23 files changed, 514 insertions, 42 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 04f8b2d083c6..ad59b4e0a9b5 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -608,5 +608,13 @@ config RAMOOPS
 	  This enables panic and oops messages to be logged to a circular
 	  buffer in RAM where it can be read back at some later point.
 
+config MSM_SMD_PKT
+	bool "Enable device interface for some SMD packet ports"
+	default n
+	depends on MSM_SMD
+	help
+	  Enables userspace clients to read and write to some packet SMD
+	  ports via device interface for MSM chipset.
+
 endmenu
 
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 057f65452e7b..7a00672bd85d 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_ATARI_DSP56K)	+= dsp56k.o
 obj-$(CONFIG_VIRTIO_CONSOLE)	+= virtio_console.o
 obj-$(CONFIG_RAW_DRIVER)	+= raw.o
 obj-$(CONFIG_SGI_SNSC)		+= snsc.o snsc_event.o
+obj-$(CONFIG_MSM_SMD_PKT)	+= msm_smd_pkt.o
 obj-$(CONFIG_MSPEC)		+= mspec.o
 obj-$(CONFIG_MMTIMER)		+= mmtimer.o
 obj-$(CONFIG_UV_MMTIMER)	+= uv_mmtimer.o
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 3e67ddde9e16..923f99df4f1c 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -237,7 +237,7 @@ extern int agp_try_unsupported_boot;
 
 long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 
-/* Chipset independant registers (from AGP Spec) */
+/* Chipset independent registers (from AGP Spec) */
 #define AGP_APBASE	0x10
 
 #define AGPSTAT		0x4
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index 45681c0ff3b6..f7e88787af97 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -272,7 +272,7 @@ static void amd_irongate_cleanup(void)
  * This routine could be implemented by taking the addresses
  * written to the GATT, and flushing them individually.  However
  * currently it just flushes the whole table.  Which is probably
- * more efficent, since agp_memory blocks can be a large number of
+ * more efficient, since agp_memory blocks can be a large number of
  * entries.
  */
 
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 012cba0d6d96..b072648dc3f6 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
 	struct agp_memory *new;
 	unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
 
+	if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+		return NULL;
+
 	new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
 	if (new == NULL)
 		return NULL;
@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
 	int scratch_pages;
 	struct agp_memory *new;
 	size_t i;
+	int cur_memory;
 
 	if (!bridge)
 		return NULL;
 
-	if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+	cur_memory = atomic_read(&bridge->current_memory_agp);
+	if ((cur_memory + page_count > bridge->max_memory_agp) ||
+	    (cur_memory + page_count < page_count))
 		return NULL;
 
 	if (type >= AGP_USER_TYPES) {
@@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
 		return -EINVAL;
 	}
 
-	/* AK: could wrap */
-	if ((pg_start + mem->page_count) > num_entries)
+	if (((pg_start + mem->page_count) > num_entries) ||
+	    ((pg_start + mem->page_count) < pg_start))
 		return -EINVAL;
 
 	j = pg_start;
@@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
 	size_t i;
 	struct agp_bridge_data *bridge;
-	int mask_type;
+	int mask_type, num_entries;
 
 	bridge = mem->bridge;
 	if (!bridge)
@@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 	if (type != mem->type)
 		return -EINVAL;
 
+	num_entries = agp_num_entries();
+	if (((pg_start + mem->page_count) > num_entries) ||
+	    ((pg_start + mem->page_count) < pg_start))
+		return -EINVAL;
+
 	mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
 	if (mask_type != 0) {
 		/* The generic routines know nothing of memory types */
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 13acaaf64edb..f02f9b07fd4c 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -229,7 +229,7 @@ static int serverworks_fetch_size(void)
  * This routine could be implemented by taking the addresses
  * written to the GATT, and flushing them individually.  However
  * currently it just flushes the whole table.  Which is probably
- * more efficent, since agp_memory blocks can be a large number of
+ * more efficient, since agp_memory blocks can be a large number of
  * entries.
  */
 static void serverworks_tlbflush(struct agp_memory *temp)
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index df67e80019d2..8bc384937401 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -400,7 +400,7 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata =
 	 * the traditional AGP which resides only in chipset. AGP is used
 	 * by 3D driver which wasn't available for the VT3336 and VT3364
 	 * generation until now.  Unfortunately, by testing, VT3364 works
-	 * but VT3336 doesn't. - explaination from via, just leave this as
+	 * but VT3336 doesn't. - explanation from via, just leave this as
 	 * as a placeholder to avoid future patches adding it back in.
 	 */
 #if 0
diff --git a/drivers/char/ipmi/ipmi_poweroff.c b/drivers/char/ipmi/ipmi_poweroff.c
index 0dec5da000ef..2efa176beab0 100644
--- a/drivers/char/ipmi/ipmi_poweroff.c
+++ b/drivers/char/ipmi/ipmi_poweroff.c
@@ -122,7 +122,7 @@ static struct ipmi_recv_msg halt_recv_msg = {
 
 
 /*
- * Code to send a message and wait for the reponse.
+ * Code to send a message and wait for the response.
  */
 
 static void receive_handler(struct ipmi_recv_msg *recv_msg, void *handler_data)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index c86d43b88e1e..cc6c9b2546a3 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -339,7 +339,7 @@ static void return_hosed_msg(struct smi_info *smi_info, int cCode)
 		cCode = IPMI_ERR_UNSPECIFIED;
 	/* else use it as is */
 
-	/* Make it a reponse */
+	/* Make it a response */
 	msg->rsp[0] = msg->data[0] | 4;
 	msg->rsp[1] = msg->data[1];
 	msg->rsp[2] = cCode;
@@ -2927,7 +2927,7 @@ static void return_hosed_msg_badsize(struct smi_info *smi_info)
 {
 	struct ipmi_smi_msg *msg = smi_info->curr_msg;
 
-	/* Make it a reponse */
+	/* Make it a response */
 	msg->rsp[0] = msg->data[0] | 4;
 	msg->rsp[1] = msg->data[1];
 	msg->rsp[2] = CANNOT_RETURN_REQUESTED_LENGTH;
@@ -3521,7 +3521,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
 	kfree(to_clean);
 }
 
-static void __exit cleanup_ipmi_si(void)
+static void cleanup_ipmi_si(void)
 {
 	struct smi_info *e, *tmp_e;
 
diff --git a/drivers/char/mbcs.h b/drivers/char/mbcs.h
index ba671589f4cb..1a36884c48b5 100644
--- a/drivers/char/mbcs.h
+++ b/drivers/char/mbcs.h
@@ -36,13 +36,13 @@
 #define MBCS_RD_DMA_CTRL	0x0110	/* Read DMA Control */
 #define MBCS_RD_DMA_AMO_DEST	0x0118	/* Read DMA AMO Destination */
 #define MBCS_RD_DMA_INT_DEST	0x0120	/* Read DMA Interrupt Destination */
-#define MBCS_RD_DMA_AUX_STAT	0x0130	/* Read DMA Auxillary Status */
+#define MBCS_RD_DMA_AUX_STAT	0x0130	/* Read DMA Auxiliary Status */
 #define MBCS_WR_DMA_SYS_ADDR	0x0200	/* Write DMA System Address */
 #define MBCS_WR_DMA_LOC_ADDR	0x0208	/* Write DMA Local Address */
 #define MBCS_WR_DMA_CTRL	0x0210	/* Write DMA Control */
 #define MBCS_WR_DMA_AMO_DEST	0x0218	/* Write DMA AMO Destination */
 #define MBCS_WR_DMA_INT_DEST	0x0220	/* Write DMA Interrupt Destination */
-#define MBCS_WR_DMA_AUX_STAT	0x0230	/* Write DMA Auxillary Status */
+#define MBCS_WR_DMA_AUX_STAT	0x0230	/* Write DMA Auxiliary Status */
 #define MBCS_ALG_AMO_DEST	0x0300	/* Algorithm AMO Destination */
 #define MBCS_ALG_INT_DEST	0x0308	/* Algorithm Interrupt Destination */
 #define MBCS_ALG_OFFSETS	0x0310
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 1256454b2d43..436a99017998 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -47,10 +47,7 @@ static inline unsigned long size_inside_page(unsigned long start,
 #ifndef ARCH_HAS_VALID_PHYS_ADDR_RANGE
 static inline int valid_phys_addr_range(unsigned long addr, size_t count)
 {
-	if (addr + count > __pa(high_memory))
-		return 0;
-
-	return 1;
+	return addr + count <= __pa(high_memory);
 }
 
 static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
diff --git a/drivers/char/msm_smd_pkt.c b/drivers/char/msm_smd_pkt.c
new file mode 100644
index 000000000000..b6f8a65c9960
--- /dev/null
+++ b/drivers/char/msm_smd_pkt.c
@@ -0,0 +1,466 @@
+/* Copyright (c) 2008-2010, Code Aurora Forum. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ */
+/*
+ * SMD Packet Driver -- Provides userspace interface to SMD packet ports.
+ */
+
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/mutex.h>
+#include <linux/delay.h>
+#include <linux/uaccess.h>
+#include <linux/workqueue.h>
+#include <linux/poll.h>
+
+#include <mach/msm_smd.h>
+
+#define NUM_SMD_PKT_PORTS 9
+#define DEVICE_NAME "smdpkt"
+#define MAX_BUF_SIZE 2048
+
+struct smd_pkt_dev {
+	struct cdev cdev;
+	struct device *devicep;
+
+	struct smd_channel *ch;
+	int open_count;
+	struct mutex ch_lock;
+	struct mutex rx_lock;
+	struct mutex tx_lock;
+	wait_queue_head_t ch_read_wait_queue;
+	wait_queue_head_t ch_opened_wait_queue;
+
+	int i;
+
+	unsigned char tx_buf[MAX_BUF_SIZE];
+	unsigned char rx_buf[MAX_BUF_SIZE];
+	int remote_open;
+
+} *smd_pkt_devp[NUM_SMD_PKT_PORTS];
+
+struct class *smd_pkt_classp;
+static dev_t smd_pkt_number;
+
+static int msm_smd_pkt_debug_enable;
+module_param_named(debug_enable, msm_smd_pkt_debug_enable,
+		   int, S_IRUGO | S_IWUSR | S_IWGRP);
+
+#ifdef DEBUG
+#define D_DUMP_BUFFER(prestr, cnt, buf) do {			\
+		int i;						\
+		if (msm_smd_pkt_debug_enable) {			\
+			pr_debug("%s", prestr);			\
+			for (i = 0; i < cnt; i++)		\
+				pr_debug("%.2x", buf[i]);	\
+			pr_debug("\n");				\
+		}						\
+	} while (0)
+#else
+#define D_DUMP_BUFFER(prestr, cnt, buf) do {} while (0)
+#endif
+
+#ifdef DEBUG
+#define DBG(x...) do {			\
+	if (msm_smd_pkt_debug_enable)	\
+		pr_debug(x);		\
+	} while (0)
+#else
+#define DBG(x...) do {} while (0)
+#endif
+
+static void check_and_wakeup_reader(struct smd_pkt_dev *smd_pkt_devp)
+{
+	int sz;
+
+	if (!smd_pkt_devp || !smd_pkt_devp->ch)
+		return;
+
+	sz = smd_cur_packet_size(smd_pkt_devp->ch);
+	if (sz == 0) {
+		DBG("no packet\n");
+		return;
+	}
+	if (sz > smd_read_avail(smd_pkt_devp->ch)) {
+		DBG("incomplete packet\n");
+		return;
+	}
+
+	DBG("waking up reader\n");
+	wake_up_interruptible(&smd_pkt_devp->ch_read_wait_queue);
+}
+
+static int smd_pkt_read(struct file *file, char __user *buf,
+			size_t count, loff_t *ppos)
+{
+	int r, bytes_read;
+	struct smd_pkt_dev *smd_pkt_devp;
+	struct smd_channel *chl;
+
+	DBG("read %d bytes\n", count);
+	if (count > MAX_BUF_SIZE)
+		return -EINVAL;
+
+	smd_pkt_devp = file->private_data;
+	if (!smd_pkt_devp || !smd_pkt_devp->ch)
+		return -EINVAL;
+
+	chl = smd_pkt_devp->ch;
+wait_for_packet:
+	r = wait_event_interruptible(smd_pkt_devp->ch_read_wait_queue,
+				     (smd_cur_packet_size(chl) > 0 &&
+				      smd_read_avail(chl) >=
+				      smd_cur_packet_size(chl)));
+
+	if (r < 0) {
+		if (r != -ERESTARTSYS)
+			pr_err("wait returned %d\n", r);
+		return r;
+	}
+
+	mutex_lock(&smd_pkt_devp->rx_lock);
+
+	bytes_read = smd_cur_packet_size(smd_pkt_devp->ch);
+	if (bytes_read == 0 ||
+	    bytes_read < smd_read_avail(smd_pkt_devp->ch)) {
+		mutex_unlock(&smd_pkt_devp->rx_lock);
+		DBG("Nothing to read\n");
+		goto wait_for_packet;
+	}
+
+	if (bytes_read > count) {
+		mutex_unlock(&smd_pkt_devp->rx_lock);
+		pr_info("packet size %d > buffer size %d", bytes_read, count);
+		return -EINVAL;
+	}
+
+	r = smd_read(smd_pkt_devp->ch, smd_pkt_devp->rx_buf, bytes_read);
+	if (r != bytes_read) {
+		mutex_unlock(&smd_pkt_devp->rx_lock);
+		pr_err("smd_read failed to read %d bytes: %d\n", bytes_read, r);
+		return -EIO;
+	}
+
+	D_DUMP_BUFFER("read: ", bytes_read, smd_pkt_devp->rx_buf);
+	r = copy_to_user(buf, smd_pkt_devp->rx_buf, bytes_read);
+	mutex_unlock(&smd_pkt_devp->rx_lock);
+	if (r) {
+		pr_err("copy_to_user failed %d\n", r);
+		return -EFAULT;
+	}
+
+	DBG("read complete %d bytes\n", bytes_read);
+	check_and_wakeup_reader(smd_pkt_devp);
+
+	return bytes_read;
+}
+
+static int smd_pkt_write(struct file *file, const char __user *buf,
+			 size_t count, loff_t *ppos)
+{
+	int r;
+	struct smd_pkt_dev *smd_pkt_devp;
+
+	if (count > MAX_BUF_SIZE)
+		return -EINVAL;
+
+	DBG("writting %d bytes\n", count);
+
+	smd_pkt_devp = file->private_data;
+	if (!smd_pkt_devp || !smd_pkt_devp->ch)
+		return -EINVAL;
+
+	mutex_lock(&smd_pkt_devp->tx_lock);
+	if (smd_write_avail(smd_pkt_devp->ch) < count) {
+		mutex_unlock(&smd_pkt_devp->tx_lock);
+		DBG("Not enough space to write\n");
+		return -ENOMEM;
+	}
+
+	D_DUMP_BUFFER("write: ", count, buf);
+	r = copy_from_user(smd_pkt_devp->tx_buf, buf, count);
+	if (r) {
+		mutex_unlock(&smd_pkt_devp->tx_lock);
+		pr_err("copy_from_user failed %d\n", r);
+		return -EFAULT;
+	}
+
+	r = smd_write(smd_pkt_devp->ch, smd_pkt_devp->tx_buf, count);
+	if (r != count) {
+		mutex_unlock(&smd_pkt_devp->tx_lock);
+		pr_err("smd_write failed to write %d bytes: %d.\n", count, r);
+		return -EIO;
+	}
+	mutex_unlock(&smd_pkt_devp->tx_lock);
+
+	DBG("wrote %d bytes\n", count);
+	return count;
+}
+
+static unsigned int smd_pkt_poll(struct file *file, poll_table *wait)
+{
+	struct smd_pkt_dev *smd_pkt_devp;
+	unsigned int mask = 0;
+
+	smd_pkt_devp = file->private_data;
+	if (!smd_pkt_devp)
+		return POLLERR;
+
+	DBG("poll waiting\n");
+	poll_wait(file, &smd_pkt_devp->ch_read_wait_queue, wait);
+	if (smd_read_avail(smd_pkt_devp->ch))
+		mask |= POLLIN | POLLRDNORM;
+
+	DBG("poll return\n");
+	return mask;
+}
+
+static void smd_pkt_ch_notify(void *priv, unsigned event)
+{
+	struct smd_pkt_dev *smd_pkt_devp = priv;
+
+	if (smd_pkt_devp->ch == 0)
+		return;
+
+	switch (event) {
+	case SMD_EVENT_DATA:
+		DBG("data\n");
+		check_and_wakeup_reader(smd_pkt_devp);
+		break;
+
+	case SMD_EVENT_OPEN:
+		DBG("remote open\n");
+		smd_pkt_devp->remote_open = 1;
+		wake_up_interruptible(&smd_pkt_devp->ch_opened_wait_queue);
+		break;
+
+	case SMD_EVENT_CLOSE:
+		smd_pkt_devp->remote_open = 0;
+		pr_info("remote closed\n");
+		break;
+
+	default:
+		pr_err("unknown event %d\n", event);
+		break;
+	}
+}
+
+static char *smd_pkt_dev_name[] = {
+	"smdcntl0",
+	"smdcntl1",
+	"smdcntl2",
+	"smdcntl3",
+	"smdcntl4",
+	"smdcntl5",
+	"smdcntl6",
+	"smdcntl7",
+	"smd22",
+};
+
+static char *smd_ch_name[] = {
+	"DATA5_CNTL",
+	"DATA6_CNTL",
+	"DATA7_CNTL",
+	"DATA8_CNTL",
+	"DATA9_CNTL",
+	"DATA12_CNTL",
+	"DATA13_CNTL",
+	"DATA14_CNTL",
+	"DATA22",
+};
+
+static int smd_pkt_open(struct inode *inode, struct file *file)
+{
+	int r = 0;
+	struct smd_pkt_dev *smd_pkt_devp;
+
+	smd_pkt_devp = container_of(inode->i_cdev, struct smd_pkt_dev, cdev);
+	if (!smd_pkt_devp)
+		return -EINVAL;
+
+	file->private_data = smd_pkt_devp;
+
+	mutex_lock(&smd_pkt_devp->ch_lock);
+	if (smd_pkt_devp->open_count == 0) {
+		r = smd_open(smd_ch_name[smd_pkt_devp->i],
+			     &smd_pkt_devp->ch, smd_pkt_devp,
+			     smd_pkt_ch_notify);
+		if (r < 0) {
+			pr_err("smd_open failed for %s, %d\n",
+			       smd_ch_name[smd_pkt_devp->i], r);
+			goto out;
+		}
+
+		r = wait_event_interruptible_timeout(
+				smd_pkt_devp->ch_opened_wait_queue,
+				smd_pkt_devp->remote_open,
+				msecs_to_jiffies(2 * HZ));
+		if (r == 0)
+			r = -ETIMEDOUT;
+
+		if (r < 0) {
+			pr_err("wait returned %d\n", r);
+			smd_close(smd_pkt_devp->ch);
+			smd_pkt_devp->ch = 0;
+		} else {
+			smd_pkt_devp->open_count++;
+			r = 0;
+		}
+	}
+out:
+	mutex_unlock(&smd_pkt_devp->ch_lock);
+	return r;
+}
+
+static int smd_pkt_release(struct inode *inode, struct file *file)
+{
+	int r = 0;
+	struct smd_pkt_dev *smd_pkt_devp = file->private_data;
+
+	if (!smd_pkt_devp)
+		return -EINVAL;
+
+	mutex_lock(&smd_pkt_devp->ch_lock);
+	if (--smd_pkt_devp->open_count == 0) {
+		r = smd_close(smd_pkt_devp->ch);
+		smd_pkt_devp->ch = 0;
+	}
+	mutex_unlock(&smd_pkt_devp->ch_lock);
+
+	return r;
+}
+
+static const struct file_operations smd_pkt_fops = {
+	.owner = THIS_MODULE,
+	.open = smd_pkt_open,
+	.release = smd_pkt_release,
+	.read = smd_pkt_read,
+	.write = smd_pkt_write,
+	.poll = smd_pkt_poll,
+};
+
+static int __init smd_pkt_init(void)
+{
+	int i;
+	int r;
+
+	r = alloc_chrdev_region(&smd_pkt_number, 0,
+				NUM_SMD_PKT_PORTS, DEVICE_NAME);
+	if (r) {
+		pr_err("alloc_chrdev_region() failed %d\n", r);
+		return r;
+	}
+
+	smd_pkt_classp = class_create(THIS_MODULE, DEVICE_NAME);
+	if (IS_ERR(smd_pkt_classp)) {
+		r = PTR_ERR(smd_pkt_classp);
+		pr_err("class_create() failed %d\n", r);
+		goto unreg_chardev;
+	}
+
+	for (i = 0; i < NUM_SMD_PKT_PORTS; ++i) {
+		smd_pkt_devp[i] = kzalloc(sizeof(struct smd_pkt_dev),
+					  GFP_KERNEL);
+		if (IS_ERR(smd_pkt_devp[i])) {
+			r = PTR_ERR(smd_pkt_devp[i]);
+			pr_err("kmalloc() failed %d\n", r);
+			goto clean_cdevs;
+		}
+
+		smd_pkt_devp[i]->i = i;
+
+		init_waitqueue_head(&smd_pkt_devp[i]->ch_read_wait_queue);
+		smd_pkt_devp[i]->remote_open = 0;
+		init_waitqueue_head(&smd_pkt_devp[i]->ch_opened_wait_queue);
+
+		mutex_init(&smd_pkt_devp[i]->ch_lock);
+		mutex_init(&smd_pkt_devp[i]->rx_lock);
+		mutex_init(&smd_pkt_devp[i]->tx_lock);
+
+		cdev_init(&smd_pkt_devp[i]->cdev, &smd_pkt_fops);
+		smd_pkt_devp[i]->cdev.owner = THIS_MODULE;
+
+		r = cdev_add(&smd_pkt_devp[i]->cdev,
+			     (smd_pkt_number + i), 1);
+		if (r) {
+			pr_err("cdev_add() failed %d\n", r);
+			kfree(smd_pkt_devp[i]);
+			goto clean_cdevs;
+		}
+
+		smd_pkt_devp[i]->devicep =
+			device_create(smd_pkt_classp, NULL,
+				      (smd_pkt_number + i), NULL,
+				      smd_pkt_dev_name[i]);
+		if (IS_ERR(smd_pkt_devp[i]->devicep)) {
+			r = PTR_ERR(smd_pkt_devp[i]->devicep);
+			pr_err("device_create() failed %d\n", r);
+			cdev_del(&smd_pkt_devp[i]->cdev);
+			kfree(smd_pkt_devp[i]);
+			goto clean_cdevs;
+		}
+
+	}
+
+	pr_info("SMD Packet Port Driver Initialized.\n");
+	return 0;
+
+clean_cdevs:
+	if (i > 0) {
+		while (--i >= 0) {
+			mutex_destroy(&smd_pkt_devp[i]->ch_lock);
+			mutex_destroy(&smd_pkt_devp[i]->rx_lock);
+			mutex_destroy(&smd_pkt_devp[i]->tx_lock);
+			cdev_del(&smd_pkt_devp[i]->cdev);
+			kfree(smd_pkt_devp[i]);
+			device_destroy(smd_pkt_classp,
+				       MKDEV(MAJOR(smd_pkt_number), i));
+		}
+	}
+
+	class_destroy(smd_pkt_classp);
+unreg_chardev:
+	unregister_chrdev_region(MAJOR(smd_pkt_number), NUM_SMD_PKT_PORTS);
+	return r;
+}
+module_init(smd_pkt_init);
+
+static void __exit smd_pkt_cleanup(void)
+{
+	int i;
+
+	for (i = 0; i < NUM_SMD_PKT_PORTS; ++i) {
+		mutex_destroy(&smd_pkt_devp[i]->ch_lock);
+		mutex_destroy(&smd_pkt_devp[i]->rx_lock);
+		mutex_destroy(&smd_pkt_devp[i]->tx_lock);
+		cdev_del(&smd_pkt_devp[i]->cdev);
+		kfree(smd_pkt_devp[i]);
+		device_destroy(smd_pkt_classp,
+			       MKDEV(MAJOR(smd_pkt_number), i));
+	}
+
+	class_destroy(smd_pkt_classp);
+	unregister_chrdev_region(MAJOR(smd_pkt_number), NUM_SMD_PKT_PORTS);
+}
+module_exit(smd_pkt_cleanup);
+
+MODULE_DESCRIPTION("MSM Shared Memory Packet Port");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h
index 270431ca7dae..fba6ab1160ce 100644
--- a/drivers/char/mwave/3780i.h
+++ b/drivers/char/mwave/3780i.h
@@ -122,7 +122,7 @@ typedef struct {
 typedef struct {
 	unsigned char Dma:3;	/* RW: DMA channel selection */
 	unsigned char NumTransfers:2;	/* RW: Maximum # of transfers once being granted the ISA bus */
-	unsigned char ReRequest:2;	/* RW: Minumum delay between releasing the ISA bus and requesting it again */
+	unsigned char ReRequest:2;	/* RW: Minimum delay between releasing the ISA bus and requesting it again */
 	unsigned char MEMCS16:1;	/* RW: ISA signal MEMCS16: 0=disabled, 1=enabled */
 } DSP_BUSMASTER_CFG_1;
 
diff --git a/drivers/char/mwave/Makefile b/drivers/char/mwave/Makefile
index 26b4fce217b6..efa6a82e543d 100644
--- a/drivers/char/mwave/Makefile
+++ b/drivers/char/mwave/Makefile
@@ -9,7 +9,7 @@ obj-$(CONFIG_MWAVE) += mwave.o
 mwave-y := mwavedd.o smapi.o tp3780i.o 3780i.o
 
 # To have the mwave driver disable other uarts if necessary
-# EXTRA_CFLAGS += -DMWAVE_FUTZ_WITH_OTHER_DEVICES
+# ccflags-y := -DMWAVE_FUTZ_WITH_OTHER_DEVICES
 
 # To compile in lots (~20 KiB) of run-time enablable printk()s for debugging:
-ccflags-y := -DMW_TRACE
+ccflags-y += -DMW_TRACE
diff --git a/drivers/char/mwave/README b/drivers/char/mwave/README
index 480251fc78e2..c2a58f428bc8 100644
--- a/drivers/char/mwave/README
+++ b/drivers/char/mwave/README
@@ -11,7 +11,7 @@ are not saved by the BIOS and so do not persist after unload and reload.
 	0x0008 tp3780i tracing
 
         Tracing only occurs if the driver has been compiled with the
-        MW_TRACE macro #defined  (i.e. let EXTRA_CFLAGS += -DMW_TRACE
+        MW_TRACE macro #defined  (i.e. let ccflags-y := -DMW_TRACE
         in the Makefile).
 
   mwave_3780i_irq=5/7/10/11/15
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index 8994ce32e6c7..04a480f86c6c 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -75,7 +75,7 @@ int button_add_callback (void (*callback) (void), int count)
  * with -EINVAL. If there is more than one entry with the same address,
  * because it searches the list from end to beginning, it will unregister the
  * last one to be registered first (FILO- First In Last Out).
- * Note that this is not neccessarily true if the entries are not submitted
+ * Note that this is not necessarily true if the entries are not submitted
  * at the same time, because another driver could have unregistered a callback
  * between the submissions creating a gap earlier in the list, which would
  * be filled first at submission time.
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index bcbbc71febb7..90bd01671c70 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -806,7 +806,7 @@ static void monitor_card(unsigned long p)
 		dev->flags1 = 0x01;
 		xoutb(dev->flags1, REG_FLAGS1(iobase));
 
-		/* atr is present (which doesnt mean it's valid) */
+		/* atr is present (which doesn't mean it's valid) */
 		set_bit(IS_ATR_PRESENT, &dev->flags);
 		if (dev->atr[0] == 0x03)
 			str_invert_revert(dev->atr, dev->atr_len);
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index beca80bb9bdb..b575411c69b2 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1290,7 +1290,7 @@ static int startup(MGSLPC_INFO * info, struct tty_struct *tty)
 	/* Allocate and claim adapter resources */
 	retval = claim_resources(info);
 
-	/* perform existance check and diagnostics */
+	/* perform existence check and diagnostics */
 	if ( !retval )
 		retval = adapter_test(info);
 
@@ -2680,7 +2680,7 @@ static void rx_free_buffers(MGSLPC_INFO *info)
 static int claim_resources(MGSLPC_INFO *info)
 {
 	if (rx_alloc_buffers(info) < 0 ) {
-		printk( "Cant allocate rx buffer %s\n", info->device_name);
+		printk( "Can't allocate rx buffer %s\n", info->device_name);
 		release_resources(info);
 		return -ENODEV;
 	}
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 5e29e8031bbc..d4ddeba56682 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -732,7 +732,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
 			       size_t nbytes, int min, int rsvd);
 
 /*
- * This utility inline function is responsible for transfering entropy
+ * This utility inline function is responsible for transferring entropy
  * from the primary pool to the secondary extraction pool. We make
  * sure we pull enough for a 'catastrophic reseed'.
  */
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 79e36c878a4c..1ee8ce7d2762 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1241,7 +1241,7 @@ static int __devinit sonypi_setup_ioports(struct sonypi_device *dev,
 	while (check_ioport && check->port1) {
 		if (!request_region(check->port1,
 				   sonypi_device.region_size,
-				   "Sony Programable I/O Device Check")) {
+				   "Sony Programmable I/O Device Check")) {
 			printk(KERN_ERR "sonypi: ioport 0x%.4x busy, using sony-laptop? "
 					"if not use check_ioport=0\n",
 					check->port1);
@@ -1255,7 +1255,7 @@ static int __devinit sonypi_setup_ioports(struct sonypi_device *dev,
 
 		if (request_region(ioport_list->port1,
 				   sonypi_device.region_size,
-				   "Sony Programable I/O Device")) {
+				   "Sony Programmable I/O Device")) {
 			dev->ioport1 = ioport_list->port1;
 			dev->ioport2 = ioport_list->port2;
 			return 0;
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 1f46f1cd9225..7beb0e25f1e1 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -980,7 +980,7 @@ int tpm_open(struct inode *inode, struct file *file)
 		return -EBUSY;
 	}
 
-	chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
+	chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
 	if (chip->data_buffer == NULL) {
 		clear_bit(0, &chip->is_open);
 		put_device(chip->dev);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 84b164d1eb2b..838568a7dbf5 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1280,18 +1280,7 @@ static void unplug_port(struct port *port)
 		spin_lock_irq(&pdrvdata_lock);
 		list_del(&port->cons.list);
 		spin_unlock_irq(&pdrvdata_lock);
-#if 0
-		/*
-		 * hvc_remove() not called as removing one hvc port
-		 * results in other hvc ports getting frozen.
-		 *
-		 * Once this is resolved in hvc, this functionality
-		 * will be enabled.  Till that is done, the -EPIPE
-		 * return from get_chars() above will help
-		 * hvc_console.c to clean up on ports we remove here.
-		 */
 		hvc_remove(port->cons.hvc);
-#endif
 	}
 
 	/* Remove unused data this port might have received. */
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index d3c9d755ed98..d6412c16385f 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -67,7 +67,7 @@
  * cp foo.bit /dev/icap0
  *
  * Note that unless foo.bit is an appropriately constructed partial
- * bitstream, this has a high likelyhood of overwriting the design
+ * bitstream, this has a high likelihood of overwriting the design
  * currently programmed in the FPGA.
  */