev->reply = &zdev->reply;
         ap_dev->private = zdev;
         rc = zcrypt_device_register(zdev);
@@ -1095,6 +337,7 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 
  out_free:
         ap_dev->private = NULL;
+        zcrypt_msgtype_release(zdev->ops);
         zcrypt_device_free(zdev);
         return rc;
 }
@@ -1106,8 +349,10 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 static void zcrypt_pcixcc_remove(struct ap_device *ap_dev)
 {
         struct zcrypt_device *zdev = ap_dev->private;
+        struct zcrypt_ops *zops = zdev->ops;
 
         zcrypt_device_unregister(zdev);
+        zcrypt_msgtype_release(zops);
 }
 
 int __init zcrypt_pcixcc_init(void)
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.h b/drivers/s390/crypto/zcrypt_pcixcc.h
index c7cdf599e46b..eacafc8962f2 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.h
+++ b/drivers/s390/crypto/zcrypt_pcixcc.h
@@ -1,12 +1,13 @@
 /*
  *  zcrypt 2.1.0
  *
- *  Copyright IBM Corp. 2001, 2006
+ *  Copyright IBM Corp. 2001, 2012
  *  Author(s): Robert Burroughs
  *             Eric Rossman (edrossma@us.ibm.com)
  *
  *  Hotplug & misc device support: Jochen Roehrig (roehrig@de.ibm.com)
  *  Major cleanup & driver split: Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *  MSGTYPE restruct:             Holger Dengler <hd@linux.vnet.ibm.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 7a8b09612c41..cf6da7fafe54 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2993,7 +2993,7 @@ static void qeth_get_trap_id(struct qeth_card *card, struct qeth_trap_id *tid)
         struct sysinfo_2_2_2 *info222 = (struct sysinfo_2_2_2 *)info;
         struct sysinfo_3_2_2 *info322 = (struct sysinfo_3_2_2 *)info;
         struct ccw_dev_id ccwid;
-        int level, rc;
+        int level;
 
         tid->chpid = card->info.chpid;
         ccw_device_get_id(CARD_RDEV(card), &ccwid);
@@ -3001,17 +3001,10 @@ static void qeth_get_trap_id(struct qeth_card *card, struct qeth_trap_id *tid)
         tid->devno = ccwid.devno;
         if (!info)
                 return;
-
-        rc = stsi(NULL, 0, 0, 0);
-        if (rc == -ENOSYS)
-                level = rc;
-        else
-                level = (((unsigned int) rc) >> 28);
-
-        if ((level >= 2) && (stsi(info222, 2, 2, 2) != -ENOSYS))
+        level = stsi(NULL, 0, 0, 0);
+        if ((level >= 2) && (stsi(info222, 2, 2, 2) == 0))
                 tid->lparnr = info222->lpar_number;
-
-        if ((level >= 3) && (stsi(info322, 3, 2, 2) != -ENOSYS)) {
+        if ((level >= 3) && (stsi(info322, 3, 2, 2) == 0)) {
                 EBCASC(info322->vm[0].name, sizeof(info322->vm[0].name));
                 memcpy(tid->vmname, info322->vm[0].name, sizeof(tid->vmname));
         }
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 25417d0e7acb..0bcacf71aef8 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -2888,7 +2888,7 @@ ahd_handle_lqiphase_error(struct ahd_softc *ahd, u_int lqistat1)
                 ahd_outb(ahd, CLRINT, CLRSCSIINT);
                 ahd_unpause(ahd);
         } else {
-                printk("Reseting Channel for LQI Phase error\n");
+                printk("Resetting Channel for LQI Phase error\n");
                 ahd_dump_card_state(ahd);
                 ahd_reset_channel(ahd, 'A', /*Initiate Reset*/TRUE);
         }
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
index 8cdb79c2fcdf..21ad2902e5ce 100644
--- a/drivers/scsi/bfa/bfa_ioc.c
+++ b/drivers/scsi/bfa/bfa_ioc.c
@@ -5587,7 +5587,7 @@ static bfa_status_t bfa_dconf_flash_write(struct bfa_dconf_mod_s *dconf);
 static void bfa_dconf_init_cb(void *arg, bfa_status_t status);
 
 /*
- * Begining state of dconf module. Waiting for an event to start.
+ * Beginning state of dconf module. Waiting for an event to start.
  */
 static void
 bfa_dconf_sm_uninit(struct bfa_dconf_mod_s *dconf, enum bfa_dconf_event event)
diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
index 1a99d4b5b50f..7b916e04ca56 100644
--- a/drivers/scsi/bfa/bfa_ioc.h
+++ b/drivers/scsi/bfa/bfa_ioc.h
@@ -530,7 +530,7 @@ struct bfa_diag_results_fwping {
 
 struct bfa_diag_qtest_result_s {
         u32     status;
-        u16     count;  /* sucessful queue test count */
+        u16     count;  /* successful queue test count */
         u8      queue;
         u8      rsvd;   /* 64-bit align */
 };
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index ae1cb7639d99..e0558656c646 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -908,7 +908,7 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event,
                 return;
 
         default:
-                printk(KERN_ERR PFX "Unkonwn netevent %ld", event);
+                printk(KERN_ERR PFX "Unknown netevent %ld", event);
                 return;
         }
 
@@ -1738,7 +1738,7 @@ static int bnx2fc_ulp_get_stats(void *handle)
 /**
  * bnx2fc_ulp_start - cnic callback to initialize & start adapter instance
  *
- * @handle:     transport handle pointing to adapter struture
+ * @handle:     transport handle pointing to adapter structure
  *
  * This function maps adapter structure to pcidev structure and initiates
  *      firmware handshake to enable/initialize on-chip FCoE components.
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index 33d6630529de..91eec60252ee 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
         int rc = 0;
         u64 mask64;
 
+        memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
+        memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
+
         bnx2i_adjust_qp_size(hba);
 
         iscsi_init.flags =
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index d3e4d7c6f577..fbf6f0f4b0dd 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -49,15 +49,6 @@
 /* GDT_ISA */
 #define GDT2_ID         0x0120941c              /* GDT2000/2020 */
 
-/* vendor ID, device IDs (PCI) */
-/* these defines should already exist in <linux/pci.h> */
-#ifndef PCI_VENDOR_ID_VORTEX
-#define PCI_VENDOR_ID_VORTEX            0x1119  /* PCI controller vendor ID */
-#endif
-#ifndef PCI_VENDOR_ID_INTEL
-#define PCI_VENDOR_ID_INTEL             0x8086  
-#endif
-
 #ifndef PCI_DEVICE_ID_VORTEX_GDT60x0
 /* GDT_PCI */
 #define PCI_DEVICE_ID_VORTEX_GDT60x0    0       /* GDT6000/6020/6050 */
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 796482badf13..2b4261cb7742 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct CommandList *cp)
         }
                 break;
         case CMD_PROTOCOL_ERR:
+                cmd->result = DID_ERROR << 16;
                 dev_warn(&h->pdev->dev, "cp %p has "
-                        "protocol error \n", cp);
+                        "protocol error\n", cp);
                 break;
         case CMD_HARDWARE_ERR:
                 cmd->result = DID_ERROR << 16;
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b91fa7aed37c..0a2c5a8ebb82 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -192,7 +192,7 @@ static const struct ipr_chip_t ipr_chip[] = {
         { PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CROCODILE, IPR_USE_MSI, IPR_SIS64, IPR_MMIO, &ipr_chip_cfg[2] }
 };
 
-static int ipr_max_bus_speeds [] = {
+static int ipr_max_bus_speeds[] = {
         IPR_80MBs_SCSI_RATE, IPR_U160_SCSI_RATE, IPR_U320_SCSI_RATE
 };
 
@@ -562,7 +562,7 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd,
         trace_entry->u.add_data = add_data;
 }
 #else
-#define ipr_trc_hook(ipr_cmd, type, add_data) do { } while(0)
+#define ipr_trc_hook(ipr_cmd, type, add_data) do { } while (0)
 #endif
 
 /**
@@ -1002,7 +1002,7 @@ static void ipr_send_hcam(struct ipr_ioa_cfg *ioa_cfg, u8 type,
  **/
 static void ipr_update_ata_class(struct ipr_resource_entry *res, unsigned int proto)
 {
-        switch(proto) {
+        switch (proto) {
         case IPR_PROTO_SATA:
         case IPR_PROTO_SAS_STP:
                 res->ata_class = ATA_DEV_ATA;
@@ -3043,7 +3043,7 @@ static void ipr_get_ioa_dump(struct ipr_ioa_cfg *ioa_cfg, struct ipr_dump *dump)
 }
 
 #else
-#define ipr_get_ioa_dump(ioa_cfg, dump) do { } while(0)
+#define ipr_get_ioa_dump(ioa_cfg, dump) do { } while (0)
 #endif
 
 /**
@@ -3055,7 +3055,7 @@ static void ipr_get_ioa_dump(struct ipr_ioa_cfg *ioa_cfg, struct ipr_dump *dump)
  **/
 static void ipr_release_dump(struct kref *kref)
 {
-        struct ipr_dump *dump = container_of(kref,struct ipr_dump,kref);
+        struct ipr_dump *dump = container_of(kref, struct ipr_dump, kref);
         struct ipr_ioa_cfg *ioa_cfg = dump->ioa_cfg;
         unsigned long lock_flags = 0;
         int i;
@@ -3142,7 +3142,7 @@ restart:
                                 break;
                         }
                 }
-        } while(did_work);
+        } while (did_work);
 
         list_for_each_entry(res, &ioa_cfg->used_res_q, queue) {
                 if (res->add_to_ml) {
@@ -3268,7 +3268,7 @@ static ssize_t ipr_show_log_level(struct device *dev,
  *      number of bytes printed to buffer
  **/
 static ssize_t ipr_store_log_level(struct device *dev,
-                                   struct device_attribute *attr,
+                                   struct device_attribute *attr,
                                    const char *buf, size_t count)
 {
         struct Scsi_Host *shost = class_to_shost(dev);
@@ -3315,7 +3315,7 @@ static ssize_t ipr_store_diagnostics(struct device *dev,
                 return -EACCES;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3682,7 +3682,7 @@ static int ipr_update_ioa_ucode(struct ipr_ioa_cfg *ioa_cfg,
         unsigned long lock_flags;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -3746,7 +3746,7 @@ static ssize_t ipr_store_update_fw(struct device *dev,
         len = snprintf(fname, 99, "%s", buf);
         fname[len-1] = '\0';
 
-        if(request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
+        if (request_firmware(&fw_entry, fname, &ioa_cfg->pdev->dev)) {
                 dev_err(&ioa_cfg->pdev->dev, "Firmware file %s not found\n", fname);
                 return -EIO;
         }
@@ -4612,7 +4612,7 @@ static int ipr_slave_alloc(struct scsi_device *sdev)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
+static int __ipr_eh_host_reset(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_ioa_cfg *ioa_cfg;
         int rc;
@@ -4634,7 +4634,7 @@ static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
         return rc;
 }
 
-static int ipr_eh_host_reset(struct scsi_cmnd * cmd)
+static int ipr_eh_host_reset(struct scsi_cmnd *cmd)
 {
         int rc;
 
@@ -4701,7 +4701,7 @@ static int ipr_device_reset(struct ipr_ioa_cfg *ioa_cfg,
         }
 
         LEAVE;
-        return (IPR_IOASC_SENSE_KEY(ioasc) ? -EIO : 0);
+        return IPR_IOASC_SENSE_KEY(ioasc) ? -EIO : 0;
 }
 
 /**
@@ -4725,7 +4725,7 @@ static int ipr_sata_reset(struct ata_link *link, unsigned int *classes,
 
         ENTER;
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
@@ -4753,7 +4753,7 @@ static int ipr_sata_reset(struct ata_link *link, unsigned int *classes,
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int __ipr_eh_dev_reset(struct scsi_cmnd * scsi_cmd)
+static int __ipr_eh_dev_reset(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_cmnd *ipr_cmd;
         struct ipr_ioa_cfg *ioa_cfg;
@@ -4811,10 +4811,10 @@ static int __ipr_eh_dev_reset(struct scsi_cmnd * scsi_cmd)
         res->resetting_device = 0;
 
         LEAVE;
-        return (rc ? FAILED : SUCCESS);
+        return rc ? FAILED : SUCCESS;
 }
 
-static int ipr_eh_dev_reset(struct scsi_cmnd * cmd)
+static int ipr_eh_dev_reset(struct scsi_cmnd *cmd)
 {
         int rc;
 
@@ -4910,7 +4910,7 @@ static void ipr_abort_timeout(struct ipr_cmnd *ipr_cmd)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
+static int ipr_cancel_op(struct scsi_cmnd *scsi_cmd)
 {
         struct ipr_cmnd *ipr_cmd;
         struct ipr_ioa_cfg *ioa_cfg;
@@ -4979,7 +4979,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
                 res->needs_sync_complete = 1;
 
         LEAVE;
-        return (IPR_IOASC_SENSE_KEY(ioasc) ? FAILED : SUCCESS);
+        return IPR_IOASC_SENSE_KEY(ioasc) ? FAILED : SUCCESS;
 }
 
 /**
@@ -4989,7 +4989,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
  * Return value:
  *      SUCCESS / FAILED
  **/
-static int ipr_eh_abort(struct scsi_cmnd * scsi_cmd)
+static int ipr_eh_abort(struct scsi_cmnd *scsi_cmd)
 {
         unsigned long flags;
         int rc;
@@ -5907,7 +5907,7 @@ static int ipr_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
  * Return value:
  *      pointer to buffer with description string
  **/
-static const char * ipr_ioa_info(struct Scsi_Host *host)
+static const char *ipr_ioa_info(struct Scsi_Host *host)
 {
         static char buffer[512];
         struct ipr_ioa_cfg *ioa_cfg;
@@ -5965,7 +5965,7 @@ static void ipr_ata_phy_reset(struct ata_port *ap)
 
         ENTER;
         spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
@@ -6005,7 +6005,7 @@ static void ipr_ata_post_internal(struct ata_queued_cmd *qc)
         unsigned long flags;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
@@ -6330,7 +6330,7 @@ static int ipr_invalid_adapter(struct ipr_ioa_cfg *ioa_cfg)
         int i;
 
         if ((ioa_cfg->type == 0x5702) && (ioa_cfg->pdev->revision < 4)) {
-                for (i = 0; i < ARRAY_SIZE(ipr_blocked_processors); i++){
+                for (i = 0; i < ARRAY_SIZE(ipr_blocked_processors); i++) {
                         if (__is_processor(ipr_blocked_processors[i]))
                                 return 1;
                 }
@@ -6608,7 +6608,7 @@ static void ipr_scsi_bus_speed_limit(struct ipr_ioa_cfg *ioa_cfg)
  *      none
  **/
 static void ipr_modify_ioafp_mode_page_28(struct ipr_ioa_cfg *ioa_cfg,
-                                                struct ipr_mode_pages *mode_pages)
+                                          struct ipr_mode_pages *mode_pages)
 {
         int i, entry_length;
         struct ipr_dev_bus_entry *bus;
@@ -8022,7 +8022,7 @@ static void ipr_reset_ioa_job(struct ipr_cmnd *ipr_cmd)
                 ipr_reinit_ipr_cmnd(ipr_cmd);
                 ipr_cmd->job_step_failed = ipr_reset_cmd_failed;
                 rc = ipr_cmd->job_step(ipr_cmd);
-        } while(rc == IPR_RC_JOB_CONTINUE);
+        } while (rc == IPR_RC_JOB_CONTINUE);
 }
 
 /**
@@ -8283,7 +8283,7 @@ static void ipr_free_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         if (ioa_cfg->ipr_cmd_pool)
-                pci_pool_destroy (ioa_cfg->ipr_cmd_pool);
+                pci_pool_destroy(ioa_cfg->ipr_cmd_pool);
 
         kfree(ioa_cfg->ipr_cmnd_list);
         kfree(ioa_cfg->ipr_cmnd_list_dma);
@@ -8363,8 +8363,8 @@ static int __devinit ipr_alloc_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         dma_addr_t dma_addr;
         int i;
 
-        ioa_cfg->ipr_cmd_pool = pci_pool_create (IPR_NAME, ioa_cfg->pdev,
-                                                 sizeof(struct ipr_cmnd), 512, 0);
+        ioa_cfg->ipr_cmd_pool = pci_pool_create(IPR_NAME, ioa_cfg->pdev,
+                                                sizeof(struct ipr_cmnd), 512, 0);
 
         if (!ioa_cfg->ipr_cmd_pool)
                 return -ENOMEM;
@@ -8378,7 +8378,7 @@ static int __devinit ipr_alloc_cmd_blks(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         for (i = 0; i < IPR_NUM_CMD_BLKS; i++) {
-                ipr_cmd = pci_pool_alloc (ioa_cfg->ipr_cmd_pool, GFP_KERNEL, &dma_addr);
+                ipr_cmd = pci_pool_alloc(ioa_cfg->ipr_cmd_pool, GFP_KERNEL, &dma_addr);
 
                 if (!ipr_cmd) {
                         ipr_free_cmd_blks(ioa_cfg);
@@ -8964,7 +8964,7 @@ static void ipr_scan_vsets(struct ipr_ioa_cfg *ioa_cfg)
         int target, lun;
 
         for (target = 0; target < IPR_MAX_NUM_TARGETS_PER_BUS; target++)
-                for (lun = 0; lun < IPR_MAX_NUM_VSET_LUNS_PER_TARGET; lun++ )
+                for (lun = 0; lun < IPR_MAX_NUM_VSET_LUNS_PER_TARGET; lun++)
                         scsi_add_device(ioa_cfg->host, IPR_VSET_BUS, target, lun);
 }
 
@@ -9010,7 +9010,7 @@ static void __ipr_remove(struct pci_dev *pdev)
         ENTER;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, host_lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
@@ -9139,7 +9139,7 @@ static void ipr_shutdown(struct pci_dev *pdev)
         unsigned long lock_flags = 0;
 
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
-        while(ioa_cfg->in_reset_reload) {
+        while (ioa_cfg->in_reset_reload) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
                 spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 45385f531649..b334fdc1726a 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -492,7 +492,7 @@ static void sci_controller_process_completions(struct isci_host *ihost)
         u32 event_cycle;
 
         dev_dbg(&ihost->pdev->dev,
-                "%s: completion queue begining get:0x%08x\n",
+                "%s: completion queue beginning get:0x%08x\n",
                 __func__,
                 ihost->completion_queue_get);
 
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 92c1d86d1fc6..9be45a2b2232 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -222,7 +222,7 @@ static struct sas_domain_function_template isci_transport_ops  = {
  * @isci_host: This parameter specifies the lldd specific wrapper for the
  *    libsas sas_ha struct.
  *
- * This method returns an error code indicating sucess or failure. The user
+ * This method returns an error code indicating success or failure. The user
  * should check for possible memory allocation error return otherwise, a zero
  * indicates success.
  */
diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
index 2fb85bf75449..13098b09a824 100644
--- a/drivers/scsi/isci/port.c
+++ b/drivers/scsi/isci/port.c
@@ -212,7 +212,7 @@ static void isci_port_link_up(struct isci_host *isci_host,
                 memcpy(iphy->sas_phy.attached_sas_addr,
                        iphy->frame_rcvd.iaf.sas_addr, SAS_ADDR_SIZE);
         } else {
-                dev_err(&isci_host->pdev->dev, "%s: unkown target\n", __func__);
+                dev_err(&isci_host->pdev->dev, "%s: unknown target\n", __func__);
                 success = false;
         }
 
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 7a0431c73493..c1bafc3f3fb1 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -2240,7 +2240,7 @@ static enum sci_status atapi_data_tc_completion_handler(struct isci_request *ire
                         status = ireq->sci_status;
                         sci_change_state(&idev->sm, SCI_STP_DEV_ATAPI_ERROR);
                 } else {
-                        /* If receiving any non-sucess TC status, no UF
+                        /* If receiving any non-success TC status, no UF
                          * received yet, then an UF for the status fis
                          * is coming after (XXX: suspect this is
                          * actually a protocol error or a bug like the
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 6bc74eb012c9..b6f19a1db780 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -532,7 +532,7 @@ int isci_task_abort_task(struct sas_task *task)
                 /* The request has already completed and there
                 * is nothing to do here other than to set the task
                 * done bit, and indicate that the task abort function
-                * was sucessful.
+                * was successful.
                 */
                 spin_lock_irqsave(&task->task_state_lock, flags);
                 task->task_state_flags |= SAS_TASK_STATE_DONE;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index a979e2765cf6..628a703abddb 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6607,7 +6607,7 @@ out_error:
  * we just use some constant number as place holder.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      -ENOMEM - No availble memory
  *      -EIO - The mailbox failed to complete successfully.
  **/
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 9cbd20b1328b..0e7e144507b2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -4739,7 +4739,7 @@ lpfc_sli4_read_rev(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq,
  * is attached to.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      otherwise - failed to retrieve physical port name
  **/
 static int
@@ -15209,7 +15209,7 @@ lpfc_check_next_fcf_pri_level(struct lpfc_hba *phba)
         /*
          * if next_fcf_pri was not set above and the list is not empty then
          * we have failed flogis on all of them. So reset flogi failed
-         * and start at the begining.
+         * and start at the beginning.
          */
         if (!next_fcf_pri && !list_empty(&phba->fcf.fcf_pri_list)) {
                 list_for_each_entry(fcf_pri, &phba->fcf.fcf_pri_list, list) {
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 97825f116954..76ad72d32c3f 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -305,12 +305,11 @@ mega_query_adapter(adapter_t *adapter)
 
         adapter->host->sg_tablesize = adapter->sglen;
 
-
         /* use HP firmware and bios version encoding
            Note: fw_version[0|1] and bios_version[0|1] were originally shifted
            right 8 bits making them zero. This 0 value was hardcoded to fix
            sparse warnings. */
-        if (adapter->product_info.subsysvid == HP_SUBSYS_VID) {
+        if (adapter->product_info.subsysvid == PCI_VENDOR_ID_HP) {
                 sprintf (adapter->fw_version, "%c%d%d.%d%d",
                          adapter->product_info.fw_version[2],
                          0,
@@ -4716,7 +4715,7 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          * support, since this firmware cannot handle 64 bit
          * addressing
          */
-        if ((subsysvid == HP_SUBSYS_VID) &&
+        if ((subsysvid == PCI_VENDOR_ID_HP) &&
             ((subsysid == 0x60E7) || (subsysid == 0x60E8))) {
                 /*
                  * which firmware
diff --git a/drivers/scsi/megaraid.h b/drivers/scsi/megaraid.h
index 9a7897f8ca43..4fb2adf6b80d 100644
--- a/drivers/scsi/megaraid.h
+++ b/drivers/scsi/megaraid.h
@@ -45,45 +45,10 @@
 
 #define MAX_DEV_TYPE    32
 
-#ifndef PCI_VENDOR_ID_LSI_LOGIC
-#define PCI_VENDOR_ID_LSI_LOGIC         0x1000
-#endif
-
-#ifndef PCI_VENDOR_ID_AMI
-#define PCI_VENDOR_ID_AMI               0x101E
-#endif
-
-#ifndef PCI_VENDOR_ID_DELL
-#define PCI_VENDOR_ID_DELL              0x1028
-#endif
-
-#ifndef PCI_VENDOR_ID_INTEL
-#define PCI_VENDOR_ID_INTEL             0x8086
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID
-#define PCI_DEVICE_ID_AMI_MEGARAID      0x9010
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID2
-#define PCI_DEVICE_ID_AMI_MEGARAID2     0x9060
-#endif
-
-#ifndef PCI_DEVICE_ID_AMI_MEGARAID3
-#define PCI_DEVICE_ID_AMI_MEGARAID3     0x1960
-#endif
-
 #define PCI_DEVICE_ID_DISCOVERY         0x000E
 #define PCI_DEVICE_ID_PERC4_DI          0x000F
 #define PCI_DEVICE_ID_PERC4_QC_VERDE    0x0407
 
-/* Sub-System Vendor IDs */
-#define AMI_SUBSYS_VID                  0x101E
-#define DELL_SUBSYS_VID                 0x1028
-#define HP_SUBSYS_VID                   0x103C
-#define LSI_SUBSYS_VID                  0x1000
-#define INTEL_SUBSYS_VID                0x8086
-
 #define HBA_SIGNATURE                   0x3344
 #define HBA_SIGNATURE_471               0xCCCC
 #define HBA_SIGNATURE_64BIT             0x0299
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index dc27598785e5..ed38454228c6 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4066,7 +4066,6 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         spin_lock_init(&instance->cmd_pool_lock);
         spin_lock_init(&instance->hba_lock);
         spin_lock_init(&instance->completion_lock);
-        spin_lock_init(&poll_aen_lock);
 
         mutex_init(&instance->aen_mutex);
         mutex_init(&instance->reset_mutex);
@@ -5392,6 +5391,8 @@ static int __init megasas_init(void)
         printk(KERN_INFO "megasas: %s %s\n", MEGASAS_VERSION,
                MEGASAS_EXT_VERSION);
 
+        spin_lock_init(&poll_aen_lock);
+
         support_poll_for_event = 2;
         support_device_change = 1;
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 9d46fcbe7755..9d5a56c4b332 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)
         u16 message_control;
 
 
+        /* Check whether controller SAS2008 B0 controller,
+           if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
+        if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
+            ioc->pdev->revision == 0x01) {
+                return -EINVAL;
+        }
+
         base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
         if (!base) {
                 dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
@@ -2424,10 +2431,13 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
         }
 
         /* command line tunables  for max controller queue depth */
-        if (max_queue_depth != -1)
-                max_request_credit = (max_queue_depth < facts->RequestCredit)
-                    ? max_queue_depth : facts->RequestCredit;
-        else
+        if (max_queue_depth != -1 && max_queue_depth != 0) {
+                max_request_credit = min_t(u16, max_queue_depth +
+                        ioc->hi_priority_depth + ioc->internal_depth,
+                        facts->RequestCredit);
+                if (max_request_credit > MAX_HBA_QUEUE_DEPTH)
+                        max_request_credit =  MAX_HBA_QUEUE_DEPTH;
+        } else
                 max_request_credit = min_t(u16, facts->RequestCredit,
                     MAX_HBA_QUEUE_DEPTH);
 
@@ -2502,7 +2512,7 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
         /* set the scsi host can_queue depth
          * with some internal commands that could be outstanding
          */
-        ioc->shost->can_queue = ioc->scsiio_depth - (2);
+        ioc->shost->can_queue = ioc->scsiio_depth;
         dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scsi host: "
             "can_queue depth (%d)\n", ioc->name, ioc->shost->can_queue));
 
diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
index 88cf1db21a79..783edc7c6b98 100644
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -122,7 +122,7 @@ static struct mvumi_res *mvumi_alloc_mem_resource(struct mvumi_hba *mhba,
 
         if (!res) {
                 dev_err(&mhba->pdev->dev,
-                        "Failed to allocate memory for resouce manager.\n");
+                        "Failed to allocate memory for resource manager.\n");
                 return NULL;
         }
 
@@ -1007,13 +1007,13 @@ static int mvumi_handshake(struct mvumi_hba *mhba)
                 tmp |= INT_MAP_COMAOUT | INT_MAP_COMAERR;
                 iowrite32(tmp, regs + CPU_ENPOINTA_MASK_REG);
                 iowrite32(mhba->list_num_io, mhba->ib_shadow);
-                /* Set InBound List Avaliable count shadow */
+                /* Set InBound List Available count shadow */
                 iowrite32(lower_32_bits(mhba->ib_shadow_phys),
                                         regs + CLA_INB_AVAL_COUNT_BASEL);
                 iowrite32(upper_32_bits(mhba->ib_shadow_phys),
                                         regs + CLA_INB_AVAL_COUNT_BASEH);
 
-                /* Set OutBound List Avaliable count shadow */
+                /* Set OutBound List Available count shadow */
                 iowrite32((mhba->list_num_io-1) | CL_POINTER_TOGGLE,
                                                 mhba->ob_shadow);
                 iowrite32(lower_32_bits(mhba->ob_shadow_phys), regs + 0x5B0);
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index c75ca26298d6..79243b76d17e 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -803,7 +803,7 @@ static void qla4xxx_conn_get_stats(struct iscsi_cls_conn *cls_conn,
                                      iscsi_stats_dma);
         if (ret != QLA_SUCCESS) {
                 ql4_printk(KERN_ERR, ha,
-                           "Unable to retreive iscsi stats\n");
+                           "Unable to retrieve iscsi stats\n");
                 goto free_stats;
         }
 
@@ -4338,7 +4338,7 @@ static int qla4xxx_compare_tuple_ddb(struct scsi_qla_host *ha,
                 return QLA_ERROR;
 
         /* For multi sessions, driver generates the ISID, so do not compare
-         * ISID in reset path since it would be a comparision between the
+         * ISID in reset path since it would be a comparison between the
          * driver generated ISID and firmware generated ISID. This could
          * lead to adding duplicated DDBs in the list as driver generated
          * ISID would not match firmware generated ISID.
@@ -5326,7 +5326,7 @@ static void qla4xxx_destroy_fw_ddb_session(struct scsi_qla_host *ha)
         }
 }
 /**
- * qla4xxx_remove_adapter - calback function to remove adapter.
+ * qla4xxx_remove_adapter - callback function to remove adapter.
  * @pci_dev: PCI device pointer
  **/
 static void __devexit qla4xxx_remove_adapter(struct pci_dev *pdev)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 4a6381c87253..de2337f255a7 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -42,6 +42,8 @@
 
 #include <trace/events/scsi.h>
 
+static void scsi_eh_done(struct scsi_cmnd *scmd);
+
 #define SENSE_TIMEOUT           (10*HZ)
 
 /*
@@ -241,6 +243,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (! scsi_command_normalize_sense(scmd, &sshdr))
                 return FAILED;  /* no valid sense data */
 
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
+
         if (scsi_sense_is_deferred(&sshdr))
                 return NEEDS_RETRY;
 
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ffd77739ae3e..faa790fba134 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -776,7 +776,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
         }
 
         if (req->cmd_type == REQ_TYPE_BLOCK_PC) { /* SG_IO ioctl from block level */
-                req->errors = result;
                 if (result) {
                         if (sense_valid && req->sense) {
                                 /*
@@ -792,6 +791,10 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                         if (!sense_deferred)
                                 error = __scsi_error_from_host_byte(cmd, result);
                 }
+                /*
+                 * __scsi_error_from_host_byte may have reset the host_byte
+                 */
+                req->errors = cmd->result;
 
                 req->resid_len = scsi_get_resid(cmd);
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 56a93794c470..d947ffc20ceb 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -764,6 +764,16 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         sdev->model = (char *) (sdev->inquiry + 16);
         sdev->rev = (char *) (sdev->inquiry + 32);
 
+        if (strncmp(sdev->vendor, "ATA     ", 8) == 0) {
+                /*
+                 * sata emulation layer device.  This is a hack to work around
+                 * the SATL power management specifications which state that
+                 * when the SATL detects the device has gone into standby
+                 * mode, it shall respond with NOT READY.
+                 */
+                sdev->allow_restart = 1;
+        }
+
         if (*bflags & BLIST_ISROM) {
                 sdev->type = TYPE_ROM;
                 sdev->removable = 1;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index c7030fbee79c..3e79a2f00042 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -331,7 +331,7 @@ static void virtscsi_map_sgl(struct scatterlist *sg, unsigned int *p_idx,
         int i;
 
         for_each_sg(table->sgl, sg_elem, table->nents, i)
-                sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
+                sg[idx++] = *sg_elem;
 
         *p_idx = idx;
 }
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 4411d4224401..20b3a483c2cc 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -295,7 +295,7 @@ static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
 
 static void ll_bus_reset(const struct pvscsi_adapter *adapter)
 {
-        dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
+        dev_dbg(pvscsi_dev(adapter), "Resetting bus on %p\n", adapter);
 
         pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
 }
@@ -304,7 +304,7 @@ static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
 {
         struct PVSCSICmdDescResetDevice cmd = { 0 };
 
-        dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
+        dev_dbg(pvscsi_dev(adapter), "Resetting device: target=%u\n", target);
 
         cmd.target = target;
 
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 32c26d795ed0..8f32a1323a79 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -355,7 +355,7 @@ int __init register_intc_controller(struct intc_desc *desc)
                         if (unlikely(res)) {
                                 if (res == -EEXIST) {
                                         res = irq_domain_associate(d->domain,
-                                                                   irq, irq);
+                                                                   irq2, irq2);
                                         if (unlikely(res)) {
                                                 pr_err("domain association "
                                                        "failure\n");
diff --git a/drivers/sh/pfc/pinctrl.c b/drivers/sh/pfc/pinctrl.c
index 2804eaae804e..0646bf6e7889 100644
--- a/drivers/sh/pfc/pinctrl.c
+++ b/drivers/sh/pfc/pinctrl.c
@@ -208,10 +208,13 @@ static int sh_pfc_gpio_request_enable(struct pinctrl_dev *pctldev,
 
                 break;
         case PINMUX_TYPE_GPIO:
+        case PINMUX_TYPE_INPUT:
+        case PINMUX_TYPE_OUTPUT:
                 break;
         default:
                 pr_err("Unsupported mux type (%d), bailing...\n", pinmux_type);
-                return -ENOTSUPP;
+                ret = -ENOTSUPP;
+                goto err;
         }
 
         ret = 0;
diff --git a/drivers/spi/spi-au1550.c b/drivers/spi/spi-au1550.c
index 5784c8799616..4de66d1cfe51 100644
--- a/drivers/spi/spi-au1550.c
+++ b/drivers/spi/spi-au1550.c
@@ -475,7 +475,7 @@ static irqreturn_t au1550_spi_dma_irq_callback(struct au1550_spi *hw)
                 /*
                  * due to an spi error we consider transfer as done,
                  * so mask all events until before next transfer start
-                 * and stop the possibly running dma immediatelly
+                 * and stop the possibly running dma immediately
                  */
                 au1550_spi_mask_ack_all(hw);
                 au1xxx_dbdma_stop(hw->dma_rx_ch);
diff --git a/drivers/spi/spi-bfin-sport.c b/drivers/spi/spi-bfin-sport.c
index 1fe51198a622..6555ecd07302 100644
--- a/drivers/spi/spi-bfin-sport.c
+++ b/drivers/spi/spi-bfin-sport.c
@@ -467,7 +467,7 @@ bfin_sport_spi_pump_transfers(unsigned long data)
                 dev_dbg(drv_data->dev, "IO write error!\n");
                 drv_data->state = ERROR_STATE;
         } else {
-                /* Update total byte transfered */
+                /* Update total byte transferred */
                 message->actual_length += transfer->len;
                 /* Move to next transfer of this msg */
                 drv_data->state = bfin_sport_spi_next_transfer(drv_data);
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index 698018fd992b..9d9071b730be 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -129,7 +129,7 @@ static int tiny_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         unsigned int i;
 
         if (hw->irq >= 0) {
-                /* use intrrupt driven data transfer */
+                /* use interrupt driven data transfer */
                 hw->len = t->len;
                 hw->txp = t->tx_buf;
                 hw->rxp = t->rx_buf;
diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
index 75ac9d48ef46..7a85f22b6474 100644
--- a/drivers/spi/spi-ppc4xx.c
+++ b/drivers/spi/spi-ppc4xx.c
@@ -101,7 +101,7 @@ struct spi_ppc4xx_regs {
         u8 dummy;
         /*
          * Clock divisor modulus register
-         * This uses the follwing formula:
+         * This uses the following formula:
          *    SCPClkOut = OPBCLK/(4(CDM + 1))
          * or
          *    CDM = (OPBCLK/4*SCPClkOut) - 1
@@ -201,7 +201,7 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
                 return -EINVAL;
         }
 
-        /* Write new configration */
+        /* Write new configuration */
         out_8(&hw->regs->mode, cs->mode);
 
         /* Set the clock */
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index cd56dcf46320..1284c9b74653 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -505,7 +505,7 @@ static int pch_spi_transfer(struct spi_device *pspi, struct spi_message *pmsg)
         }
 
         if (unlikely(pspi->max_speed_hz == 0)) {
-                dev_err(&pspi->dev, "%s pch_spi_tranfer maxspeed=%d\n",
+                dev_err(&pspi->dev, "%s pch_spi_transfer maxspeed=%d\n",
                         __func__, pspi->max_speed_hz);
                 retval = -EINVAL;
                 goto err_out;
diff --git a/drivers/staging/android/android_alarm.h b/drivers/staging/android/android_alarm.h
index d0cafd637199..f2ffd963f1c3 100644
--- a/drivers/staging/android/android_alarm.h
+++ b/drivers/staging/android/android_alarm.h
@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
 #define ANDROID_ALARM_WAIT                  _IO('a', 1)
 
 #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
+#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
+
 /* Set alarm */
 #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
 #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
 #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
 #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
 #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c
index 6c81e377262c..cc8931fde839 100644
--- a/drivers/staging/comedi/drivers/amplc_dio200.c
+++ b/drivers/staging/comedi/drivers/amplc_dio200.c
@@ -1412,6 +1412,13 @@ static int __devinit dio200_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in dio200_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via dio200_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return dio200_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c
index aabba9886b7d..f50287903038 100644
--- a/drivers/staging/comedi/drivers/amplc_pc236.c
+++ b/drivers/staging/comedi/drivers/amplc_pc236.c
@@ -565,6 +565,13 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc236_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc236_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pc236_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
index 40ec1ffebba6..8191c4e28e0a 100644
--- a/drivers/staging/comedi/drivers/amplc_pc263.c
+++ b/drivers/staging/comedi/drivers/amplc_pc263.c
@@ -298,6 +298,13 @@ static int __devinit pc263_attach_pci(struct comedi_device *dev,
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pc263_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pc263_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pc263_pci_common_attach(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pci224.c b/drivers/staging/comedi/drivers/amplc_pci224.c
index 4e17f13e57f6..8bf109e7bb05 100644
--- a/drivers/staging/comedi/drivers/amplc_pci224.c
+++ b/drivers/staging/comedi/drivers/amplc_pci224.c
@@ -1503,6 +1503,13 @@ pci224_attach_pci(struct comedi_device *dev, struct pci_dev *pci_dev)
                         DRIVER_NAME ": BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci224_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci224_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pci224_attach_common(dev, pci_dev, NULL);
 }
 
diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c
index 1b67d0c61fa7..66e74bd12267 100644
--- a/drivers/staging/comedi/drivers/amplc_pci230.c
+++ b/drivers/staging/comedi/drivers/amplc_pci230.c
@@ -2925,6 +2925,13 @@ static int __devinit pci230_attach_pci(struct comedi_device *dev,
                         "amplc_pci230: BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in pci230_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via pci230_attach()
+         * has been removed.
+         */
+        pci_dev_get(pci_dev);
         return pci230_attach_common(dev, pci_dev);
 }
 
diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
index 874e02e47668..67a914a10b55 100644
--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -378,7 +378,7 @@ das08jr_ao_winsn(struct comedi_device *dev, struct comedi_subdevice *s,
         int chan;
 
         lsb = data[0] & 0xff;
-        msb = (data[0] >> 8) & 0xf;
+        msb = (data[0] >> 8) & 0xff;
 
         chan = CR_CHAN(insn->chanspec);
 
@@ -623,7 +623,7 @@ static const struct das08_board_struct das08_boards[] = {
                 .ai = das08_ai_rinsn,
                 .ai_nbits = 16,
                 .ai_pg = das08_pg_none,
-                .ai_encoding = das08_encode12,
+                .ai_encoding = das08_encode16,
                 .ao = das08jr_ao_winsn,
                 .ao_nbits = 16,
                 .di = das08jr_di_rbits,
@@ -922,6 +922,13 @@ das08_attach_pci(struct comedi_device *dev, struct pci_dev *pdev)
                 dev_err(dev->class_dev, "BUG! cannot determine board type!\n");
                 return -EINVAL;
         }
+        /*
+         * Need to 'get' the PCI device to match the 'put' in das08_detach().
+         * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+         * support for manual attachment of PCI devices via das08_attach()
+         * has been removed.
+         */
+        pci_dev_get(pdev);
         return das08_pci_attach_common(dev, pdev);
 }
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 18d108fd967a..f3da59063ed2 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -121,8 +121,10 @@ static int lis3l02dq_get_buffer_element(struct iio_dev *indio_dev,
         if (rx_array == NULL)
                 return -ENOMEM;
         ret = lis3l02dq_read_all(indio_dev, rx_array);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(rx_array);
                 return ret;
+        }
         for (i = 0; i < scan_count; i++)
                 data[i] = combine_8_to_16(rx_array[i*4+1],
                                         rx_array[i*4+3]);
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index 095837285f4f..19a064d649e3 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -647,6 +647,8 @@ static ssize_t ad7192_write_frequency(struct device *dev,
         ret = strict_strtoul(buf, 10, &lval);
         if (ret)
                 return ret;
+        if (lval == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
         if (iio_buffer_enabled(indio_dev)) {
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 93aa431287ac..eb8e9d69efd3 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -195,6 +195,8 @@ static ssize_t adis16260_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
         if (spi_get_device_id(st->us)) {
diff --git a/drivers/staging/iio/imu/adis16400_core.c b/drivers/staging/iio/imu/adis16400_core.c
index 1f4c17779b5a..a618327e06ed 100644
--- a/drivers/staging/iio/imu/adis16400_core.c
+++ b/drivers/staging/iio/imu/adis16400_core.c
@@ -234,6 +234,8 @@ static ssize_t adis16400_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7753.c b/drivers/staging/iio/meter/ade7753.c
index f04ece7fbc2f..3ccff189f258 100644
--- a/drivers/staging/iio/meter/ade7753.c
+++ b/drivers/staging/iio/meter/ade7753.c
@@ -425,6 +425,8 @@ static ssize_t ade7753_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7754.c b/drivers/staging/iio/meter/ade7754.c
index 6cee28a5e877..abb1e9c8d094 100644
--- a/drivers/staging/iio/meter/ade7754.c
+++ b/drivers/staging/iio/meter/ade7754.c
@@ -445,6 +445,8 @@ static ssize_t ade7754_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/iio/meter/ade7759.c b/drivers/staging/iio/meter/ade7759.c
index b3f7e0fa9612..eb0a2a98f388 100644
--- a/drivers/staging/iio/meter/ade7759.c
+++ b/drivers/staging/iio/meter/ade7759.c
@@ -385,6 +385,8 @@ static ssize_t ade7759_write_frequency(struct device *dev,
         ret = strict_strtol(buf, 10, &val);
         if (ret)
                 return ret;
+        if (val == 0)
+                return -EINVAL;
 
         mutex_lock(&indio_dev->mlock);
 
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 695ea35f75b0..d0a7e408efe9 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -837,7 +837,7 @@ static int __devinit tegra_nvec_probe(struct platform_device *pdev)
         }
 
         ret = mfd_add_devices(nvec->dev, -1, nvec_devices,
-                              ARRAY_SIZE(nvec_devices), base, 0);
+                              ARRAY_SIZE(nvec_devices), base, 0, NULL);
         if (ret)
                 dev_err(nvec->dev, "error adding subdevices\n");
 
diff --git a/drivers/staging/omapdrm/omap_connector.c b/drivers/staging/omapdrm/omap_connector.c
index 5e2856c0e0bb..55e9c8655850 100644
--- a/drivers/staging/omapdrm/omap_connector.c
+++ b/drivers/staging/omapdrm/omap_connector.c
@@ -48,13 +48,20 @@ static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
         mode->vsync_end = mode->vsync_start + timings->vsw;
         mode->vtotal = mode->vsync_end + timings->vbp;
 
-        /* note: whether or not it is interlaced, +/- h/vsync, etc,
-         * which should be set in the mode flags, is not exposed in
-         * the omap_video_timings struct.. but hdmi driver tracks
-         * those separately so all we have to have to set the mode
-         * is the way to recover these timings values, and the
-         * omap_dss_driver would do the rest.
-         */
+        mode->flags = 0;
+
+        if (timings->interlace)
+                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+
+        if (timings->hsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
+                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NHSYNC;
+
+        if (timings->vsync_level == OMAPDSS_SIG_ACTIVE_HIGH)
+                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+        else
+                mode->flags |= DRM_MODE_FLAG_NVSYNC;
 }
 
 static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
@@ -71,6 +78,22 @@ static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
         timings->vfp = mode->vsync_start - mode->vdisplay;
         timings->vsw = mode->vsync_end - mode->vsync_start;
         timings->vbp = mode->vtotal - mode->vsync_end;
+
+        timings->interlace = !!(mode->flags & DRM_MODE_FLAG_INTERLACE);
+
+        if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->hsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+
+        if (mode->flags & DRM_MODE_FLAG_PVSYNC)
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        else
+                timings->vsync_level = OMAPDSS_SIG_ACTIVE_LOW;
+
+        timings->data_pclk_edge = OMAPDSS_DRIVE_SIG_RISING_EDGE;
+        timings->de_level = OMAPDSS_SIG_ACTIVE_HIGH;
+        timings->sync_pclk_edge = OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES;
 }
 
 static void omap_connector_dpms(struct drm_connector *connector, int mode)
@@ -187,7 +210,7 @@ static int omap_connector_get_modes(struct drm_connector *connector)
                 }
         } else {
                 struct drm_display_mode *mode = drm_mode_create(dev);
-                struct omap_video_timings timings;
+                struct omap_video_timings timings = {0};
 
                 dssdrv->get_timings(dssdev, &timings);
 
@@ -291,7 +314,7 @@ void omap_connector_mode_set(struct drm_connector *connector,
         struct omap_connector *omap_connector = to_omap_connector(connector);
         struct omap_dss_device *dssdev = omap_connector->dssdev;
         struct omap_dss_driver *dssdrv = dssdev->driver;
-        struct omap_video_timings timings;
+        struct omap_video_timings timings = {0};
 
         copy_timings_drm_to_omap(&timings, mode);
 
diff --git a/drivers/staging/ozwpan/ozcdev.c b/drivers/staging/ozwpan/ozcdev.c
index d98321945802..758ce0a8d82e 100644
--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -8,6 +8,7 @@
 #include <linux/cdev.h>
 #include <linux/uaccess.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include "ozconfig.h"
@@ -213,7 +214,7 @@ static int oz_set_active_pd(u8 *addr)
                 if (old_pd)
                         oz_pd_put(old_pd);
         } else {
-                if (!memcmp(addr, "\0\0\0\0\0\0", sizeof(addr))) {
+                if (is_zero_ether_addr(addr)) {
                         spin_lock_bh(&g_cdev.lock);
                         pd = g_cdev.active_pd;
                         g_cdev.active_pd = 0;
diff --git a/drivers/staging/rtl8712/recv_linux.c b/drivers/staging/rtl8712/recv_linux.c
index 0e26d5f6cf2d..495ee1205e02 100644
--- a/drivers/staging/rtl8712/recv_linux.c
+++ b/drivers/staging/rtl8712/recv_linux.c
@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adapter *padapter,
         if (skb == NULL)
                 goto _recv_indicatepkt_drop;
         skb->data = precv_frame->u.hdr.rx_data;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-        skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
-                     precv_frame->u.hdr.rx_head);
-#else
-        skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
-#endif
         skb->len = precv_frame->u.hdr.len;
+        skb_set_tail_pointer(skb, skb->len);
         if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
index e4bdf2a2b582..3aa895ec6507 100644
--- a/drivers/staging/vt6656/dpc.c
+++ b/drivers/staging/vt6656/dpc.c
@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
     } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
         cbHeaderSize += 6;
         pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
-        if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
+        if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
             (*pwType == cpu_to_le16(0xF380))) {
                 cbHeaderSize -= 8;
             pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index bb464527fc1b..b6e04e7b629b 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -1699,7 +1699,7 @@ s_bPacketToWirelessUsb(
     // 802.1H
     if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
         if (pDevice->dwDiagRefCount == 0) {
-                if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
+                if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
                     (psEthHeader->wType == cpu_to_le16(0xF380))) {
                         memcpy((PBYTE) (pbyPayloadHead),
                                abySNAP_Bridgetunnel, 6);
@@ -2838,10 +2838,10 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
     Packet_Type = skb->data[ETH_HLEN+1];
     Descriptor_type = skb->data[ETH_HLEN+1+1+2];
     Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-        /* 802.1x OR eapol-key challenge frame transfer */
-        if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
-                (Packet_Type == 3)) {
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+                /* 802.1x OR eapol-key challenge frame transfer */
+                if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+                        (Packet_Type == 3)) {
                         bTxeapol_key = TRUE;
                        if(!(Key_info & BIT3) &&  //WPA or RSN group-key challenge
                            (Key_info & BIT8) && (Key_info & BIT9)) {    //send 2/2 key
@@ -2987,19 +2987,19 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
         }
     }
 
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-        if (pDevice->byBBType != BB_TYPE_11A) {
-            pDevice->wCurrentRate = RATE_1M;
-            pDevice->byACKRate = RATE_1M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        } else {
-            pDevice->wCurrentRate = RATE_6M;
-            pDevice->byACKRate = RATE_6M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        }
-    }
+        if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+                if (pDevice->byBBType != BB_TYPE_11A) {
+                        pDevice->wCurrentRate = RATE_1M;
+                        pDevice->byACKRate = RATE_1M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
+                } else {
+                        pDevice->wCurrentRate = RATE_6M;
+                        pDevice->byACKRate = RATE_6M;
+                        pDevice->byTopCCKBasicRate = RATE_1M;
+                        pDevice->byTopOFDMBasicRate = RATE_6M;
+                }
+        }
 
     DBG_PRT(MSG_LEVEL_DEBUG,
             KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
@@ -3015,7 +3015,7 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
 
     if (bNeedEncryption == TRUE) {
         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
-        if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
+        if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
                 bNeedEncryption = FALSE;
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index fabff4d650ef..0970127344e6 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -327,9 +327,9 @@ int prism2_get_station(struct wiphy *wiphy, struct net_device *dev,
         return result;
 }
 
-int prism2_scan(struct wiphy *wiphy, struct net_device *dev,
-                struct cfg80211_scan_request *request)
+int prism2_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
 {
+        struct net_device *dev = request->wdev->netdev;
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = dev->ml_priv;
         struct p80211msg_dot11req_scan msg1;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index c214977b4ab4..52b43b7b83d7 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1251,13 +1251,12 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
                                         void *pampd, struct tmem_pool *pool,
                                         struct tmem_oid *oid, uint32_t index)
 {
-        int ret = 0;
-
         BUG_ON(!is_ephemeral(pool));
-        zbud_decompress((struct page *)(data), pampd);
+        if (zbud_decompress((struct page *)(data), pampd) < 0)
+                return -EINVAL;
         zbud_free_and_delist((struct zbud_hdr *)pampd);
         atomic_dec(&zcache_curr_eph_pampd_count);
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 0694d9b1bce6..6aba4395e8d8 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -221,6 +221,7 @@ static int iscsi_login_zero_tsih_s1(
 {
         struct iscsi_session *sess = NULL;
         struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;
+        int ret;
 
         sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);
         if (!sess) {
@@ -257,9 +258,17 @@ static int iscsi_login_zero_tsih_s1(
                 return -ENOMEM;
         }
         spin_lock(&sess_idr_lock);
-        idr_get_new(&sess_idr, NULL, &sess->session_index);
+        ret = idr_get_new(&sess_idr, NULL, &sess->session_index);
         spin_unlock(&sess_idr_lock);
 
+        if (ret < 0) {
+                pr_err("idr_get_new() for sess_idr failed\n");
+                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                kfree(sess);
+                return -ENOMEM;
+        }
+
         sess->creation_time = get_jiffies_64();
         spin_lock_init(&sess->session_stats_lock);
         /*
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 0c4760fabfc0..240f7aa76ed1 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -662,7 +662,7 @@ int iscsi_extract_key_value(char *textbuf, char **key, char **value)
 {
         *value = strchr(textbuf, '=');
         if (!*value) {
-                pr_err("Unable to locate \"=\" seperator for key,"
+                pr_err("Unable to locate \"=\" separator for key,"
                                 " ignoring request.\n");
                 return -1;
         }
@@ -1269,7 +1269,7 @@ static int iscsi_check_value(struct iscsi_param *param, char *value)
                 comma_ptr = strchr(value, ',');
 
                 if (comma_ptr && !IS_TYPE_VALUE_LIST(param)) {
-                        pr_err("Detected value seperator \",\", but"
+                        pr_err("Detected value separator \",\", but"
                                 " key \"%s\" does not allow a value list,"
                                 " protocol error.\n", param->name);
                         return -1;
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 91799973081a..41641ba54828 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -218,6 +218,13 @@ int target_emulate_set_target_port_groups(struct se_cmd *cmd)
                 cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return -EINVAL;
         }
+        if (cmd->data_length < 4) {
+                pr_warn("SET TARGET PORT GROUPS parameter list length %u too"
+                        " small\n", cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(cmd);
 
         /*
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index cf2c66f3c116..9fc9a6006ca0 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -669,6 +669,13 @@ int target_report_luns(struct se_cmd *se_cmd)
         unsigned char *buf;
         u32 lun_count = 0, offset = 8, i;
 
+        if (se_cmd->data_length < 16) {
+                pr_warn("REPORT LUNS allocation length %u too small\n",
+                        se_cmd->data_length);
+                se_cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(se_cmd);
         if (!buf)
                 return -ENOMEM;
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 76db75e836ed..9ba495477fd2 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -325,17 +325,30 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
         struct iblock_dev *ibd = dev->dev_ptr;
         unsigned char *buf, *ptr = NULL;
         sector_t lba;
-        int size = cmd->data_length;
+        int size;
         u32 range;
         int ret = 0;
         int dl, bd_dl;
 
+        if (cmd->data_length < 8) {
+                pr_warn("UNMAP parameter list length %u too small\n",
+                        cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(cmd);
 
         dl = get_unaligned_be16(&buf[0]);
         bd_dl = get_unaligned_be16(&buf[2]);
 
-        size = min(size - 8, bd_dl);
+        size = cmd->data_length - 8;
+        if (bd_dl > size)
+                pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
+                        cmd->data_length, bd_dl);
+        else
+                size = bd_dl;
+
         if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
                 cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
                 ret = -EINVAL;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 1e946502c378..956c84c6b666 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1540,6 +1540,14 @@ static int core_scsi3_decode_spec_i_port(
         tidh_new->dest_local_nexus = 1;
         list_add_tail(&tidh_new->dest_list, &tid_dest_list);
 
+        if (cmd->data_length < 28) {
+                pr_warn("SPC-PR: Received PR OUT parameter list"
+                        " length too small: %u\n", cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                ret = -EINVAL;
+                goto out;
+        }
+
         buf = transport_kmap_data_sg(cmd);
         /*
          * For a PERSISTENT RESERVE OUT specify initiator ports payload,
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 5552fa7426bc..9d7ce3daa262 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -667,7 +667,8 @@ static void pscsi_free_device(void *p)
         kfree(pdv);
 }
 
-static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
+static void pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg,
+                                     unsigned char *sense_buffer)
 {
         struct pscsi_dev_virt *pdv = cmd->se_dev->dev_ptr;
         struct scsi_device *sd = pdv->pdv_sd;
@@ -679,7 +680,7 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
          * not been allocated because TCM is handling the emulation directly.
          */
         if (!pt)
-                return 0;
+                return;
 
         cdb = &pt->pscsi_cdb[0];
         result = pt->pscsi_result;
@@ -687,11 +688,11 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
          * Hack to make sure that Write-Protect modepage is set if R/O mode is
          * forced.
          */
+        if (!cmd->se_deve || !cmd->data_length)
+                goto after_mode_sense;
+
         if (((cdb[0] == MODE_SENSE) || (cdb[0] == MODE_SENSE_10)) &&
              (status_byte(result) << 1) == SAM_STAT_GOOD) {
-                if (!cmd->se_deve)
-                        goto after_mode_sense;
-
                 if (cmd->se_deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY) {
                         unsigned char *buf = transport_kmap_data_sg(cmd);
 
@@ -708,7 +709,7 @@ static int pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg)
         }
 after_mode_sense:
 
-        if (sd->type != TYPE_TAPE)
+        if (sd->type != TYPE_TAPE || !cmd->data_length)
                 goto after_mode_select;
 
         /*
@@ -750,10 +751,10 @@ after_mode_sense:
         }
 after_mode_select:
 
-        if (status_byte(result) & CHECK_CONDITION)
-                return 1;
-
-        return 0;
+        if (sense_buffer && (status_byte(result) & CHECK_CONDITION)) {
+                memcpy(sense_buffer, pt->pscsi_sense, TRANSPORT_SENSE_BUFFER);
+                cmd->se_cmd_flags |= SCF_TRANSPORT_TASK_SENSE;
+        }
 }
 
 enum {
@@ -1184,13 +1185,6 @@ fail:
         return -ENOMEM;
 }
 
-static unsigned char *pscsi_get_sense_buffer(struct se_cmd *cmd)
-{
-        struct pscsi_plugin_task *pt = cmd->priv;
-
-        return pt->pscsi_sense;
-}
-
 /*      pscsi_get_device_rev():
  *
  *
@@ -1273,7 +1267,6 @@ static struct se_subsystem_api pscsi_template = {
         .check_configfs_dev_params = pscsi_check_configfs_dev_params,
         .set_configfs_dev_params = pscsi_set_configfs_dev_params,
         .show_configfs_dev_params = pscsi_show_configfs_dev_params,
-        .get_sense_buffer       = pscsi_get_sense_buffer,
         .get_device_rev         = pscsi_get_device_rev,
         .get_device_type        = pscsi_get_device_type,
         .get_blocks             = pscsi_get_blocks,
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 4c861de538c9..388a922c8f6d 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -877,9 +877,11 @@ static int spc_emulate_modesense(struct se_cmd *cmd)
 static int spc_emulate_request_sense(struct se_cmd *cmd)
 {
         unsigned char *cdb = cmd->t_task_cdb;
-        unsigned char *buf;
+        unsigned char *rbuf;
         u8 ua_asc = 0, ua_ascq = 0;
-        int err = 0;
+        unsigned char buf[SE_SENSE_BUF];
+
+        memset(buf, 0, SE_SENSE_BUF);
 
         if (cdb[1] & 0x01) {
                 pr_err("REQUEST_SENSE description emulation not"
@@ -888,20 +890,21 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 return -ENOSYS;
         }
 
-        buf = transport_kmap_data_sg(cmd);
-
-        if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
+        rbuf = transport_kmap_data_sg(cmd);
+        if (cmd->scsi_sense_reason != 0) {
+                /*
+                 * Out of memory.  We will fail with CHECK CONDITION, so
+                 * we must not clear the unit attention condition.
+                 */
+                target_complete_cmd(cmd, CHECK_CONDITION);
+                return 0;
+        } else if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
                 /*
                  * CURRENT ERROR, UNIT ATTENTION
                  */
                 buf[0] = 0x70;
                 buf[SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
 
-                if (cmd->data_length < 18) {
-                        buf[7] = 0x00;
-                        err = -EINVAL;
-                        goto end;
-                }
                 /*
                  * The Additional Sense Code (ASC) from the UNIT ATTENTION
                  */
@@ -915,11 +918,6 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 buf[0] = 0x70;
                 buf[SPC_SENSE_KEY_OFFSET] = NO_SENSE;
 
-                if (cmd->data_length < 18) {
-                        buf[7] = 0x00;
-                        err = -EINVAL;
-                        goto end;
-                }
                 /*
                  * NO ADDITIONAL SENSE INFORMATION
                  */
@@ -927,8 +925,11 @@ static int spc_emulate_request_sense(struct se_cmd *cmd)
                 buf[7] = 0x0A;
         }
 
-end:
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
+
         target_complete_cmd(cmd, GOOD);
         return 0;
 }
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 4de3186dc44e..269f54488397 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -567,6 +567,34 @@ static void target_complete_failure_work(struct work_struct *work)
         transport_generic_request_failure(cmd);
 }
 
+/*
+ * Used when asking transport to copy Sense Data from the underlying
+ * Linux/SCSI struct scsi_cmnd
+ */
+static unsigned char *transport_get_sense_buffer(struct se_cmd *cmd)
+{
+        unsigned char *buffer = cmd->sense_buffer;
+        struct se_device *dev = cmd->se_dev;
+        u32 offset = 0;
+
+        WARN_ON(!cmd->se_lun);
+
+        if (!dev)
+                return NULL;
+
+        if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION)
+                return NULL;
+
+        offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
+
+        /* Automatically padded */
+        cmd->scsi_sense_length = TRANSPORT_SENSE_BUFFER + offset;
+
+        pr_debug("HBA_[%u]_PLUG[%s]: Requesting sense for SAM STATUS: 0x%02x\n",
+                dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
+        return &buffer[offset];
+}
+
 void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
 {
         struct se_device *dev = cmd->se_dev;
@@ -580,11 +608,11 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         cmd->transport_state &= ~CMD_T_BUSY;
 
         if (dev && dev->transport->transport_complete) {
-                if (dev->transport->transport_complete(cmd,
-                                cmd->t_data_sg) != 0) {
-                        cmd->se_cmd_flags |= SCF_TRANSPORT_TASK_SENSE;
+                dev->transport->transport_complete(cmd,
+                                cmd->t_data_sg,
+                                transport_get_sense_buffer(cmd));
+                if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)
                         success = 1;
-                }
         }
 
         /*
@@ -1181,15 +1209,20 @@ int target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
                         /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
                         goto out_invalid_cdb_field;
                 }
-
+                /*
+                 * For the overflow case keep the existing fabric provided
+                 * ->data_length.  Otherwise for the underflow case, reset
+                 * ->data_length to the smaller SCSI expected data transfer
+                 * length.
+                 */
                 if (size > cmd->data_length) {
                         cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
                         cmd->residual_count = (size - cmd->data_length);
                 } else {
                         cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
                         cmd->residual_count = (cmd->data_length - size);
+                        cmd->data_length = size;
                 }
-                cmd->data_length = size;
         }
 
         return 0;
@@ -1816,61 +1849,6 @@ execute:
 EXPORT_SYMBOL(target_execute_cmd);
 
 /*
- * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
- */
-static int transport_get_sense_data(struct se_cmd *cmd)
-{
-        unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
-        struct se_device *dev = cmd->se_dev;
-        unsigned long flags;
-        u32 offset = 0;
-
-        WARN_ON(!cmd->se_lun);
-
-        if (!dev)
-                return 0;
-
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                return 0;
-        }
-
-        if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
-                goto out;
-
-        if (!dev->transport->get_sense_buffer) {
-                pr_err("dev->transport->get_sense_buffer is NULL\n");
-                goto out;
-        }
-
-        sense_buffer = dev->transport->get_sense_buffer(cmd);
-        if (!sense_buffer) {
-                pr_err("ITT 0x%08x cmd %p: Unable to locate"
-                        " sense buffer for task with sense\n",
-                        cmd->se_tfo->get_task_tag(cmd), cmd);
-                goto out;
-        }
-
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-
-        offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
-
-        memcpy(&buffer[offset], sense_buffer, TRANSPORT_SENSE_BUFFER);
-
-        /* Automatically padded */
-        cmd->scsi_sense_length = TRANSPORT_SENSE_BUFFER + offset;
-
-        pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
-                dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
-        return 0;
-
-out:
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-        return -1;
-}
-
-/*
  * Process all commands up to the last received ORDERED task attribute which
  * requires another blocking boundary
  */
@@ -1985,7 +1963,7 @@ static void transport_handle_queue_full(
 static void target_complete_ok_work(struct work_struct *work)
 {
         struct se_cmd *cmd = container_of(work, struct se_cmd, work);
-        int reason = 0, ret;
+        int ret;
 
         /*
          * Check if we need to move delayed/dormant tasks from cmds on the
@@ -2002,23 +1980,19 @@ static void target_complete_ok_work(struct work_struct *work)
                 schedule_work(&cmd->se_dev->qf_work_queue);
 
         /*
-         * Check if we need to retrieve a sense buffer from
+         * Check if we need to send a sense buffer from
          * the struct se_cmd in question.
          */
         if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-                if (transport_get_sense_data(cmd) < 0)
-                        reason = TCM_NON_EXISTENT_LUN;
-
-                if (cmd->scsi_status) {
-                        ret = transport_send_check_condition_and_sense(
-                                        cmd, reason, 1);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
-                                goto queue_full;
+                WARN_ON(!cmd->scsi_status);
+                ret = transport_send_check_condition_and_sense(
+                                        cmd, 0, 1);
+                if (ret == -EAGAIN || ret == -ENOMEM)
+                        goto queue_full;
 
-                        transport_lun_remove_cmd(cmd);
-                        transport_cmd_check_stop_to_fabric(cmd);
-                        return;
-                }
+                transport_lun_remove_cmd(cmd);
+                transport_cmd_check_stop_to_fabric(cmd);
+                return;
         }
         /*
          * Check for a callback, used by amongst other things
@@ -2216,7 +2190,6 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
         struct page **pages;
         int i;
 
-        BUG_ON(!sg);
         /*
          * We need to take into account a possible offset here for fabrics like
          * tcm_loop who may be using a contig buffer from the SCSI midlayer for
@@ -2224,13 +2197,17 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
          */
         if (!cmd->t_data_nents)
                 return NULL;
-        else if (cmd->t_data_nents == 1)
+
+        BUG_ON(!sg);
+        if (cmd->t_data_nents == 1)
                 return kmap(sg_page(sg)) + sg->offset;
 
         /* >1 page. use vmap */
         pages = kmalloc(sizeof(*pages) * cmd->t_data_nents, GFP_KERNEL);
-        if (!pages)
+        if (!pages) {
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return NULL;
+        }
 
         /* convert sg[] to pages[] */
         for_each_sg(cmd->t_data_sg, sg, cmd->t_data_nents, i) {
@@ -2239,8 +2216,10 @@ void *transport_kmap_data_sg(struct se_cmd *cmd)
 
         cmd->t_data_vmap = vmap(pages, cmd->t_data_nents,  VM_MAP, PAGE_KERNEL);
         kfree(pages);
-        if (!cmd->t_data_vmap)
+        if (!cmd->t_data_vmap) {
+                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 return NULL;
+        }
 
         return cmd->t_data_vmap + cmd->t_data_sg[0].offset;
 }
@@ -2326,19 +2305,14 @@ int transport_generic_new_cmd(struct se_cmd *cmd)
          * into the fabric for data transfers, go ahead and complete it right
          * away.
          */
-        if (!cmd->data_length) {
+        if (!cmd->data_length &&
+            cmd->t_task_cdb[0] != REQUEST_SENSE &&
+            cmd->se_dev->transport->transport_type != TRANSPORT_PLUGIN_PHBA_PDEV) {
                 spin_lock_irq(&cmd->t_state_lock);
                 cmd->t_state = TRANSPORT_COMPLETE;
                 cmd->transport_state |= CMD_T_ACTIVE;
                 spin_unlock_irq(&cmd->t_state_lock);
 
-                if (cmd->t_task_cdb[0] == REQUEST_SENSE) {
-                        u8 ua_asc = 0, ua_ascq = 0;
-
-                        core_scsi3_ua_clear_for_request_sense(cmd,
-                                        &ua_asc, &ua_ascq);
-                }
-
                 INIT_WORK(&cmd->work, target_complete_ok_work);
                 queue_work(target_completion_wq, &cmd->work);
                 return 0;
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index d5c689d6217e..e309e8b0aaba 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -132,6 +132,7 @@
 #define  UCR4_OREN       (1<<1)  /* Receiver overrun interrupt enable */
 #define  UCR4_DREN       (1<<0)  /* Recv data ready interrupt enable */
 #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
+#define  UFCR_DCEDTE     (1<<6)  /* DCE/DTE mode select */
 #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
 #define  UFCR_RFDIV_REG(x)      (((x) < 7 ? 6 - (x) : 6) << 7)
 #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
@@ -667,22 +668,11 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
 static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
 {
         unsigned int val;
-        unsigned int ufcr_rfdiv;
-
-        /* set receiver / transmitter trigger level.
-         * RFDIV is set such way to satisfy requested uartclk value
-         */
-        val = TXTL << 10 | RXTL;
-        ufcr_rfdiv = (clk_get_rate(sport->clk_per) + sport->port.uartclk / 2)
-                        / sport->port.uartclk;
-
-        if(!ufcr_rfdiv)
-                ufcr_rfdiv = 1;
-
-        val |= UFCR_RFDIV_REG(ufcr_rfdiv);
 
+        /* set receiver / transmitter trigger level */
+        val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
+        val |= TXTL << UFCR_TXTL_SHF | RXTL;
         writel(val, sport->port.membase + UFCR);
-
         return 0;
 }
 
@@ -754,6 +744,7 @@ static int imx_startup(struct uart_port *port)
                 }
         }
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         /*
          * Finally, clear and enable interrupts
          */
@@ -807,7 +798,6 @@ static int imx_startup(struct uart_port *port)
         /*
          * Enable modem status interrupts
          */
-        spin_lock_irqsave(&sport->port.lock,flags);
         imx_enable_ms(&sport->port);
         spin_unlock_irqrestore(&sport->port.lock,flags);
 
@@ -837,10 +827,13 @@ static void imx_shutdown(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
         unsigned long temp;
+        unsigned long flags;
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         temp = readl(sport->port.membase + UCR2);
         temp &= ~(UCR2_TXEN);
         writel(temp, sport->port.membase + UCR2);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 
         if (USE_IRDA(sport)) {
                 struct imxuart_platform_data *pdata;
@@ -869,12 +862,14 @@ static void imx_shutdown(struct uart_port *port)
          * Disable all interrupts, port and break condition.
          */
 
+        spin_lock_irqsave(&sport->port.lock, flags);
         temp = readl(sport->port.membase + UCR1);
         temp &= ~(UCR1_TXMPTYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN);
         if (USE_IRDA(sport))
                 temp &= ~(UCR1_IREN);
 
         writel(temp, sport->port.membase + UCR1);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 static void
@@ -1217,6 +1212,9 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         struct imx_port *sport = imx_ports[co->index];
         struct imx_port_ucrs old_ucr;
         unsigned int ucr1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&sport->port.lock, flags);
 
         /*
          *      First, save UCR1/2/3 and then disable interrupts
@@ -1242,6 +1240,8 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         while (!(readl(sport->port.membase + USR2) & USR2_TXDC));
 
         imx_port_ucrs_restore(&sport->port, &old_ucr);
+
+        spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 /*
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index c7a032a4f0c5..d214448b677e 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -78,8 +78,7 @@ static inline int ep_to_bit(struct ci13xxx *ci, int n)
 }
 
 /**
- * hw_device_state: enables/disables interrupts & starts/stops device (execute
- *                  without interruption)
+ * hw_device_state: enables/disables interrupts (execute without interruption)
  * @dma: 0 => disable, !0 => enable and set dma engine
  *
  * This function returns an error code
@@ -91,9 +90,7 @@ static int hw_device_state(struct ci13xxx *ci, u32 dma)
                 /* interrupt, error, port change, reset, sleep/suspend */
                 hw_write(ci, OP_USBINTR, ~0,
                              USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
-                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
         } else {
-                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
                 hw_write(ci, OP_USBINTR, ~0, 0);
         }
         return 0;
@@ -774,10 +771,7 @@ __acquires(mEp->lock)
 {
         struct ci13xxx_req *mReq, *mReqTemp;
         struct ci13xxx_ep *mEpTemp = mEp;
-        int uninitialized_var(retval);
-
-        if (list_empty(&mEp->qh.queue))
-                return -EINVAL;
+        int retval = 0;
 
         list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
                         queue) {
@@ -1420,6 +1414,21 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
         return -ENOTSUPP;
 }
 
+/* Change Data+ pullup status
+ * this func is used by usb_gadget_connect/disconnet
+ */
+static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
+{
+        struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
+
+        if (is_on)
+                hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
+        else
+                hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
+
+        return 0;
+}
+
 static int ci13xxx_start(struct usb_gadget *gadget,
                          struct usb_gadget_driver *driver);
 static int ci13xxx_stop(struct usb_gadget *gadget,
@@ -1432,6 +1441,7 @@ static int ci13xxx_stop(struct usb_gadget *gadget,
 static const struct usb_gadget_ops usb_gadget_ops = {
         .vbus_session   = ci13xxx_vbus_session,
         .wakeup         = ci13xxx_wakeup,
+        .pullup         = ci13xxx_pullup,
         .vbus_draw      = ci13xxx_vbus_draw,
         .udc_start      = ci13xxx_start,
         .udc_stop       = ci13xxx_stop,
@@ -1455,7 +1465,12 @@ static int init_eps(struct ci13xxx *ci)
 
                         mEp->ep.name      = mEp->name;
                         mEp->ep.ops       = &usb_ep_ops;
-                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+                        /*
+                         * for ep0: maxP defined in desc, for other
+                         * eps, maxP is set by epautoconfig() called
+                         * by gadget layer
+                         */
+                        mEp->ep.maxpacket = (unsigned short)~0;
 
                         INIT_LIST_HEAD(&mEp->qh.queue);
                         mEp->qh.ptr = dma_pool_alloc(ci->qh_pool, GFP_KERNEL,
@@ -1475,6 +1490,7 @@ static int init_eps(struct ci13xxx *ci)
                                 else
                                         ci->ep0in = mEp;
 
+                                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
                                 continue;
                         }
 
@@ -1484,6 +1500,17 @@ static int init_eps(struct ci13xxx *ci)
         return retval;
 }
 
+static void destroy_eps(struct ci13xxx *ci)
+{
+        int i;
+
+        for (i = 0; i < ci->hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
+
+                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+        }
+}
+
 /**
  * ci13xxx_start: register a gadget driver
  * @gadget: our gadget
@@ -1691,7 +1718,7 @@ static int udc_start(struct ci13xxx *ci)
         if (ci->platdata->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
                 if (ci->transceiver == NULL) {
                         retval = -ENODEV;
-                        goto free_pools;
+                        goto destroy_eps;
                 }
         }
 
@@ -1729,7 +1756,7 @@ static int udc_start(struct ci13xxx *ci)
 
 remove_trans:
         if (!IS_ERR_OR_NULL(ci->transceiver)) {
-                otg_set_peripheral(ci->transceiver->otg, &ci->gadget);
+                otg_set_peripheral(ci->transceiver->otg, NULL);
                 if (ci->global_phy)
                         usb_put_phy(ci->transceiver);
         }
@@ -1742,6 +1769,8 @@ unreg_device:
 put_transceiver:
         if (!IS_ERR_OR_NULL(ci->transceiver) && ci->global_phy)
                 usb_put_phy(ci->transceiver);
+destroy_eps:
+        destroy_eps(ci);
 free_pools:
         dma_pool_destroy(ci->td_pool);
 free_qh_pool:
@@ -1756,18 +1785,12 @@ free_qh_pool:
  */
 static void udc_stop(struct ci13xxx *ci)
 {
-        int i;
-
         if (ci == NULL)
                 return;
 
         usb_del_gadget_udc(&ci->gadget);
 
-        for (i = 0; i < ci->hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &ci->ci13xxx_ep[i];
-
-                dma_pool_free(ci->qh_pool, mEp->qh.ptr, mEp->qh.dma);
-        }
+        destroy_eps(ci);
 
         dma_pool_destroy(ci->td_pool);
         dma_pool_destroy(ci->qh_pool);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 65a55abb791f..5f0cb417b736 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -109,12 +109,14 @@ static struct usb_driver wdm_driver;
 /* return intfdata if we own the interface, else look up intf in the list */
 static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
 
         spin_lock(&wdm_device_list_lock);
         list_for_each_entry(desc, &wdm_device_list, device_list)
                 if (desc->intf == intf)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
         spin_unlock(&wdm_device_list_lock);
 
         return desc;
@@ -122,12 +124,14 @@ static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 
 static struct wdm_device *wdm_find_device_by_minor(int minor)
 {
-        struct wdm_device *desc = NULL;
+        struct wdm_device *desc;
 
         spin_lock(&wdm_device_list_lock);
         list_for_each_entry(desc, &wdm_device_list, device_list)
                 if (desc->intf->minor == minor)
-                        break;
+                        goto found;
+        desc = NULL;
+found:
         spin_unlock(&wdm_device_list_lock);
 
         return desc;
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index d95696584762..3440812b4a84 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,
         /* print devices for all busses */
         list_for_each_entry(bus, &usb_bus_list, bus_list) {
                 /* recurse through all children of the root hub */
-                if (!bus->root_hub)
+                if (!bus_to_hcd(bus)->rh_registered)
                         continue;
                 usb_lock_device(bus->root_hub);
                 ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index bc84106ac057..75ba2091f9b4 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)
         if (retval) {
                 dev_err (parent_dev, "can't register root hub for %s, %d\n",
                                 dev_name(&usb_dev->dev), retval);
-        }
-        mutex_unlock(&usb_bus_list_lock);
-
-        if (retval == 0) {
+        } else {
                 spin_lock_irq (&hcd_root_hub_lock);
                 hcd->rh_registered = 1;
                 spin_unlock_irq (&hcd_root_hub_lock);
@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_hcd *hcd)
                 if (HCD_DEAD(hcd))
                         usb_hc_died (hcd);      /* This time clean up */
         }
+        mutex_unlock(&usb_bus_list_lock);
 
         return retval;
 }
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f15501f4c585..e77a8e8eaa23 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -71,6 +71,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04b4, 0x0526), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Microchip Joss Optical infrared touchboard device */
+        { USB_DEVICE(0x04d8, 0x000c), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* Samsung Android phone modem - ID conflict with SPH-I500 */
         { USB_DEVICE(0x04e8, 0x6601), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index c34452a7304f..a68ff53124dc 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -436,16 +436,21 @@ static int __devinit dwc3_probe(struct platform_device *pdev)
                 dev_err(dev, "missing IRQ\n");
                 return -ENODEV;
         }
-        dwc->xhci_resources[1] = *res;
+        dwc->xhci_resources[1].start = res->start;
+        dwc->xhci_resources[1].end = res->end;
+        dwc->xhci_resources[1].flags = res->flags;
+        dwc->xhci_resources[1].name = res->name;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(dev, "missing memory resource\n");
                 return -ENODEV;
         }
-        dwc->xhci_resources[0] = *res;
+        dwc->xhci_resources[0].start = res->start;
         dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
                                         DWC3_XHCI_REGS_END;
+        dwc->xhci_resources[0].flags = res->flags;
+        dwc->xhci_resources[0].name = res->name;
 
          /*
           * Request memory region but exclude xHCI regs,
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 9b94886b66e5..e4d5ca86b9da 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -720,7 +720,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 transferred = min_t(u32, ur->length,
                                 transfer_size - length);
                 memcpy(ur->buf, dwc->ep0_bounce, transferred);
-                dwc->ep0_bounced = false;
         } else {
                 transferred = ur->length - length;
         }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 58fdfad96b4d..c2813c2b005a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -263,8 +263,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
 
-        usb_gadget_unmap_request(&dwc->gadget, &req->request,
-                        req->direction);
+        if (dwc->ep0_bounced && dep->number == 0)
+                dwc->ep0_bounced = false;
+        else
+                usb_gadget_unmap_request(&dwc->gadget, &req->request,
+                                req->direction);
 
         dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
                         req, dep->name, req->request.actual,
@@ -1026,6 +1029,7 @@ static void __dwc3_gadget_start_isoc(struct dwc3 *dwc,
         if (list_empty(&dep->request_list)) {
                 dev_vdbg(dwc->dev, "ISOC ep %s run out for requests.\n",
                         dep->name);
+                dep->flags |= DWC3_EP_PENDING_REQUEST;
                 return;
         }
 
@@ -1089,6 +1093,17 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
         if (dep->flags & DWC3_EP_PENDING_REQUEST) {
                 int     ret;
 
+                /*
+                 * If xfernotready is already elapsed and it is a case
+                 * of isoc transfer, then issue END TRANSFER, so that
+                 * you can receive xfernotready again and can have
+                 * notion of current microframe.
+                 */
+                if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                        dwc3_stop_active_transfer(dwc, dep->number);
+                        return 0;
+                }
+
                 ret = __dwc3_gadget_kick_transfer(dep, 0, true);
                 if (ret && ret != -EBUSY) {
                         struct dwc3     *dwc = dep->dwc;
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index c9e66dfb02e6..1e35963bd4ed 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep *_ep,
         unsigned long   flags;
 
         if (!_ep || !ep
-                        || !desc || ep->ep.desc
-                        || _ep->name == ep0name
+                        || !desc || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || (maxpacket = usb_endpoint_maxp(desc)) == 0
                         || maxpacket > ep->maxpacket) {
@@ -530,7 +529,6 @@ ok:
         tmp |= AT91_UDP_EPEDS;
         __raw_writel(tmp, ep->creg);
 
-        ep->ep.desc = desc;
         ep->ep.maxpacket = maxpacket;
 
         /*
@@ -1635,7 +1633,6 @@ static int at91_start(struct usb_gadget *gadget,
         udc->driver = driver;
         udc->gadget.dev.driver = &driver->driver;
         udc->gadget.dev.of_node = udc->pdev->dev.of_node;
-        dev_set_drvdata(&udc->gadget.dev, &driver->driver);
         udc->enabled = 1;
         udc->selfpowered = 1;
 
@@ -1656,7 +1653,6 @@ static int at91_stop(struct usb_gadget *gadget,
         spin_unlock_irqrestore(&udc->lock, flags);
 
         udc->gadget.dev.driver = NULL;
-        dev_set_drvdata(&udc->gadget.dev, NULL);
         udc->driver = NULL;
 
         DBG("unbound from %s\n", driver->driver.name);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index b799106027ad..afdbb1cbf5d9 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1916,6 +1916,27 @@ done:
         return retval;
 }
 
+/* usb 3.0 root hub device descriptor */
+struct {
+        struct usb_bos_descriptor bos;
+        struct usb_ss_cap_descriptor ss_cap;
+} __packed usb3_bos_desc = {
+
+        .bos = {
+                .bLength                = USB_DT_BOS_SIZE,
+                .bDescriptorType        = USB_DT_BOS,
+                .wTotalLength           = cpu_to_le16(sizeof(usb3_bos_desc)),
+                .bNumDeviceCaps         = 1,
+        },
+        .ss_cap = {
+                .bLength                = USB_DT_USB_SS_CAP_SIZE,
+                .bDescriptorType        = USB_DT_DEVICE_CAPABILITY,
+                .bDevCapabilityType     = USB_SS_CAP_TYPE,
+                .wSpeedSupported        = cpu_to_le16(USB_5GBPS_OPERATION),
+                .bFunctionalitySupport  = ilog2(USB_5GBPS_OPERATION),
+        },
+};
+
 static inline void
 ss_hub_descriptor(struct usb_hub_descriptor *desc)
 {
@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
                 else
                         hub_descriptor((struct usb_hub_descriptor *) buf);
                 break;
+
+        case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+                if (hcd->speed != HCD_USB3)
+                        goto error;
+
+                if ((wValue >> 8) != USB_DT_BOS)
+                        goto error;
+
+                memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
+                retval = sizeof(usb3_bos_desc);
+                break;
+
         case GetHubStatus:
                 *(__le32 *) buf = cpu_to_le32(0);
                 break;
@@ -2503,10 +2536,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         hs_hcd->has_tt = 1;
 
         retval = usb_add_hcd(hs_hcd, 0, 0);
-        if (retval != 0) {
-                usb_put_hcd(hs_hcd);
-                return retval;
-        }
+        if (retval)
+                goto put_usb2_hcd;
 
         if (mod_data.is_super_speed) {
                 ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2525,6 +2556,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
 put_usb3_hcd:
         usb_put_hcd(ss_hcd);
 dealloc_usb2_hcd:
+        usb_remove_hcd(hs_hcd);
+put_usb2_hcd:
         usb_put_hcd(hs_hcd);
         the_controller.hs_hcd = the_controller.ss_hcd = NULL;
         return retval;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 8adc79d1b402..829aba75a6df 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -34,11 +34,15 @@
 /* Debugging ****************************************************************/
 
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #  define pr_vdebug pr_debug
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) \
         print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
 #else
+#ifndef pr_vdebug
 #  define pr_vdebug(...)                 do { } while (0)
+#endif /* pr_vdebug */
 #  define ffs_dump_mem(prefix, ptr, len) do { } while (0)
 #endif /* VERBOSE_DEBUG */
 
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index b13e0bb5f5b8..0bb617e1dda2 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3599,6 +3599,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
 
         if (hsotg->num_of_eps == 0) {
                 dev_err(dev, "wrong number of EPs (zero)\n");
+                ret = -EINVAL;
                 goto err_supplies;
         }
 
@@ -3606,6 +3607,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                       GFP_KERNEL);
         if (!eps) {
                 dev_err(dev, "cannot get memory\n");
+                ret = -ENOMEM;
                 goto err_supplies;
         }
 
@@ -3622,6 +3624,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
                                                      GFP_KERNEL);
         if (!hsotg->ctrl_req) {
                 dev_err(dev, "failed to allocate ctrl req\n");
+                ret = -ENOMEM;
                 goto err_ep_mem;
         }
 
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 5b3f5fffea92..da6d479ff9a6 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -132,11 +132,15 @@ static unsigned	n_ports;
 
 
 #ifdef VERBOSE_DEBUG
+#ifndef pr_vdebug
 #define pr_vdebug(fmt, arg...) \
         pr_debug(fmt, ##arg)
+#endif /* pr_vdebug */
 #else
+#ifndef pr_vdebig
 #define pr_vdebug(fmt, arg...) \
         ({ if (0) pr_debug(fmt, ##arg); })
+#endif /* pr_vdebug */
 #endif
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9bc39ca460c8..4b66374bdc8e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
         else {
                 qtd = list_entry (qh->qtd_list.next,
                                 struct ehci_qtd, qtd_list);
-                /* first qtd may already be partially processed */
-                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
+                /*
+                 * first qtd may already be partially processed.
+                 * If we come here during unlink, the QH overlay region
+                 * might have reference to the just unlinked qtd. The
+                 * qtd is updated in qh_completions(). Update the QH
+                 * overlay here.
+                 */
+                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+                        qh->hw->hw_qtd_next = qtd->hw_next;
                         qtd = NULL;
+                }
         }
 
         if (qtd)
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index a665b3eaa746..0bf72f943b00 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -467,7 +467,8 @@ static irqreturn_t ohci_hcd_at91_overcurrent_irq(int irq, void *data)
         /* From the GPIO notifying the over-current situation, find
          * out the corresponding port */
         at91_for_each_port(port) {
-                if (gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
+                if (gpio_is_valid(pdata->overcurrent_pin[port]) &&
+                                gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
                         gpio = pdata->overcurrent_pin[port];
                         break;
                 }
@@ -570,6 +571,16 @@ static int __devinit ohci_hcd_at91_drv_probe(struct platform_device *pdev)
 
         if (pdata) {
                 at91_for_each_port(i) {
+                        /*
+                         * do not configure PIO if not in relation with
+                         * real USB port on board
+                         */
+                        if (i >= pdata->ports) {
+                                pdata->vbus_pin[i] = -EINVAL;
+                                pdata->overcurrent_pin[i] = -EINVAL;
+                                break;
+                        }
+
                         if (!gpio_is_valid(pdata->vbus_pin[i]))
                                 continue;
                         gpio = pdata->vbus_pin[i];
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index c5e9e4a76f14..966d1484ee79 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -75,7 +75,9 @@
 #define NB_PIF0_PWRDOWN_1       0x01100013
 
 #define USB_INTEL_XUSB2PR      0xD0
+#define USB_INTEL_USB2PRM      0xD4
 #define USB_INTEL_USB3_PSSEN   0xD8
+#define USB_INTEL_USB3PRM      0xDC
 
 static struct amd_chipset_info {
         struct pci_dev  *nb_dev;
@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                 return;
         }
 
-        ports_available = 0xffffffff;
+        /* Read USB3PRM, the USB 3.0 Port Routing Mask Register
+         * Indicate the ports that can be changed from OS.
+         */
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
+                        &ports_available);
+
+        dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
+                        ports_available);
+
         /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
-         * Register, to turn on SuperSpeed terminations for all
-         * available ports.
+         * Register, to turn on SuperSpeed terminations for the
+         * switchable ports.
          */
         pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                         cpu_to_le32(ports_available));
@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
         dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
                         "under xHCI: 0x%x\n", ports_available);
 
-        ports_available = 0xffffffff;
+        /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
+         * Indicate the USB 2.0 ports to be controlled by the xHCI host.
+         */
+
+        pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
+                        &ports_available);
+
+        dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
+                        ports_available);
+
         /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
          * switch the USB 2.0 power and data lines over to the xHCI
          * host.
@@ -822,12 +841,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
         void __iomem *op_reg_base;
         u32 val;
         int timeout;
+        int len = pci_resource_len(pdev, 0);
 
         if (!mmio_resource_enabled(pdev, 0))
                 return;
 
-        base = ioremap_nocache(pci_resource_start(pdev, 0),
-                                pci_resource_len(pdev, 0));
+        base = ioremap_nocache(pci_resource_start(pdev, 0), len);
         if (base == NULL)
                 return;
 
@@ -837,9 +856,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
          */
         ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
         do {
+                if ((ext_cap_offset + sizeof(val)) > len) {
+                        /* We're reading garbage from the controller */
+                        dev_warn(&pdev->dev,
+                                 "xHCI controller failing to respond");
+                        return;
+                }
+
                 if (!ext_cap_offset)
                         /* We've reached the end of the extended capabilities */
                         goto hc_init;
+
                 val = readl(base + ext_cap_offset);
                 if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
                         break;
@@ -870,9 +897,10 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
         /* Disable any BIOS SMIs and clear all SMI events*/
         writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
 
+hc_init:
         if (usb_is_intel_switchable_xhci(pdev))
                 usb_enable_xhci_ports(pdev);
-hc_init:
+
         op_reg_base = base + XHCI_HC_LENGTH(readl(base));
 
         /* Wait for the host controller to be ready before writing any
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index ef004a5de20f..7f69a39163ce 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
 static inline void usb_amd_dev_put(void) {}
+static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 #endif  /* CONFIG_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 74bfc868b7ad..d5eb357aa5c4 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
                  * when this bit is set.
                  */
                 pls |= USB_PORT_STAT_CONNECTION;
+        } else {
+                /*
+                 * If CAS bit isn't set but the Port is already at
+                 * Compliance Mode, fake a connection so the USB core
+                 * notices the Compliance state and resets the port.
+                 * This resolves an issue generated by the SN65LVPE502CP
+                 * in which sometimes the port enters compliance mode
+                 * caused by a delay on the host-device negotiation.
+                 */
+                if (pls == USB_SS_PORT_LS_COMP_MOD)
+                        pls |= USB_PORT_STAT_CONNECTION;
         }
+
         /* update status field */
         *status |= pls;
 }
 
+/*
+ * Function for Compliance Mode Quirk.
+ *
+ * This Function verifies if all xhc USB3 ports have entered U0, if so,
+ * the compliance mode timer is deleted. A port won't enter
+ * compliance mode if it has previously entered U0.
+ */
+void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
+{
+        u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
+        bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
+
+        if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
+                return;
+
+        if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
+                xhci->port_status_u0 |= 1 << wIndex;
+                if (xhci->port_status_u0 == all_ports_seen_u0) {
+                        del_timer_sync(&xhci->comp_mode_recovery_timer);
+                        xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
+                        xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
+                }
+        }
+}
+
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 u16 wIndex, char *buf, u16 wLength)
 {
@@ -651,6 +688,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 /* Update Port Link State for super speed ports*/
                 if (hcd->speed == HCD_USB3) {
                         xhci_hub_report_link_state(&status, temp);
+                        /*
+                         * Verify if all USB3 Ports Have entered U0 already.
+                         * Delete Compliance Mode Timer if so.
+                         */
+                        xhci_del_comp_mod_timer(xhci, temp, wIndex);
                 }
                 if (bus_state->port_c_suspend & (1 << wIndex))
                         status |= 1 << USB_PORT_FEAT_C_SUSPEND;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 689bc18b051d..df90fe51b4aa 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
                 goto put_hcd;
         }
 
-        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
         if (!hcd->regs) {
                 dev_dbg(&pdev->dev, "error mapping memory\n");
                 ret = -EFAULT;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c59d5b5b6c7d..6ece0ed288d4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 
 #include "xhci.h"
 
@@ -398,6 +399,95 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 
 #endif
 
+static void compliance_mode_recovery(unsigned long arg)
+{
+        struct xhci_hcd *xhci;
+        struct usb_hcd *hcd;
+        u32 temp;
+        int i;
+
+        xhci = (struct xhci_hcd *)arg;
+
+        for (i = 0; i < xhci->num_usb3_ports; i++) {
+                temp = xhci_readl(xhci, xhci->usb3_ports[i]);
+                if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
+                        /*
+                         * Compliance Mode Detected. Letting USB Core
+                         * handle the Warm Reset
+                         */
+                        xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
+                                        i + 1);
+                        xhci_dbg(xhci, "Attempting Recovery routine!\n");
+                        hcd = xhci->shared_hcd;
+
+                        if (hcd->state == HC_STATE_SUSPENDED)
+                                usb_hcd_resume_root_hub(hcd);
+
+                        usb_hcd_poll_rh_status(hcd);
+                }
+        }
+
+        if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
+                mod_timer(&xhci->comp_mode_recovery_timer,
+                        jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+}
+
+/*
+ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
+ * that causes ports behind that hardware to enter compliance mode sometimes.
+ * The quirk creates a timer that polls every 2 seconds the link state of
+ * each host controller's port and recovers it by issuing a Warm reset
+ * if Compliance mode is detected, otherwise the port will become "dead" (no
+ * device connections or disconnections will be detected anymore). Becasue no
+ * status event is generated when entering compliance mode (per xhci spec),
+ * this quirk is needed on systems that have the failing hardware installed.
+ */
+static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
+{
+        xhci->port_status_u0 = 0;
+        init_timer(&xhci->comp_mode_recovery_timer);
+
+        xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
+        xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
+        xhci->comp_mode_recovery_timer.expires = jiffies +
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
+
+        set_timer_slack(&xhci->comp_mode_recovery_timer,
+                        msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+        add_timer(&xhci->comp_mode_recovery_timer);
+        xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
+}
+
+/*
+ * This function identifies the systems that have installed the SN65LVPE502CP
+ * USB3.0 re-driver and that need the Compliance Mode Quirk.
+ * Systems:
+ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
+ */
+static bool compliance_mode_recovery_timer_quirk_check(void)
+{
+        const char *dmi_product_name, *dmi_sys_vendor;
+
+        dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
+        dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+
+        if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
+                return false;
+
+        if (strstr(dmi_product_name, "Z420") ||
+                        strstr(dmi_product_name, "Z620") ||
+                        strstr(dmi_product_name, "Z820"))
+                return true;
+
+        return false;
+}
+
+static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
+{
+        return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
+}
+
+
 /*
  * Initialize memory for HCD and xHC (one-time init).
  *
@@ -421,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
         retval = xhci_mem_init(xhci, GFP_KERNEL);
         xhci_dbg(xhci, "Finished xhci_init\n");
 
+        /* Initializing Compliance Mode Recovery Data If Needed */
+        if (compliance_mode_recovery_timer_quirk_check()) {
+                xhci->quirks |= XHCI_COMP_MODE_QUIRK;
+                compliance_mode_recovery_timer_init(xhci);
+        }
+
         return retval;
 }
 
@@ -629,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
         del_timer_sync(&xhci->event_ring_timer);
 #endif
 
+        /* Deleting Compliance Mode Recovery Timer */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci))))
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
+
         if (xhci->quirks & XHCI_AMD_PLL_FIX)
                 usb_amd_dev_put();
 
@@ -659,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-        if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
+        if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
                 usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
 
         spin_lock_irq(&xhci->lock);
@@ -806,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
         }
         spin_unlock_irq(&xhci->lock);
 
+        /*
+         * Deleting Compliance Mode Recovery Timer because the xHCI Host
+         * is about to be suspended.
+         */
+        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                        (!(xhci_all_ports_seen_u0(xhci)))) {
+                del_timer_sync(&xhci->comp_mode_recovery_timer);
+                xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
+        }
+
         /* step 5: remove core well power */
         /* synchronize irq when using MSI-X */
         xhci_msix_sync_irqs(xhci);
@@ -938,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 usb_hcd_resume_root_hub(hcd);
                 usb_hcd_resume_root_hub(xhci->shared_hcd);
         }
+
+        /*
+         * If system is subject to the Quirk, Compliance Mode Timer needs to
+         * be re-initialized Always after a system resume. Ports are subject
+         * to suffer the Compliance Mode issue again. It doesn't matter if
+         * ports have entered previously to U0 before system's suspension.
+         */
+        if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+                compliance_mode_recovery_timer_init(xhci);
+
         return retval;
 }
 #endif  /* CONFIG_PM */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index c713256297ac..1a05908c6673 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1495,6 +1495,7 @@ struct xhci_hcd {
 #define XHCI_LPM_SUPPORT        (1 << 11)
 #define XHCI_INTEL_HOST         (1 << 12)
 #define XHCI_SPURIOUS_REBOOT    (1 << 13)
+#define XHCI_COMP_MODE_QUIRK    (1 << 14)
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
         /* There are two roothubs to keep track of bus suspend info for */
@@ -1511,6 +1512,11 @@ struct xhci_hcd {
         unsigned                sw_lpm_support:1;
         /* support xHCI 1.0 spec USB2 hardware LPM */
         unsigned                hw_lpm_support:1;
+        /* Compliance Mode Recovery Data */
+        struct timer_list       comp_mode_recovery_timer;
+        u32                     port_status_u0;
+/* Compliance Mode Timer Triggered every 2 seconds */
+#define COMP_MODE_RCVRY_MSECS 2000
 };
 
 /* convert between an HCD pointer and the corresponding EHCI_HCD */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 4bb717d0bd41..1ae378d5fc6f 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2049,7 +2049,7 @@ static int musb_urb_enqueue(
          * we only have work to do in the former case.
          */
         spin_lock_irqsave(&musb->lock, flags);
-        if (hep->hcpriv) {
+        if (hep->hcpriv || !next_urb(qh)) {
                 /* some concurrent activity submitted another urb to hep...
                  * odd, rare, error prone, but legal.
                  */
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 57a608584e16..c1be687e00ec 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -388,7 +388,7 @@ dma_controller_create(struct musb *musb, void __iomem *base)
         struct platform_device *pdev = to_platform_device(dev);
         int irq = platform_get_irq_byname(pdev, "dma");
 
-        if (irq == 0) {
+        if (irq <= 0) {
                 dev_err(dev, "No DMA interrupt line!\n");
                 return NULL;
         }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 1a1bd9cf40c5..341625442377 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1215,7 +1215,7 @@ static int __devinit tusb_probe(struct platform_device *pdev)
         ret = platform_device_add(musb);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register musb device\n");
-                goto err1;
+                goto err2;
         }
 
         return 0;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index ecd173032fd4..143c4e9e1be4 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -818,7 +818,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
             usbhs_pipe_is_dcp(pipe))
                 goto usbhsf_pio_prepare_push;
 
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                 goto usbhsf_pio_prepare_push;
 
         if ((uintptr_t)(pkt->buf + pkt->actual) & 0x7) /* 8byte alignment */
@@ -905,7 +905,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done)
         /* use PIO if packet is less than pio_dma_border */
         len = usbhsf_fifo_rcv_len(priv, fifo);
         len = min(pkt->length - pkt->actual, len);
-        if (len % 4) /* 32bit alignment */
+        if (len & 0x7) /* 8byte alignment */
                 goto usbhsf_pio_prepare_pop_unselect;
 
         if (len < usbhs_get_dparam(priv, pio_dma_border))
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 5620db6469e5..f906b3aec217 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -704,6 +704,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
         { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
@@ -804,13 +805,32 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
+                                        USB_CLASS_VENDOR_SPEC,
+                                        USB_SUBCLASS_VENDOR_SPEC, 0x00) },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
         { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
         { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C865_PID) },
+        { USB_DEVICE(FTDI_VID, PI_C857_PID) },
+        { USB_DEVICE(PI_VID, PI_C866_PID) },
+        { USB_DEVICE(PI_VID, PI_C663_PID) },
+        { USB_DEVICE(PI_VID, PI_C725_PID) },
+        { USB_DEVICE(PI_VID, PI_E517_PID) },
+        { USB_DEVICE(PI_VID, PI_C863_PID) },
         { USB_DEVICE(PI_VID, PI_E861_PID) },
+        { USB_DEVICE(PI_VID, PI_C867_PID) },
+        { USB_DEVICE(PI_VID, PI_E609_PID) },
+        { USB_DEVICE(PI_VID, PI_E709_PID) },
+        { USB_DEVICE(PI_VID, PI_100F_PID) },
+        { USB_DEVICE(PI_VID, PI_1011_PID) },
+        { USB_DEVICE(PI_VID, PI_1012_PID) },
+        { USB_DEVICE(PI_VID, PI_1013_PID) },
+        { USB_DEVICE(PI_VID, PI_1014_PID) },
+        { USB_DEVICE(PI_VID, PI_1015_PID) },
+        { USB_DEVICE(PI_VID, PI_1016_PID) },
         { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
         { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
         { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5dd96ca6c380..41fe5826100c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -75,6 +75,9 @@
 #define FTDI_OPENDCC_GATEWAY_PID        0xBFDB
 #define FTDI_OPENDCC_GBM_PID    0xBFDC
 
+/* NZR SEM 16+ USB (http://www.nzr.de) */
+#define FTDI_NZR_SEM_USB_PID    0xC1E0  /* NZR SEM-LOG16+ */
+
 /*
  * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
  */
@@ -539,7 +542,10 @@
 /*
  * Microchip Technology, Inc.
  *
- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
+ * used by single function CDC ACM class based firmware demo
+ * applications.  The VID/PID has also been used in firmware
+ * emulating FTDI serial chips by:
  * Hornby Elite - Digital Command Control Console
  * http://www.hornby.com/hornby-dcc/controllers/
  */
@@ -791,8 +797,27 @@
  * Physik Instrumente
  * http://www.physikinstrumente.com/en/products/
  */
+/* These two devices use the VID of FTDI */
+#define PI_C865_PID     0xe0a0  /* PI C-865 Piezomotor Controller */
+#define PI_C857_PID     0xe0a1  /* PI Encoder Trigger Box */
+
 #define PI_VID              0x1a72  /* Vendor ID */
-#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
+#define PI_C866_PID     0x1000  /* PI C-866 Piezomotor Controller */
+#define PI_C663_PID     0x1001  /* PI C-663 Mercury-Step */
+#define PI_C725_PID     0x1002  /* PI C-725 Piezomotor Controller */
+#define PI_E517_PID     0x1005  /* PI E-517 Digital Piezo Controller Operation Module */
+#define PI_C863_PID     0x1007  /* PI C-863 */
+#define PI_E861_PID     0x1008  /* PI E-861 Piezomotor Controller */
+#define PI_C867_PID     0x1009  /* PI C-867 Piezomotor Controller */
+#define PI_E609_PID     0x100D  /* PI E-609 Digital Piezo Controller */
+#define PI_E709_PID     0x100E  /* PI E-709 Digital Piezo Controller */
+#define PI_100F_PID     0x100F  /* PI Digital Piezo Controller */
+#define PI_1011_PID     0x1011  /* PI Digital Piezo Controller */
+#define PI_1012_PID     0x1012  /* PI Motion Controller */
+#define PI_1013_PID     0x1013  /* PI Motion Controller */
+#define PI_1014_PID     0x1014  /* PI Device */
+#define PI_1015_PID     0x1015  /* PI Device */
+#define PI_1016_PID     0x1016  /* PI Digital Servo Module */
 
 /*
  * Kondo Kagaku Co.Ltd.
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index cc40f47ecea1..5ce88d1bc6f1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -886,8 +886,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
-          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1092,6 +1090,10 @@ static const struct usb_device_id option_ids[] = {
          .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
          .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 211a4920b88a..d8dedc7d3910 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -76,9 +76,24 @@ static int virqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
                         schedule_work(&virqfd->inject);
         }
 
-        if (flags & POLLHUP)
-                /* The eventfd is closing, detach from VFIO */
-                virqfd_deactivate(virqfd);
+        if (flags & POLLHUP) {
+                unsigned long flags;
+                spin_lock_irqsave(&virqfd->vdev->irqlock, flags);
+
+                /*
+                 * The eventfd is closing, if the virqfd has not yet been
+                 * queued for release, as determined by testing whether the
+                 * vdev pointer to it is still valid, queue it now.  As
+                 * with kvm irqfds, we know we won't race against the virqfd
+                 * going away because we hold wqh->lock to get here.
+                 */
+                if (*(virqfd->pvirqfd) == virqfd) {
+                        *(virqfd->pvirqfd) = NULL;
+                        virqfd_deactivate(virqfd);
+                }
+
+                spin_unlock_irqrestore(&virqfd->vdev->irqlock, flags);
+        }
 
         return 0;
 }
@@ -93,7 +108,6 @@ static void virqfd_ptable_queue_proc(struct file *file,
 static void virqfd_shutdown(struct work_struct *work)
 {
         struct virqfd *virqfd = container_of(work, struct virqfd, shutdown);
-        struct virqfd **pvirqfd = virqfd->pvirqfd;
         u64 cnt;
 
         eventfd_ctx_remove_wait_queue(virqfd->eventfd, &virqfd->wait, &cnt);
@@ -101,7 +115,6 @@ static void virqfd_shutdown(struct work_struct *work)
         eventfd_ctx_put(virqfd->eventfd);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 }
 
 static void virqfd_inject(struct work_struct *work)
@@ -122,15 +135,11 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         int ret = 0;
         unsigned int events;
 
-        if (*pvirqfd)
-                return -EBUSY;
-
         virqfd = kzalloc(sizeof(*virqfd), GFP_KERNEL);
         if (!virqfd)
                 return -ENOMEM;
 
         virqfd->pvirqfd = pvirqfd;
-        *pvirqfd = virqfd;
         virqfd->vdev = vdev;
         virqfd->handler = handler;
         virqfd->thread = thread;
@@ -154,6 +163,23 @@ static int virqfd_enable(struct vfio_pci_device *vdev,
         virqfd->eventfd = ctx;
 
         /*
+         * virqfds can be released by closing the eventfd or directly
+         * through ioctl.  These are both done through a workqueue, so
+         * we update the pointer to the virqfd under lock to avoid
+         * pushing multiple jobs to release the same virqfd.
+         */
+        spin_lock_irq(&vdev->irqlock);
+
+        if (*pvirqfd) {
+                spin_unlock_irq(&vdev->irqlock);
+                ret = -EBUSY;
+                goto fail;
+        }
+        *pvirqfd = virqfd;
+
+        spin_unlock_irq(&vdev->irqlock);
+
+        /*
          * Install our own custom wake-up handling so we are notified via
          * a callback whenever someone signals the underlying eventfd.
          */
@@ -187,19 +213,29 @@ fail:
                 fput(file);
 
         kfree(virqfd);
-        *pvirqfd = NULL;
 
         return ret;
 }
 
-static void virqfd_disable(struct virqfd *virqfd)
+static void virqfd_disable(struct vfio_pci_device *vdev,
+                           struct virqfd **pvirqfd)
 {
-        if (!virqfd)
-                return;
+        unsigned long flags;
+
+        spin_lock_irqsave(&vdev->irqlock, flags);
+
+        if (*pvirqfd) {
+                virqfd_deactivate(*pvirqfd);
+                *pvirqfd = NULL;
+        }
 
-        virqfd_deactivate(virqfd);
+        spin_unlock_irqrestore(&vdev->irqlock, flags);
 
-        /* Block until we know all outstanding shutdown jobs have completed. */
+        /*
+         * Block until we know all outstanding shutdown jobs have completed.
+         * Even if we don't queue the job, flush the wq to be sure it's
+         * been released.
+         */
         flush_workqueue(vfio_irqfd_cleanup_wq);
 }
 
@@ -392,8 +428,8 @@ static int vfio_intx_set_signal(struct vfio_pci_device *vdev, int fd)
 static void vfio_intx_disable(struct vfio_pci_device *vdev)
 {
         vfio_intx_set_signal(vdev, -1);
-        virqfd_disable(vdev->ctx[0].unmask);
-        virqfd_disable(vdev->ctx[0].mask);
+        virqfd_disable(vdev, &vdev->ctx[0].unmask);
+        virqfd_disable(vdev, &vdev->ctx[0].mask);
         vdev->irq_type = VFIO_PCI_NUM_IRQS;
         vdev->num_ctx = 0;
         kfree(vdev->ctx);
@@ -539,8 +575,8 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)
         vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix);
 
         for (i = 0; i < vdev->num_ctx; i++) {
-                virqfd_disable(vdev->ctx[i].unmask);
-                virqfd_disable(vdev->ctx[i].mask);
+                virqfd_disable(vdev, &vdev->ctx[i].unmask);
+                virqfd_disable(vdev, &vdev->ctx[i].mask);
         }
 
         if (msix) {
@@ -577,7 +613,7 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_device *vdev,
                                              vfio_send_intx_eventfd, NULL,
                                              &vdev->ctx[0].unmask, fd);
 
-                virqfd_disable(vdev->ctx[0].unmask);
+                virqfd_disable(vdev, &vdev->ctx[0].unmask);
         }
 
         return 0;
diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
index f75da8758adc..f49181c73113 100644
--- a/drivers/video/backlight/88pm860x_bl.c
+++ b/drivers/video/backlight/88pm860x_bl.c
@@ -228,7 +228,6 @@ static int pm860x_backlight_probe(struct platform_device *pdev)
         data->port = pdata->flags;
         if (data->port < 0) {
                 dev_err(&pdev->dev, "wrong platform data is assigned");
-                kfree(data);
                 return -EINVAL;
         }
 
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index b4a632ada401..932abaa58a89 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -553,7 +553,9 @@ static int __init efifb_init(void)
         int ret;
         char *option = NULL;
 
-        dmi_check_system(dmi_system_table);
+        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI ||
+            !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS))
+                dmi_check_system(dmi_system_table);
 
         if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
                 return -ENODEV;
diff --git a/drivers/video/exynos/exynos_mipi_dsi.c b/drivers/video/exynos/exynos_mipi_dsi.c
index 4bc2b8a5dd8b..663c308d0e73 100644
--- a/drivers/video/exynos/exynos_mipi_dsi.c
+++ b/drivers/video/exynos/exynos_mipi_dsi.c
@@ -461,7 +461,7 @@ static int exynos_mipi_dsi_probe(struct platform_device *pdev)
 done:
         platform_set_drvdata(pdev, dsim);
 
-        dev_dbg(&pdev->dev, "%s() completed sucessfuly (%s mode)\n", __func__,
+        dev_dbg(&pdev->dev, "%s() completed successfully (%s mode)\n", __func__,
                 dsim_config->e_interface == DSIM_COMMAND ? "CPU" : "RGB");
 
         return 0;
diff --git a/drivers/video/tmiofb.c b/drivers/video/tmiofb.c
index 8e4a446b5ed1..b244f060f151 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/tmiofb.c
@@ -694,6 +694,10 @@ static int __devinit tmiofb_probe(struct platform_device *dev)
                 dev_err(&dev->dev, "NULL platform data!\n");
                 return -EINVAL;
         }
+        if (ccr == NULL || lcr == NULL || vram == NULL || irq < 0) {
+                dev_err(&dev->dev, "missing resources\n");
+                return -EINVAL;
+        }
 
         info = framebuffer_alloc(sizeof(struct tmiofb_par), &dev->dev);
 
diff --git a/drivers/w1/masters/ds1wm.c b/drivers/w1/masters/ds1wm.c
index 530a2d309063..7c294f4dc0ed 100644
--- a/drivers/w1/masters/ds1wm.c
+++ b/drivers/w1/masters/ds1wm.c
@@ -349,7 +349,7 @@ static void ds1wm_search(void *data, struct w1_master *master_dev,
                         "pass: %d entering ASM\n", pass);
                 ds1wm_write_register(ds1wm_data, DS1WM_CMD, DS1WM_CMD_SRA);
                 dev_dbg(&ds1wm_data->pdev->dev,
-                        "pass: %d begining nibble loop\n", pass);
+                        "pass: %d beginning nibble loop\n", pass);
 
                 r_prime = 0;
                 d = 0;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 1eff743ec497..ae60406ea8a1 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
         hpwdt_timer_reg = pci_mem_addr + 0x70;
         hpwdt_timer_con = pci_mem_addr + 0x72;
 
+        /* Make sure that timer is disabled until /dev/watchdog is opened */
+        hpwdt_stop();
+
         /* Make sure that we have a valid soft_margin */
         if (hpwdt_change_timer(soft_margin))
                 hpwdt_change_timer(DEFAULT_MARGIN);
diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 6aa46a90ff02..3796434991fa 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -128,11 +128,12 @@ EXPORT_SYMBOL_GPL(watchdog_register_device);
 void watchdog_unregister_device(struct watchdog_device *wdd)
 {
         int ret;
-        int devno = wdd->cdev.dev;
+        int devno;
 
         if (wdd == NULL)
                 return;
 
+        devno = wdd->cdev.dev;
         ret = watchdog_dev_unregister(wdd);
         if (ret)
                 pr_err("error unregistering /dev/watchdog (err=%d)\n", ret);
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1ffd03bf8e10..7f1241608489 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
                 }
         }
 
-        err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
-                                pages, true);
+        err = gnttab_unmap_refs(map->unmap_ops + offset,
+                        use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
+                        pages);
         if (err)
                 return err;
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 0bfc1ef11259..006726688baf 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
 EXPORT_SYMBOL_GPL(gnttab_map_refs);
 
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-                      struct page **pages, unsigned int count, bool clear_pte)
+                      struct gnttab_map_grant_ref *kmap_ops,
+                      struct page **pages, unsigned int count)
 {
         int i, ret;
         bool lazy = false;
@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
         }
 
         for (i = 0; i < count; i++) {
-                ret = m2p_remove_override(pages[i], clear_pte);
+                ret = m2p_remove_override(pages[i], kmap_ops ?
+                                       &kmap_ops[i] : NULL);
                 if (ret)
                         return ret;
         }