Merge branch 'master' of git://git.denx.de/u-boot-arm into master

Conflicts:
	arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg
	arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg

Signed-off-by: Stefano Babic <sbabic@denx.de>

64 files changed, 4809 insertions, 1413 deletions

diff --git a/drivers/block/ahci.c b/drivers/block/ahci.c
index e64df4f..a409f63 100644
--- a/drivers/block/ahci.c
+++ b/drivers/block/ahci.c
@@ -41,7 +41,7 @@ u16 *ataid[AHCI_MAX_PORTS];
 #define WAIT_MS_SPINUP	20000
 #define WAIT_MS_DATAIO	5000
 #define WAIT_MS_FLUSH	5000
-#define WAIT_MS_LINKUP	4
+#define WAIT_MS_LINKUP	40
 
 static inline u32 ahci_port_base(u32 base, u32 port)
 {
@@ -930,6 +930,11 @@ int ahci_init(u32 base)
 err_out:
 	return rc;
 }
+
+void __weak scsi_init(void)
+{
+}
+
 #endif
 
 /*
diff --git a/drivers/core/Makefile b/drivers/core/Makefile
new file mode 100644
index 0000000..90b2a7f
--- /dev/null
+++ b/drivers/core/Makefile
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2013 Google, Inc
+#
+# SPDX-License-Identifier:	GPL-2.0+
+#
+
+obj-$(CONFIG_DM)	:= device.o lists.o root.o uclass.o util.o
diff --git a/drivers/core/device.c b/drivers/core/device.c
new file mode 100644
index 0000000..55ba281
--- /dev/null
+++ b/drivers/core/device.c
@@ -0,0 +1,348 @@
+/*
+ * Device manager
+ *
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Pavel Herrmann <morpheus.ibis@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <malloc.h>
+#include <dm/device.h>
+#include <dm/device-internal.h>
+#include <dm/lists.h>
+#include <dm/platdata.h>
+#include <dm/uclass.h>
+#include <dm/uclass-internal.h>
+#include <dm/util.h>
+#include <linux/err.h>
+#include <linux/list.h>
+
+/**
+ * device_chld_unbind() - Unbind all device's children from the device
+ *
+ * On error, the function continues to unbind all children, and reports the
+ * first error.
+ *
+ * @dev:	The device that is to be stripped of its children
+ * @return 0 on success, -ve on error
+ */
+static int device_chld_unbind(struct device *dev)
+{
+	struct device *pos, *n;
+	int ret, saved_ret = 0;
+
+	assert(dev);
+
+	list_for_each_entry_safe(pos, n, &dev->child_head, sibling_node) {
+		ret = device_unbind(pos);
+		if (ret && !saved_ret)
+			saved_ret = ret;
+	}
+
+	return saved_ret;
+}
+
+/**
+ * device_chld_remove() - Stop all device's children
+ * @dev:	The device whose children are to be removed
+ * @return 0 on success, -ve on error
+ */
+static int device_chld_remove(struct device *dev)
+{
+	struct device *pos, *n;
+	int ret;
+
+	assert(dev);
+
+	list_for_each_entry_safe(pos, n, &dev->child_head, sibling_node) {
+		ret = device_remove(pos);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+int device_bind(struct device *parent, struct driver *drv, const char *name,
+		void *platdata, int of_offset, struct device **devp)
+{
+	struct device *dev;
+	struct uclass *uc;
+	int ret = 0;
+
+	*devp = NULL;
+	if (!name)
+		return -EINVAL;
+
+	ret = uclass_get(drv->id, &uc);
+	if (ret)
+		return ret;
+
+	dev = calloc(1, sizeof(struct device));
+	if (!dev)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&dev->sibling_node);
+	INIT_LIST_HEAD(&dev->child_head);
+	INIT_LIST_HEAD(&dev->uclass_node);
+	dev->platdata = platdata;
+	dev->name = name;
+	dev->of_offset = of_offset;
+	dev->parent = parent;
+	dev->driver = drv;
+	dev->uclass = uc;
+	if (!dev->platdata && drv->platdata_auto_alloc_size)
+		dev->flags |= DM_FLAG_ALLOC_PDATA;
+
+	/* put dev into parent's successor list */
+	if (parent)
+		list_add_tail(&dev->sibling_node, &parent->child_head);
+
+	ret = uclass_bind_device(dev);
+	if (ret)
+		goto fail_bind;
+
+	/* if we fail to bind we remove device from successors and free it */
+	if (drv->bind) {
+		ret = drv->bind(dev);
+		if (ret) {
+			if (uclass_unbind_device(dev)) {
+				dm_warn("Failed to unbind dev '%s' on error path\n",
+					dev->name);
+			}
+			goto fail_bind;
+		}
+	}
+	if (parent)
+		dm_dbg("Bound device %s to %s\n", dev->name, parent->name);
+	*devp = dev;
+
+	return 0;
+
+fail_bind:
+	list_del(&dev->sibling_node);
+	free(dev);
+	return ret;
+}
+
+int device_bind_by_name(struct device *parent, const struct driver_info *info,
+			struct device **devp)
+{
+	struct driver *drv;
+
+	drv = lists_driver_lookup_name(info->name);
+	if (!drv)
+		return -ENOENT;
+
+	return device_bind(parent, drv, info->name, (void *)info->platdata,
+			   -1, devp);
+}
+
+int device_unbind(struct device *dev)
+{
+	struct driver *drv;
+	int ret;
+
+	if (!dev)
+		return -EINVAL;
+
+	if (dev->flags & DM_FLAG_ACTIVATED)
+		return -EINVAL;
+
+	drv = dev->driver;
+	assert(drv);
+
+	if (drv->unbind) {
+		ret = drv->unbind(dev);
+		if (ret)
+			return ret;
+	}
+
+	ret = device_chld_unbind(dev);
+	if (ret)
+		return ret;
+
+	ret = uclass_unbind_device(dev);
+	if (ret)
+		return ret;
+
+	if (dev->parent)
+		list_del(&dev->sibling_node);
+	free(dev);
+
+	return 0;
+}
+
+/**
+ * device_free() - Free memory buffers allocated by a device
+ * @dev:	Device that is to be started
+ */
+static void device_free(struct device *dev)
+{
+	int size;
+
+	if (dev->driver->priv_auto_alloc_size) {
+		free(dev->priv);
+		dev->priv = NULL;
+	}
+	if (dev->flags & DM_FLAG_ALLOC_PDATA) {
+		free(dev->platdata);
+		dev->platdata = NULL;
+	}
+	size = dev->uclass->uc_drv->per_device_auto_alloc_size;
+	if (size) {
+		free(dev->uclass_priv);
+		dev->uclass_priv = NULL;
+	}
+}
+
+int device_probe(struct device *dev)
+{
+	struct driver *drv;
+	int size = 0;
+	int ret;
+
+	if (!dev)
+		return -EINVAL;
+
+	if (dev->flags & DM_FLAG_ACTIVATED)
+		return 0;
+
+	drv = dev->driver;
+	assert(drv);
+
+	/* Allocate private data and platdata if requested */
+	if (drv->priv_auto_alloc_size) {
+		dev->priv = calloc(1, drv->priv_auto_alloc_size);
+		if (!dev->priv) {
+			ret = -ENOMEM;
+			goto fail;
+		}
+	}
+	/* Allocate private data if requested */
+	if (dev->flags & DM_FLAG_ALLOC_PDATA) {
+		dev->platdata = calloc(1, drv->platdata_auto_alloc_size);
+		if (!dev->platdata) {
+			ret = -ENOMEM;
+			goto fail;
+		}
+	}
+	size = dev->uclass->uc_drv->per_device_auto_alloc_size;
+	if (size) {
+		dev->uclass_priv = calloc(1, size);
+		if (!dev->uclass_priv) {
+			ret = -ENOMEM;
+			goto fail;
+		}
+	}
+
+	/* Ensure all parents are probed */
+	if (dev->parent) {
+		ret = device_probe(dev->parent);
+		if (ret)
+			goto fail;
+	}
+
+	if (drv->ofdata_to_platdata && dev->of_offset >= 0) {
+		ret = drv->ofdata_to_platdata(dev);
+		if (ret)
+			goto fail;
+	}
+
+	if (drv->probe) {
+		ret = drv->probe(dev);
+		if (ret)
+			goto fail;
+	}
+
+	dev->flags |= DM_FLAG_ACTIVATED;
+
+	ret = uclass_post_probe_device(dev);
+	if (ret) {
+		dev->flags &= ~DM_FLAG_ACTIVATED;
+		goto fail_uclass;
+	}
+
+	return 0;
+fail_uclass:
+	if (device_remove(dev)) {
+		dm_warn("%s: Device '%s' failed to remove on error path\n",
+			__func__, dev->name);
+	}
+fail:
+	device_free(dev);
+
+	return ret;
+}
+
+int device_remove(struct device *dev)
+{
+	struct driver *drv;
+	int ret;
+
+	if (!dev)
+		return -EINVAL;
+
+	if (!(dev->flags & DM_FLAG_ACTIVATED))
+		return 0;
+
+	drv = dev->driver;
+	assert(drv);
+
+	ret = uclass_pre_remove_device(dev);
+	if (ret)
+		return ret;
+
+	ret = device_chld_remove(dev);
+	if (ret)
+		goto err;
+
+	if (drv->remove) {
+		ret = drv->remove(dev);
+		if (ret)
+			goto err_remove;
+	}
+
+	device_free(dev);
+
+	dev->flags &= ~DM_FLAG_ACTIVATED;
+
+	return 0;
+
+err_remove:
+	/* We can't put the children back */
+	dm_warn("%s: Device '%s' failed to remove, but children are gone\n",
+		__func__, dev->name);
+err:
+	ret = uclass_post_probe_device(dev);
+	if (ret) {
+		dm_warn("%s: Device '%s' failed to post_probe on error path\n",
+			__func__, dev->name);
+	}
+
+	return ret;
+}
+
+void *dev_get_platdata(struct device *dev)
+{
+	if (!dev) {
+		dm_warn("%s: null device", __func__);
+		return NULL;
+	}
+
+	return dev->platdata;
+}
+
+void *dev_get_priv(struct device *dev)
+{
+	if (!dev) {
+		dm_warn("%s: null device", __func__);
+		return NULL;
+	}
+
+	return dev->priv;
+}
diff --git a/drivers/core/lists.c b/drivers/core/lists.c
new file mode 100644
index 0000000..4f2c126
--- /dev/null
+++ b/drivers/core/lists.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Marek Vasut <marex@denx.de>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <errno.h>
+#include <dm/device.h>
+#include <dm/device-internal.h>
+#include <dm/platdata.h>
+#include <dm/uclass.h>
+#include <dm/util.h>
+#include <linux/compiler.h>
+
+struct driver *lists_driver_lookup_name(const char *name)
+{
+	struct driver *drv =
+		ll_entry_start(struct driver, driver);
+	const int n_ents = ll_entry_count(struct driver, driver);
+	struct driver *entry;
+	int len;
+
+	if (!drv || !n_ents)
+		return NULL;
+
+	len = strlen(name);
+
+	for (entry = drv; entry != drv + n_ents; entry++) {
+		if (strncmp(name, entry->name, len))
+			continue;
+
+		/* Full match */
+		if (len == strlen(entry->name))
+			return entry;
+	}
+
+	/* Not found */
+	return NULL;
+}
+
+struct uclass_driver *lists_uclass_lookup(enum uclass_id id)
+{
+	struct uclass_driver *uclass =
+		ll_entry_start(struct uclass_driver, uclass);
+	const int n_ents = ll_entry_count(struct uclass_driver, uclass);
+	struct uclass_driver *entry;
+
+	if ((id == UCLASS_INVALID) || !uclass)
+		return NULL;
+
+	for (entry = uclass; entry != uclass + n_ents; entry++) {
+		if (entry->id == id)
+			return entry;
+	}
+
+	return NULL;
+}
+
+int lists_bind_drivers(struct device *parent)
+{
+	struct driver_info *info =
+		ll_entry_start(struct driver_info, driver_info);
+	const int n_ents = ll_entry_count(struct driver_info, driver_info);
+	struct driver_info *entry;
+	struct device *dev;
+	int result = 0;
+	int ret;
+
+	for (entry = info; entry != info + n_ents; entry++) {
+		ret = device_bind_by_name(parent, entry, &dev);
+		if (ret) {
+			dm_warn("No match for driver '%s'\n", entry->name);
+			if (!result || ret != -ENOENT)
+				result = ret;
+		}
+	}
+
+	return result;
+}
+
+#ifdef CONFIG_OF_CONTROL
+/**
+ * driver_check_compatible() - Check if a driver is compatible with this node
+ *
+ * @param blob:		Device tree pointer
+ * @param offset:	Offset of node in device tree
+ * @param of_matchL	List of compatible strings to match
+ * @return 0 if there is a match, -ENOENT if no match, -ENODEV if the node
+ * does not have a compatible string, other error <0 if there is a device
+ * tree error
+ */
+static int driver_check_compatible(const void *blob, int offset,
+				   const struct device_id *of_match)
+{
+	int ret;
+
+	if (!of_match)
+		return -ENOENT;
+
+	while (of_match->compatible) {
+		ret = fdt_node_check_compatible(blob, offset,
+						of_match->compatible);
+		if (!ret)
+			return 0;
+		else if (ret == -FDT_ERR_NOTFOUND)
+			return -ENODEV;
+		else if (ret < 0)
+			return -EINVAL;
+		of_match++;
+	}
+
+	return -ENOENT;
+}
+
+int lists_bind_fdt(struct device *parent, const void *blob, int offset)
+{
+	struct driver *driver = ll_entry_start(struct driver, driver);
+	const int n_ents = ll_entry_count(struct driver, driver);
+	struct driver *entry;
+	struct device *dev;
+	const char *name;
+	int result = 0;
+	int ret;
+
+	dm_dbg("bind node %s\n", fdt_get_name(blob, offset, NULL));
+	for (entry = driver; entry != driver + n_ents; entry++) {
+		ret = driver_check_compatible(blob, offset, entry->of_match);
+		if (ret == -ENOENT) {
+			continue;
+		} else if (ret == -ENODEV) {
+			break;
+		} else if (ret) {
+			dm_warn("Device tree error at offset %d\n", offset);
+			if (!result || ret != -ENOENT)
+				result = ret;
+			break;
+		}
+
+		name = fdt_get_name(blob, offset, NULL);
+		dm_dbg("   - found match at '%s'\n", entry->name);
+		ret = device_bind(parent, entry, name, NULL, offset, &dev);
+		if (ret) {
+			dm_warn("No match for driver '%s'\n", entry->name);
+			if (!result || ret != -ENOENT)
+				result = ret;
+		}
+	}
+
+	return result;
+}
+#endif
diff --git a/drivers/core/root.c b/drivers/core/root.c
new file mode 100644
index 0000000..407bc0d
--- /dev/null
+++ b/drivers/core/root.c
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Pavel Herrmann <morpheus.ibis@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <errno.h>
+#include <malloc.h>
+#include <dm/device.h>
+#include <dm/device-internal.h>
+#include <dm/lists.h>
+#include <dm/platdata.h>
+#include <dm/uclass.h>
+#include <dm/util.h>
+#include <linux/list.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+static const struct driver_info root_info = {
+	.name		= "root_driver",
+};
+
+struct device *dm_root(void)
+{
+	if (!gd->dm_root) {
+		dm_warn("Virtual root driver does not exist!\n");
+		return NULL;
+	}
+
+	return gd->dm_root;
+}
+
+int dm_init(void)
+{
+	int ret;
+
+	if (gd->dm_root) {
+		dm_warn("Virtual root driver already exists!\n");
+		return -EINVAL;
+	}
+	INIT_LIST_HEAD(&gd->uclass_root);
+
+	ret = device_bind_by_name(NULL, &root_info, &gd->dm_root);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int dm_scan_platdata(void)
+{
+	int ret;
+
+	ret = lists_bind_drivers(gd->dm_root);
+	if (ret == -ENOENT) {
+		dm_warn("Some drivers were not found\n");
+		ret = 0;
+	}
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+#ifdef CONFIG_OF_CONTROL
+int dm_scan_fdt(const void *blob)
+{
+	int offset = 0;
+	int ret = 0, err;
+	int depth = 0;
+
+	do {
+		offset = fdt_next_node(blob, offset, &depth);
+		if (offset > 0 && depth == 1) {
+			err = lists_bind_fdt(gd->dm_root, blob, offset);
+			if (err && !ret)
+				ret = err;
+		}
+	} while (offset > 0);
+
+	if (ret)
+		dm_warn("Some drivers failed to bind\n");
+
+	return ret;
+}
+#endif
+
+/* This is the root driver - all drivers are children of this */
+U_BOOT_DRIVER(root_driver) = {
+	.name	= "root_driver",
+	.id	= UCLASS_ROOT,
+};
+
+/* This is the root uclass */
+UCLASS_DRIVER(root) = {
+	.name	= "root",
+	.id	= UCLASS_ROOT,
+};
diff --git a/drivers/core/uclass.c b/drivers/core/uclass.c
new file mode 100644
index 0000000..4df5a8b
--- /dev/null
+++ b/drivers/core/uclass.c
@@ -0,0 +1,285 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Pavel Herrmann <morpheus.ibis@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <errno.h>
+#include <malloc.h>
+#include <dm/device.h>
+#include <dm/device-internal.h>
+#include <dm/lists.h>
+#include <dm/uclass.h>
+#include <dm/uclass-internal.h>
+#include <dm/util.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+struct uclass *uclass_find(enum uclass_id key)
+{
+	struct uclass *uc;
+
+	/*
+	 * TODO(sjg@chromium.org): Optimise this, perhaps moving the found
+	 * node to the start of the list, or creating a linear array mapping
+	 * id to node.
+	 */
+	list_for_each_entry(uc, &gd->uclass_root, sibling_node) {
+		if (uc->uc_drv->id == key)
+			return uc;
+	}
+
+	return NULL;
+}
+
+/**
+ * uclass_add() - Create new uclass in list
+ * @id: Id number to create
+ * @ucp: Returns pointer to uclass, or NULL on error
+ * @return 0 on success, -ve on error
+ *
+ * The new uclass is added to the list. There must be only one uclass for
+ * each id.
+ */
+static int uclass_add(enum uclass_id id, struct uclass **ucp)
+{
+	struct uclass_driver *uc_drv;
+	struct uclass *uc;
+	int ret;
+
+	*ucp = NULL;
+	uc_drv = lists_uclass_lookup(id);
+	if (!uc_drv) {
+		dm_warn("Cannot find uclass for id %d: please add the UCLASS_DRIVER() declaration for this UCLASS_... id\n",
+			id);
+		return -ENOENT;
+	}
+	if (uc_drv->ops) {
+		dm_warn("No ops for uclass id %d\n", id);
+		return -EINVAL;
+	}
+	uc = calloc(1, sizeof(*uc));
+	if (!uc)
+		return -ENOMEM;
+	if (uc_drv->priv_auto_alloc_size) {
+		uc->priv = calloc(1, uc_drv->priv_auto_alloc_size);
+		if (!uc->priv) {
+			ret = -ENOMEM;
+			goto fail_mem;
+		}
+	}
+	uc->uc_drv = uc_drv;
+	INIT_LIST_HEAD(&uc->sibling_node);
+	INIT_LIST_HEAD(&uc->dev_head);
+	list_add(&uc->sibling_node, &gd->uclass_root);
+
+	if (uc_drv->init) {
+		ret = uc_drv->init(uc);
+		if (ret)
+			goto fail;
+	}
+
+	*ucp = uc;
+
+	return 0;
+fail:
+	if (uc_drv->priv_auto_alloc_size) {
+		free(uc->priv);
+		uc->priv = NULL;
+	}
+	list_del(&uc->sibling_node);
+fail_mem:
+	free(uc);
+
+	return ret;
+}
+
+int uclass_destroy(struct uclass *uc)
+{
+	struct uclass_driver *uc_drv;
+	struct device *dev, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(dev, tmp, &uc->dev_head, uclass_node) {
+		ret = device_remove(dev);
+		if (ret)
+			return ret;
+		ret = device_unbind(dev);
+		if (ret)
+			return ret;
+	}
+
+	uc_drv = uc->uc_drv;
+	if (uc_drv->destroy)
+		uc_drv->destroy(uc);
+	list_del(&uc->sibling_node);
+	if (uc_drv->priv_auto_alloc_size)
+		free(uc->priv);
+	free(uc);
+
+	return 0;
+}
+
+int uclass_get(enum uclass_id id, struct uclass **ucp)
+{
+	struct uclass *uc;
+
+	*ucp = NULL;
+	uc = uclass_find(id);
+	if (!uc)
+		return uclass_add(id, ucp);
+	*ucp = uc;
+
+	return 0;
+}
+
+int uclass_find_device(enum uclass_id id, int index, struct device **devp)
+{
+	struct uclass *uc;
+	struct device *dev;
+	int ret;
+
+	*devp = NULL;
+	ret = uclass_get(id, &uc);
+	if (ret)
+		return ret;
+
+	list_for_each_entry(dev, &uc->dev_head, uclass_node) {
+		if (!index--) {
+			*devp = dev;
+			return 0;
+		}
+	}
+
+	return -ENODEV;
+}
+
+int uclass_get_device(enum uclass_id id, int index, struct device **devp)
+{
+	struct device *dev;
+	int ret;
+
+	*devp = NULL;
+	ret = uclass_find_device(id, index, &dev);
+	if (ret)
+		return ret;
+
+	ret = device_probe(dev);
+	if (ret)
+		return ret;
+
+	*devp = dev;
+
+	return 0;
+}
+
+int uclass_first_device(enum uclass_id id, struct device **devp)
+{
+	struct uclass *uc;
+	struct device *dev;
+	int ret;
+
+	*devp = NULL;
+	ret = uclass_get(id, &uc);
+	if (ret)
+		return ret;
+	if (list_empty(&uc->dev_head))
+		return 0;
+
+	dev = list_first_entry(&uc->dev_head, struct device, uclass_node);
+	ret = device_probe(dev);
+	if (ret)
+		return ret;
+	*devp = dev;
+
+	return 0;
+}
+
+int uclass_next_device(struct device **devp)
+{
+	struct device *dev = *devp;
+	int ret;
+
+	*devp = NULL;
+	if (list_is_last(&dev->uclass_node, &dev->uclass->dev_head))
+		return 0;
+
+	dev = list_entry(dev->uclass_node.next, struct device, uclass_node);
+	ret = device_probe(dev);
+	if (ret)
+		return ret;
+	*devp = dev;
+
+	return 0;
+}
+
+int uclass_bind_device(struct device *dev)
+{
+	struct uclass *uc;
+	int ret;
+
+	uc = dev->uclass;
+
+	list_add_tail(&dev->uclass_node, &uc->dev_head);
+
+	if (uc->uc_drv->post_bind) {
+		ret = uc->uc_drv->post_bind(dev);
+		if (ret) {
+			list_del(&dev->uclass_node);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+int uclass_unbind_device(struct device *dev)
+{
+	struct uclass *uc;
+	int ret;
+
+	uc = dev->uclass;
+	if (uc->uc_drv->pre_unbind) {
+		ret = uc->uc_drv->pre_unbind(dev);
+		if (ret)
+			return ret;
+	}
+
+	list_del(&dev->uclass_node);
+	return 0;
+}
+
+int uclass_post_probe_device(struct device *dev)
+{
+	struct uclass_driver *uc_drv = dev->uclass->uc_drv;
+
+	if (uc_drv->post_probe)
+		return uc_drv->post_probe(dev);
+
+	return 0;
+}
+
+int uclass_pre_remove_device(struct device *dev)
+{
+	struct uclass_driver *uc_drv;
+	struct uclass *uc;
+	int ret;
+
+	uc = dev->uclass;
+	uc_drv = uc->uc_drv;
+	if (uc->uc_drv->pre_remove) {
+		ret = uc->uc_drv->pre_remove(dev);
+		if (ret)
+			return ret;
+	}
+	if (uc_drv->per_device_auto_alloc_size) {
+		free(dev->uclass_priv);
+		dev->uclass_priv = NULL;
+	}
+
+	return 0;
+}
diff --git a/drivers/core/util.c b/drivers/core/util.c
new file mode 100644
index 0000000..e01dd06
--- /dev/null
+++ b/drivers/core/util.c
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <vsprintf.h>
+
+void dm_warn(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	vprintf(fmt, args);
+	va_end(args);
+}
+
+void dm_dbg(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	vprintf(fmt, args);
+	va_end(args);
+}
+
+int list_count_items(struct list_head *head)
+{
+	struct list_head *node;
+	int count = 0;
+
+	list_for_each(node, head)
+		count++;
+
+	return count;
+}
diff --git a/drivers/demo/Makefile b/drivers/demo/Makefile
new file mode 100644
index 0000000..baaa2ba
--- /dev/null
+++ b/drivers/demo/Makefile
@@ -0,0 +1,9 @@
+#
+# Copyright (c) 2013 Google, Inc
+#
+# SPDX-License-Identifier:	GPL-2.0+
+#
+
+obj-$(CONFIG_DM_DEMO) += demo-uclass.o demo-pdata.o
+obj-$(CONFIG_DM_DEMO_SIMPLE) += demo-simple.o
+obj-$(CONFIG_DM_DEMO_SHAPE) += demo-shape.o
diff --git a/drivers/demo/demo-pdata.c b/drivers/demo/demo-pdata.c
new file mode 100644
index 0000000..e92841d
--- /dev/null
+++ b/drivers/demo/demo-pdata.c
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <dm-demo.h>
+
+static const struct dm_demo_pdata red_square = {
+	.colour = "red",
+	.sides = 4.
+};
+static const struct dm_demo_pdata green_triangle = {
+	.colour = "green",
+	.sides = 3.
+};
+static const struct dm_demo_pdata yellow_hexagon = {
+	.colour = "yellow",
+	.sides = 6.
+};
+
+U_BOOT_DEVICE(demo0) = {
+	.name = "demo_shape_drv",
+	.platdata = &red_square,
+};
+
+U_BOOT_DEVICE(demo1) = {
+	.name = "demo_simple_drv",
+	.platdata = &red_square,
+};
+
+U_BOOT_DEVICE(demo2) = {
+	.name = "demo_shape_drv",
+	.platdata = &green_triangle,
+};
+
+U_BOOT_DEVICE(demo3) = {
+	.name = "demo_simple_drv",
+	.platdata = &yellow_hexagon,
+};
+
+U_BOOT_DEVICE(demo4) = {
+	.name = "demo_shape_drv",
+	.platdata = &yellow_hexagon,
+};
diff --git a/drivers/demo/demo-shape.c b/drivers/demo/demo-shape.c
new file mode 100644
index 0000000..2f0eb96
--- /dev/null
+++ b/drivers/demo/demo-shape.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <errno.h>
+#include <fdtdec.h>
+#include <malloc.h>
+#include <dm-demo.h>
+#include <asm/io.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+/* Shape size */
+#define WIDTH	8
+#define HEIGHT	6
+
+struct shape_data {
+	int num_chars;	/* Number of non-space characters output so far */
+};
+
+/* Crazy little function to draw shapes on the console */
+static int shape_hello(struct device *dev, int ch)
+{
+	const struct dm_demo_pdata *pdata = dev_get_platdata(dev);
+	struct shape_data *data = dev_get_priv(dev);
+	static const struct shape {
+		int start;
+		int end;
+		int dstart;
+		int dend;
+	} shapes[3] = {
+		{ 0, 1, 0, 1 },
+		{ 0, WIDTH, 0, 0 },
+		{ HEIGHT / 2 - 1, WIDTH - HEIGHT / 2 + 1, -1, 1},
+	};
+	struct shape shape;
+	unsigned int index;
+	int line, pos, inside;
+	const char *colour = pdata->colour;
+	int first = 0;
+
+	if (!ch)
+		ch = pdata->default_char;
+	if (!ch)
+		ch = '@';
+
+	index = (pdata->sides / 2) - 1;
+	if (index >= ARRAY_SIZE(shapes))
+		return -EIO;
+	shape = shapes[index];
+
+	for (line = 0; line < HEIGHT; line++) {
+		first = 1;
+		for (pos = 0; pos < WIDTH; pos++) {
+			inside = pos >= shape.start && pos < shape.end;
+			if (inside) {
+				putc(first ? *colour++ : ch);
+				data->num_chars++;
+				first = 0;
+				if (!*colour)
+					colour = pdata->colour;
+			} else {
+				putc(' ');
+			}
+		}
+		putc('\n');
+		shape.start += shape.dstart;
+		shape.end += shape.dend;
+		if (shape.start < 0) {
+			shape.dstart = -shape.dstart;
+			shape.dend = -shape.dend;
+			shape.start += shape.dstart;
+			shape.end += shape.dend;
+		}
+	}
+
+	return 0;
+}
+
+static int shape_status(struct device *dev, int *status)
+{
+	struct shape_data *data = dev_get_priv(dev);
+
+	*status = data->num_chars;
+	return 0;
+}
+
+static const struct demo_ops shape_ops = {
+	.hello = shape_hello,
+	.status = shape_status,
+};
+
+static int shape_ofdata_to_platdata(struct device *dev)
+{
+	struct dm_demo_pdata *pdata = dev_get_platdata(dev);
+	int ret;
+
+	/* Parse the data that is common with all demo devices */
+	ret = demo_parse_dt(dev);
+	if (ret)
+		return ret;
+
+	/* Parse the data that only we need */
+	pdata->default_char = fdtdec_get_int(gd->fdt_blob, dev->of_offset,
+					     "character", '@');
+
+	return 0;
+}
+
+static const struct device_id demo_shape_id[] = {
+	{ "demo-shape", 0 },
+	{ },
+};
+
+U_BOOT_DRIVER(demo_shape_drv) = {
+	.name	= "demo_shape_drv",
+	.of_match = demo_shape_id,
+	.id	= UCLASS_DEMO,
+	.ofdata_to_platdata = shape_ofdata_to_platdata,
+	.ops	= &shape_ops,
+	.priv_auto_alloc_size = sizeof(struct shape_data),
+	.platdata_auto_alloc_size = sizeof(struct dm_demo_pdata),
+};
diff --git a/drivers/demo/demo-simple.c b/drivers/demo/demo-simple.c
new file mode 100644
index 0000000..6ba8131
--- /dev/null
+++ b/drivers/demo/demo-simple.c
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Pavel Herrmann <morpheus.ibis@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <dm-demo.h>
+#include <asm/io.h>
+
+static int simple_hello(struct device *dev, int ch)
+{
+	const struct dm_demo_pdata *pdata = dev_get_platdata(dev);
+
+	printf("Hello from %08x: %s %d\n", map_to_sysmem(dev), pdata->colour,
+	       pdata->sides);
+
+	return 0;
+}
+
+static const struct demo_ops simple_ops = {
+	.hello = simple_hello,
+};
+
+static int demo_shape_ofdata_to_platdata(struct device *dev)
+{
+	/* Parse the data that is common with all demo devices */
+	return demo_parse_dt(dev);
+}
+
+static const struct device_id demo_shape_id[] = {
+	{ "demo-simple", 0 },
+	{ },
+};
+
+U_BOOT_DRIVER(demo_simple_drv) = {
+	.name	= "demo_simple_drv",
+	.of_match = demo_shape_id,
+	.id	= UCLASS_DEMO,
+	.ofdata_to_platdata = demo_shape_ofdata_to_platdata,
+	.ops	= &simple_ops,
+	.platdata_auto_alloc_size = sizeof(struct dm_demo_pdata),
+};
diff --git a/drivers/demo/demo-uclass.c b/drivers/demo/demo-uclass.c
new file mode 100644
index 0000000..48588be
--- /dev/null
+++ b/drivers/demo/demo-uclass.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * (C) Copyright 2012
+ * Pavel Herrmann <morpheus.ibis@gmail.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <dm-demo.h>
+#include <errno.h>
+#include <fdtdec.h>
+#include <malloc.h>
+#include <asm/io.h>
+#include <linux/list.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+UCLASS_DRIVER(demo) = {
+	.id		= UCLASS_DEMO,
+};
+
+int demo_hello(struct device *dev, int ch)
+{
+	const struct demo_ops *ops = device_get_ops(dev);
+
+	if (!ops->hello)
+		return -ENOSYS;
+
+	return ops->hello(dev, ch);
+}
+
+int demo_status(struct device *dev, int *status)
+{
+	const struct demo_ops *ops = device_get_ops(dev);
+
+	if (!ops->status)
+		return -ENOSYS;
+
+	return ops->status(dev, status);
+}
+
+int demo_parse_dt(struct device *dev)
+{
+	struct dm_demo_pdata *pdata = dev_get_platdata(dev);
+	int dn = dev->of_offset;
+
+	pdata->sides = fdtdec_get_int(gd->fdt_blob, dn, "sides", 0);
+	pdata->colour = fdt_getprop(gd->fdt_blob, dn, "colour", NULL);
+	if (!pdata->sides || !pdata->colour) {
+		debug("%s: Invalid device tree data\n", __func__);
+		return -EINVAL;
+	}
+
+	return 0;
+}
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index 07011e9..56e69fd 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -19,6 +19,7 @@
 static bool dfu_reset_request;
 static LIST_HEAD(dfu_list);
 static int dfu_alt_num;
+static int alt_num_cnt;
 
 bool dfu_reset(void)
 {
@@ -377,6 +378,8 @@ void dfu_free_entities(void)
 	if (t)
 		free(t);
 	INIT_LIST_HEAD(&dfu_list);
+
+	alt_num_cnt = 0;
 }
 
 int dfu_config_entities(char *env, char *interface, int num)
@@ -394,11 +397,12 @@ int dfu_config_entities(char *env, char *interface, int num)
 	for (i = 0; i < dfu_alt_num; i++) {
 
 		s = strsep(&env, ";");
-		ret = dfu_fill_entity(&dfu[i], s, i, interface, num);
+		ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, num);
 		if (ret)
 			return -1;
 
 		list_add_tail(&dfu[i].list, &dfu_list);
+		alt_num_cnt++;
 	}
 
 	return 0;
diff --git a/drivers/fpga/zynqpl.c b/drivers/fpga/zynqpl.c
index 15900c9..923a158 100644
--- a/drivers/fpga/zynqpl.c
+++ b/drivers/fpga/zynqpl.c
@@ -10,7 +10,7 @@
 #include <common.h>
 #include <asm/io.h>
 #include <zynqpl.h>
-#include <asm/sizes.h>
+#include <linux/sizes.h>
 #include <asm/arch/hardware.h>
 #include <asm/arch/sys_proto.h>
 
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index ed2c0c7..4e001e1 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -5,6 +5,8 @@
 # SPDX-License-Identifier:	GPL-2.0+
 #
 
+obj-$(CONFIG_DM_GPIO)		+= gpio-uclass.o
+
 obj-$(CONFIG_AT91_GPIO)	+= at91_gpio.o
 obj-$(CONFIG_INTEL_ICH6_GPIO)	+= intel_ich6_gpio.o
 obj-$(CONFIG_KIRKWOOD_GPIO)	+= kw_gpio.o
diff --git a/drivers/gpio/at91_gpio.c b/drivers/gpio/at91_gpio.c
index 8b76666..0b70071 100644
--- a/drivers/gpio/at91_gpio.c
+++ b/drivers/gpio/at91_gpio.c
@@ -11,7 +11,7 @@
 #include <config.h>
 #include <common.h>
 #include <asm/io.h>
-#include <asm/sizes.h>
+#include <linux/sizes.h>
 #include <asm/arch/hardware.h>
 #include <asm/arch/at91_pio.h>
 #include <asm/arch/gpio.h>
diff --git a/drivers/gpio/gpio-uclass.c b/drivers/gpio/gpio-uclass.c
new file mode 100644
index 0000000..56bfd11
--- /dev/null
+++ b/drivers/gpio/gpio-uclass.c
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <errno.h>
+#include <asm/gpio.h>
+
+/**
+ * gpio_to_device() - Convert global GPIO number to device, number
+ * gpio:	The numeric representation of the GPIO
+ *
+ * Convert the GPIO number to an entry in the list of GPIOs
+ * or GPIO blocks registered with the GPIO controller. Returns
+ * entry on success, NULL on error.
+ */
+static int gpio_to_device(unsigned int gpio, struct device **devp,
+			  unsigned int *offset)
+{
+	struct gpio_dev_priv *uc_priv;
+	struct device *dev;
+	int ret;
+
+	for (ret = uclass_first_device(UCLASS_GPIO, &dev);
+	     dev;
+	     ret = uclass_next_device(&dev)) {
+		uc_priv = dev->uclass_priv;
+		if (gpio >= uc_priv->gpio_base &&
+		    gpio < uc_priv->gpio_base + uc_priv->gpio_count) {
+			*devp = dev;
+			*offset = gpio - uc_priv->gpio_base;
+			return 0;
+		}
+	}
+
+	/* No such GPIO */
+	return ret ? ret : -EINVAL;
+}
+
+int gpio_lookup_name(const char *name, struct device **devp,
+		     unsigned int *offsetp, unsigned int *gpiop)
+{
+	struct gpio_dev_priv *uc_priv;
+	struct device *dev;
+	int ret;
+
+	if (devp)
+		*devp = NULL;
+	for (ret = uclass_first_device(UCLASS_GPIO, &dev);
+	     dev;
+	     ret = uclass_next_device(&dev)) {
+		ulong offset;
+		int len;
+
+		uc_priv = dev->uclass_priv;
+		len = uc_priv->bank_name ? strlen(uc_priv->bank_name) : 0;
+
+		if (!strncmp(name, uc_priv->bank_name, len)) {
+			if (strict_strtoul(name + len, 10, &offset))
+				continue;
+			if (devp)
+				*devp = dev;
+			if (offsetp)
+				*offsetp = offset;
+			if (gpiop)
+				*gpiop = uc_priv->gpio_base + offset;
+			return 0;
+		}
+	}
+
+	return ret ? ret : -EINVAL;
+}
+
+/**
+ * gpio_request() - [COMPAT] Request GPIO
+ * gpio:	GPIO number
+ * label:	Name for the requested GPIO
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns 0 on success, negative value on error.
+ */
+int gpio_request(unsigned gpio, const char *label)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	if (!gpio_get_ops(dev)->request)
+		return 0;
+
+	return gpio_get_ops(dev)->request(dev, offset, label);
+}
+
+/**
+ * gpio_free() - [COMPAT] Relinquish GPIO
+ * gpio:	GPIO number
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns 0 on success, negative value on error.
+ */
+int gpio_free(unsigned gpio)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	if (!gpio_get_ops(dev)->free)
+		return 0;
+	return gpio_get_ops(dev)->free(dev, offset);
+}
+
+/**
+ * gpio_direction_input() - [COMPAT] Set GPIO direction to input
+ * gpio:	GPIO number
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns 0 on success, negative value on error.
+ */
+int gpio_direction_input(unsigned gpio)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	return gpio_get_ops(dev)->direction_input(dev, offset);
+}
+
+/**
+ * gpio_direction_output() - [COMPAT] Set GPIO direction to output and set value
+ * gpio:	GPIO number
+ * value:	Logical value to be set on the GPIO pin
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns 0 on success, negative value on error.
+ */
+int gpio_direction_output(unsigned gpio, int value)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	return gpio_get_ops(dev)->direction_output(dev, offset, value);
+}
+
+/**
+ * gpio_get_value() - [COMPAT] Sample GPIO pin and return it's value
+ * gpio:	GPIO number
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns the value of the GPIO pin, or negative value
+ * on error.
+ */
+int gpio_get_value(unsigned gpio)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	return gpio_get_ops(dev)->get_value(dev, offset);
+}
+
+/**
+ * gpio_set_value() - [COMPAT] Configure logical value on GPIO pin
+ * gpio:	GPIO number
+ * value:	Logical value to be set on the GPIO pin.
+ *
+ * This function implements the API that's compatible with current
+ * GPIO API used in U-Boot. The request is forwarded to particular
+ * GPIO driver. Returns 0 on success, negative value on error.
+ */
+int gpio_set_value(unsigned gpio, int value)
+{
+	unsigned int offset;
+	struct device *dev;
+	int ret;
+
+	ret = gpio_to_device(gpio, &dev, &offset);
+	if (ret)
+		return ret;
+
+	return gpio_get_ops(dev)->set_value(dev, offset, value);
+}
+
+const char *gpio_get_bank_info(struct device *dev, int *bit_count)
+{
+	struct gpio_dev_priv *priv;
+
+	/* Must be called on an active device */
+	priv = dev->uclass_priv;
+	assert(priv);
+
+	*bit_count = priv->gpio_count;
+	return priv->bank_name;
+}
+
+/* We need to renumber the GPIOs when any driver is probed/removed */
+static int gpio_renumber(void)
+{
+	struct gpio_dev_priv *uc_priv;
+	struct device *dev;
+	struct uclass *uc;
+	unsigned base;
+	int ret;
+
+	ret = uclass_get(UCLASS_GPIO, &uc);
+	if (ret)
+		return ret;
+
+	/* Ensure that we have a base for each bank */
+	base = 0;
+	uclass_foreach_dev(dev, uc) {
+		if (device_active(dev)) {
+			uc_priv = dev->uclass_priv;
+			uc_priv->gpio_base = base;
+			base += uc_priv->gpio_count;
+		}
+	}
+
+	return 0;
+}
+
+static int gpio_post_probe(struct device *dev)
+{
+	return gpio_renumber();
+}
+
+static int gpio_pre_remove(struct device *dev)
+{
+	return gpio_renumber();
+}
+
+UCLASS_DRIVER(gpio) = {
+	.id		= UCLASS_GPIO,
+	.name		= "gpio",
+	.post_probe	= gpio_post_probe,
+	.pre_remove	= gpio_pre_remove,
+	.per_device_auto_alloc_size = sizeof(struct gpio_dev_priv),
+};
diff --git a/drivers/gpio/sandbox.c b/drivers/gpio/sandbox.c
index 3c6cfec..22b6a5f 100644
--- a/drivers/gpio/sandbox.c
+++ b/drivers/gpio/sandbox.c
@@ -4,8 +4,13 @@
  */
 
 #include <common.h>
+#include <dm.h>
+#include <fdtdec.h>
+#include <malloc.h>
 #include <asm/gpio.h>
 
+DECLARE_GLOBAL_DATA_PTR;
+
 /* Flags for each GPIO */
 #define GPIOF_OUTPUT	(1 << 0)	/* Currently set as an output */
 #define GPIOF_HIGH	(1 << 1)	/* Currently set high */
@@ -16,34 +21,30 @@ struct gpio_state {
 	u8 flags;		/* flags (GPIOF_...) */
 };
 
-/*
- * State of GPIOs
- * TODO: Put this into sandbox state
- */
-static struct gpio_state state[CONFIG_SANDBOX_GPIO_COUNT];
-
 /* Access routines for GPIO state */
-static u8 *get_gpio_flags(unsigned gp)
+static u8 *get_gpio_flags(struct device *dev, unsigned offset)
 {
-	/* assert()'s could be disabled, so make sure we handle that */
-	assert(gp < ARRAY_SIZE(state));
-	if (gp >= ARRAY_SIZE(state)) {
+	struct gpio_dev_priv *uc_priv = dev->uclass_priv;
+	struct gpio_state *state = dev_get_priv(dev);
+
+	if (offset >= uc_priv->gpio_count) {
 		static u8 invalid_flags;
-		printf("sandbox_gpio: error: invalid gpio %u\n", gp);
+		printf("sandbox_gpio: error: invalid gpio %u\n", offset);
 		return &invalid_flags;
 	}
 
-	return &state[gp].flags;
+	return &state[offset].flags;
 }
 
-static int get_gpio_flag(unsigned gp, int flag)
+static int get_gpio_flag(struct device *dev, unsigned offset, int flag)
 {
-	return (*get_gpio_flags(gp) & flag) != 0;
+	return (*get_gpio_flags(dev, offset) & flag) != 0;
 }
 
-static int set_gpio_flag(unsigned gp, int flag, int value)
+static int set_gpio_flag(struct device *dev, unsigned offset, int flag,
+			 int value)
 {
-	u8 *gpio = get_gpio_flags(gp);
+	u8 *gpio = get_gpio_flags(dev, offset);
 
 	if (value)
 		*gpio |= flag;
@@ -53,11 +54,12 @@ static int set_gpio_flag(unsigned gp, int flag, int value)
 	return 0;
 }
 
-static int check_reserved(unsigned gpio, const char *func)
+static int check_reserved(struct device *dev, unsigned offset,
+			  const char *func)
 {
-	if (!get_gpio_flag(gpio, GPIOF_RESERVED)) {
-		printf("sandbox_gpio: %s: error: gpio %u not reserved\n",
-			func, gpio);
+	if (!get_gpio_flag(dev, offset, GPIOF_RESERVED)) {
+		printf("sandbox_gpio: %s: error: offset %u not reserved\n",
+		       func, offset);
 		return -1;
 	}
 
@@ -68,126 +70,185 @@ static int check_reserved(unsigned gpio, const char *func)
  * Back-channel sandbox-internal-only access to GPIO state
  */
 
-int sandbox_gpio_get_value(unsigned gp)
+int sandbox_gpio_get_value(struct device *dev, unsigned offset)
 {
-	if (get_gpio_flag(gp, GPIOF_OUTPUT))
-		debug("sandbox_gpio: get_value on output gpio %u\n", gp);
-	return get_gpio_flag(gp, GPIOF_HIGH);
+	if (get_gpio_flag(dev, offset, GPIOF_OUTPUT))
+		debug("sandbox_gpio: get_value on output gpio %u\n", offset);
+	return get_gpio_flag(dev, offset, GPIOF_HIGH);
 }
 
-int sandbox_gpio_set_value(unsigned gp, int value)
+int sandbox_gpio_set_value(struct device *dev, unsigned offset, int value)
 {
-	return set_gpio_flag(gp, GPIOF_HIGH, value);
+	return set_gpio_flag(dev, offset, GPIOF_HIGH, value);
 }
 
-int sandbox_gpio_get_direction(unsigned gp)
+int sandbox_gpio_get_direction(struct device *dev, unsigned offset)
 {
-	return get_gpio_flag(gp, GPIOF_OUTPUT);
+	return get_gpio_flag(dev, offset, GPIOF_OUTPUT);
 }
 
-int sandbox_gpio_set_direction(unsigned gp, int output)
+int sandbox_gpio_set_direction(struct device *dev, unsigned offset, int output)
 {
-	return set_gpio_flag(gp, GPIOF_OUTPUT, output);
+	return set_gpio_flag(dev, offset, GPIOF_OUTPUT, output);
 }
 
 /*
  * These functions implement the public interface within U-Boot
  */
 
-/* set GPIO port 'gp' as an input */
-int gpio_direction_input(unsigned gp)
+/* set GPIO port 'offset' as an input */
+static int sb_gpio_direction_input(struct device *dev, unsigned offset)
 {
-	debug("%s: gp:%u\n", __func__, gp);
+	debug("%s: offset:%u\n", __func__, offset);
 
-	if (check_reserved(gp, __func__))
+	if (check_reserved(dev, offset, __func__))
 		return -1;
 
-	return sandbox_gpio_set_direction(gp, 0);
+	return sandbox_gpio_set_direction(dev, offset, 0);
 }
 
-/* set GPIO port 'gp' as an output, with polarity 'value' */
-int gpio_direction_output(unsigned gp, int value)
+/* set GPIO port 'offset' as an output, with polarity 'value' */
+static int sb_gpio_direction_output(struct device *dev, unsigned offset,
+				    int value)
 {
-	debug("%s: gp:%u, value = %d\n", __func__, gp, value);
+	debug("%s: offset:%u, value = %d\n", __func__, offset, value);
 
-	if (check_reserved(gp, __func__))
+	if (check_reserved(dev, offset, __func__))
 		return -1;
 
-	return sandbox_gpio_set_direction(gp, 1) |
-		sandbox_gpio_set_value(gp, value);
+	return sandbox_gpio_set_direction(dev, offset, 1) |
+		sandbox_gpio_set_value(dev, offset, value);
 }
 
-/* read GPIO IN value of port 'gp' */
-int gpio_get_value(unsigned gp)
+/* read GPIO IN value of port 'offset' */
+static int sb_gpio_get_value(struct device *dev, unsigned offset)
 {
-	debug("%s: gp:%u\n", __func__, gp);
+	debug("%s: offset:%u\n", __func__, offset);
 
-	if (check_reserved(gp, __func__))
+	if (check_reserved(dev, offset, __func__))
 		return -1;
 
-	return sandbox_gpio_get_value(gp);
+	return sandbox_gpio_get_value(dev, offset);
 }
 
-/* write GPIO OUT value to port 'gp' */
-int gpio_set_value(unsigned gp, int value)
+/* write GPIO OUT value to port 'offset' */
+static int sb_gpio_set_value(struct device *dev, unsigned offset, int value)
 {
-	debug("%s: gp:%u, value = %d\n", __func__, gp, value);
+	debug("%s: offset:%u, value = %d\n", __func__, offset, value);
 
-	if (check_reserved(gp, __func__))
+	if (check_reserved(dev, offset, __func__))
 		return -1;
 
-	if (!sandbox_gpio_get_direction(gp)) {
-		printf("sandbox_gpio: error: set_value on input gpio %u\n", gp);
+	if (!sandbox_gpio_get_direction(dev, offset)) {
+		printf("sandbox_gpio: error: set_value on input gpio %u\n",
+		       offset);
 		return -1;
 	}
 
-	return sandbox_gpio_set_value(gp, value);
+	return sandbox_gpio_set_value(dev, offset, value);
 }
 
-int gpio_request(unsigned gp, const char *label)
+static int sb_gpio_request(struct device *dev, unsigned offset,
+			   const char *label)
 {
-	debug("%s: gp:%u, label:%s\n", __func__, gp, label);
+	struct gpio_dev_priv *uc_priv = dev->uclass_priv;
+	struct gpio_state *state = dev_get_priv(dev);
+
+	debug("%s: offset:%u, label:%s\n", __func__, offset, label);
 
-	if (gp >= ARRAY_SIZE(state)) {
-		printf("sandbox_gpio: error: invalid gpio %u\n", gp);
+	if (offset >= uc_priv->gpio_count) {
+		printf("sandbox_gpio: error: invalid gpio %u\n", offset);
 		return -1;
 	}
 
-	if (get_gpio_flag(gp, GPIOF_RESERVED)) {
-		printf("sandbox_gpio: error: gpio %u already reserved\n", gp);
+	if (get_gpio_flag(dev, offset, GPIOF_RESERVED)) {
+		printf("sandbox_gpio: error: gpio %u already reserved\n",
+		       offset);
 		return -1;
 	}
 
-	state[gp].label = label;
-	return set_gpio_flag(gp, GPIOF_RESERVED, 1);
+	state[offset].label = label;
+	return set_gpio_flag(dev, offset, GPIOF_RESERVED, 1);
 }
 
-int gpio_free(unsigned gp)
+static int sb_gpio_free(struct device *dev, unsigned offset)
 {
-	debug("%s: gp:%u\n", __func__, gp);
+	struct gpio_state *state = dev_get_priv(dev);
+
+	debug("%s: offset:%u\n", __func__, offset);
 
-	if (check_reserved(gp, __func__))
+	if (check_reserved(dev, offset, __func__))
 		return -1;
 
-	state[gp].label = NULL;
-	return set_gpio_flag(gp, GPIOF_RESERVED, 0);
+	state[offset].label = NULL;
+	return set_gpio_flag(dev, offset, GPIOF_RESERVED, 0);
 }
 
-/* Display GPIO information */
-void gpio_info(void)
+static int sb_gpio_get_state(struct device *dev, unsigned int offset,
+			     char *buf, int bufsize)
 {
-	unsigned gpio;
+	struct gpio_dev_priv *uc_priv = dev->uclass_priv;
+	struct gpio_state *state = dev_get_priv(dev);
+	const char *label;
+
+	label = state[offset].label;
+	snprintf(buf, bufsize, "%s%d: %s: %d [%c]%s%s",
+		 uc_priv->bank_name ? uc_priv->bank_name : "", offset,
+		 sandbox_gpio_get_direction(dev, offset) ? "out" : " in",
+		 sandbox_gpio_get_value(dev, offset),
+		 get_gpio_flag(dev, offset, GPIOF_RESERVED) ? 'x' : ' ',
+		 label ? " " : "",
+		 label ? label : "");
 
-	puts("Sandbox GPIOs\n");
+	return 0;
+}
+
+static const struct dm_gpio_ops gpio_sandbox_ops = {
+	.request		= sb_gpio_request,
+	.free			= sb_gpio_free,
+	.direction_input	= sb_gpio_direction_input,
+	.direction_output	= sb_gpio_direction_output,
+	.get_value		= sb_gpio_get_value,
+	.set_value		= sb_gpio_set_value,
+	.get_state		= sb_gpio_get_state,
+};
+
+static int sandbox_gpio_ofdata_to_platdata(struct device *dev)
+{
+	struct gpio_dev_priv *uc_priv = dev->uclass_priv;
 
-	for (gpio = 0; gpio < ARRAY_SIZE(state); ++gpio) {
-		const char *label = state[gpio].label;
+	uc_priv->gpio_count = fdtdec_get_int(gd->fdt_blob, dev->of_offset,
+					     "num-gpios", 0);
+	uc_priv->bank_name = fdt_getprop(gd->fdt_blob, dev->of_offset,
+					 "gpio-bank-name", NULL);
 
-		printf("%4d: %s: %d [%c] %s\n",
-			gpio,
-			sandbox_gpio_get_direction(gpio) ? "out" : " in",
-			sandbox_gpio_get_value(gpio),
-			get_gpio_flag(gpio, GPIOF_RESERVED) ? 'x' : ' ',
-			label ? label : "");
+	return 0;
+}
+
+static int gpio_sandbox_probe(struct device *dev)
+{
+	struct gpio_dev_priv *uc_priv = dev->uclass_priv;
+
+	if (dev->of_offset == -1) {
+		/* Tell the uclass how many GPIOs we have */
+		uc_priv->gpio_count = CONFIG_SANDBOX_GPIO_COUNT;
 	}
+
+	dev->priv = calloc(sizeof(struct gpio_state), uc_priv->gpio_count);
+
+	return 0;
 }
+
+static const struct device_id sandbox_gpio_ids[] = {
+	{ .compatible = "sandbox,gpio" },
+	{ }
+};
+
+U_BOOT_DRIVER(gpio_sandbox) = {
+	.name	= "gpio_sandbox",
+	.id	= UCLASS_GPIO,
+	.of_match = sandbox_gpio_ids,
+	.ofdata_to_platdata = sandbox_gpio_ofdata_to_platdata,
+	.probe	= gpio_sandbox_probe,
+	.ops	= &gpio_sandbox_ops,
+};
diff --git a/drivers/input/cros_ec_keyb.c b/drivers/input/cros_ec_keyb.c
index e8dac23..a2501e0 100644
--- a/drivers/input/cros_ec_keyb.c
+++ b/drivers/input/cros_ec_keyb.c
@@ -8,6 +8,7 @@
 
 #include <common.h>
 #include <cros_ec.h>
+#include <errno.h>
 #include <fdtdec.h>
 #include <input.h>
 #include <key_matrix.h>
@@ -39,20 +40,34 @@ static struct keyb {
  * @param config	Keyboard config
  * @param keys		List of keys that we have detected
  * @param max_count	Maximum number of keys to return
- * @return number of pressed keys, 0 for none
+ * @param samep		Set to true if this scan repeats the last, else false
+ * @return number of pressed keys, 0 for none, -EIO on error
  */
 static int check_for_keys(struct keyb *config,
-			   struct key_matrix_key *keys, int max_count)
+			   struct key_matrix_key *keys, int max_count,
+			   bool *samep)
 {
 	struct key_matrix_key *key;
+	static struct mbkp_keyscan last_scan;
+	static bool last_scan_valid;
 	struct mbkp_keyscan scan;
 	unsigned int row, col, bit, data;
 	int num_keys;
 
 	if (cros_ec_scan_keyboard(config->dev, &scan)) {
 		debug("%s: keyboard scan failed\n", __func__);
-		return -1;
+		return -EIO;
 	}
+	*samep = last_scan_valid && !memcmp(&last_scan, &scan, sizeof(scan));
+
+	/*
+	 * This is a bit odd. The EC has no way to tell us that it has run
+	 * out of key scans. It just returns the same scan over and over
+	 * again. So the only way to detect that we have run out is to detect
+	 * that this scan is the same as the last.
+	 */
+	last_scan_valid = true;
+	memcpy(&last_scan, &scan, sizeof(last_scan));
 
 	for (col = num_keys = bit = 0; col < config->matrix.num_cols;
 			col++) {
@@ -112,6 +127,7 @@ int cros_ec_kbc_check(struct input_config *input)
 	int keycodes[KBC_MAX_KEYS];
 	int num_keys, num_keycodes;
 	int irq_pending, sent;
+	bool same = false;
 
 	/*
 	 * Loop until the EC has no more keyscan records, or we have
@@ -125,7 +141,10 @@ int cros_ec_kbc_check(struct input_config *input)
 	do {
 		irq_pending = cros_ec_interrupt_pending(config.dev);
 		if (irq_pending) {
-			num_keys = check_for_keys(&config, keys, KBC_MAX_KEYS);
+			num_keys = check_for_keys(&config, keys, KBC_MAX_KEYS,
+						  &same);
+			if (num_keys < 0)
+				return 0;
 			last_num_keys = num_keys;
 			memcpy(last_keys, keys, sizeof(keys));
 		} else {
@@ -142,6 +161,13 @@ int cros_ec_kbc_check(struct input_config *input)
 		num_keycodes = key_matrix_decode(&config.matrix, keys,
 				num_keys, keycodes, KBC_MAX_KEYS);
 		sent = input_send_keycodes(input, keycodes, num_keycodes);
+
+		/*
+		 * For those ECs without an interrupt, stop scanning when we
+		 * see that the scan is the same as last time.
+		 */
+		if ((irq_pending < 0) && same)
+			break;
 	} while (irq_pending && !sent);
 
 	return 1;
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 0f9f6f1..2f2e48f 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_CBMEM_CONSOLE) += cbmem_console.o
 obj-$(CONFIG_CROS_EC) += cros_ec.o
 obj-$(CONFIG_CROS_EC_LPC) += cros_ec_lpc.o
 obj-$(CONFIG_CROS_EC_I2C) += cros_ec_i2c.o
+obj-$(CONFIG_CROS_EC_SANDBOX) += cros_ec_sandbox.o
 obj-$(CONFIG_CROS_EC_SPI) += cros_ec_spi.o
 obj-$(CONFIG_FSL_IIM) += fsl_iim.o
 obj-$(CONFIG_GPIO_LED) += gpio_led.o
diff --git a/drivers/misc/cros_ec.c b/drivers/misc/cros_ec.c
index 301e8eb..068373b 100644
--- a/drivers/misc/cros_ec.c
+++ b/drivers/misc/cros_ec.c
@@ -7,10 +7,11 @@
  */
 
 /*
- * The Matrix Keyboard Protocol driver handles talking to the keyboard
- * controller chip. Mostly this is for keyboard functions, but some other
- * things have slipped in, so we provide generic services to talk to the
- * KBC.
+ * This is the interface to the Chrome OS EC. It provides keyboard functions,
+ * power control and battery management. Quite a few other functions are
+ * provided to enable the EC software to be updated, talk to the EC's I2C bus
+ * and store a small amount of data in a memory which persists while the EC
+ * is not reset.
  */
 
 #include <common.h>
@@ -20,6 +21,7 @@
 #include <fdtdec.h>
 #include <malloc.h>
 #include <spi.h>
+#include <asm/errno.h>
 #include <asm/io.h>
 #include <asm-generic/gpio.h>
 
@@ -73,11 +75,184 @@ int cros_ec_calc_checksum(const uint8_t *data, int size)
 	return csum & 0xff;
 }
 
+/**
+ * Create a request packet for protocol version 3.
+ *
+ * The packet is stored in the device's internal output buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param cmd		Command to send (EC_CMD_...)
+ * @param cmd_version	Version of command to send (EC_VER_...)
+ * @param dout          Output data (may be NULL If dout_len=0)
+ * @param dout_len      Size of output data in bytes
+ * @return packet size in bytes, or <0 if error.
+ */
+static int create_proto3_request(struct cros_ec_dev *dev,
+				 int cmd, int cmd_version,
+				 const void *dout, int dout_len)
+{
+	struct ec_host_request *rq = (struct ec_host_request *)dev->dout;
+	int out_bytes = dout_len + sizeof(*rq);
+
+	/* Fail if output size is too big */
+	if (out_bytes > (int)sizeof(dev->dout)) {
+		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
+		return -EC_RES_REQUEST_TRUNCATED;
+	}
+
+	/* Fill in request packet */
+	rq->struct_version = EC_HOST_REQUEST_VERSION;
+	rq->checksum = 0;
+	rq->command = cmd;
+	rq->command_version = cmd_version;
+	rq->reserved = 0;
+	rq->data_len = dout_len;
+
+	/* Copy data after header */
+	memcpy(rq + 1, dout, dout_len);
+
+	/* Write checksum field so the entire packet sums to 0 */
+	rq->checksum = (uint8_t)(-cros_ec_calc_checksum(dev->dout, out_bytes));
+
+	cros_ec_dump_data("out", cmd, dev->dout, out_bytes);
+
+	/* Return size of request packet */
+	return out_bytes;
+}
+
+/**
+ * Prepare the device to receive a protocol version 3 response.
+ *
+ * @param dev		CROS-EC device
+ * @param din_len       Maximum size of response in bytes
+ * @return maximum expected number of bytes in response, or <0 if error.
+ */
+static int prepare_proto3_response_buffer(struct cros_ec_dev *dev, int din_len)
+{
+	int in_bytes = din_len + sizeof(struct ec_host_response);
+
+	/* Fail if input size is too big */
+	if (in_bytes > (int)sizeof(dev->din)) {
+		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	/* Return expected size of response packet */
+	return in_bytes;
+}
+
+/**
+ * Handle a protocol version 3 response packet.
+ *
+ * The packet must already be stored in the device's internal input buffer.
+ *
+ * @param dev		CROS-EC device
+ * @param dinp          Returns pointer to response data
+ * @param din_len       Maximum size of response in bytes
+ * @return number of bytes of response data, or <0 if error
+ */
+static int handle_proto3_response(struct cros_ec_dev *dev,
+				  uint8_t **dinp, int din_len)
+{
+	struct ec_host_response *rs = (struct ec_host_response *)dev->din;
+	int in_bytes;
+	int csum;
+
+	cros_ec_dump_data("in-header", -1, dev->din, sizeof(*rs));
+
+	/* Check input data */
+	if (rs->struct_version != EC_HOST_RESPONSE_VERSION) {
+		debug("%s: EC response version mismatch\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->reserved) {
+		debug("%s: EC response reserved != 0\n", __func__);
+		return -EC_RES_INVALID_RESPONSE;
+	}
+
+	if (rs->data_len > din_len) {
+		debug("%s: EC returned too much data\n", __func__);
+		return -EC_RES_RESPONSE_TOO_BIG;
+	}
+
+	cros_ec_dump_data("in-data", -1, dev->din + sizeof(*rs), rs->data_len);
+
+	/* Update in_bytes to actual data size */
+	in_bytes = sizeof(*rs) + rs->data_len;
+
+	/* Verify checksum */
+	csum = cros_ec_calc_checksum(dev->din, in_bytes);
+	if (csum) {
+		debug("%s: EC response checksum invalid: 0x%02x\n", __func__,
+		      csum);
+		return -EC_RES_INVALID_CHECKSUM;
+	}
+
+	/* Return error result, if any */
+	if (rs->result)
+		return -(int)rs->result;
+
+	/* If we're still here, set response data pointer and return length */
+	*dinp = (uint8_t *)(rs + 1);
+
+	return rs->data_len;
+}
+
+static int send_command_proto3(struct cros_ec_dev *dev,
+			       int cmd, int cmd_version,
+			       const void *dout, int dout_len,
+			       uint8_t **dinp, int din_len)
+{
+	int out_bytes, in_bytes;
+	int rv;
+
+	/* Create request packet */
+	out_bytes = create_proto3_request(dev, cmd, cmd_version,
+					  dout, dout_len);
+	if (out_bytes < 0)
+		return out_bytes;
+
+	/* Prepare response buffer */
+	in_bytes = prepare_proto3_response_buffer(dev, din_len);
+	if (in_bytes < 0)
+		return in_bytes;
+
+	switch (dev->interface) {
+#ifdef CONFIG_CROS_EC_SPI
+	case CROS_EC_IF_SPI:
+		rv = cros_ec_spi_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		rv = cros_ec_sandbox_packet(dev, out_bytes, in_bytes);
+		break;
+#endif
+	case CROS_EC_IF_NONE:
+	/* TODO: support protocol 3 for LPC, I2C; for now fall through */
+	default:
+		debug("%s: Unsupported interface\n", __func__);
+		rv = -1;
+	}
+	if (rv < 0)
+		return rv;
+
+	/* Process the response */
+	return handle_proto3_response(dev, dinp, din_len);
+}
+
 static int send_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 			const void *dout, int dout_len,
 			uint8_t **dinp, int din_len)
 {
-	int ret;
+	int ret = -1;
+
+	/* Handle protocol version 3 support */
+	if (dev->protocol_version == 3) {
+		return send_command_proto3(dev, cmd, cmd_version,
+					   dout, dout_len, dinp, din_len);
+	}
 
 	switch (dev->interface) {
 #ifdef CONFIG_CROS_EC_SPI
@@ -129,19 +304,15 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 		int cmd_version, const void *dout, int dout_len, uint8_t **dinp,
 		int din_len)
 {
-	uint8_t *din;
+	uint8_t *din = NULL;
 	int len;
 
-	if (cmd_version != 0 && !dev->cmd_version_is_supported) {
-		debug("%s: Command version >0 unsupported\n", __func__);
-		return -1;
-	}
 	len = send_command(dev, cmd, cmd_version, dout, dout_len,
 				&din, din_len);
 
 	/* If the command doesn't complete, wait a while */
 	if (len == -EC_RES_IN_PROGRESS) {
-		struct ec_response_get_comms_status *resp;
+		struct ec_response_get_comms_status *resp = NULL;
 		ulong start;
 
 		/* Wait for command to complete */
@@ -169,7 +340,8 @@ static int ec_command_inptr(struct cros_ec_dev *dev, uint8_t cmd,
 				NULL, 0, &din, din_len);
 	}
 
-	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp, *dinp);
+	debug("%s: len=%d, dinp=%p, *dinp=%p\n", __func__, len, dinp,
+	      dinp ? *dinp : NULL);
 	if (dinp) {
 		/* If we have any data to return, it must be 64bit-aligned */
 		assert(len <= 0 || !((uintptr_t)din & 7));
@@ -220,8 +392,8 @@ static int ec_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 
 int cros_ec_scan_keyboard(struct cros_ec_dev *dev, struct mbkp_keyscan *scan)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_STATE, 0, NULL, 0, scan,
-		       sizeof(scan->data)) < sizeof(scan->data))
+	if (ec_command(dev, EC_CMD_MKBP_STATE, 0, NULL, 0, scan,
+		       sizeof(scan->data)) != sizeof(scan->data))
 		return -1;
 
 	return 0;
@@ -232,10 +404,10 @@ int cros_ec_read_id(struct cros_ec_dev *dev, char *id, int maxlen)
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
-	if (maxlen > sizeof(r->version_string_ro))
+	if (maxlen > (int)sizeof(r->version_string_ro))
 		maxlen = sizeof(r->version_string_ro);
 
 	switch (r->current_image) {
@@ -258,7 +430,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
 			(uint8_t **)versionp, sizeof(**versionp))
-			< sizeof(**versionp))
+			!= sizeof(**versionp))
 		return -1;
 
 	return 0;
@@ -267,7 +439,7 @@ int cros_ec_read_version(struct cros_ec_dev *dev,
 int cros_ec_read_build_info(struct cros_ec_dev *dev, char **strp)
 {
 	if (ec_command_inptr(dev, EC_CMD_GET_BUILD_INFO, 0, NULL, 0,
-			(uint8_t **)strp, EC_HOST_PARAM_SIZE) < 0)
+			(uint8_t **)strp, EC_PROTO2_MAX_PARAM_SIZE) < 0)
 		return -1;
 
 	return 0;
@@ -279,7 +451,7 @@ int cros_ec_read_current_image(struct cros_ec_dev *dev,
 	struct ec_response_get_version *r;
 
 	if (ec_command_inptr(dev, EC_CMD_GET_VERSION, 0, NULL, 0,
-			(uint8_t **)&r, sizeof(*r)) < sizeof(*r))
+			(uint8_t **)&r, sizeof(*r)) != sizeof(*r))
 		return -1;
 
 	*image = r->current_image;
@@ -336,7 +508,7 @@ int cros_ec_read_hash(struct cros_ec_dev *dev,
 	debug("%s: No valid hash (status=%d size=%d). Compute one...\n",
 	      __func__, hash->status, hash->size);
 
-	p.cmd = EC_VBOOT_HASH_RECALC;
+	p.cmd = EC_VBOOT_HASH_START;
 	p.hash_type = EC_VBOOT_HASH_TYPE_SHA256;
 	p.nonce_size = 0;
 	p.offset = EC_VBOOT_HASH_OFFSET_RW;
@@ -413,15 +585,15 @@ int cros_ec_interrupt_pending(struct cros_ec_dev *dev)
 {
 	/* no interrupt support : always poll */
 	if (!fdt_gpio_isvalid(&dev->ec_int))
-		return 1;
+		return -ENOENT;
 
 	return !gpio_get_value(dev->ec_int.gpio);
 }
 
-int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_cros_ec_info *info)
+int cros_ec_info(struct cros_ec_dev *dev, struct ec_response_mkbp_info *info)
 {
-	if (ec_command(dev, EC_CMD_CROS_EC_INFO, 0, NULL, 0, info,
-			sizeof(*info)) < sizeof(*info))
+	if (ec_command(dev, EC_CMD_MKBP_INFO, 0, NULL, 0, info,
+		       sizeof(*info)) != sizeof(*info))
 		return -1;
 
 	return 0;
@@ -436,7 +608,7 @@ int cros_ec_get_host_events(struct cros_ec_dev *dev, uint32_t *events_ptr)
 	 * used by ACPI/SMI.
 	 */
 	if (ec_command_inptr(dev, EC_CMD_HOST_EVENT_GET_B, 0, NULL, 0,
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) < (int)sizeof(*resp))
 		return -1;
 
 	if (resp->mask & EC_HOST_EVENT_MASK(EC_HOST_EVENT_INVALID))
@@ -474,7 +646,7 @@ int cros_ec_flash_protect(struct cros_ec_dev *dev,
 
 	if (ec_command(dev, EC_CMD_FLASH_PROTECT, EC_VER_FLASH_PROTECT,
 		       &params, sizeof(params),
-		       resp, sizeof(*resp)) < sizeof(*resp))
+		       resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	return 0;
@@ -504,23 +676,30 @@ static int cros_ec_check_version(struct cros_ec_dev *dev)
 	 *
 	 * So for now, just read all the data anyway.
 	 */
-	dev->cmd_version_is_supported = 1;
+
+	/* Try sending a version 3 packet */
+	dev->protocol_version = 3;
+	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
+			     (uint8_t **)&resp, sizeof(*resp)) > 0) {
+		return 0;
+	}
+
+	/* Try sending a version 2 packet */
+	dev->protocol_version = 2;
 	if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req, sizeof(req),
 		       (uint8_t **)&resp, sizeof(*resp)) > 0) {
-		/* It appears to understand new version commands */
-		dev->cmd_version_is_supported = 1;
-	} else {
-		dev->cmd_version_is_supported = 0;
-		if (ec_command_inptr(dev, EC_CMD_HELLO, 0, &req,
-			      sizeof(req), (uint8_t **)&resp,
-			      sizeof(*resp)) < 0) {
-			debug("%s: Failed both old and new command style\n",
-				__func__);
-			return -1;
-		}
+		return 0;
 	}
 
-	return 0;
+	/*
+	 * Fail if we're still here, since the EC doesn't understand any
+	 * protcol version we speak.  Version 1 interface without command
+	 * version is no longer supported, and we don't know about any new
+	 * protocol versions.
+	 */
+	dev->protocol_version = 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
 
 int cros_ec_test(struct cros_ec_dev *dev)
@@ -599,8 +778,8 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
 
 	p.offset = offset;
 	p.size = size;
-	assert(data && p.size <= sizeof(p.data));
-	memcpy(p.data, data, p.size);
+	assert(data && p.size <= EC_FLASH_WRITE_VER0_SIZE);
+	memcpy(&p + 1, data, p.size);
 
 	return ec_command_inptr(dev, EC_CMD_FLASH_WRITE, 0,
 			  &p, sizeof(p), NULL, 0) >= 0 ? 0 : -1;
@@ -611,8 +790,7 @@ static int cros_ec_flash_write_block(struct cros_ec_dev *dev,
  */
 static int cros_ec_flash_write_burst_size(struct cros_ec_dev *dev)
 {
-	struct ec_params_flash_write p;
-	return sizeof(p.data);
+	return EC_FLASH_WRITE_VER0_SIZE;
 }
 
 /**
@@ -718,7 +896,7 @@ int cros_ec_flash_update_rw(struct cros_ec_dev *dev,
 
 	if (cros_ec_flash_offset(dev, EC_FLASH_REGION_RW, &rw_offset, &rw_size))
 		return -1;
-	if (image_size > rw_size)
+	if (image_size > (int)rw_size)
 		return -1;
 
 	/* Invalidate the existing hash, just in case the AP reboots
@@ -804,7 +982,7 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 
 	if (ec_command_inptr(dev, EC_CMD_LDO_GET, 0,
 		       &params, sizeof(params),
-		       (uint8_t **)&resp, sizeof(*resp)) < sizeof(*resp))
+		       (uint8_t **)&resp, sizeof(*resp)) != sizeof(*resp))
 		return -1;
 
 	*state = resp->state;
@@ -813,7 +991,8 @@ int cros_ec_get_ldo(struct cros_ec_dev *dev, uint8_t index, uint8_t *state)
 }
 
 /**
- * Decode MBKP details from the device tree and allocate a suitable device.
+ * Decode EC interface details from the device tree and allocate a suitable
+ * device.
  *
  * @param blob		Device tree blob
  * @param node		Node to decode from
@@ -859,6 +1038,11 @@ static int cros_ec_decode_fdt(const void *blob, int node,
 		dev->interface = CROS_EC_IF_LPC;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case COMPAT_SANDBOX_HOST_EMULATION:
+		dev->interface = CROS_EC_IF_SANDBOX;
+		break;
+#endif
 	default:
 		debug("%s: Unknown compat id %d\n", __func__, compat);
 		return -1;
@@ -914,6 +1098,12 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 			return -CROS_EC_ERR_DEV_INIT;
 		break;
 #endif
+#ifdef CONFIG_CROS_EC_SANDBOX
+	case CROS_EC_IF_SANDBOX:
+		if (cros_ec_sandbox_init(dev, blob))
+			return -CROS_EC_ERR_DEV_INIT;
+		break;
+#endif
 	case CROS_EC_IF_NONE:
 	default:
 		return 0;
@@ -941,7 +1131,6 @@ int cros_ec_init(const void *blob, struct cros_ec_dev **cros_ecp)
 	return 0;
 }
 
-#ifdef CONFIG_CMD_CROS_EC
 int cros_ec_decode_region(int argc, char * const argv[])
 {
 	if (argc > 0) {
@@ -958,6 +1147,139 @@ int cros_ec_decode_region(int argc, char * const argv[])
 	return -1;
 }
 
+int cros_ec_decode_ec_flash(const void *blob, struct fdt_cros_ec *config)
+{
+	int flash_node, node;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC);
+	if (node < 0) {
+		debug("Failed to find chrome-ec node'\n");
+		return -1;
+	}
+
+	flash_node = fdt_subnode_offset(blob, node, "flash");
+	if (flash_node < 0) {
+		debug("Failed to find flash node\n");
+		return -1;
+	}
+
+	if (fdtdec_read_fmap_entry(blob, flash_node, "flash",
+				   &config->flash)) {
+		debug("Failed to decode flash node in chrome-ec'\n");
+		return -1;
+	}
+
+	config->flash_erase_value = fdtdec_get_int(blob, flash_node,
+						    "erase-value", -1);
+	for (node = fdt_first_subnode(blob, flash_node); node >= 0;
+	     node = fdt_next_subnode(blob, node)) {
+		const char *name = fdt_get_name(blob, node, NULL);
+		enum ec_flash_region region;
+
+		if (0 == strcmp(name, "ro")) {
+			region = EC_FLASH_REGION_RO;
+		} else if (0 == strcmp(name, "rw")) {
+			region = EC_FLASH_REGION_RW;
+		} else if (0 == strcmp(name, "wp-ro")) {
+			region = EC_FLASH_REGION_WP_RO;
+		} else {
+			debug("Unknown EC flash region name '%s'\n", name);
+			return -1;
+		}
+
+		if (fdtdec_read_fmap_entry(blob, node, "reg",
+					   &config->region[region])) {
+			debug("Failed to decode flash region in chrome-ec'\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+int cros_ec_i2c_xfer(struct cros_ec_dev *dev, uchar chip, uint addr,
+		     int alen, uchar *buffer, int len, int is_read)
+{
+	union {
+		struct ec_params_i2c_passthru p;
+		uint8_t outbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} params;
+	union {
+		struct ec_response_i2c_passthru r;
+		uint8_t inbuf[EC_PROTO2_MAX_PARAM_SIZE];
+	} response;
+	struct ec_params_i2c_passthru *p = &params.p;
+	struct ec_response_i2c_passthru *r = &response.r;
+	struct ec_params_i2c_passthru_msg *msg = p->msg;
+	uint8_t *pdata;
+	int read_len, write_len;
+	int size;
+	int rv;
+
+	p->port = 0;
+
+	if (alen != 1) {
+		printf("Unsupported address length %d\n", alen);
+		return -1;
+	}
+	if (is_read) {
+		read_len = len;
+		write_len = alen;
+		p->num_msgs = 2;
+	} else {
+		read_len = 0;
+		write_len = alen + len;
+		p->num_msgs = 1;
+	}
+
+	size = sizeof(*p) + p->num_msgs * sizeof(*msg);
+	if (size + write_len > sizeof(params)) {
+		puts("Params too large for buffer\n");
+		return -1;
+	}
+	if (sizeof(*r) + read_len > sizeof(response)) {
+		puts("Read length too big for buffer\n");
+		return -1;
+	}
+
+	/* Create a message to write the register address and optional data */
+	pdata = (uint8_t *)p + size;
+	msg->addr_flags = chip;
+	msg->len = write_len;
+	pdata[0] = addr;
+	if (!is_read)
+		memcpy(pdata + 1, buffer, len);
+	msg++;
+
+	if (read_len) {
+		msg->addr_flags = chip | EC_I2C_FLAG_READ;
+		msg->len = read_len;
+	}
+
+	rv = ec_command(dev, EC_CMD_I2C_PASSTHRU, 0, p, size + write_len,
+			r, sizeof(*r) + read_len);
+	if (rv < 0)
+		return rv;
+
+	/* Parse response */
+	if (r->i2c_status & EC_I2C_STATUS_ERROR) {
+		printf("Transfer failed with status=0x%x\n", r->i2c_status);
+		return -1;
+	}
+
+	if (rv < sizeof(*r) + read_len) {
+		puts("Truncated read response\n");
+		return -1;
+	}
+
+	if (read_len)
+		memcpy(buffer, r->data, read_len);
+
+	return 0;
+}
+
+#ifdef CONFIG_CMD_CROS_EC
+
 /**
  * Perform a flash read or write command
  *
@@ -1011,6 +1333,187 @@ static int do_read_write(struct cros_ec_dev *dev, int is_write, int argc,
 	return 0;
 }
 
+/**
+ * get_alen() - Small parser helper function to get address length
+ *
+ * Returns the address length.
+ */
+static uint get_alen(char *arg)
+{
+	int	j;
+	int	alen;
+
+	alen = 1;
+	for (j = 0; j < 8; j++) {
+		if (arg[j] == '.') {
+			alen = arg[j+1] - '0';
+			break;
+		} else if (arg[j] == '\0') {
+			break;
+		}
+	}
+	return alen;
+}
+
+#define DISP_LINE_LEN	16
+
+/*
+ * TODO(sjg@chromium.org): This code copied almost verbatim from cmd_i2c.c
+ * so we can remove it later.
+ */
+static int cros_ec_i2c_md(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	u_char	chip;
+	uint	addr, alen, length = 0x10;
+	int	j, nbytes, linebytes;
+
+	if (argc < 2)
+		return CMD_RET_USAGE;
+
+	if (1 || (flag & CMD_FLAG_REPEAT) == 0) {
+		/*
+		 * New command specified.
+		 */
+
+		/*
+		 * I2C chip address
+		 */
+		chip = simple_strtoul(argv[0], NULL, 16);
+
+		/*
+		 * I2C data address within the chip.  This can be 1 or
+		 * 2 bytes long.  Some day it might be 3 bytes long :-).
+		 */
+		addr = simple_strtoul(argv[1], NULL, 16);
+		alen = get_alen(argv[1]);
+		if (alen > 3)
+			return CMD_RET_USAGE;
+
+		/*
+		 * If another parameter, it is the length to display.
+		 * Length is the number of objects, not number of bytes.
+		 */
+		if (argc > 2)
+			length = simple_strtoul(argv[2], NULL, 16);
+	}
+
+	/*
+	 * Print the lines.
+	 *
+	 * We buffer all read data, so we can make sure data is read only
+	 * once.
+	 */
+	nbytes = length;
+	do {
+		unsigned char	linebuf[DISP_LINE_LEN];
+		unsigned char	*cp;
+
+		linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
+
+		if (cros_ec_i2c_xfer(dev, chip, addr, alen, linebuf, linebytes,
+				     1))
+			puts("Error reading the chip.\n");
+		else {
+			printf("%04x:", addr);
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				printf(" %02x", *cp++);
+				addr++;
+			}
+			puts("    ");
+			cp = linebuf;
+			for (j = 0; j < linebytes; j++) {
+				if ((*cp < 0x20) || (*cp > 0x7e))
+					puts(".");
+				else
+					printf("%c", *cp);
+				cp++;
+			}
+			putc('\n');
+		}
+		nbytes -= linebytes;
+	} while (nbytes > 0);
+
+	return 0;
+}
+
+static int cros_ec_i2c_mw(struct cros_ec_dev *dev, int flag, int argc,
+			  char * const argv[])
+{
+	uchar	chip;
+	ulong	addr;
+	uint	alen;
+	uchar	byte;
+	int	count;
+
+	if ((argc < 3) || (argc > 4))
+		return CMD_RET_USAGE;
+
+	/*
+	 * Chip is always specified.
+	 */
+	chip = simple_strtoul(argv[0], NULL, 16);
+
+	/*
+	 * Address is always specified.
+	 */
+	addr = simple_strtoul(argv[1], NULL, 16);
+	alen = get_alen(argv[1]);
+	if (alen > 3)
+		return CMD_RET_USAGE;
+
+	/*
+	 * Value to write is always specified.
+	 */
+	byte = simple_strtoul(argv[2], NULL, 16);
+
+	/*
+	 * Optional count
+	 */
+	if (argc == 4)
+		count = simple_strtoul(argv[3], NULL, 16);
+	else
+		count = 1;
+
+	while (count-- > 0) {
+		if (cros_ec_i2c_xfer(dev, chip, addr++, alen, &byte, 1, 0))
+			puts("Error writing the chip.\n");
+		/*
+		 * Wait for the write to complete.  The write can take
+		 * up to 10mSec (we allow a little more time).
+		 */
+/*
+ * No write delay with FRAM devices.
+ */
+#if !defined(CONFIG_SYS_I2C_FRAM)
+		udelay(11000);
+#endif
+	}
+
+	return 0;
+}
+
+/* Temporary code until we have driver model and can use the i2c command */
+static int cros_ec_i2c_passthrough(struct cros_ec_dev *dev, int flag,
+				   int argc, char * const argv[])
+{
+	const char *cmd;
+
+	if (argc < 1)
+		return CMD_RET_USAGE;
+	cmd = *argv++;
+	argc--;
+	if (0 == strcmp("md", cmd))
+		cros_ec_i2c_md(dev, flag, argc, argv);
+	else if (0 == strcmp("mw", cmd))
+		cros_ec_i2c_mw(dev, flag, argc, argv);
+	else
+		return CMD_RET_USAGE;
+
+	return 0;
+}
+
 static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	struct cros_ec_dev *dev = last_dev;
@@ -1044,7 +1547,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		}
 		printf("%s\n", id);
 	} else if (0 == strcmp("info", cmd)) {
-		struct ec_response_cros_ec_info info;
+		struct ec_response_mkbp_info info;
 
 		if (cros_ec_info(dev, &info)) {
 			debug("%s: Could not read KBC info\n", __func__);
@@ -1213,10 +1716,10 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		if (!ret) {
 			/* Print versions */
 			printf("RO version:    %1.*s\n",
-			       sizeof(p->version_string_ro),
+			       (int)sizeof(p->version_string_ro),
 			       p->version_string_ro);
 			printf("RW version:    %1.*s\n",
-			       sizeof(p->version_string_rw),
+			       (int)sizeof(p->version_string_rw),
 			       p->version_string_rw);
 			printf("Firmware copy: %s\n",
 				(p->current_image <
@@ -1254,6 +1757,8 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 			debug("%s: Could not access LDO%d\n", __func__, index);
 			return ret;
 		}
+	} else if (0 == strcmp("i2c", cmd)) {
+		ret = cros_ec_i2c_passthrough(dev, flag, argc - 2, argv + 2);
 	} else {
 		return CMD_RET_USAGE;
 	}
@@ -1267,7 +1772,7 @@ static int do_cros_ec(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 }
 
 U_BOOT_CMD(
-	crosec,	5,	1,	do_cros_ec,
+	crosec,	6,	1,	do_cros_ec,
 	"CROS-EC utility command",
 	"init                Re-init CROS-EC (done on startup automatically)\n"
 	"crosec id                  Read CROS-EC ID\n"
@@ -1284,6 +1789,8 @@ U_BOOT_CMD(
 	"crosec vbnvcontext [hexstring]        Read [write] VbNvContext from EC\n"
 	"crosec ldo <idx> [<state>] Switch/Read LDO state\n"
 	"crosec test                run tests on cros_ec\n"
-	"crosec version             Read CROS-EC version"
+	"crosec version             Read CROS-EC version\n"
+	"crosec i2c md chip address[.0, .1, .2] [# of objects] - read from I2C passthru\n"
+	"crosec i2c mw chip address[.0, .1, .2] value [count] - write to I2C passthru (fill)"
 );
 #endif
diff --git a/drivers/misc/cros_ec_i2c.c b/drivers/misc/cros_ec_i2c.c
index 0fbab99..513cdb1 100644
--- a/drivers/misc/cros_ec_i2c.c
+++ b/drivers/misc/cros_ec_i2c.c
@@ -35,7 +35,7 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	uint8_t *ptr;
 	/* Receive input data, so that args will be dword aligned */
 	uint8_t *in_ptr;
-	int ret;
+	int len, csum, ret;
 
 	old_bus = i2c_get_bus_num();
 
@@ -67,24 +67,24 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	 * will be dword aligned.
 	 */
 	in_ptr = dev->din + sizeof(int64_t);
-	if (!dev->cmd_version_is_supported) {
-		/* Send an old-style command */
-		*ptr++ = cmd;
-		out_bytes = dout_len + 1;
-		in_bytes = din_len + 2;
-		in_ptr--;	/* Expect just a status byte */
-	} else {
-		*ptr++ = EC_CMD_VERSION0 + cmd_version;
-		*ptr++ = cmd;
-		*ptr++ = dout_len;
-		in_ptr -= 2;	/* Expect status, length bytes */
+
+	if (dev->protocol_version != 2) {
+		/* Something we don't support */
+		debug("%s: Protocol version %d unsupported\n",
+		      __func__, dev->protocol_version);
+		return -1;
 	}
+
+	*ptr++ = EC_CMD_VERSION0 + cmd_version;
+	*ptr++ = cmd;
+	*ptr++ = dout_len;
+	in_ptr -= 2;	/* Expect status, length bytes */
+
 	memcpy(ptr, dout, dout_len);
 	ptr += dout_len;
 
-	if (dev->cmd_version_is_supported)
-		*ptr++ = (uint8_t)
-			 cros_ec_calc_checksum(dev->dout, dout_len + 3);
+	*ptr++ = (uint8_t)
+		cros_ec_calc_checksum(dev->dout, dout_len + 3);
 
 	/* Set to the proper i2c bus */
 	if (i2c_set_bus_num(dev->bus_num)) {
@@ -121,26 +121,20 @@ int cros_ec_i2c_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		return -(int)*in_ptr;
 	}
 
-	if (dev->cmd_version_is_supported) {
-		int len, csum;
-
-		len = in_ptr[1];
-		if (len + 3 > sizeof(dev->din)) {
-			debug("%s: Received length %#02x too large\n",
-			      __func__, len);
-			return -1;
-		}
-		csum = cros_ec_calc_checksum(in_ptr, 2 + len);
-		if (csum != in_ptr[2 + len]) {
-			debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
-			      __func__, in_ptr[2 + din_len], csum);
-			return -1;
-		}
-		din_len = min(din_len, len);
-		cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
-	} else {
-		cros_ec_dump_data("in (old)", -1, in_ptr, in_bytes);
+	len = in_ptr[1];
+	if (len + 3 > sizeof(dev->din)) {
+		debug("%s: Received length %#02x too large\n",
+		      __func__, len);
+		return -1;
 	}
+	csum = cros_ec_calc_checksum(in_ptr, 2 + len);
+	if (csum != in_ptr[2 + len]) {
+		debug("%s: Invalid checksum rx %#02x, calced %#02x\n",
+		      __func__, in_ptr[2 + din_len], csum);
+		return -1;
+	}
+	din_len = min(din_len, len);
+	cros_ec_dump_data("in", -1, in_ptr, din_len + 3);
 
 	/* Return pointer to dword-aligned input data, if any */
 	*dinp = dev->din + sizeof(int64_t);
@@ -178,7 +172,5 @@ int cros_ec_i2c_init(struct cros_ec_dev *dev, const void *blob)
 {
 	i2c_init(dev->max_frequency, dev->addr);
 
-	dev->cmd_version_is_supported = 0;
-
 	return 0;
 }
diff --git a/drivers/misc/cros_ec_lpc.c b/drivers/misc/cros_ec_lpc.c
index 7257476..0e02671 100644
--- a/drivers/misc/cros_ec_lpc.c
+++ b/drivers/misc/cros_ec_lpc.c
@@ -40,71 +40,6 @@ static int wait_for_sync(struct cros_ec_dev *dev)
 	return 0;
 }
 
-/**
- * Send a command to a LPC CROS_EC device and return the reply.
- *
- * The device's internal input/output buffers are used.
- *
- * @param dev		CROS_EC device
- * @param cmd		Command to send (EC_CMD_...)
- * @param cmd_version	Version of command to send (EC_VER_...)
- * @param dout          Output data (may be NULL If dout_len=0)
- * @param dout_len      Size of output data in bytes
- * @param dinp          Place to put pointer to response data
- * @param din_len       Maximum size of response in bytes
- * @return number of bytes in response, or -1 on error
- */
-static int old_lpc_command(struct cros_ec_dev *dev, uint8_t cmd,
-		     const uint8_t *dout, int dout_len,
-		     uint8_t **dinp, int din_len)
-{
-	int ret, i;
-
-	if (dout_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
-		return -1;
-	}
-
-	if (din_len > EC_OLD_PARAM_SIZE) {
-		debug("%s: Cannot receive %d bytes\n", __func__, din_len);
-		return -1;
-	}
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	debug_trace("cmd: %02x, ", cmd);
-	for (i = 0; i < dout_len; i++) {
-		debug_trace("%02x ", dout[i]);
-		outb(dout[i], EC_LPC_ADDR_OLD_PARAM + i);
-	}
-	outb(cmd, EC_LPC_ADDR_HOST_CMD);
-	debug_trace("\n");
-
-	if (wait_for_sync(dev)) {
-		debug("%s: Timeout waiting ready\n", __func__);
-		return -1;
-	}
-
-	ret = inb(EC_LPC_ADDR_HOST_DATA);
-	if (ret) {
-		debug("%s: CROS_EC result code %d\n", __func__, ret);
-		return -ret;
-	}
-
-	debug_trace("resp: %02x, ", ret);
-	for (i = 0; i < din_len; i++) {
-		dev->din[i] = inb(EC_LPC_ADDR_OLD_PARAM + i);
-		debug_trace("%02x ", dev->din[i]);
-	}
-	debug_trace("\n");
-	*dinp = dev->din;
-
-	return din_len;
-}
-
 int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 		     const uint8_t *dout, int dout_len,
 		     uint8_t **dinp, int din_len)
@@ -119,11 +54,6 @@ int cros_ec_lpc_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum;
 	int i;
 
-	/* Fall back to old-style command interface if args aren't supported */
-	if (!dev->cmd_version_is_supported)
-		return old_lpc_command(dev, cmd, dout, dout_len, dinp,
-				       din_len);
-
 	if (dout_len > EC_HOST_PARAM_SIZE) {
 		debug("%s: Cannot send %d bytes\n", __func__, dout_len);
 		return -1;
@@ -256,13 +186,9 @@ int cros_ec_lpc_check_version(struct cros_ec_dev *dev)
 			(inb(EC_LPC_ADDR_MEMMAP +
 				EC_MEMMAP_HOST_CMD_FLAGS) &
 				EC_HOST_CMD_FLAG_LPC_ARGS_SUPPORTED)) {
-		dev->cmd_version_is_supported = 1;
-	} else {
-		/* We are going to use the old IO ports */
-		dev->cmd_version_is_supported = 0;
+		return 0;
 	}
-	debug("lpc: version %s\n", dev->cmd_version_is_supported ?
-			"new" : "old");
 
-	return 0;
+	printf("%s: ERROR: old EC interface not supported\n", __func__);
+	return -1;
 }
diff --git a/drivers/misc/cros_ec_sandbox.c b/drivers/misc/cros_ec_sandbox.c
new file mode 100644
index 0000000..4bb1d60
--- /dev/null
+++ b/drivers/misc/cros_ec_sandbox.c
@@ -0,0 +1,559 @@
+/*
+ * Chromium OS cros_ec driver - sandbox emulation
+ *
+ * Copyright (c) 2013 The Chromium OS Authors.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <cros_ec.h>
+#include <ec_commands.h>
+#include <errno.h>
+#include <hash.h>
+#include <malloc.h>
+#include <os.h>
+#include <sha256.h>
+#include <spi.h>
+#include <asm/state.h>
+#include <asm/sdl.h>
+#include <linux/input.h>
+
+/*
+ * Ultimately it shold be possible to connect an Chrome OS EC emulation
+ * to U-Boot and remove all of this code. But this provides a test
+ * environment for bringing up chromeos_sandbox and demonstrating its
+ * utility.
+ *
+ * This emulation includes the following:
+ *
+ * 1. Emulation of the keyboard, by converting keypresses received from SDL
+ * into key scan data, passed back from the EC as key scan messages. The
+ * key layout is read from the device tree.
+ *
+ * 2. Emulation of vboot context - so this can be read/written as required.
+ *
+ * 3. Save/restore of EC state, so that the vboot context, flash memory
+ * contents and current image can be preserved across boots. This is important
+ * since the EC is supposed to continue running even if the AP resets.
+ *
+ * 4. Some event support, in particular allowing Escape to be pressed on boot
+ * to enter recovery mode. The EC passes this to U-Boot through the normal
+ * event message.
+ *
+ * 5. Flash read/write/erase support, so that software sync works. The
+ * protect messages are supported but no protection is implemented.
+ *
+ * 6. Hashing of the EC image, again to support software sync.
+ *
+ * Other features can be added, although a better path is probably to link
+ * the EC image in with U-Boot (Vic has demonstrated a prototype for this).
+ */
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#define KEYBOARD_ROWS	8
+#define KEYBOARD_COLS	13
+
+/* A single entry of the key matrix */
+struct ec_keymatrix_entry {
+	int row;	/* key matrix row */
+	int col;	/* key matrix column */
+	int keycode;	/* corresponding linux key code */
+};
+
+/**
+ * struct ec_state - Information about the EC state
+ *
+ * @vbnv_context: Vboot context data stored by EC
+ * @ec_config: FDT config information about the EC (e.g. flashmap)
+ * @flash_data: Contents of flash memory
+ * @flash_data_len: Size of flash memory
+ * @current_image: Current image the EC is running
+ * @matrix_count: Number of keys to decode in matrix
+ * @matrix: Information about keyboard matrix
+ * @keyscan: Current keyscan information (bit set for each row/column pressed)
+ * @recovery_req: Keyboard recovery requested
+ */
+struct ec_state {
+	uint8_t vbnv_context[EC_VBNV_BLOCK_SIZE];
+	struct fdt_cros_ec ec_config;
+	uint8_t *flash_data;
+	int flash_data_len;
+	enum ec_current_image current_image;
+	int matrix_count;
+	struct ec_keymatrix_entry *matrix;	/* the key matrix info */
+	uint8_t keyscan[KEYBOARD_COLS];
+	bool recovery_req;
+} s_state, *state;
+
+/**
+ * cros_ec_read_state() - read the sandbox EC state from the state file
+ *
+ * If data is available, then blob and node will provide access to it. If
+ * not this function sets up an empty EC.
+ *
+ * @param blob: Pointer to device tree blob, or NULL if no data to read
+ * @param node: Node offset to read from
+ */
+static int cros_ec_read_state(const void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+	const char *prop;
+	int len;
+
+	/* Set everything to defaults */
+	ec->current_image = EC_IMAGE_RO;
+	if (!blob)
+		return 0;
+
+	/* Read the data if available */
+	ec->current_image = fdtdec_get_int(blob, node, "current-image",
+					   EC_IMAGE_RO);
+	prop = fdt_getprop(blob, node, "vbnv-context", &len);
+	if (prop && len == sizeof(ec->vbnv_context))
+		memcpy(ec->vbnv_context, prop, len);
+
+	prop = fdt_getprop(blob, node, "flash-data", &len);
+	if (prop) {
+		ec->flash_data_len = len;
+		ec->flash_data = os_malloc(len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+		memcpy(ec->flash_data, prop, len);
+		debug("%s: Loaded EC flash data size %#x\n", __func__, len);
+	}
+
+	return 0;
+}
+
+/**
+ * cros_ec_write_state() - Write out our state to the state file
+ *
+ * The caller will ensure that there is a node ready for the state. The node
+ * may already contain the old state, in which case it is overridden.
+ *
+ * @param blob: Device tree blob holding state
+ * @param node: Node to write our state into
+ */
+static int cros_ec_write_state(void *blob, int node)
+{
+	struct ec_state *ec = &s_state;
+
+	/* We are guaranteed enough space to write basic properties */
+	fdt_setprop_u32(blob, node, "current-image", ec->current_image);
+	fdt_setprop(blob, node, "vbnv-context", ec->vbnv_context,
+		    sizeof(ec->vbnv_context));
+	return state_setprop(node, "flash-data", ec->flash_data,
+			     ec->ec_config.flash.length);
+}
+
+SANDBOX_STATE_IO(cros_ec, "google,cros-ec", cros_ec_read_state,
+		 cros_ec_write_state);
+
+/**
+ * Return the number of bytes used in the specified image.
+ *
+ * This is the actual size of code+data in the image, as opposed to the
+ * amount of space reserved in flash for that image. This code is similar to
+ * that used by the real EC code base.
+ *
+ * @param ec	Current emulated EC state
+ * @param entry	Flash map entry containing the image to check
+ * @return actual image size in bytes, 0 if the image contains no content or
+ * error.
+ */
+static int get_image_used(struct ec_state *ec, struct fmap_entry *entry)
+{
+	int size;
+
+	/*
+	 * Scan backwards looking for 0xea byte, which is by definition the
+	 * last byte of the image.  See ec.lds.S for how this is inserted at
+	 * the end of the image.
+	 */
+	for (size = entry->length - 1;
+	     size > 0 && ec->flash_data[entry->offset + size] != 0xea;
+	     size--)
+		;
+
+	return size ? size + 1 : 0;  /* 0xea byte IS part of the image */
+}
+
+/**
+ * Read the key matrix from the device tree
+ *
+ * Keymap entries in the fdt take the form of 0xRRCCKKKK where
+ * RR=Row CC=Column KKKK=Key Code
+ *
+ * @param ec	Current emulated EC state
+ * @param blob	Device tree blob containing keyscan information
+ * @param node	Keyboard node of device tree containing keyscan information
+ * @return 0 if ok, -1 on error
+ */
+static int keyscan_read_fdt_matrix(struct ec_state *ec, const void *blob,
+				   int node)
+{
+	const u32 *cell;
+	int upto;
+	int len;
+
+	cell = fdt_getprop(blob, node, "linux,keymap", &len);
+	ec->matrix_count = len / 4;
+	ec->matrix = calloc(ec->matrix_count, sizeof(*ec->matrix));
+	if (!ec->matrix) {
+		debug("%s: Out of memory for key matrix\n", __func__);
+		return -1;
+	}
+
+	/* Now read the data */
+	for (upto = 0; upto < ec->matrix_count; upto++) {
+		struct ec_keymatrix_entry *matrix = &ec->matrix[upto];
+		u32 word;
+
+		word = fdt32_to_cpu(*cell++);
+		matrix->row = word >> 24;
+		matrix->col = (word >> 16) & 0xff;
+		matrix->keycode = word & 0xffff;
+
+		/* Hard-code some sanity limits for now */
+		if (matrix->row >= KEYBOARD_ROWS ||
+		    matrix->col >= KEYBOARD_COLS) {
+			debug("%s: Matrix pos out of range (%d,%d)\n",
+			      __func__, matrix->row, matrix->col);
+			return -1;
+		}
+	}
+
+	if (upto != ec->matrix_count) {
+		debug("%s: Read mismatch from key matrix\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+/**
+ * Return the next keyscan message contents
+ *
+ * @param ec	Current emulated EC state
+ * @param scan	Place to put keyscan bytes for the keyscan message (must hold
+ *		enough space for a full keyscan)
+ * @return number of bytes of valid scan data
+ */
+static int cros_ec_keyscan(struct ec_state *ec, uint8_t *scan)
+{
+	const struct ec_keymatrix_entry *matrix;
+	int bytes = KEYBOARD_COLS;
+	int key[8];	/* allow up to 8 keys to be pressed at once */
+	int count;
+	int i;
+
+	memset(ec->keyscan, '\0', bytes);
+	count = sandbox_sdl_scan_keys(key, ARRAY_SIZE(key));
+
+	/* Look up keycode in matrix */
+	for (i = 0, matrix = ec->matrix; i < ec->matrix_count; i++, matrix++) {
+		bool found;
+		int j;
+
+		for (found = false, j = 0; j < count; j++) {
+			if (matrix->keycode == key[j])
+				found = true;
+		}
+
+		if (found) {
+			debug("%d: %d,%d\n", matrix->keycode, matrix->row,
+			      matrix->col);
+			ec->keyscan[matrix->col] |= 1 << matrix->row;
+		}
+	}
+
+	memcpy(scan, ec->keyscan, bytes);
+	return bytes;
+}
+
+/**
+ * Process an emulated EC command
+ *
+ * @param ec		Current emulated EC state
+ * @param req_hdr	Pointer to request header
+ * @param req_data	Pointer to body of request
+ * @param resp_hdr	Pointer to place to put response header
+ * @param resp_data	Pointer to place to put response data, if any
+ * @return length of response data, or 0 for no response data, or -1 on error
+ */
+static int process_cmd(struct ec_state *ec,
+		       struct ec_host_request *req_hdr, const void *req_data,
+		       struct ec_host_response *resp_hdr, void *resp_data)
+{
+	int len;
+
+	/* TODO(sjg@chromium.org): Check checksums */
+	debug("EC command %#0x\n", req_hdr->command);
+
+	switch (req_hdr->command) {
+	case EC_CMD_HELLO: {
+		const struct ec_params_hello *req = req_data;
+		struct ec_response_hello *resp = resp_data;
+
+		resp->out_data = req->in_data + 0x01020304;
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_GET_VERSION: {
+		struct ec_response_get_version *resp = resp_data;
+
+		strcpy(resp->version_string_ro, "sandbox_ro");
+		strcpy(resp->version_string_rw, "sandbox_rw");
+		resp->current_image = ec->current_image;
+		debug("Current image %d\n", resp->current_image);
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBNV_CONTEXT: {
+		const struct ec_params_vbnvcontext *req = req_data;
+		struct ec_response_vbnvcontext *resp = resp_data;
+
+		switch (req->op) {
+		case EC_VBNV_CONTEXT_OP_READ:
+			memcpy(resp->block, ec->vbnv_context,
+			       sizeof(resp->block));
+			len = sizeof(*resp);
+			break;
+		case EC_VBNV_CONTEXT_OP_WRITE:
+			memcpy(ec->vbnv_context, resp->block,
+			       sizeof(resp->block));
+			len = 0;
+			break;
+		default:
+			printf("   ** Unknown vbnv_context command %#02x\n",
+			       req->op);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_REBOOT_EC: {
+		const struct ec_params_reboot_ec *req = req_data;
+
+		printf("Request reboot type %d\n", req->cmd);
+		switch (req->cmd) {
+		case EC_REBOOT_DISABLE_JUMP:
+			len = 0;
+			break;
+		case EC_REBOOT_JUMP_RW:
+			ec->current_image = EC_IMAGE_RW;
+			len = 0;
+			break;
+		default:
+			puts("   ** Unknown type");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_HOST_EVENT_GET_B: {
+		struct ec_response_host_event_mask *resp = resp_data;
+
+		resp->mask = 0;
+		if (ec->recovery_req) {
+			resp->mask |= EC_HOST_EVENT_MASK(
+					EC_HOST_EVENT_KEYBOARD_RECOVERY);
+		}
+
+		len = sizeof(*resp);
+		break;
+	}
+	case EC_CMD_VBOOT_HASH: {
+		const struct ec_params_vboot_hash *req = req_data;
+		struct ec_response_vboot_hash *resp = resp_data;
+		struct fmap_entry *entry;
+		int ret, size;
+
+		entry = &state->ec_config.region[EC_FLASH_REGION_RW];
+
+		switch (req->cmd) {
+		case EC_VBOOT_HASH_RECALC:
+		case EC_VBOOT_HASH_GET:
+			size = SHA256_SUM_LEN;
+			len = get_image_used(ec, entry);
+			ret = hash_block("sha256",
+					 ec->flash_data + entry->offset,
+					 len, resp->hash_digest, &size);
+			if (ret) {
+				printf("   ** hash_block() failed\n");
+				return -1;
+			}
+			resp->status = EC_VBOOT_HASH_STATUS_DONE;
+			resp->hash_type = EC_VBOOT_HASH_TYPE_SHA256;
+			resp->digest_size = size;
+			resp->reserved0 = 0;
+			resp->offset = entry->offset;
+			resp->size = len;
+			len = sizeof(*resp);
+			break;
+		default:
+			printf("   ** EC_CMD_VBOOT_HASH: Unknown command %d\n",
+			       req->cmd);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_PROTECT: {
+		const struct ec_params_flash_protect *req = req_data;
+		struct ec_response_flash_protect *resp = resp_data;
+		uint32_t expect = EC_FLASH_PROTECT_ALL_NOW |
+				EC_FLASH_PROTECT_ALL_AT_BOOT;
+
+		printf("mask=%#x, flags=%#x\n", req->mask, req->flags);
+		if (req->flags == expect || req->flags == 0) {
+			resp->flags = req->flags ? EC_FLASH_PROTECT_ALL_NOW :
+								0;
+			resp->valid_flags = EC_FLASH_PROTECT_ALL_NOW;
+			resp->writable_flags = 0;
+			len = sizeof(*resp);
+		} else {
+			puts("   ** unexpected flash protect request\n");
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_REGION_INFO: {
+		const struct ec_params_flash_region_info *req = req_data;
+		struct ec_response_flash_region_info *resp = resp_data;
+		struct fmap_entry *entry;
+
+		switch (req->region) {
+		case EC_FLASH_REGION_RO:
+		case EC_FLASH_REGION_RW:
+		case EC_FLASH_REGION_WP_RO:
+			entry = &state->ec_config.region[req->region];
+			resp->offset = entry->offset;
+			resp->size = entry->length;
+			len = sizeof(*resp);
+			printf("EC flash region %d: offset=%#x, size=%#x\n",
+			       req->region, resp->offset, resp->size);
+			break;
+		default:
+			printf("** Unknown flash region %d\n", req->region);
+			return -1;
+		}
+		break;
+	}
+	case EC_CMD_FLASH_ERASE: {
+		const struct ec_params_flash_erase *req = req_data;
+
+		memset(ec->flash_data + req->offset,
+		       ec->ec_config.flash_erase_value,
+		       req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_FLASH_WRITE: {
+		const struct ec_params_flash_write *req = req_data;
+
+		memcpy(ec->flash_data + req->offset, req + 1, req->size);
+		len = 0;
+		break;
+	}
+	case EC_CMD_MKBP_STATE:
+		len = cros_ec_keyscan(ec, resp_data);
+		break;
+	default:
+		printf("   ** Unknown EC command %#02x\n", req_hdr->command);
+		return -1;
+	}
+
+	return len;
+}
+
+int cros_ec_sandbox_packet(struct cros_ec_dev *dev, int out_bytes,
+			   int in_bytes)
+{
+	struct ec_host_request *req_hdr = (struct ec_host_request *)dev->dout;
+	const void *req_data = req_hdr + 1;
+	struct ec_host_response *resp_hdr = (struct ec_host_response *)dev->din;
+	void *resp_data = resp_hdr + 1;
+	int len;
+
+	len = process_cmd(&s_state, req_hdr, req_data, resp_hdr, resp_data);
+	if (len < 0)
+		return len;
+
+	resp_hdr->struct_version = 3;
+	resp_hdr->result = EC_RES_SUCCESS;
+	resp_hdr->data_len = len;
+	resp_hdr->reserved = 0;
+	len += sizeof(*resp_hdr);
+	resp_hdr->checksum = 0;
+	resp_hdr->checksum = (uint8_t)
+		-cros_ec_calc_checksum((const uint8_t *)resp_hdr, len);
+
+	return in_bytes;
+}
+
+int cros_ec_sandbox_decode_fdt(struct cros_ec_dev *dev, const void *blob)
+{
+	return 0;
+}
+
+void cros_ec_check_keyboard(struct cros_ec_dev *dev)
+{
+	struct ec_state *ec = &s_state;
+	ulong start;
+
+	printf("Press keys for EC to detect on reset (ESC=recovery)...");
+	start = get_timer(0);
+	while (get_timer(start) < 1000)
+		;
+	putc('\n');
+	if (!sandbox_sdl_key_pressed(KEY_ESC)) {
+		ec->recovery_req = true;
+		printf("   - EC requests recovery\n");
+	}
+}
+
+/**
+ * Initialize sandbox EC emulation.
+ *
+ * @param dev		CROS_EC device
+ * @param blob		Device tree blob
+ * @return 0 if ok, -1 on error
+ */
+int cros_ec_sandbox_init(struct cros_ec_dev *dev, const void *blob)
+{
+	struct ec_state *ec = &s_state;
+	int node;
+	int err;
+
+	state = &s_state;
+	err = cros_ec_decode_ec_flash(blob, &ec->ec_config);
+	if (err)
+		return err;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_GOOGLE_CROS_EC_KEYB);
+	if (node < 0) {
+		debug("%s: No cros_ec keyboard found\n", __func__);
+	} else if (keyscan_read_fdt_matrix(ec, blob, node)) {
+		debug("%s: Could not read key matrix\n", __func__);
+		return -1;
+	}
+
+	/* If we loaded EC data, check that the length matches */
+	if (ec->flash_data &&
+	    ec->flash_data_len != ec->ec_config.flash.length) {
+		printf("EC data length is %x, expected %x, discarding data\n",
+		       ec->flash_data_len, ec->ec_config.flash.length);
+		os_free(ec->flash_data);
+		ec->flash_data = NULL;
+	}
+
+	/* Otherwise allocate the memory */
+	if (!ec->flash_data) {
+		ec->flash_data_len = ec->ec_config.flash.length;
+		ec->flash_data = os_malloc(ec->flash_data_len);
+		if (!ec->flash_data)
+			return -ENOMEM;
+	}
+
+	return 0;
+}
diff --git a/drivers/misc/cros_ec_spi.c b/drivers/misc/cros_ec_spi.c
index 2fc9110..7df709c 100644
--- a/drivers/misc/cros_ec_spi.c
+++ b/drivers/misc/cros_ec_spi.c
@@ -17,6 +17,30 @@
 #include <cros_ec.h>
 #include <spi.h>
 
+int cros_ec_spi_packet(struct cros_ec_dev *dev, int out_bytes, int in_bytes)
+{
+	int rv;
+
+	/* Do the transfer */
+	if (spi_claim_bus(dev->spi)) {
+		debug("%s: Cannot claim SPI bus\n", __func__);
+		return -1;
+	}
+
+	rv = spi_xfer(dev->spi, max(out_bytes, in_bytes) * 8,
+		      dev->dout, dev->din,
+		      SPI_XFER_BEGIN | SPI_XFER_END);
+
+	spi_release_bus(dev->spi);
+
+	if (rv) {
+		debug("%s: Cannot complete SPI transfer\n", __func__);
+		return -1;
+	}
+
+	return in_bytes;
+}
+
 /**
  * Send a command to a LPC CROS_EC device and return the reply.
  *
@@ -42,6 +66,12 @@ int cros_ec_spi_command(struct cros_ec_dev *dev, uint8_t cmd, int cmd_version,
 	int csum, len;
 	int rv;
 
+	if (dev->protocol_version != 2) {
+		debug("%s: Unsupported EC protcol version %d\n",
+		      __func__, dev->protocol_version);
+		return -1;
+	}
+
 	/*
 	 * Sanity-check input size to make sure it plus transaction overhead
 	 * fits in the internal device buffer.
diff --git a/drivers/mmc/s5p_sdhci.c b/drivers/mmc/s5p_sdhci.c
index 40ff873..ccae4cc 100644
--- a/drivers/mmc/s5p_sdhci.c
+++ b/drivers/mmc/s5p_sdhci.c
@@ -8,8 +8,15 @@
 #include <common.h>
 #include <malloc.h>
 #include <sdhci.h>
+#include <fdtdec.h>
+#include <libfdt.h>
+#include <asm/gpio.h>
 #include <asm/arch/mmc.h>
 #include <asm/arch/clk.h>
+#include <errno.h>
+#ifdef CONFIG_OF_CONTROL
+#include <asm/arch/pinmux.h>
+#endif
 
 static char *S5P_NAME = "SAMSUNG SDHCI";
 static void s5p_sdhci_set_control_reg(struct sdhci_host *host)
@@ -86,3 +93,125 @@ int s5p_sdhci_init(u32 regbase, int index, int bus_width)
 
 	return add_sdhci(host, 52000000, 400000);
 }
+
+#ifdef CONFIG_OF_CONTROL
+struct sdhci_host sdhci_host[SDHCI_MAX_HOSTS];
+
+static int do_sdhci_init(struct sdhci_host *host)
+{
+	int dev_id, flag;
+	int err = 0;
+
+	flag = host->bus_width == 8 ? PINMUX_FLAG_8BIT_MODE : PINMUX_FLAG_NONE;
+	dev_id = host->index + PERIPH_ID_SDMMC0;
+
+	if (fdt_gpio_isvalid(&host->pwr_gpio)) {
+		gpio_direction_output(host->pwr_gpio.gpio, 1);
+		err = exynos_pinmux_config(dev_id, flag);
+		if (err) {
+			debug("MMC not configured\n");
+			return err;
+		}
+	}
+
+	if (fdt_gpio_isvalid(&host->cd_gpio)) {
+		gpio_direction_output(host->cd_gpio.gpio, 0xf);
+		if (gpio_get_value(host->cd_gpio.gpio))
+			return -ENODEV;
+
+		err = exynos_pinmux_config(dev_id, flag);
+		if (err) {
+			printf("external SD not configured\n");
+			return err;
+		}
+	}
+
+	host->name = S5P_NAME;
+
+	host->quirks = SDHCI_QUIRK_NO_HISPD_BIT | SDHCI_QUIRK_BROKEN_VOLTAGE |
+		SDHCI_QUIRK_BROKEN_R1B | SDHCI_QUIRK_32BIT_DMA_ADDR |
+		SDHCI_QUIRK_WAIT_SEND_CMD;
+	host->voltages = MMC_VDD_32_33 | MMC_VDD_33_34 | MMC_VDD_165_195;
+	host->version = sdhci_readw(host, SDHCI_HOST_VERSION);
+
+	host->set_control_reg = &s5p_sdhci_set_control_reg;
+	host->set_clock = set_mmc_clk;
+
+	host->host_caps = MMC_MODE_HC;
+
+	return add_sdhci(host, 52000000, 400000);
+}
+
+static int sdhci_get_config(const void *blob, int node, struct sdhci_host *host)
+{
+	int bus_width, dev_id;
+	unsigned int base;
+
+	/* Get device id */
+	dev_id = pinmux_decode_periph_id(blob, node);
+	if (dev_id < PERIPH_ID_SDMMC0 && dev_id > PERIPH_ID_SDMMC3) {
+		debug("MMC: Can't get device id\n");
+		return -1;
+	}
+	host->index = dev_id - PERIPH_ID_SDMMC0;
+
+	/* Get bus width */
+	bus_width = fdtdec_get_int(blob, node, "samsung,bus-width", 0);
+	if (bus_width <= 0) {
+		debug("MMC: Can't get bus-width\n");
+		return -1;
+	}
+	host->bus_width = bus_width;
+
+	/* Get the base address from the device node */
+	base = fdtdec_get_addr(blob, node, "reg");
+	if (!base) {
+		debug("MMC: Can't get base address\n");
+		return -1;
+	}
+	host->ioaddr = (void *)base;
+
+	fdtdec_decode_gpio(blob, node, "pwr-gpios", &host->pwr_gpio);
+	fdtdec_decode_gpio(blob, node, "cd-gpios", &host->cd_gpio);
+
+	return 0;
+}
+
+static int process_nodes(const void *blob, int node_list[], int count)
+{
+	struct sdhci_host *host;
+	int i, node;
+
+	debug("%s: count = %d\n", __func__, count);
+
+	/* build sdhci_host[] for each controller */
+	for (i = 0; i < count; i++) {
+		node = node_list[i];
+		if (node <= 0)
+			continue;
+
+		host = &sdhci_host[i];
+
+		if (sdhci_get_config(blob, node, host)) {
+			printf("%s: failed to decode dev %d\n",	__func__, i);
+			return -1;
+		}
+		do_sdhci_init(host);
+	}
+	return 0;
+}
+
+int exynos_mmc_init(const void *blob)
+{
+	int count;
+	int node_list[SDHCI_MAX_HOSTS];
+
+	count = fdtdec_find_aliases_for_id(blob, "mmc",
+			COMPAT_SAMSUNG_EXYNOS_MMC, node_list,
+			SDHCI_MAX_HOSTS);
+
+	process_nodes(blob, node_list, count);
+
+	return 1;
+}
+#endif
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c
index 72a272f..fdce2c2 100644
--- a/drivers/mmc/zynq_sdhci.c
+++ b/drivers/mmc/zynq_sdhci.c
@@ -7,6 +7,8 @@
  */
 
 #include <common.h>
+#include <fdtdec.h>
+#include <libfdt.h>
 #include <malloc.h>
 #include <sdhci.h>
 #include <asm/arch/sys_proto.h>
@@ -32,3 +34,30 @@ int zynq_sdhci_init(u32 regbase)
 	add_sdhci(host, 52000000, 52000000 >> 9);
 	return 0;
 }
+
+#ifdef CONFIG_OF_CONTROL
+int zynq_sdhci_of_init(const void *blob)
+{
+	int offset = 0;
+	u32 ret = 0;
+	u32 reg;
+
+	debug("ZYNQ SDHCI: Initialization\n");
+
+	do {
+		offset = fdt_node_offset_by_compatible(blob, offset,
+					"arasan,sdhci-8.9a");
+		if (offset != -1) {
+			reg = fdtdec_get_addr(blob, offset, "reg");
+			if (reg != FDT_ADDR_T_NONE) {
+				ret |= zynq_sdhci_init(reg);
+			} else {
+				debug("ZYNQ SDHCI: Can't get base address\n");
+				return -1;
+			}
+		}
+	} while (offset != -1);
+
+	return ret;
+}
+#endif
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 05ddfbb..e1fc48f 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -31,6 +31,10 @@
 
 #ifdef CONFIG_ATMEL_NAND_HW_PMECC
 
+#ifdef CONFIG_SPL_BUILD
+#undef CONFIG_SYS_NAND_ONFI_DETECTION
+#endif
+
 struct atmel_nand_host {
 	struct pmecc_regs __iomem *pmecc;
 	struct pmecc_errloc_regs __iomem *pmerrloc;
@@ -1169,6 +1173,209 @@ static int at91_nand_ready(struct mtd_info *mtd)
 }
 #endif
 
+#ifdef CONFIG_SPL_BUILD
+/* The following code is for SPL */
+static nand_info_t mtd;
+static struct nand_chip nand_chip;
+
+static int nand_command(int block, int page, uint32_t offs, u8 cmd)
+{
+	struct nand_chip *this = mtd.priv;
+	int page_addr = page + block * CONFIG_SYS_NAND_PAGE_COUNT;
+	void (*hwctrl)(struct mtd_info *mtd, int cmd,
+			unsigned int ctrl) = this->cmd_ctrl;
+
+	while (this->dev_ready(&mtd))
+		;
+
+	if (cmd == NAND_CMD_READOOB) {
+		offs += CONFIG_SYS_NAND_PAGE_SIZE;
+		cmd = NAND_CMD_READ0;
+	}
+
+	hwctrl(&mtd, cmd, NAND_CTRL_CLE | NAND_CTRL_CHANGE);
+
+	if (this->options & NAND_BUSWIDTH_16)
+		offs >>= 1;
+
+	hwctrl(&mtd, offs & 0xff, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
+	hwctrl(&mtd, (offs >> 8) & 0xff, NAND_CTRL_ALE);
+	hwctrl(&mtd, (page_addr & 0xff), NAND_CTRL_ALE);
+	hwctrl(&mtd, ((page_addr >> 8) & 0xff), NAND_CTRL_ALE);
+#ifdef CONFIG_SYS_NAND_5_ADDR_CYCLE
+	hwctrl(&mtd, (page_addr >> 16) & 0x0f, NAND_CTRL_ALE);
+#endif
+	hwctrl(&mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
+
+	hwctrl(&mtd, NAND_CMD_READSTART, NAND_CTRL_CLE | NAND_CTRL_CHANGE);
+	hwctrl(&mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
+
+	while (this->dev_ready(&mtd))
+		;
+
+	return 0;
+}
+
+static int nand_is_bad_block(int block)
+{
+	struct nand_chip *this = mtd.priv;
+
+	nand_command(block, 0, CONFIG_SYS_NAND_BAD_BLOCK_POS, NAND_CMD_READOOB);
+
+	if (this->options & NAND_BUSWIDTH_16) {
+		if (readw(this->IO_ADDR_R) != 0xffff)
+			return 1;
+	} else {
+		if (readb(this->IO_ADDR_R) != 0xff)
+			return 1;
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_SPL_NAND_ECC
+static int nand_ecc_pos[] = CONFIG_SYS_NAND_ECCPOS;
+#define ECCSTEPS (CONFIG_SYS_NAND_PAGE_SIZE / \
+		  CONFIG_SYS_NAND_ECCSIZE)
+#define ECCTOTAL (ECCSTEPS * CONFIG_SYS_NAND_ECCBYTES)
+
+static int nand_read_page(int block, int page, void *dst)
+{
+	struct nand_chip *this = mtd.priv;
+	u_char ecc_calc[ECCTOTAL];
+	u_char ecc_code[ECCTOTAL];
+	u_char oob_data[CONFIG_SYS_NAND_OOBSIZE];
+	int eccsize = CONFIG_SYS_NAND_ECCSIZE;
+	int eccbytes = CONFIG_SYS_NAND_ECCBYTES;
+	int eccsteps = ECCSTEPS;
+	int i;
+	uint8_t *p = dst;
+	nand_command(block, page, 0, NAND_CMD_READ0);
+
+	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
+		if (this->ecc.mode != NAND_ECC_SOFT)
+			this->ecc.hwctl(&mtd, NAND_ECC_READ);
+		this->read_buf(&mtd, p, eccsize);
+		this->ecc.calculate(&mtd, p, &ecc_calc[i]);
+	}
+	this->read_buf(&mtd, oob_data, CONFIG_SYS_NAND_OOBSIZE);
+
+	for (i = 0; i < ECCTOTAL; i++)
+		ecc_code[i] = oob_data[nand_ecc_pos[i]];
+
+	eccsteps = ECCSTEPS;
+	p = dst;
+
+	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize)
+		this->ecc.correct(&mtd, p, &ecc_code[i], &ecc_calc[i]);
+
+	return 0;
+}
+#else
+static int nand_read_page(int block, int page, void *dst)
+{
+	struct nand_chip *this = mtd.priv;
+
+	nand_command(block, page, 0, NAND_CMD_READ0);
+	atmel_nand_pmecc_read_page(&mtd, this, dst, 0, page);
+
+	return 0;
+}
+#endif /* CONFIG_SPL_NAND_ECC */
+
+int nand_spl_load_image(uint32_t offs, unsigned int size, void *dst)
+{
+	unsigned int block, lastblock;
+	unsigned int page;
+
+	block = offs / CONFIG_SYS_NAND_BLOCK_SIZE;
+	lastblock = (offs + size - 1) / CONFIG_SYS_NAND_BLOCK_SIZE;
+	page = (offs % CONFIG_SYS_NAND_BLOCK_SIZE) / CONFIG_SYS_NAND_PAGE_SIZE;
+
+	while (block <= lastblock) {
+		if (!nand_is_bad_block(block)) {
+			while (page < CONFIG_SYS_NAND_PAGE_COUNT) {
+				nand_read_page(block, page, dst);
+				dst += CONFIG_SYS_NAND_PAGE_SIZE;
+				page++;
+			}
+
+			page = 0;
+		} else {
+			lastblock++;
+		}
+
+		block++;
+	}
+
+	return 0;
+}
+
+int at91_nand_wait_ready(struct mtd_info *mtd)
+{
+	struct nand_chip *this = mtd->priv;
+
+	udelay(this->chip_delay);
+
+	return 0;
+}
+
+int board_nand_init(struct nand_chip *nand)
+{
+	int ret = 0;
+
+	nand->ecc.mode = NAND_ECC_SOFT;
+#ifdef CONFIG_SYS_NAND_DBW_16
+	nand->options = NAND_BUSWIDTH_16;
+	nand->read_buf = nand_read_buf16;
+#else
+	nand->read_buf = nand_read_buf;
+#endif
+	nand->cmd_ctrl = at91_nand_hwcontrol;
+#ifdef CONFIG_SYS_NAND_READY_PIN
+	nand->dev_ready = at91_nand_ready;
+#else
+	nand->dev_ready = at91_nand_wait_ready;
+#endif
+	nand->chip_delay = 20;
+
+#ifdef CONFIG_ATMEL_NAND_HWECC
+#ifdef CONFIG_ATMEL_NAND_HW_PMECC
+	ret = atmel_pmecc_nand_init_params(nand, &mtd);
+#endif
+#endif
+
+	return ret;
+}
+
+void nand_init(void)
+{
+	mtd.writesize = CONFIG_SYS_NAND_PAGE_SIZE;
+	mtd.oobsize = CONFIG_SYS_NAND_OOBSIZE;
+	mtd.priv = &nand_chip;
+	nand_chip.IO_ADDR_R = (void __iomem *)CONFIG_SYS_NAND_BASE;
+	nand_chip.IO_ADDR_W = (void __iomem *)CONFIG_SYS_NAND_BASE;
+	board_nand_init(&nand_chip);
+
+#ifdef CONFIG_SPL_NAND_ECC
+	if (nand_chip.ecc.mode == NAND_ECC_SOFT) {
+		nand_chip.ecc.calculate = nand_calculate_ecc;
+		nand_chip.ecc.correct = nand_correct_data;
+	}
+#endif
+
+	if (nand_chip.select_chip)
+		nand_chip.select_chip(&mtd, 0);
+}
+
+void nand_deselect(void)
+{
+	if (nand_chip.select_chip)
+		nand_chip.select_chip(&mtd, -1);
+}
+
+#else
+
 #ifndef CONFIG_SYS_NAND_BASE_LIST
 #define CONFIG_SYS_NAND_BASE_LIST { CONFIG_SYS_NAND_BASE }
 #endif
@@ -1227,3 +1434,4 @@ void board_nand_init(void)
 			dev_err(host->dev, "atmel_nand: Fail to initialize #%d chip",
 				i);
 }
+#endif /* CONFIG_SPL_BUILD */
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index 34688e9..5510b13 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -104,7 +104,6 @@ static void ndfc_read_buf(struct mtd_info *mtdinfo, uint8_t *buf, int len)
 		*p++ = in_be32((u32 *)(base + NDFC_DATA));
 }
 
-#ifndef CONFIG_NAND_SPL
 /*
  * Don't use these speedup functions in NAND boot image, since the image
  * has to fit into 4kByte.
@@ -148,8 +147,6 @@ static uint8_t ndfc_read_byte(struct mtd_info *mtd)
 
 }
 
-#endif /* #ifndef CONFIG_NAND_SPL */
-
 void board_nand_select_device(struct nand_chip *nand, int chip)
 {
 	/*
@@ -207,21 +204,11 @@ int board_nand_init(struct nand_chip *nand)
 	nand->options |= NAND_BUSWIDTH_16;
 #endif
 
-#ifndef CONFIG_NAND_SPL
 	nand->write_buf  = ndfc_write_buf;
 	nand->verify_buf = ndfc_verify_buf;
 	nand->read_byte = ndfc_read_byte;
 
 	chip++;
-#else
-	/*
-	 * Setup EBC (CS0 only right now)
-	 */
-	mtebc(EBC0_CFG, CONFIG_SYS_NDFC_EBC0_CFG);
-
-	mtebc(PB0CR, CONFIG_SYS_EBC_PB0CR);
-	mtebc(PB0AP, CONFIG_SYS_EBC_PB0AP);
-#endif
 
 	return 0;
 }
diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
index 2aa7807..47b1f1b 100644
--- a/drivers/mtd/nand/omap_elm.c
+++ b/drivers/mtd/nand/omap_elm.c
@@ -16,9 +16,9 @@
 #include <common.h>
 #include <asm/io.h>
 #include <asm/errno.h>
-#include <asm/arch/cpu.h>
-#include <asm/omap_gpmc.h>
-#include <asm/omap_elm.h>
+#include <linux/mtd/omap_gpmc.h>
+#include <linux/mtd/omap_elm.h>
+#include <asm/arch/hardware.h>
 
 #define ELM_DEFAULT_POLY (0)
 
diff --git a/drivers/mtd/nand/omap_gpmc.c b/drivers/mtd/nand/omap_gpmc.c
index 389c4de..881a636 100644
--- a/drivers/mtd/nand/omap_gpmc.c
+++ b/drivers/mtd/nand/omap_gpmc.c
@@ -9,17 +9,24 @@
 #include <asm/io.h>
 #include <asm/errno.h>
 #include <asm/arch/mem.h>
-#include <asm/arch/cpu.h>
-#include <asm/omap_gpmc.h>
+#include <linux/mtd/omap_gpmc.h>
 #include <linux/mtd/nand_ecc.h>
 #include <linux/bch.h>
 #include <linux/compiler.h>
 #include <nand.h>
-#include <asm/omap_elm.h>
+#include <linux/mtd/omap_elm.h>
 
 #define BADBLOCK_MARKER_LENGTH	2
 #define SECTOR_BYTES		512
+#define ECCCLEAR		(0x1 << 8)
+#define ECCRESULTREG1		(0x1 << 0)
+/* 4 bit padding to make byte aligned, 56 = 52 + 4 */
+#define BCH4_BIT_PAD		4
 
+#ifdef CONFIG_BCH
+static u8  bch8_polynomial[] = {0xef, 0x51, 0x2e, 0x09, 0xed, 0x93, 0x9a, 0xc2,
+				0x97, 0x79, 0xe5, 0x24, 0xb5};
+#endif
 static uint8_t cs;
 static __maybe_unused struct nand_ecclayout omap_ecclayout;
 
@@ -60,21 +67,6 @@ int omap_spl_dev_ready(struct mtd_info *mtd)
 }
 #endif
 
-/*
- * omap_hwecc_init - Initialize the Hardware ECC for NAND flash in
- *                   GPMC controller
- * @mtd:        MTD device structure
- *
- */
-static void __maybe_unused omap_hwecc_init(struct nand_chip *chip)
-{
-	/*
-	 * Init ECC Control Register
-	 * Clear all ECC | Enable Reg1
-	 */
-	writel(ECCCLEAR | ECCRESULTREG1, &gpmc_cfg->ecc_control);
-	writel(ECCSIZE1 | ECCSIZE0 | ECCSIZE0SEL, &gpmc_cfg->ecc_size_config);
-}
 
 /*
  * gen_true_ecc - This function will generate true ECC value, which
@@ -156,74 +148,6 @@ static int __maybe_unused omap_correct_data(struct mtd_info *mtd, uint8_t *dat,
 }
 
 /*
- *  omap_calculate_ecc - Generate non-inverted ECC bytes.
- *
- *  Using noninverted ECC can be considered ugly since writing a blank
- *  page ie. padding will clear the ECC bytes. This is no problem as
- *  long nobody is trying to write data on the seemingly unused page.
- *  Reading an erased page will produce an ECC mismatch between
- *  generated and read ECC bytes that has to be dealt with separately.
- *  E.g. if page is 0xFF (fresh erased), and if HW ECC engine within GPMC
- *  is used, the result of read will be 0x0 while the ECC offsets of the
- *  spare area will be 0xFF which will result in an ECC mismatch.
- *  @mtd:	MTD structure
- *  @dat:	unused
- *  @ecc_code:	ecc_code buffer
- */
-static int __maybe_unused omap_calculate_ecc(struct mtd_info *mtd,
-		const uint8_t *dat, uint8_t *ecc_code)
-{
-	u_int32_t val;
-
-	/* Start Reading from HW ECC1_Result = 0x200 */
-	val = readl(&gpmc_cfg->ecc1_result);
-
-	ecc_code[0] = val & 0xFF;
-	ecc_code[1] = (val >> 16) & 0xFF;
-	ecc_code[2] = ((val >> 8) & 0x0F) | ((val >> 20) & 0xF0);
-
-	/*
-	 * Stop reading anymore ECC vals and clear old results
-	 * enable will be called if more reads are required
-	 */
-	writel(0x000, &gpmc_cfg->ecc_config);
-
-	return 0;
-}
-
-/*
- * omap_enable_ecc - This function enables the hardware ecc functionality
- * @mtd:        MTD device structure
- * @mode:       Read/Write mode
- */
-static void __maybe_unused omap_enable_hwecc(struct mtd_info *mtd, int32_t mode)
-{
-	struct nand_chip *chip = mtd->priv;
-	uint32_t val, dev_width = (chip->options & NAND_BUSWIDTH_16) >> 1;
-
-	switch (mode) {
-	case NAND_ECC_READ:
-	case NAND_ECC_WRITE:
-		/* Clear the ecc result registers, select ecc reg as 1 */
-		writel(ECCCLEAR | ECCRESULTREG1, &gpmc_cfg->ecc_control);
-
-		/*
-		 * Size 0 = 0xFF, Size1 is 0xFF - both are 512 bytes
-		 * tell all regs to generate size0 sized regs
-		 * we just have a single ECC engine for all CS
-		 */
-		writel(ECCSIZE1 | ECCSIZE0 | ECCSIZE0SEL,
-			&gpmc_cfg->ecc_size_config);
-		val = (dev_width << 7) | (cs << 1) | (0x1);
-		writel(val, &gpmc_cfg->ecc_config);
-		break;
-	default:
-		printf("Error: Unrecognized Mode[%d]!\n", mode);
-		break;
-	}
-}
-
-/*
  * Generic BCH interface
  */
 struct nand_bch_priv {
@@ -239,12 +163,7 @@ struct nand_bch_priv {
 #define ECC_BCH8	1
 #define ECC_BCH16	2
 
-/* GPMC ecc engine settings */
-#define BCH_WRAPMODE_1		1	/* BCH wrap mode 1 */
-#define BCH_WRAPMODE_6		6	/* BCH wrap mode 6 */
-
 /* BCH nibbles for diff bch levels */
-#define NAND_ECC_HW_BCH ((uint8_t)(NAND_ECC_HW_OOB_FIRST) + 1)
 #define ECC_BCH4_NIBBLES	13
 #define ECC_BCH8_NIBBLES	26
 #define ECC_BCH16_NIBBLES	52
@@ -256,266 +175,161 @@ struct nand_bch_priv {
  * When some users with other BCH strength will exists this have to change!
  */
 static __maybe_unused struct nand_bch_priv bch_priv = {
-	.mode = NAND_ECC_HW_BCH,
 	.type = ECC_BCH8,
 	.nibbles = ECC_BCH8_NIBBLES,
 	.control = NULL
 };
 
 /*
- * omap_hwecc_init_bch - Initialize the BCH Hardware ECC for NAND flash in
- *				GPMC controller
- * @mtd:	MTD device structure
- * @mode:	Read/Write mode
- */
-__maybe_unused
-static void omap_hwecc_init_bch(struct nand_chip *chip, int32_t mode)
+ * omap_reverse_list - re-orders list elements in reverse order [internal]
+ * @list:	pointer to start of list
+ * @length:	length of list
+*/
+void omap_reverse_list(u8 *list, unsigned int length)
 {
-	uint32_t val;
-	uint32_t dev_width = (chip->options & NAND_BUSWIDTH_16) >> 1;
-	uint32_t unused_length = 0;
-	uint32_t wr_mode = BCH_WRAPMODE_6;
-	struct nand_bch_priv *bch = chip->priv;
-
-	/* Clear the ecc result registers, select ecc reg as 1 */
-	writel(ECCCLEAR | ECCRESULTREG1, &gpmc_cfg->ecc_control);
-
-	if (bch->ecc_scheme == OMAP_ECC_BCH8_CODE_HW) {
-		wr_mode = BCH_WRAPMODE_1;
-
-		switch (bch->nibbles) {
-		case ECC_BCH4_NIBBLES:
-			unused_length = 3;
-			break;
-		case ECC_BCH8_NIBBLES:
-			unused_length = 2;
-			break;
-		case ECC_BCH16_NIBBLES:
-			unused_length = 0;
-			break;
-		}
-
-		/*
-		 * This is ecc_size_config for ELM mode.  Here we are using
-		 * different settings for read and write access and also
-		 * depending on BCH strength.
-		 */
-		switch (mode) {
-		case NAND_ECC_WRITE:
-			/* write access only setup eccsize1 config */
-			val = ((unused_length + bch->nibbles) << 22);
-			break;
-
-		case NAND_ECC_READ:
-		default:
-			/*
-			 * by default eccsize0 selected for ecc1resultsize
-			 * eccsize0 config.
-			 */
-			val  = (bch->nibbles << 12);
-			/* eccsize1 config */
-			val |= (unused_length << 22);
-			break;
-		}
-	} else {
-		/*
-		 * This ecc_size_config setting is for BCH sw library.
-		 *
-		 * Note: we only support BCH8 currently with BCH sw library!
-		 * Should be really easy to adobt to BCH4, however some omap3
-		 * have flaws with BCH4.
-		 *
-		 * Here we are using wrapping mode 6 both for reading and
-		 * writing, with:
-		 *  size0 = 0  (no additional protected byte in spare area)
-		 *  size1 = 32 (skip 32 nibbles = 16 bytes per sector in
-		 *		spare area)
-		 */
-		val = (32 << 22) | (0 << 12);
+	unsigned int i, j;
+	unsigned int half_length = length / 2;
+	u8 tmp;
+	for (i = 0, j = length - 1; i < half_length; i++, j--) {
+		tmp = list[i];
+		list[i] = list[j];
+		list[j] = tmp;
 	}
-	/* ecc size configuration */
-	writel(val, &gpmc_cfg->ecc_size_config);
-
-	/*
-	 * Configure the ecc engine in gpmc
-	 * We assume 512 Byte sector pages for access to NAND.
-	 */
-	val  = (1 << 16);		/* enable BCH mode */
-	val |= (bch->type << 12);	/* setup BCH type */
-	val |= (wr_mode << 8);		/* setup wrapping mode */
-	val |= (dev_width << 7);	/* setup device width (16 or 8 bit) */
-	val |= (cs << 1);		/* setup chip select to work on */
-	debug("set ECC_CONFIG=0x%08x\n", val);
-	writel(val, &gpmc_cfg->ecc_config);
 }
 
 /*
- * omap_enable_ecc_bch - This function enables the bch h/w ecc functionality
+ * omap_enable_hwecc - configures GPMC as per ECC scheme before read/write
  * @mtd:	MTD device structure
  * @mode:	Read/Write mode
  */
 __maybe_unused
-static void omap_enable_ecc_bch(struct mtd_info *mtd, int32_t mode)
-{
-	struct nand_chip *chip = mtd->priv;
-
-	omap_hwecc_init_bch(chip, mode);
-	/* enable ecc */
-	writel((readl(&gpmc_cfg->ecc_config) | 0x1), &gpmc_cfg->ecc_config);
-}
-
-/*
- * omap_ecc_disable - Disable H/W ECC calculation
- *
- * @mtd:	MTD device structure
- */
-static void __maybe_unused omap_ecc_disable(struct mtd_info *mtd)
+static void omap_enable_hwecc(struct mtd_info *mtd, int32_t mode)
 {
-	writel((readl(&gpmc_cfg->ecc_config) & ~0x1), &gpmc_cfg->ecc_config);
+	struct nand_chip	*nand	= mtd->priv;
+	struct nand_bch_priv	*bch	= nand->priv;
+	unsigned int dev_width = (nand->options & NAND_BUSWIDTH_16) ? 1 : 0;
+	unsigned int ecc_algo = 0;
+	unsigned int bch_type = 0;
+	unsigned int eccsize1 = 0x00, eccsize0 = 0x00, bch_wrapmode = 0x00;
+	u32 ecc_size_config_val = 0;
+	u32 ecc_config_val = 0;
+
+	/* configure GPMC for specific ecc-scheme */
+	switch (bch->ecc_scheme) {
+	case OMAP_ECC_HAM1_CODE_SW:
+		return;
+	case OMAP_ECC_HAM1_CODE_HW:
+		ecc_algo = 0x0;
+		bch_type = 0x0;
+		bch_wrapmode = 0x00;
+		eccsize0 = 0xFF;
+		eccsize1 = 0xFF;
+		break;
+	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+	case OMAP_ECC_BCH8_CODE_HW:
+		ecc_algo = 0x1;
+		bch_type = 0x1;
+		if (mode == NAND_ECC_WRITE) {
+			bch_wrapmode = 0x01;
+			eccsize0 = 0;  /* extra bits in nibbles per sector */
+			eccsize1 = 28; /* OOB bits in nibbles per sector */
+		} else {
+			bch_wrapmode = 0x01;
+			eccsize0 = 26; /* ECC bits in nibbles per sector */
+			eccsize1 = 2;  /* non-ECC bits in nibbles per sector */
+		}
+		break;
+	default:
+		return;
+	}
+	/* Clear ecc and enable bits */
+	writel(ECCCLEAR | ECCRESULTREG1, &gpmc_cfg->ecc_control);
+	/* Configure ecc size for BCH */
+	ecc_size_config_val = (eccsize1 << 22) | (eccsize0 << 12);
+	writel(ecc_size_config_val, &gpmc_cfg->ecc_size_config);
+
+	/* Configure device details for BCH engine */
+	ecc_config_val = ((ecc_algo << 16)	| /* HAM1 | BCHx */
+			(bch_type << 12)	| /* BCH4/BCH8/BCH16 */
+			(bch_wrapmode << 8)	| /* wrap mode */
+			(dev_width << 7)	| /* bus width */
+			(0x0 << 4)		| /* number of sectors */
+			(cs <<  1)		| /* ECC CS */
+			(0x1));			  /* enable ECC */
+	writel(ecc_config_val, &gpmc_cfg->ecc_config);
 }
 
 /*
- * BCH support using ELM module
- */
-#ifdef CONFIG_NAND_OMAP_ELM
-/*
- * omap_read_bch8_result - Read BCH result for BCH8 level
- *
- * @mtd:	MTD device structure
- * @big_endian:	When set read register 3 first
- * @ecc_code:	Read syndrome from BCH result registers
+ *  omap_calculate_ecc - Read ECC result
+ *  @mtd:	MTD structure
+ *  @dat:	unused
+ *  @ecc_code:	ecc_code buffer
+ *  Using noninverted ECC can be considered ugly since writing a blank
+ *  page ie. padding will clear the ECC bytes. This is no problem as
+ *  long nobody is trying to write data on the seemingly unused page.
+ *  Reading an erased page will produce an ECC mismatch between
+ *  generated and read ECC bytes that has to be dealt with separately.
+ *  E.g. if page is 0xFF (fresh erased), and if HW ECC engine within GPMC
+ *  is used, the result of read will be 0x0 while the ECC offsets of the
+ *  spare area will be 0xFF which will result in an ECC mismatch.
  */
-static void omap_read_bch8_result(struct mtd_info *mtd, uint8_t big_endian,
+static int omap_calculate_ecc(struct mtd_info *mtd, const uint8_t *dat,
 				uint8_t *ecc_code)
 {
-	uint32_t *ptr;
+	struct nand_chip *chip = mtd->priv;
+	struct nand_bch_priv *bch = chip->priv;
+	uint32_t *ptr, val = 0;
 	int8_t i = 0, j;
 
-	if (big_endian) {
+	switch (bch->ecc_scheme) {
+	case OMAP_ECC_HAM1_CODE_HW:
+		val = readl(&gpmc_cfg->ecc1_result);
+		ecc_code[0] = val & 0xFF;
+		ecc_code[1] = (val >> 16) & 0xFF;
+		ecc_code[2] = ((val >> 8) & 0x0F) | ((val >> 20) & 0xF0);
+		break;
+#ifdef CONFIG_BCH
+	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+#endif
+	case OMAP_ECC_BCH8_CODE_HW:
 		ptr = &gpmc_cfg->bch_result_0_3[0].bch_result_x[3];
-		ecc_code[i++] = readl(ptr) & 0xFF;
+		val = readl(ptr);
+		ecc_code[i++] = (val >>  0) & 0xFF;
 		ptr--;
 		for (j = 0; j < 3; j++) {
-			ecc_code[i++] = (readl(ptr) >> 24) & 0xFF;
-			ecc_code[i++] = (readl(ptr) >> 16) & 0xFF;
-			ecc_code[i++] = (readl(ptr) >>  8) & 0xFF;
-			ecc_code[i++] = readl(ptr) & 0xFF;
+			val = readl(ptr);
+			ecc_code[i++] = (val >> 24) & 0xFF;
+			ecc_code[i++] = (val >> 16) & 0xFF;
+			ecc_code[i++] = (val >>  8) & 0xFF;
+			ecc_code[i++] = (val >>  0) & 0xFF;
 			ptr--;
 		}
-	} else {
-		ptr = &gpmc_cfg->bch_result_0_3[0].bch_result_x[0];
-		for (j = 0; j < 3; j++) {
-			ecc_code[i++] = readl(ptr) & 0xFF;
-			ecc_code[i++] = (readl(ptr) >>  8) & 0xFF;
-			ecc_code[i++] = (readl(ptr) >> 16) & 0xFF;
-			ecc_code[i++] = (readl(ptr) >> 24) & 0xFF;
-			ptr++;
-		}
-		ecc_code[i++] = readl(ptr) & 0xFF;
-		ecc_code[i++] = 0;	/* 14th byte is always zero */
+		break;
+	default:
+		return -EINVAL;
 	}
-}
-
-/*
- * omap_rotate_ecc_bch - Rotate the syndrome bytes
- *
- * @mtd:	MTD device structure
- * @calc_ecc:	ECC read from ECC registers
- * @syndrome:	Rotated syndrome will be retuned in this array
- *
- */
-static void omap_rotate_ecc_bch(struct mtd_info *mtd, uint8_t *calc_ecc,
-		uint8_t *syndrome)
-{
-	struct nand_chip *chip = mtd->priv;
-	struct nand_bch_priv *bch = chip->priv;
-	uint8_t n_bytes = 0;
-	int8_t i, j;
-
-	switch (bch->type) {
-	case ECC_BCH4:
-		n_bytes = 8;
+	/* ECC scheme specific syndrome customizations */
+	switch (bch->ecc_scheme) {
+	case OMAP_ECC_HAM1_CODE_HW:
 		break;
+#ifdef CONFIG_BCH
+	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
 
-	case ECC_BCH16:
-		n_bytes = 28;
+		for (i = 0; i < chip->ecc.bytes; i++)
+			*(ecc_code + i) = *(ecc_code + i) ^
+						bch8_polynomial[i];
 		break;
-
-	case ECC_BCH8:
-	default:
-		n_bytes = 13;
+#endif
+	case OMAP_ECC_BCH8_CODE_HW:
+		ecc_code[chip->ecc.bytes - 1] = 0x00;
 		break;
+	default:
+		return -EINVAL;
 	}
-
-	for (i = 0, j = (n_bytes-1); i < n_bytes; i++, j--)
-		syndrome[i] =  calc_ecc[j];
-}
-
-/*
- *  omap_calculate_ecc_bch - Read BCH ECC result
- *
- *  @mtd:	MTD structure
- *  @dat:	unused
- *  @ecc_code:	ecc_code buffer
- */
-static int omap_calculate_ecc_bch(struct mtd_info *mtd, const uint8_t *dat,
-				uint8_t *ecc_code)
-{
-	struct nand_chip *chip = mtd->priv;
-	struct nand_bch_priv *bch = chip->priv;
-	uint8_t big_endian = 1;
-	int8_t ret = 0;
-
-	if (bch->type == ECC_BCH8)
-		omap_read_bch8_result(mtd, big_endian, ecc_code);
-	else /* BCH4 and BCH16 currently not supported */
-		ret = -1;
-
-	/*
-	 * Stop reading anymore ECC vals and clear old results
-	 * enable will be called if more reads are required
-	 */
-	omap_ecc_disable(mtd);
-
-	return ret;
-}
-
-/*
- * omap_fix_errors_bch - Correct bch error in the data
- *
- * @mtd:	MTD device structure
- * @data:	Data read from flash
- * @error_count:Number of errors in data
- * @error_loc:	Locations of errors in the data
- *
- */
-static void omap_fix_errors_bch(struct mtd_info *mtd, uint8_t *data,
-		uint32_t error_count, uint32_t *error_loc)
-{
-	struct nand_chip *chip = mtd->priv;
-	struct nand_bch_priv *bch = chip->priv;
-	uint8_t count = 0;
-	uint32_t error_byte_pos;
-	uint32_t error_bit_mask;
-	uint32_t last_bit = (bch->nibbles * 4) - 1;
-
-	/* Flip all bits as specified by the error location array. */
-	/* FOR( each found error location flip the bit ) */
-	for (count = 0; count < error_count; count++) {
-		if (error_loc[count] > last_bit) {
-			/* Remove the ECC spare bits from correction. */
-			error_loc[count] -= (last_bit + 1);
-			/* Offset bit in data region */
-			error_byte_pos = ((512 * 8) -
-					(error_loc[count]) - 1) / 8;
-			/* Error Bit mask */
-			error_bit_mask = 0x1 << (error_loc[count] % 8);
-			/* Toggle the error bit to make the correction. */
-			data[error_byte_pos] ^= error_bit_mask;
-		}
-	}
+	return 0;
 }
 
+#ifdef CONFIG_NAND_OMAP_ELM
 /*
  * omap_correct_data_bch - Compares the ecc read from nand spare area
  * with ECC registers values and corrects one bit error if it has occured
@@ -532,40 +346,72 @@ static int omap_correct_data_bch(struct mtd_info *mtd, uint8_t *dat,
 {
 	struct nand_chip *chip = mtd->priv;
 	struct nand_bch_priv *bch = chip->priv;
-	uint8_t syndrome[28];
-	uint32_t error_count = 0;
+	uint32_t eccbytes = chip->ecc.bytes;
+	uint32_t error_count = 0, error_max;
 	uint32_t error_loc[8];
-	uint32_t i, ecc_flag;
+	uint32_t i, ecc_flag = 0;
+	uint8_t count, err = 0;
+	uint32_t byte_pos, bit_pos;
+
+	/* check calculated ecc */
+	for (i = 0; i < chip->ecc.bytes && !ecc_flag; i++) {
+		if (calc_ecc[i] != 0x00)
+			ecc_flag = 1;
+	}
+	if (!ecc_flag)
+		return 0;
 
+	/* check for whether its a erased-page */
 	ecc_flag = 0;
-	for (i = 0; i < chip->ecc.bytes; i++)
+	for (i = 0; i < chip->ecc.bytes && !ecc_flag; i++) {
 		if (read_ecc[i] != 0xff)
 			ecc_flag = 1;
-
+	}
 	if (!ecc_flag)
 		return 0;
 
-	elm_reset();
-	elm_config((enum bch_level)(bch->type));
-
 	/*
 	 * while reading ECC result we read it in big endian.
 	 * Hence while loading to ELM we have rotate to get the right endian.
 	 */
-	omap_rotate_ecc_bch(mtd, calc_ecc, syndrome);
-
+	switch (bch->ecc_scheme) {
+	case OMAP_ECC_BCH8_CODE_HW:
+		omap_reverse_list(calc_ecc, eccbytes - 1);
+		break;
+	default:
+		return -EINVAL;
+	}
 	/* use elm module to check for errors */
-	if (elm_check_error(syndrome, bch->nibbles, &error_count,
-				error_loc) != 0) {
-		printf("ECC: uncorrectable.\n");
-		return -1;
+	elm_config((enum bch_level)(bch->type));
+	if (elm_check_error(calc_ecc, bch->nibbles, &error_count, error_loc)) {
+		printf("nand: error: uncorrectable ECC errors\n");
+		return -EINVAL;
 	}
-
 	/* correct bch error */
-	if (error_count > 0)
-		omap_fix_errors_bch(mtd, dat, error_count, error_loc);
-
-	return 0;
+	for (count = 0; count < error_count; count++) {
+		switch (bch->type) {
+		case ECC_BCH8:
+			/* 14th byte in ECC is reserved to match ROM layout */
+			error_max = SECTOR_BYTES + (eccbytes - 1);
+			break;
+		default:
+			return -EINVAL;
+		}
+		byte_pos = error_max - (error_loc[count] / 8) - 1;
+		bit_pos  = error_loc[count] % 8;
+		if (byte_pos < SECTOR_BYTES) {
+			dat[byte_pos] ^= 1 << bit_pos;
+			printf("nand: bit-flip corrected @data=%d\n", byte_pos);
+		} else if (byte_pos < error_max) {
+			read_ecc[byte_pos - SECTOR_BYTES] = 1 << bit_pos;
+			printf("nand: bit-flip corrected @oob=%d\n", byte_pos -
+								SECTOR_BYTES);
+		} else {
+			err = -EBADMSG;
+			printf("nand: error: invalid bit-flip location\n");
+		}
+	}
+	return (err) ? err : error_count;
 }
 
 /**
@@ -636,57 +482,6 @@ static int omap_read_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
  * OMAP3 BCH8 support (with BCH library)
  */
 #ifdef CONFIG_BCH
-/*
- *  omap_calculate_ecc_bch_sw - Read BCH ECC result
- *
- *  @mtd:	MTD device structure
- *  @dat:	The pointer to data on which ecc is computed (unused here)
- *  @ecc:	The ECC output buffer
- */
-static int omap_calculate_ecc_bch_sw(struct mtd_info *mtd, const uint8_t *dat,
-				uint8_t *ecc)
-{
-	int ret = 0;
-	size_t i;
-	unsigned long nsectors, val1, val2, val3, val4;
-
-	nsectors = ((readl(&gpmc_cfg->ecc_config) >> 4) & 0x7) + 1;
-
-	for (i = 0; i < nsectors; i++) {
-		/* Read hw-computed remainder */
-		val1 = readl(&gpmc_cfg->bch_result_0_3[i].bch_result_x[0]);
-		val2 = readl(&gpmc_cfg->bch_result_0_3[i].bch_result_x[1]);
-		val3 = readl(&gpmc_cfg->bch_result_0_3[i].bch_result_x[2]);
-		val4 = readl(&gpmc_cfg->bch_result_0_3[i].bch_result_x[3]);
-
-		/*
-		 * Add constant polynomial to remainder, in order to get an ecc
-		 * sequence of 0xFFs for a buffer filled with 0xFFs.
-		 */
-		*ecc++ = 0xef ^ (val4 & 0xFF);
-		*ecc++ = 0x51 ^ ((val3 >> 24) & 0xFF);
-		*ecc++ = 0x2e ^ ((val3 >> 16) & 0xFF);
-		*ecc++ = 0x09 ^ ((val3 >> 8) & 0xFF);
-		*ecc++ = 0xed ^ (val3 & 0xFF);
-		*ecc++ = 0x93 ^ ((val2 >> 24) & 0xFF);
-		*ecc++ = 0x9a ^ ((val2 >> 16) & 0xFF);
-		*ecc++ = 0xc2 ^ ((val2 >> 8) & 0xFF);
-		*ecc++ = 0x97 ^ (val2 & 0xFF);
-		*ecc++ = 0x79 ^ ((val1 >> 24) & 0xFF);
-		*ecc++ = 0xe5 ^ ((val1 >> 16) & 0xFF);
-		*ecc++ = 0x24 ^ ((val1 >> 8) & 0xFF);
-		*ecc++ = 0xb5 ^ (val1 & 0xFF);
-	}
-
-	/*
-	 * Stop reading anymore ECC vals and clear old results
-	 * enable will be called if more reads are required
-	 */
-	omap_ecc_disable(mtd);
-
-	return ret;
-}
-
 /**
  * omap_correct_data_bch_sw - Decode received data and correct errors
  * @mtd: MTD device structure
@@ -835,9 +630,9 @@ static int omap_select_ecc_scheme(struct nand_chip *nand,
 		nand->ecc.strength	= 8;
 		nand->ecc.size		= SECTOR_BYTES;
 		nand->ecc.bytes		= 13;
-		nand->ecc.hwctl		= omap_enable_ecc_bch;
+		nand->ecc.hwctl		= omap_enable_hwecc;
 		nand->ecc.correct	= omap_correct_data_bch_sw;
-		nand->ecc.calculate	= omap_calculate_ecc_bch_sw;
+		nand->ecc.calculate	= omap_calculate_ecc;
 		/* define ecc-layout */
 		ecclayout->eccbytes	= nand->ecc.bytes * eccsteps;
 		ecclayout->eccpos[0]	= BADBLOCK_MARKER_LENGTH;
@@ -852,7 +647,6 @@ static int omap_select_ecc_scheme(struct nand_chip *nand,
 		ecclayout->oobfree[0].offset = i + BADBLOCK_MARKER_LENGTH;
 		ecclayout->oobfree[0].length = oobsize - ecclayout->eccbytes -
 						BADBLOCK_MARKER_LENGTH;
-		omap_hwecc_init_bch(nand, NAND_ECC_READ);
 		bch->ecc_scheme		= OMAP_ECC_BCH8_CODE_HW_DETECTION_SW;
 		break;
 #else
@@ -878,9 +672,9 @@ static int omap_select_ecc_scheme(struct nand_chip *nand,
 		nand->ecc.strength	= 8;
 		nand->ecc.size		= SECTOR_BYTES;
 		nand->ecc.bytes		= 14;
-		nand->ecc.hwctl		= omap_enable_ecc_bch;
+		nand->ecc.hwctl		= omap_enable_hwecc;
 		nand->ecc.correct	= omap_correct_data_bch;
-		nand->ecc.calculate	= omap_calculate_ecc_bch;
+		nand->ecc.calculate	= omap_calculate_ecc;
 		nand->ecc.read_page	= omap_read_page_bch;
 		/* define ecc-layout */
 		ecclayout->eccbytes	= nand->ecc.bytes * eccsteps;
diff --git a/drivers/mtd/spi/sf_ops.c b/drivers/mtd/spi/sf_ops.c
index 1f1bb36..ef91b92 100644
--- a/drivers/mtd/spi/sf_ops.c
+++ b/drivers/mtd/spi/sf_ops.c
@@ -9,6 +9,7 @@
  */
 
 #include <common.h>
+#include <errno.h>
 #include <malloc.h>
 #include <spi.h>
 #include <spi_flash.h>
@@ -381,8 +382,11 @@ int spi_flash_cmd_read_ops(struct spi_flash *flash, u32 offset,
 	}
 
 	cmdsz = SPI_FLASH_CMD_LEN + flash->dummy_byte;
-	cmd = malloc(cmdsz);
-	memset(cmd, 0, cmdsz);
+	cmd = calloc(1, cmdsz);
+	if (!cmd) {
+		debug("SF: Failed to allocate cmd\n");
+		return -ENOMEM;
+	}
 
 	cmd[0] = flash->read_cmd;
 	while (len) {
diff --git a/drivers/mtd/spi/sf_params.c b/drivers/mtd/spi/sf_params.c
index daf8fe7..eb372b7 100644
--- a/drivers/mtd/spi/sf_params.c
+++ b/drivers/mtd/spi/sf_params.c
@@ -54,10 +54,11 @@ const struct spi_flash_params spi_flash_params_table[] = {
 	{"S25FL128P_64K",  0x012018, 0x0301,    64 * 1024,   256, RD_FULL,		     WR_QPP},
 	{"S25FL032P",	   0x010215, 0x4d00,    64 * 1024,    64, RD_FULL,		     WR_QPP},
 	{"S25FL064P",	   0x010216, 0x4d00,    64 * 1024,   128, RD_FULL,		     WR_QPP},
+	{"S25FL128S_256K", 0x012018, 0x4d00,   256 * 1024,    64, RD_FULL,		     WR_QPP},
 	{"S25FL128S_64K",  0x012018, 0x4d01,    64 * 1024,   256, RD_FULL,		     WR_QPP},
-	{"S25FL256S_256K", 0x010219, 0x4d00,    64 * 1024,   512, RD_FULL,		     WR_QPP},
+	{"S25FL256S_256K", 0x010219, 0x4d00,   256 * 1024,   128, RD_FULL,		     WR_QPP},
 	{"S25FL256S_64K",  0x010219, 0x4d01,	64 * 1024,   512, RD_FULL,		     WR_QPP},
-	{"S25FL512S_256K", 0x010220, 0x4d00,    64 * 1024,  1024, RD_FULL,		     WR_QPP},
+	{"S25FL512S_256K", 0x010220, 0x4d00,   256 * 1024,   256, RD_FULL,		     WR_QPP},
 	{"S25FL512S_64K",  0x010220, 0x4d01,    64 * 1024,  1024, RD_FULL,		     WR_QPP},
 #endif
 #ifdef CONFIG_SPI_FLASH_STMICRO		/* STMICRO */
diff --git a/drivers/mtd/spi/sf_probe.c b/drivers/mtd/spi/sf_probe.c
index bc3cf6c..0a46fe3 100644
--- a/drivers/mtd/spi/sf_probe.c
+++ b/drivers/mtd/spi/sf_probe.c
@@ -123,12 +123,11 @@ static struct spi_flash *spi_flash_validate_params(struct spi_slave *spi,
 		return NULL;
 	}
 
-	flash = malloc(sizeof(*flash));
+	flash = calloc(1, sizeof(*flash));
 	if (!flash) {
 		debug("SF: Failed to allocate spi_flash\n");
 		return NULL;
 	}
-	memset(flash, '\0', sizeof(*flash));
 
 	/* Assign spi data */
 	flash->spi = spi;
@@ -147,7 +146,21 @@ static struct spi_flash *spi_flash_validate_params(struct spi_slave *spi,
 
 	/* Compute the flash size */
 	flash->shift = (flash->dual_flash & SF_DUAL_PARALLEL_FLASH) ? 1 : 0;
-	flash->page_size = ((ext_jedec == 0x4d00) ? 512 : 256) << flash->shift;
+	/*
+	 * The Spansion S25FL032P and S25FL064P have 256b pages, yet use the
+	 * 0x4d00 Extended JEDEC code. The rest of the Spansion flashes with
+	 * the 0x4d00 Extended JEDEC code have 512b pages. All of the others
+	 * have 256b pages.
+	 */
+	if (ext_jedec == 0x4d00) {
+		if ((jedec == 0x0215) || (jedec == 0x216))
+			flash->page_size = 256;
+		else
+			flash->page_size = 512;
+	} else {
+		flash->page_size = 256;
+	}
+	flash->page_size <<= flash->shift;
 	flash->sector_size = params->sector_size << flash->shift;
 	flash->size = flash->sector_size * params->nr_sectors << flash->shift;
 #ifdef CONFIG_SF_DUAL_FLASH
diff --git a/drivers/net/cpsw.c b/drivers/net/cpsw.c
index dd6c26a..bd5fba2 100644
--- a/drivers/net/cpsw.c
+++ b/drivers/net/cpsw.c
@@ -941,11 +941,7 @@ static int cpsw_phy_init(struct eth_device *dev, struct cpsw_slave *slave)
 {
 	struct cpsw_priv *priv = (struct cpsw_priv *)dev->priv;
 	struct phy_device *phydev;
-	u32 supported = (SUPPORTED_10baseT_Half |
-			SUPPORTED_10baseT_Full |
-			SUPPORTED_100baseT_Half |
-			SUPPORTED_100baseT_Full |
-			SUPPORTED_1000baseT_Full);
+	u32 supported = PHY_GBIT_FEATURES;
 
 	phydev = phy_connect(priv->bus,
 			slave->data->phy_addr,
diff --git a/drivers/net/phy/atheros.c b/drivers/net/phy/atheros.c
index 5332e1a..b80980d 100644
--- a/drivers/net/phy/atheros.c
+++ b/drivers/net/phy/atheros.c
@@ -41,7 +41,7 @@ static int ar8035_config(struct phy_device *phydev)
 static struct phy_driver AR8021_driver =  {
 	.name = "AR8021",
 	.uid = 0x4dd040,
-	.mask = 0x4fffff,
+	.mask = 0x4ffff0,
 	.features = PHY_GBIT_FEATURES,
 	.config = ar8021_config,
 	.startup = genphy_startup,
diff --git a/drivers/net/xilinx_emaclite.c b/drivers/net/xilinx_emaclite.c
index 0a5209d..2a5cc44 100644
--- a/drivers/net/xilinx_emaclite.c
+++ b/drivers/net/xilinx_emaclite.c
@@ -14,8 +14,6 @@
 #include <asm/io.h>
 #include <fdtdec.h>
 
-DECLARE_GLOBAL_DATA_PTR;
-
 #undef DEBUG
 
 #define ENET_ADDR_LENGTH	6
@@ -364,24 +362,27 @@ int xilinx_emaclite_initialize(bd_t *bis, unsigned long base_addr,
 }
 
 #ifdef CONFIG_OF_CONTROL
-int xilinx_emaclite_init(bd_t *bis)
+int xilinx_emaclite_of_init(const void *blob)
 {
 	int offset = 0;
 	u32 ret = 0;
 	u32 reg;
 
 	do {
-		offset = fdt_node_offset_by_compatible(gd->fdt_blob, offset,
+		offset = fdt_node_offset_by_compatible(blob, offset,
 					"xlnx,xps-ethernetlite-1.00.a");
 		if (offset != -1) {
-			reg = fdtdec_get_addr(gd->fdt_blob, offset, "reg");
+			reg = fdtdec_get_addr(blob, offset, "reg");
 			if (reg != FDT_ADDR_T_NONE) {
-				u32 rxpp = fdtdec_get_int(gd->fdt_blob, offset,
+				u32 rxpp = fdtdec_get_int(blob, offset,
 							"xlnx,rx-ping-pong", 0);
-				u32 txpp = fdtdec_get_int(gd->fdt_blob, offset,
+				u32 txpp = fdtdec_get_int(blob, offset,
 							"xlnx,tx-ping-pong", 0);
-				ret |= xilinx_emaclite_initialize(bis, reg,
+				ret |= xilinx_emaclite_initialize(NULL, reg,
 								txpp, rxpp);
+			} else {
+				debug("EMACLITE: Can't get base address\n");
+				return -1;
 			}
 		}
 	} while (offset != -1);
diff --git a/drivers/net/zynq_gem.c b/drivers/net/zynq_gem.c
index 6d4001b..101489c 100644
--- a/drivers/net/zynq_gem.c
+++ b/drivers/net/zynq_gem.c
@@ -12,6 +12,8 @@
 #include <common.h>
 #include <net.h>
 #include <config.h>
+#include <fdtdec.h>
+#include <libfdt.h>
 #include <malloc.h>
 #include <asm/io.h>
 #include <phy.h>
@@ -534,3 +536,43 @@ int zynq_gem_initialize(bd_t *bis, int base_addr, int phy_addr, u32 emio)
 
 	return 1;
 }
+
+#ifdef CONFIG_OF_CONTROL
+int zynq_gem_of_init(const void *blob)
+{
+	int offset = 0;
+	u32 ret = 0;
+	u32 reg, phy_reg;
+
+	debug("ZYNQ GEM: Initialization\n");
+
+	do {
+		offset = fdt_node_offset_by_compatible(blob, offset,
+					"xlnx,ps7-ethernet-1.00.a");
+		if (offset != -1) {
+			reg = fdtdec_get_addr(blob, offset, "reg");
+			if (reg != FDT_ADDR_T_NONE) {
+				offset = fdtdec_lookup_phandle(blob, offset,
+							       "phy-handle");
+				if (offset != -1)
+					phy_reg = fdtdec_get_addr(blob, offset,
+								  "reg");
+				else
+					phy_reg = 0;
+
+				debug("ZYNQ GEM: addr %x, phyaddr %x\n",
+				      reg, phy_reg);
+
+				ret |= zynq_gem_initialize(NULL, reg,
+							   phy_reg, 0);
+
+			} else {
+				debug("ZYNQ GEM: Can't get base address\n");
+				return -1;
+			}
+		}
+	} while (offset != -1);
+
+	return ret;
+}
+#endif
diff --git a/drivers/pci/pcie_imx.c b/drivers/pci/pcie_imx.c
index 8951a93..c48737e 100644
--- a/drivers/pci/pcie_imx.c
+++ b/drivers/pci/pcie_imx.c
@@ -17,7 +17,7 @@
 #include <asm/arch/crm_regs.h>
 #include <asm/gpio.h>
 #include <asm/io.h>
-#include <asm/sizes.h>
+#include <linux/sizes.h>
 #include <errno.h>
 
 #define PCI_ACCESS_READ  0
diff --git a/drivers/serial/sandbox.c b/drivers/serial/sandbox.c
index ffff5e1..51fd871 100644
--- a/drivers/serial/sandbox.c
+++ b/drivers/serial/sandbox.c
@@ -11,9 +11,11 @@
  */
 
 #include <common.h>
+#include <lcd.h>
 #include <os.h>
 #include <serial.h>
 #include <linux/compiler.h>
+#include <asm/state.h>
 
 /*
  *
@@ -30,7 +32,10 @@ static unsigned int serial_buf_read;
 
 static int sandbox_serial_init(void)
 {
-	os_tty_raw(0);
+	struct sandbox_state *state = state_get_current();
+
+	if (state->term_raw != STATE_TERM_COOKED)
+		os_tty_raw(0, state->term_raw == STATE_TERM_RAW_WITH_SIGS);
 	return 0;
 }
 
@@ -60,6 +65,9 @@ static int sandbox_serial_tstc(void)
 	ssize_t count;
 
 	os_usleep(100);
+#ifdef CONFIG_LCD
+	lcd_sync();
+#endif
 	if (next_index == serial_buf_read)
 		return 1;	/* buffer full */
 
diff --git a/drivers/serial/serial_zynq.c b/drivers/serial/serial_zynq.c
index 22c6bf0..53a8af0 100644
--- a/drivers/serial/serial_zynq.c
+++ b/drivers/serial/serial_zynq.c
@@ -6,6 +6,7 @@
  */
 
 #include <common.h>
+#include <fdtdec.h>
 #include <watchdog.h>
 #include <asm/io.h>
 #include <linux/compiler.h>
@@ -13,6 +14,8 @@
 #include <asm/arch/clk.h>
 #include <asm/arch/hardware.h>
 
+DECLARE_GLOBAL_DATA_PTR;
+
 #define ZYNQ_UART_SR_TXFULL	0x00000010 /* TX FIFO full */
 #define ZYNQ_UART_SR_RXEMPTY	0x00000002 /* RX FIFO empty */
 
@@ -182,6 +185,30 @@ DECLARE_PSSERIAL_FUNCTIONS(1);
 struct serial_device uart_zynq_serial1_device =
 	INIT_PSSERIAL_STRUCTURE(1, "ttyPS1");
 
+#ifdef CONFIG_OF_CONTROL
+__weak struct serial_device *default_serial_console(void)
+{
+	const void *blob = gd->fdt_blob;
+	int node;
+	unsigned int base_addr;
+
+	node = fdt_path_offset(blob, "serial0");
+	if (node < 0)
+		return NULL;
+
+	base_addr = fdtdec_get_addr(blob, node, "reg");
+	if (base_addr == FDT_ADDR_T_NONE)
+		return NULL;
+
+	if (base_addr == ZYNQ_SERIAL_BASEADDR0)
+		return &uart_zynq_serial0_device;
+
+	if (base_addr == ZYNQ_SERIAL_BASEADDR1)
+		return &uart_zynq_serial1_device;
+
+	return NULL;
+}
+#else
 __weak struct serial_device *default_serial_console(void)
 {
 #if defined(CONFIG_ZYNQ_SERIAL_UART0)
@@ -194,6 +221,7 @@ __weak struct serial_device *default_serial_console(void)
 #endif
 	return NULL;
 }
+#endif
 
 void zynq_serial_initalize(void)
 {
diff --git a/drivers/sound/Makefile b/drivers/sound/Makefile
index 6d25292..981ed61 100644
--- a/drivers/sound/Makefile
+++ b/drivers/sound/Makefile
@@ -6,6 +6,8 @@
 #
 
 obj-$(CONFIG_SOUND)	+= sound.o
-obj-$(CONFIG_I2S)	+= samsung-i2s.o
+obj-$(CONFIG_I2S)	+= sound-i2s.o
+obj-$(CONFIG_I2S_SAMSUNG)	+= samsung-i2s.o
+obj-$(CONFIG_SOUND_SANDBOX)	+= sandbox.o
 obj-$(CONFIG_SOUND_WM8994)	+= wm8994.o
 obj-$(CONFIG_SOUND_MAX98095)	+= max98095.o
diff --git a/drivers/sound/sandbox.c b/drivers/sound/sandbox.c
new file mode 100644
index 0000000..fe5c9e9
--- /dev/null
+++ b/drivers/sound/sandbox.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <asm/arch/sound.h>
+#include <asm/sdl.h>
+
+int sound_play(uint32_t msec, uint32_t frequency)
+{
+	sandbox_sdl_sound_start(frequency);
+	mdelay(msec);
+	sandbox_sdl_sound_stop();
+
+	return 0;
+}
+
+int sound_init(const void *blob)
+{
+	return sandbox_sdl_sound_init();
+}
diff --git a/drivers/sound/sound-i2s.c b/drivers/sound/sound-i2s.c
new file mode 100644
index 0000000..749bbbd
--- /dev/null
+++ b/drivers/sound/sound-i2s.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ * R. Chandrasekar <rcsekar@samsung.com>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <malloc.h>
+#include <common.h>
+#include <asm/io.h>
+#include <libfdt.h>
+#include <fdtdec.h>
+#include <i2c.h>
+#include <i2s.h>
+#include <sound.h>
+#include <asm/arch/sound.h>
+#include "wm8994.h"
+#include "max98095.h"
+
+/* defines */
+#define SOUND_400_HZ 400
+#define SOUND_BITS_IN_BYTE 8
+
+static struct i2stx_info g_i2stx_pri;
+
+/*
+ * get_sound_i2s_values gets values for i2s parameters
+ *
+ * @param i2stx_info	i2s transmitter transfer param structure
+ * @param blob		FDT blob if enabled else NULL
+ */
+static int get_sound_i2s_values(struct i2stx_info *i2s, const void *blob)
+{
+	int node;
+	int error = 0;
+	int base;
+
+	node = fdt_path_offset(blob, "i2s");
+	if (node <= 0) {
+		debug("EXYNOS_SOUND: No node for sound in device tree\n");
+		return -1;
+	}
+
+	/*
+	 * Get the pre-defined sound specific values from FDT.
+	 * All of these are expected to be correct otherwise
+	 * wrong register values in i2s setup parameters
+	 * may result in no sound play.
+	 */
+	base = fdtdec_get_addr(blob, node, "reg");
+	if (base == FDT_ADDR_T_NONE) {
+		debug("%s: Missing  i2s base\n", __func__);
+		return -1;
+	}
+	i2s->base_address = base;
+
+	i2s->audio_pll_clk = fdtdec_get_int(blob,
+				node, "samsung,i2s-epll-clock-frequency", -1);
+	error |= i2s->audio_pll_clk;
+	debug("audio_pll_clk = %d\n", i2s->audio_pll_clk);
+	i2s->samplingrate = fdtdec_get_int(blob,
+				node, "samsung,i2s-sampling-rate", -1);
+	error |= i2s->samplingrate;
+	debug("samplingrate = %d\n", i2s->samplingrate);
+	i2s->bitspersample = fdtdec_get_int(blob,
+				node, "samsung,i2s-bits-per-sample", -1);
+	error |= i2s->bitspersample;
+	debug("bitspersample = %d\n", i2s->bitspersample);
+	i2s->channels = fdtdec_get_int(blob,
+			node, "samsung,i2s-channels", -1);
+	error |= i2s->channels;
+	debug("channels = %d\n", i2s->channels);
+	i2s->rfs = fdtdec_get_int(blob,
+				node, "samsung,i2s-lr-clk-framesize", -1);
+	error |= i2s->rfs;
+	debug("rfs = %d\n", i2s->rfs);
+	i2s->bfs = fdtdec_get_int(blob,
+				node, "samsung,i2s-bit-clk-framesize", -1);
+	error |= i2s->bfs;
+	debug("bfs = %d\n", i2s->bfs);
+
+	i2s->id = fdtdec_get_int(blob, node, "samsung,i2s-id", -1);
+	error |= i2s->id;
+	debug("id = %d\n", i2s->id);
+
+	if (error == -1) {
+		debug("fail to get sound i2s node properties\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/*
+ * Init codec
+ *
+ * @param blob          FDT blob
+ * @param pi2s_tx	i2s parameters required by codec
+ * @return              int value, 0 for success
+ */
+static int codec_init(const void *blob, struct i2stx_info *pi2s_tx)
+{
+	int ret;
+	const char *codectype;
+	int node;
+
+	/* Get the node from FDT for sound */
+	node = fdt_path_offset(blob, "i2s");
+	if (node <= 0) {
+		debug("EXYNOS_SOUND: No node for sound in device tree\n");
+		debug("node = %d\n", node);
+		return -1;
+	}
+
+	/*
+	 * Get the pre-defined sound codec specific values from FDT.
+	 * All of these are expected to be correct otherwise sound
+	 * can not be played
+	 */
+	codectype = fdt_getprop(blob, node, "samsung,codec-type", NULL);
+	debug("device = %s\n", codectype);
+	if (!strcmp(codectype, "wm8994")) {
+		/* Check the codec type and initialise the same */
+		ret = wm8994_init(blob, pi2s_tx->id + 1,
+				  pi2s_tx->samplingrate,
+				  (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
+				  pi2s_tx->bitspersample, pi2s_tx->channels);
+	} else if (!strcmp(codectype, "max98095")) {
+		ret = max98095_init(blob, pi2s_tx->id + 1,
+				    pi2s_tx->samplingrate,
+				    (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
+				    pi2s_tx->bitspersample);
+	} else {
+		debug("%s: Unknown codec type %s\n", __func__, codectype);
+		return -1;
+	}
+
+	if (ret) {
+		debug("%s: Codec init failed\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
+
+int sound_init(const void *blob)
+{
+	int ret;
+	struct i2stx_info *pi2s_tx = &g_i2stx_pri;
+
+	/* Get the I2S Values */
+	if (get_sound_i2s_values(pi2s_tx, blob) < 0) {
+		debug(" FDT I2S values failed\n");
+		return -1;
+	}
+
+	if (codec_init(blob, pi2s_tx) < 0) {
+		debug(" Codec init failed\n");
+		return -1;
+	}
+
+	ret = i2s_tx_init(pi2s_tx);
+	if (ret) {
+		debug("%s: Failed to init i2c transmit: ret=%d\n", __func__,
+		      ret);
+		return ret;
+	}
+
+
+	return ret;
+}
+
+int sound_play(uint32_t msec, uint32_t frequency)
+{
+	unsigned int *data;
+	unsigned long data_size;
+	unsigned int ret = 0;
+
+	/*Buffer length computation */
+	data_size = g_i2stx_pri.samplingrate * g_i2stx_pri.channels;
+	data_size *= (g_i2stx_pri.bitspersample / SOUND_BITS_IN_BYTE);
+	data = malloc(data_size);
+
+	if (data == NULL) {
+		debug("%s: malloc failed\n", __func__);
+		return -1;
+	}
+
+	sound_create_square_wave((unsigned short *)data,
+				 data_size / sizeof(unsigned short),
+				 frequency);
+
+	while (msec >= 1000) {
+		ret = i2s_transfer_tx_data(&g_i2stx_pri, data,
+					   (data_size / sizeof(int)));
+		msec -= 1000;
+	}
+	if (msec) {
+		unsigned long size =
+			(data_size * msec) / (sizeof(int) * 1000);
+
+		ret = i2s_transfer_tx_data(&g_i2stx_pri, data, size);
+	}
+
+	free(data);
+
+	return ret;
+}
diff --git a/drivers/sound/sound.c b/drivers/sound/sound.c
index 9b8ce5a..9dda2db 100644
--- a/drivers/sound/sound.c
+++ b/drivers/sound/sound.c
@@ -5,193 +5,10 @@
  * SPDX-License-Identifier:	GPL-2.0+
  */
 
-#include <malloc.h>
 #include <common.h>
-#include <asm/io.h>
-#include <libfdt.h>
-#include <fdtdec.h>
-#include <i2c.h>
-#include <i2s.h>
 #include <sound.h>
-#include <asm/arch/sound.h>
-#include "wm8994.h"
-#include "max98095.h"
 
-/* defines */
-#define SOUND_400_HZ 400
-#define SOUND_BITS_IN_BYTE 8
-
-static struct i2stx_info g_i2stx_pri;
-
-/*
- * get_sound_i2s_values gets values for i2s parameters
- *
- * @param i2stx_info	i2s transmitter transfer param structure
- * @param blob		FDT blob if enabled else NULL
- */
-static int get_sound_i2s_values(struct i2stx_info *i2s, const void *blob)
-{
-#ifdef CONFIG_OF_CONTROL
-	int node;
-	int error = 0;
-	int base;
-
-	node = fdt_path_offset(blob, "i2s");
-	if (node <= 0) {
-		debug("EXYNOS_SOUND: No node for sound in device tree\n");
-		return -1;
-	}
-
-	/*
-	 * Get the pre-defined sound specific values from FDT.
-	 * All of these are expected to be correct otherwise
-	 * wrong register values in i2s setup parameters
-	 * may result in no sound play.
-	 */
-	base = fdtdec_get_addr(blob, node, "reg");
-	if (base == FDT_ADDR_T_NONE) {
-		debug("%s: Missing  i2s base\n", __func__);
-		return -1;
-	}
-	i2s->base_address = base;
-
-	i2s->audio_pll_clk = fdtdec_get_int(blob,
-				node, "samsung,i2s-epll-clock-frequency", -1);
-	error |= i2s->audio_pll_clk;
-	debug("audio_pll_clk = %d\n", i2s->audio_pll_clk);
-	i2s->samplingrate = fdtdec_get_int(blob,
-				node, "samsung,i2s-sampling-rate", -1);
-	error |= i2s->samplingrate;
-	debug("samplingrate = %d\n", i2s->samplingrate);
-	i2s->bitspersample = fdtdec_get_int(blob,
-				node, "samsung,i2s-bits-per-sample", -1);
-	error |= i2s->bitspersample;
-	debug("bitspersample = %d\n", i2s->bitspersample);
-	i2s->channels = fdtdec_get_int(blob,
-			node, "samsung,i2s-channels", -1);
-	error |= i2s->channels;
-	debug("channels = %d\n", i2s->channels);
-	i2s->rfs = fdtdec_get_int(blob,
-				node, "samsung,i2s-lr-clk-framesize", -1);
-	error |= i2s->rfs;
-	debug("rfs = %d\n", i2s->rfs);
-	i2s->bfs = fdtdec_get_int(blob,
-				node, "samsung,i2s-bit-clk-framesize", -1);
-	error |= i2s->bfs;
-	debug("bfs = %d\n", i2s->bfs);
-
-	i2s->id = fdtdec_get_int(blob, node, "samsung,i2s-id", -1);
-	error |= i2s->id;
-	debug("id = %d\n", i2s->id);
-
-	if (error == -1) {
-		debug("fail to get sound i2s node properties\n");
-		return -1;
-	}
-#else
-	i2s->base_address = samsung_get_base_i2s();
-	i2s->audio_pll_clk = I2S_PLL_CLK;
-	i2s->samplingrate = I2S_SAMPLING_RATE;
-	i2s->bitspersample = I2S_BITS_PER_SAMPLE;
-	i2s->channels = I2S_CHANNELS;
-	i2s->rfs = I2S_RFS;
-	i2s->bfs = I2S_BFS;
-	i2s->id = 0;
-#endif
-	return 0;
-}
-
-/*
- * Init codec
- *
- * @param blob          FDT blob
- * @param pi2s_tx	i2s parameters required by codec
- * @return              int value, 0 for success
- */
-static int codec_init(const void *blob, struct i2stx_info *pi2s_tx)
-{
-	int ret;
-	const char *codectype;
-#ifdef CONFIG_OF_CONTROL
-	int node;
-
-	/* Get the node from FDT for sound */
-	node = fdt_path_offset(blob, "i2s");
-	if (node <= 0) {
-		debug("EXYNOS_SOUND: No node for sound in device tree\n");
-		debug("node = %d\n", node);
-		return -1;
-	}
-
-	/*
-	 * Get the pre-defined sound codec specific values from FDT.
-	 * All of these are expected to be correct otherwise sound
-	 * can not be played
-	 */
-	codectype = fdt_getprop(blob, node, "samsung,codec-type", NULL);
-	debug("device = %s\n", codectype);
-#else
-	codectype =  AUDIO_CODEC;
-#endif
-	if (!strcmp(codectype, "wm8994")) {
-		/* Check the codec type and initialise the same */
-		ret = wm8994_init(blob, pi2s_tx->id + 1,
-				  pi2s_tx->samplingrate,
-				  (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
-				  pi2s_tx->bitspersample, pi2s_tx->channels);
-	} else if (!strcmp(codectype, "max98095")) {
-		ret = max98095_init(blob, pi2s_tx->id + 1,
-				    pi2s_tx->samplingrate,
-				    (pi2s_tx->samplingrate * (pi2s_tx->rfs)),
-				    pi2s_tx->bitspersample);
-	} else {
-		debug("%s: Unknown codec type %s\n", __func__, codectype);
-		return -1;
-	}
-
-	if (ret) {
-		debug("%s: Codec init failed\n", __func__);
-		return -1;
-	}
-
-	return 0;
-}
-
-int sound_init(const void *blob)
-{
-	int ret;
-	struct i2stx_info *pi2s_tx = &g_i2stx_pri;
-
-	/* Get the I2S Values */
-	if (get_sound_i2s_values(pi2s_tx, blob) < 0) {
-		debug(" FDT I2S values failed\n");
-		return -1;
-	}
-
-	if (codec_init(blob, pi2s_tx) < 0) {
-		debug(" Codec init failed\n");
-		return -1;
-	}
-
-	ret = i2s_tx_init(pi2s_tx);
-	if (ret) {
-		debug("%s: Failed to init i2c transmit: ret=%d\n", __func__,
-		      ret);
-		return ret;
-	}
-
-
-	return ret;
-}
-
-/*
- * Generates square wave sound data for 1 second
- *
- * @param data          data buffer pointer
- * @param size          size of the buffer
- * @param freq          frequency of the wave
- */
-static void sound_prepare_buffer(unsigned short *data, int size, uint32_t freq)
+void sound_create_square_wave(unsigned short *data, int size, uint32_t freq)
 {
 	const int sample = 48000;
 	const unsigned short amplitude = 16000; /* between 1 and 32767 */
@@ -218,39 +35,3 @@ static void sound_prepare_buffer(unsigned short *data, int size, uint32_t freq)
 		}
 	}
 }
-
-int sound_play(uint32_t msec, uint32_t frequency)
-{
-	unsigned int *data;
-	unsigned long data_size;
-	unsigned int ret = 0;
-
-	/*Buffer length computation */
-	data_size = g_i2stx_pri.samplingrate * g_i2stx_pri.channels;
-	data_size *= (g_i2stx_pri.bitspersample / SOUND_BITS_IN_BYTE);
-	data = malloc(data_size);
-
-	if (data == NULL) {
-		debug("%s: malloc failed\n", __func__);
-		return -1;
-	}
-
-	sound_prepare_buffer((unsigned short *)data,
-			     data_size / sizeof(unsigned short), frequency);
-
-	while (msec >= 1000) {
-		ret = i2s_transfer_tx_data(&g_i2stx_pri, data,
-					   (data_size / sizeof(int)));
-		msec -= 1000;
-	}
-	if (msec) {
-		unsigned long size =
-			(data_size * msec) / (sizeof(int) * 1000);
-
-		ret = i2s_transfer_tx_data(&g_i2stx_pri, data, size);
-	}
-
-	free(data);
-
-	return ret;
-}
diff --git a/drivers/spi/atmel_dataflash_spi.c b/drivers/spi/atmel_dataflash_spi.c
index 8a5eddc..a2e9c00 100644
--- a/drivers/spi/atmel_dataflash_spi.c
+++ b/drivers/spi/atmel_dataflash_spi.c
@@ -102,33 +102,26 @@ void AT91F_SpiEnable(int cs)
 {
 	unsigned long mode;
 
+	mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	mode &= ~AT91_SPI_PCS;
+
 	switch (cs) {
-	case 0:	/* Configure SPI CS0 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS0_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 0:
+		mode |= AT91_SPI_PCS0_DATAFLASH_CARD << 16;
 		break;
-	case 1:	/* Configure SPI CS1 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS1_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 1:
+		mode |= AT91_SPI_PCS1_DATAFLASH_CARD << 16;
 		break;
-	case 2:	/* Configure SPI CS2 for Serial DataFlash AT45DBxx */
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS2_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+	case 2:
+		mode |= AT91_SPI_PCS2_DATAFLASH_CARD << 16;
 		break;
 	case 3:
-		mode = readl(ATMEL_BASE_SPI0 + AT91_SPI_MR);
-		mode &= 0xFFF0FFFF;
-		writel(mode | ((AT91_SPI_PCS3_DATAFLASH_CARD<<16) & AT91_SPI_PCS),
-		       ATMEL_BASE_SPI0 + AT91_SPI_MR);
+		mode |= AT91_SPI_PCS3_DATAFLASH_CARD << 16;
 		break;
 	}
 
+	writel(mode, ATMEL_BASE_SPI0 + AT91_SPI_MR);
+
 	/* SPI_Enable */
 	writel(AT91_SPI_SPIEN, ATMEL_BASE_SPI0 + AT91_SPI_CR);
 }
diff --git a/drivers/spi/omap3_spi.c b/drivers/spi/omap3_spi.c
index a3ad056..651e46e 100644
--- a/drivers/spi/omap3_spi.c
+++ b/drivers/spi/omap3_spi.c
@@ -260,8 +260,9 @@ int omap3_spi_write(struct spi_slave *slave, unsigned int len, const void *txp,
 	}
 
 	/* wait to finish of transfer */
-	while (!(readl(&ds->regs->channel[ds->slave.cs].chstat) &
-			 OMAP3_MCSPI_CHSTAT_EOT));
+	while ((readl(&ds->regs->channel[ds->slave.cs].chstat) &
+			 (OMAP3_MCSPI_CHSTAT_EOT | OMAP3_MCSPI_CHSTAT_TXS)) !=
+			 (OMAP3_MCSPI_CHSTAT_EOT | OMAP3_MCSPI_CHSTAT_TXS));
 
 	/* Disable the channel otherwise the next immediate RX will get affected */
 	omap3_spi_set_enable(ds,OMAP3_MCSPI_CHCTRL_DIS);
diff --git a/drivers/spi/sandbox_spi.c b/drivers/spi/sandbox_spi.c
index 7895305..12e9bda 100644
--- a/drivers/spi/sandbox_spi.c
+++ b/drivers/spi/sandbox_spi.c
@@ -202,3 +202,16 @@ int spi_xfer(struct spi_slave *slave, unsigned int bitlen, const void *dout,
 
 	return ret;
 }
+
+/**
+ * Set up a new SPI slave for an fdt node
+ *
+ * @param blob		Device tree blob
+ * @param node		SPI peripheral node to use
+ * @return 0 if ok, -1 on error
+ */
+struct spi_slave *spi_setup_slave_fdt(const void *blob, int slave_node,
+				      int spi_node)
+{
+	return NULL;
+}
diff --git a/drivers/usb/eth/Makefile b/drivers/usb/eth/Makefile
index 03f5474..94551c4 100644
--- a/drivers/usb/eth/Makefile
+++ b/drivers/usb/eth/Makefile
@@ -8,4 +8,5 @@ obj-$(CONFIG_USB_HOST_ETHER) += usb_ether.o
 ifdef CONFIG_USB_ETHER_ASIX
 obj-y += asix.o
 endif
+obj-$(CONFIG_USB_ETHER_MCS7830) += mcs7830.o
 obj-$(CONFIG_USB_ETHER_SMSC95XX) += smsc95xx.o
diff --git a/drivers/usb/eth/asix.c b/drivers/usb/eth/asix.c
index 659533a..ce133f0 100644
--- a/drivers/usb/eth/asix.c
+++ b/drivers/usb/eth/asix.c
@@ -468,8 +468,6 @@ static int asix_send(struct eth_device *eth, void *packet, int length)
 
 	memcpy(msg, &packet_len, sizeof(packet_len));
 	memcpy(msg + sizeof(packet_len), (void *)packet, length);
-	if (length & 1)
-		length++;
 
 	err = usb_bulk_msg(dev->pusb_dev,
 				usb_sndbulkpipe(dev->pusb_dev, dev->ep_out),
diff --git a/drivers/usb/eth/mcs7830.c b/drivers/usb/eth/mcs7830.c
new file mode 100644
index 0000000..c353286
--- /dev/null
+++ b/drivers/usb/eth/mcs7830.c
@@ -0,0 +1,812 @@
+/*
+ * Copyright (c) 2013 Gerhard Sittig <gsi@denx.de>
+ * based on the U-Boot Asix driver as well as information
+ * from the Linux Moschip driver
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+/*
+ * MOSCHIP MCS7830 based (7730/7830/7832) USB 2.0 Ethernet Devices
+ */
+
+#include <common.h>
+#include <errno.h>
+#include <linux/mii.h>
+#include <malloc.h>
+#include <usb.h>
+
+#include "usb_ether.h"
+
+#define MCS7830_BASE_NAME	"mcs"
+
+#define USBCALL_TIMEOUT		1000
+#define LINKSTATUS_TIMEOUT	5000	/* link status, connect timeout */
+#define LINKSTATUS_TIMEOUT_RES	50	/* link status, resolution in msec */
+
+#define MCS7830_RX_URB_SIZE	2048
+
+/* command opcodes */
+#define MCS7830_WR_BREQ		0x0d
+#define MCS7830_RD_BREQ		0x0e
+
+/* register layout, numerical offset specs for USB API calls */
+struct mcs7830_regs {
+	uint8_t multicast_hashes[8];
+	uint8_t packet_gap[2];
+	uint8_t phy_data[2];
+	uint8_t phy_command[2];
+	uint8_t configuration;
+	uint8_t ether_address[6];
+	uint8_t frame_drop_count;
+	uint8_t pause_threshold;
+};
+#define REG_MULTICAST_HASH	offsetof(struct mcs7830_regs, multicast_hashes)
+#define REG_PHY_DATA		offsetof(struct mcs7830_regs, phy_data)
+#define REG_PHY_CMD		offsetof(struct mcs7830_regs, phy_command)
+#define REG_CONFIG		offsetof(struct mcs7830_regs, configuration)
+#define REG_ETHER_ADDR		offsetof(struct mcs7830_regs, ether_address)
+#define REG_FRAME_DROP_COUNTER	offsetof(struct mcs7830_regs, frame_drop_count)
+#define REG_PAUSE_THRESHOLD	offsetof(struct mcs7830_regs, pause_threshold)
+
+/* bit masks and default values for the above registers */
+#define PHY_CMD1_READ		0x40
+#define PHY_CMD1_WRITE		0x20
+#define PHY_CMD1_PHYADDR	0x01
+
+#define PHY_CMD2_PEND		0x80
+#define PHY_CMD2_READY		0x40
+
+#define CONF_CFG		0x80
+#define CONF_SPEED100		0x40
+#define CONF_FDX_ENABLE		0x20
+#define CONF_RXENABLE		0x10
+#define CONF_TXENABLE		0x08
+#define CONF_SLEEPMODE		0x04
+#define CONF_ALLMULTICAST	0x02
+#define CONF_PROMISCUOUS	0x01
+
+#define PAUSE_THRESHOLD_DEFAULT	0
+
+/* bit masks for the status byte which follows received ethernet frames */
+#define STAT_RX_FRAME_CORRECT	0x20
+#define STAT_RX_LARGE_FRAME	0x10
+#define STAT_RX_CRC_ERROR	0x08
+#define STAT_RX_ALIGNMENT_ERROR	0x04
+#define STAT_RX_LENGTH_ERROR	0x02
+#define STAT_RX_SHORT_FRAME	0x01
+
+/*
+ * struct mcs7830_private - private driver data for an individual adapter
+ * @config:	shadow for the network adapter's configuration register
+ * @mchash:	shadow for the network adapter's multicast hash registers
+ */
+struct mcs7830_private {
+	uint8_t config;
+	uint8_t mchash[8];
+};
+
+/*
+ * mcs7830_read_reg() - read a register of the network adapter
+ * @dev:	network device to read from
+ * @idx:	index of the register to start reading from
+ * @size:	number of bytes to read
+ * @data:	buffer to read into
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_read_reg(struct ueth_data *dev, uint8_t idx,
+			    uint16_t size, void *data)
+{
+	int len;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, size);
+
+	debug("%s() idx=0x%04X sz=%d\n", __func__, idx, size);
+
+	len = usb_control_msg(dev->pusb_dev,
+			      usb_rcvctrlpipe(dev->pusb_dev, 0),
+			      MCS7830_RD_BREQ,
+			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      0, idx, buf, size,
+			      USBCALL_TIMEOUT);
+	if (len != size) {
+		debug("%s() len=%d != sz=%d\n", __func__, len, size);
+		return -EIO;
+	}
+	memcpy(data, buf, size);
+	return 0;
+}
+
+/*
+ * mcs7830_write_reg() - write a register of the network adapter
+ * @dev:	network device to write to
+ * @idx:	index of the register to start writing to
+ * @size:	number of bytes to write
+ * @data:	buffer holding the data to write
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_write_reg(struct ueth_data *dev, uint8_t idx,
+			     uint16_t size, void *data)
+{
+	int len;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, size);
+
+	debug("%s() idx=0x%04X sz=%d\n", __func__, idx, size);
+
+	memcpy(buf, data, size);
+	len = usb_control_msg(dev->pusb_dev,
+			      usb_sndctrlpipe(dev->pusb_dev, 0),
+			      MCS7830_WR_BREQ,
+			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			      0, idx, buf, size,
+			      USBCALL_TIMEOUT);
+	if (len != size) {
+		debug("%s() len=%d != sz=%d\n", __func__, len, size);
+		return -EIO;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_phy_emit_wait() - emit PHY read/write access, wait for its execution
+ * @dev:	network device to talk to
+ * @rwflag:	PHY_CMD1_READ or PHY_CMD1_WRITE opcode
+ * @index:	number of the PHY register to read or write
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_phy_emit_wait(struct ueth_data *dev,
+				 uint8_t rwflag, uint8_t index)
+{
+	int rc;
+	int retry;
+	uint8_t cmd[2];
+
+	/* send the PHY read/write request */
+	cmd[0] = rwflag | PHY_CMD1_PHYADDR;
+	cmd[1] = PHY_CMD2_PEND | (index & 0x1f);
+	rc = mcs7830_write_reg(dev, REG_PHY_CMD, sizeof(cmd), cmd);
+	if (rc < 0)
+		return rc;
+
+	/* wait for the response to become available (usually < 1ms) */
+	retry = 10;
+	do {
+		rc = mcs7830_read_reg(dev, REG_PHY_CMD, sizeof(cmd), cmd);
+		if (rc < 0)
+			return rc;
+		if (cmd[1] & PHY_CMD2_READY)
+			return 0;
+		if (!retry--)
+			return -ETIMEDOUT;
+		mdelay(1);
+	} while (1);
+	/* UNREACH */
+}
+
+/*
+ * mcs7830_read_phy() - read a PHY register of the network adapter
+ * @dev:	network device to read from
+ * @index:	index of the PHY register to read from
+ * Return: non-negative 16bit register content, negative upon error
+ */
+static int mcs7830_read_phy(struct ueth_data *dev, uint8_t index)
+{
+	int rc;
+	uint16_t val;
+
+	/* issue the PHY read request and wait for its execution */
+	rc = mcs7830_phy_emit_wait(dev, PHY_CMD1_READ, index);
+	if (rc < 0)
+		return rc;
+
+	/* fetch the PHY data which was read */
+	rc = mcs7830_read_reg(dev, REG_PHY_DATA, sizeof(val), &val);
+	if (rc < 0)
+		return rc;
+	rc = le16_to_cpu(val);
+	debug("%s(%s, %d) => 0x%04X\n", __func__, dev->eth_dev.name, index, rc);
+	return rc;
+}
+
+/*
+ * mcs7830_write_phy() - write a PHY register of the network adapter
+ * @dev:	network device to write to
+ * @index:	index of the PHY register to write to
+ * @val:	value to write to the PHY register
+ * Return: zero upon success, negative upon error
+ */
+static int mcs7830_write_phy(struct ueth_data *dev, uint8_t index, uint16_t val)
+{
+	int rc;
+
+	debug("%s(%s, %d, 0x%04X)\n", __func__, dev->eth_dev.name, index, val);
+
+	/* setup the PHY data which is to get written */
+	val = cpu_to_le16(val);
+	rc = mcs7830_write_reg(dev, REG_PHY_DATA, sizeof(val), &val);
+	if (rc < 0)
+		return rc;
+
+	/* issue the PHY write request and wait for its execution */
+	rc = mcs7830_phy_emit_wait(dev, PHY_CMD1_WRITE, index);
+	if (rc < 0)
+		return rc;
+
+	return 0;
+}
+
+/*
+ * mcs7830_write_config() - write to the network adapter's config register
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * the data which gets written is taken from the shadow config register
+ * within the device driver's private data
+ */
+static int mcs7830_write_config(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	rc = mcs7830_write_reg(dev, REG_CONFIG,
+			       sizeof(priv->config), &priv->config);
+	if (rc < 0) {
+		debug("writing config to adapter failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_write_mchash() - write the network adapter's multicast filter
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * the data which gets written is taken from the shadow multicast hashes
+ * within the device driver's private data
+ */
+static int mcs7830_write_mchash(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	rc = mcs7830_write_reg(dev, REG_MULTICAST_HASH,
+			       sizeof(priv->mchash), &priv->mchash);
+	if (rc < 0) {
+		debug("writing multicast hash to adapter failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_set_autoneg() - setup and trigger ethernet link autonegotiation
+ * @eth:	network device to run link negotiation on
+ * Return: zero upon success, negative upon error
+ *
+ * the routine advertises available media and starts autonegotiation
+ */
+static int mcs7830_set_autoneg(struct ueth_data *dev)
+{
+	int adv, flg;
+	int rc;
+
+	debug("%s()\n", __func__);
+
+	/*
+	 * algorithm taken from the Linux driver, which took it from
+	 * "the original mcs7830 version 1.4 driver":
+	 *
+	 * enable all media, reset BMCR, enable auto neg, restart
+	 * auto neg while keeping the enable auto neg flag set
+	 */
+
+	adv = ADVERTISE_PAUSE_CAP | ADVERTISE_ALL | ADVERTISE_CSMA;
+	rc = mcs7830_write_phy(dev, MII_ADVERTISE, adv);
+
+	flg = 0;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	flg |= BMCR_ANENABLE;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	flg |= BMCR_ANRESTART;
+	if (!rc)
+		rc = mcs7830_write_phy(dev, MII_BMCR, flg);
+
+	return rc;
+}
+
+/*
+ * mcs7830_get_rev() - identify a network adapter's chip revision
+ * @eth:	network device to identify
+ * Return: non-negative number, reflecting the revision number
+ *
+ * currently, only "rev C and higher" and "below rev C" are needed, so
+ * the return value is #1 for "below rev C", and #2 for "rev C and above"
+ */
+static int mcs7830_get_rev(struct ueth_data *dev)
+{
+	uint8_t buf[2];
+	int rc;
+	int rev;
+
+	/* register 22 is readable in rev C and higher */
+	rc = mcs7830_read_reg(dev, REG_FRAME_DROP_COUNTER, sizeof(buf), buf);
+	if (rc < 0)
+		rev = 1;
+	else
+		rev = 2;
+	debug("%s() rc=%d, rev=%d\n", __func__, rc, rev);
+	return rev;
+}
+
+/*
+ * mcs7830_apply_fixup() - identify an adapter and potentially apply fixups
+ * @eth:	network device to identify and apply fixups to
+ * Return: zero upon success (no errors emitted from here)
+ *
+ * this routine identifies the network adapter's chip revision, and applies
+ * fixups for known issues
+ */
+static int mcs7830_apply_fixup(struct ueth_data *dev)
+{
+	int rev;
+	int i;
+	uint8_t thr;
+
+	rev = mcs7830_get_rev(dev);
+	debug("%s() rev=%d\n", __func__, rev);
+
+	/*
+	 * rev C requires setting the pause threshold (the Linux driver
+	 * is inconsistent, the implementation does it for "rev C
+	 * exactly", the introductory comment says "rev C and above")
+	 */
+	if (rev == 2) {
+		debug("%s: applying rev C fixup\n", dev->eth_dev.name);
+		thr = PAUSE_THRESHOLD_DEFAULT;
+		for (i = 0; i < 2; i++) {
+			(void)mcs7830_write_reg(dev, REG_PAUSE_THRESHOLD,
+						sizeof(thr), &thr);
+			mdelay(1);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_basic_reset() - bring the network adapter into a known first state
+ * @eth:	network device to act upon
+ * Return: zero upon success, negative upon error
+ *
+ * this routine initializes the network adapter such that subsequent invocations
+ * of the interface callbacks can exchange ethernet frames; link negotiation is
+ * triggered from here already and continues in background
+ */
+static int mcs7830_basic_reset(struct ueth_data *dev)
+{
+	struct mcs7830_private *priv;
+	int rc;
+
+	debug("%s()\n", __func__);
+	priv = dev->dev_priv;
+
+	/*
+	 * comment from the respective Linux driver, which
+	 * unconditionally sets the ALLMULTICAST flag as well:
+	 * should not be needed, but does not work otherwise
+	 */
+	priv->config = CONF_TXENABLE;
+	priv->config |= CONF_ALLMULTICAST;
+
+	rc = mcs7830_set_autoneg(dev);
+	if (rc < 0) {
+		error("setting autoneg failed\n");
+		return rc;
+	}
+
+	rc = mcs7830_write_mchash(dev);
+	if (rc < 0) {
+		error("failed to set multicast hash\n");
+		return rc;
+	}
+
+	rc = mcs7830_write_config(dev);
+	if (rc < 0) {
+		error("failed to set configuration\n");
+		return rc;
+	}
+
+	rc = mcs7830_apply_fixup(dev);
+	if (rc < 0) {
+		error("fixup application failed\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ * mcs7830_read_mac() - read an ethernet adapter's MAC address
+ * @eth:	network device to read from
+ * Return: zero upon success, negative upon error
+ *
+ * this routine fetches the MAC address stored within the ethernet adapter,
+ * and stores it in the ethernet interface's data structure
+ */
+static int mcs7830_read_mac(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	int rc;
+	uint8_t buf[ETH_ALEN];
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	rc = mcs7830_read_reg(dev, REG_ETHER_ADDR, ETH_ALEN, buf);
+	if (rc < 0) {
+		debug("reading MAC from adapter failed\n");
+		return rc;
+	}
+
+	memcpy(&eth->enetaddr[0], buf, ETH_ALEN);
+	return 0;
+}
+
+/*
+ * mcs7830_write_mac() - write an ethernet adapter's MAC address
+ * @eth:	network device to write to
+ * Return: zero upon success, negative upon error
+ *
+ * this routine takes the MAC address from the ethernet interface's data
+ * structure, and writes it into the ethernet adapter such that subsequent
+ * exchange of ethernet frames uses this address
+ */
+static int mcs7830_write_mac(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	int rc;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	if (sizeof(eth->enetaddr) != ETH_ALEN)
+		return -EINVAL;
+	rc = mcs7830_write_reg(dev, REG_ETHER_ADDR, ETH_ALEN, eth->enetaddr);
+	if (rc < 0) {
+		debug("writing MAC to adapter failed\n");
+		return rc;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_init() - network interface's init callback
+ * @eth:	network device to initialize
+ * @bd:		board information
+ * Return: zero upon success, negative upon error
+ *
+ * after initial setup during probe() and get_info(), this init() callback
+ * ensures that the link is up and subsequent send() and recv() calls can
+ * exchange ethernet frames
+ */
+static int mcs7830_init(struct eth_device *eth, bd_t *bd)
+{
+	struct ueth_data *dev;
+	int timeout;
+	int have_link;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	timeout = 0;
+	do {
+		have_link = mcs7830_read_phy(dev, MII_BMSR) & BMSR_LSTATUS;
+		if (have_link)
+			break;
+		udelay(LINKSTATUS_TIMEOUT_RES * 1000);
+		timeout += LINKSTATUS_TIMEOUT_RES;
+	} while (timeout < LINKSTATUS_TIMEOUT);
+	if (!have_link) {
+		debug("ethernet link is down\n");
+		return -ETIMEDOUT;
+	}
+	return 0;
+}
+
+/*
+ * mcs7830_send() - network interface's send callback
+ * @eth:	network device to send the frame from
+ * @packet:	ethernet frame content
+ * @length:	ethernet frame length
+ * Return: zero upon success, negative upon error
+ *
+ * this routine send an ethernet frame out of the network interface
+ */
+static int mcs7830_send(struct eth_device *eth, void *packet, int length)
+{
+	struct ueth_data *dev;
+	int rc;
+	int gotlen;
+	/* there is a status byte after the ethernet frame */
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, PKTSIZE + sizeof(uint8_t));
+
+	dev = eth->priv;
+
+	memcpy(buf, packet, length);
+	rc = usb_bulk_msg(dev->pusb_dev,
+			  usb_sndbulkpipe(dev->pusb_dev, dev->ep_out),
+			  &buf[0], length, &gotlen,
+			  USBCALL_TIMEOUT);
+	debug("%s() TX want len %d, got len %d, rc %d\n",
+	      __func__, length, gotlen, rc);
+	return rc;
+}
+
+/*
+ * mcs7830_recv() - network interface's recv callback
+ * @eth:	network device to receive frames from
+ * Return: zero upon success, negative upon error
+ *
+ * this routine checks for available ethernet frames that the network
+ * interface might have received, and notifies the network stack
+ */
+static int mcs7830_recv(struct eth_device *eth)
+{
+	struct ueth_data *dev;
+	ALLOC_CACHE_ALIGN_BUFFER(uint8_t, buf, MCS7830_RX_URB_SIZE);
+	int rc, wantlen, gotlen;
+	uint8_t sts;
+
+	debug("%s()\n", __func__);
+	dev = eth->priv;
+
+	/* fetch input data from the adapter */
+	wantlen = MCS7830_RX_URB_SIZE;
+	rc = usb_bulk_msg(dev->pusb_dev,
+			  usb_rcvbulkpipe(dev->pusb_dev, dev->ep_in),
+			  &buf[0], wantlen, &gotlen,
+			  USBCALL_TIMEOUT);
+	debug("%s() RX want len %d, got len %d, rc %d\n",
+	      __func__, wantlen, gotlen, rc);
+	if (rc != 0) {
+		error("RX: failed to receive\n");
+		return rc;
+	}
+	if (gotlen > wantlen) {
+		error("RX: got too many bytes (%d)\n", gotlen);
+		return -EIO;
+	}
+
+	/*
+	 * the bulk message that we received from USB contains exactly
+	 * one ethernet frame and a trailing status byte
+	 */
+	if (gotlen < sizeof(sts))
+		return -EIO;
+	gotlen -= sizeof(sts);
+	sts = buf[gotlen];
+
+	if (sts == STAT_RX_FRAME_CORRECT) {
+		debug("%s() got a frame, len=%d\n", __func__, gotlen);
+		NetReceive(buf, gotlen);
+		return 0;
+	}
+
+	debug("RX: frame error (sts 0x%02X, %s %s %s %s %s)\n",
+	      sts,
+	      (sts & STAT_RX_LARGE_FRAME) ? "large" : "-",
+	      (sts & STAT_RX_LENGTH_ERROR) ?  "length" : "-",
+	      (sts & STAT_RX_SHORT_FRAME) ? "short" : "-",
+	      (sts & STAT_RX_CRC_ERROR) ? "crc" : "-",
+	      (sts & STAT_RX_ALIGNMENT_ERROR) ?  "align" : "-");
+	return -EIO;
+}
+
+/*
+ * mcs7830_halt() - network interface's halt callback
+ * @eth:	network device to cease operation of
+ * Return: none
+ *
+ * this routine is supposed to undo the effect of previous initialization and
+ * ethernet frames exchange; in this implementation it's a NOP
+ */
+static void mcs7830_halt(struct eth_device *eth)
+{
+	debug("%s()\n", __func__);
+}
+
+/*
+ * mcs7830_iface_idx - index of detected network interfaces
+ *
+ * this counter keeps track of identified supported interfaces,
+ * to assign unique names as more interfaces are found
+ */
+static int mcs7830_iface_idx;
+
+/*
+ * mcs7830_eth_before_probe() - network driver's before_probe callback
+ * Return: none
+ *
+ * this routine initializes driver's internal data in preparation of
+ * subsequent probe callbacks
+ */
+void mcs7830_eth_before_probe(void)
+{
+	mcs7830_iface_idx = 0;
+}
+
+/*
+ * struct mcs7830_dongle - description of a supported Moschip ethernet dongle
+ * @vendor:	16bit USB vendor identification
+ * @product:	16bit USB product identification
+ *
+ * this structure describes a supported USB ethernet dongle by means of the
+ * vendor and product codes found during USB enumeration; no flags are held
+ * here since all supported dongles have identical behaviour, and required
+ * fixups get determined at runtime, such that no manual configuration is
+ * needed
+ */
+struct mcs7830_dongle {
+	uint16_t vendor;
+	uint16_t product;
+};
+
+/*
+ * mcs7830_dongles - the list of supported Moschip based USB ethernet dongles
+ */
+static const struct mcs7830_dongle const mcs7830_dongles[] = {
+	{ 0x9710, 0x7832, },	/* Moschip 7832 */
+	{ 0x9710, 0x7830, },	/* Moschip 7830 */
+	{ 0x9710, 0x7730, },	/* Moschip 7730 */
+	{ 0x0df6, 0x0021, },	/* Sitecom LN 30 */
+};
+
+/*
+ * mcs7830_eth_probe() - network driver's probe callback
+ * @dev:	detected USB device to check
+ * @ifnum:	detected USB interface to check
+ * @ss:		USB ethernet data structure to fill in upon match
+ * Return: #1 upon match, #0 upon mismatch or error
+ *
+ * this routine checks whether the found USB device is supported by
+ * this ethernet driver, and upon match fills in the USB ethernet
+ * data structure which later is passed to the get_info callback
+ */
+int mcs7830_eth_probe(struct usb_device *dev, unsigned int ifnum,
+		      struct ueth_data *ss)
+{
+	struct usb_interface *iface;
+	struct usb_interface_descriptor *iface_desc;
+	int i;
+	struct mcs7830_private *priv;
+	int ep_in_found, ep_out_found, ep_intr_found;
+
+	debug("%s()\n", __func__);
+
+	/* iterate the list of supported dongles */
+	iface = &dev->config.if_desc[ifnum];
+	iface_desc = &iface->desc;
+	for (i = 0; i < ARRAY_SIZE(mcs7830_dongles); i++) {
+		if (dev->descriptor.idVendor == mcs7830_dongles[i].vendor &&
+		    dev->descriptor.idProduct == mcs7830_dongles[i].product)
+			break;
+	}
+	if (i == ARRAY_SIZE(mcs7830_dongles))
+		return 0;
+	debug("detected USB ethernet device: %04X:%04X\n",
+	      dev->descriptor.idVendor, dev->descriptor.idProduct);
+
+	/* fill in driver private data */
+	priv = calloc(1, sizeof(*priv));
+	if (!priv)
+		return 0;
+
+	/* fill in the ueth_data structure, attach private data */
+	memset(ss, 0, sizeof(*ss));
+	ss->ifnum = ifnum;
+	ss->pusb_dev = dev;
+	ss->subclass = iface_desc->bInterfaceSubClass;
+	ss->protocol = iface_desc->bInterfaceProtocol;
+	ss->dev_priv = priv;
+
+	/*
+	 * a minimum of three endpoints is expected: in (bulk),
+	 * out (bulk), and interrupt; ignore all others
+	 */
+	ep_in_found = ep_out_found = ep_intr_found = 0;
+	for (i = 0; i < iface_desc->bNumEndpoints; i++) {
+		uint8_t eptype, epaddr;
+		bool is_input;
+
+		eptype = iface->ep_desc[i].bmAttributes;
+		eptype &= USB_ENDPOINT_XFERTYPE_MASK;
+
+		epaddr = iface->ep_desc[i].bEndpointAddress;
+		is_input = epaddr & USB_DIR_IN;
+		epaddr &= USB_ENDPOINT_NUMBER_MASK;
+
+		if (eptype == USB_ENDPOINT_XFER_BULK) {
+			if (is_input && !ep_in_found) {
+				ss->ep_in = epaddr;
+				ep_in_found++;
+			}
+			if (!is_input && !ep_out_found) {
+				ss->ep_out = epaddr;
+				ep_out_found++;
+			}
+		}
+
+		if (eptype == USB_ENDPOINT_XFER_INT) {
+			if (is_input && !ep_intr_found) {
+				ss->ep_int = epaddr;
+				ss->irqinterval = iface->ep_desc[i].bInterval;
+				ep_intr_found++;
+			}
+		}
+	}
+	debug("endpoints: in %d, out %d, intr %d\n",
+	      ss->ep_in, ss->ep_out, ss->ep_int);
+
+	/* apply basic sanity checks */
+	if (usb_set_interface(dev, iface_desc->bInterfaceNumber, 0) ||
+	    !ss->ep_in || !ss->ep_out || !ss->ep_int) {
+		debug("device probe incomplete\n");
+		return 0;
+	}
+
+	dev->privptr = ss;
+	return 1;
+}
+
+/*
+ * mcs7830_eth_get_info() - network driver's get_info callback
+ * @dev:	detected USB device
+ * @ss:		USB ethernet data structure filled in at probe()
+ * @eth:	ethernet interface data structure to fill in
+ * Return: #1 upon success, #0 upon error
+ *
+ * this routine registers the mandatory init(), send(), recv(), and
+ * halt() callbacks with the ethernet interface, can register the
+ * optional write_hwaddr() callback with the ethernet interface,
+ * and initiates configuration of the interface such that subsequent
+ * calls to those callbacks results in network communication
+ */
+int mcs7830_eth_get_info(struct usb_device *dev, struct ueth_data *ss,
+			 struct eth_device *eth)
+{
+	debug("%s()\n", __func__);
+	if (!eth) {
+		debug("%s: missing parameter.\n", __func__);
+		return 0;
+	}
+
+	snprintf(eth->name, sizeof(eth->name), "%s%d",
+		 MCS7830_BASE_NAME, mcs7830_iface_idx++);
+	eth->init = mcs7830_init;
+	eth->send = mcs7830_send;
+	eth->recv = mcs7830_recv;
+	eth->halt = mcs7830_halt;
+	eth->write_hwaddr = mcs7830_write_mac;
+	eth->priv = ss;
+
+	if (mcs7830_basic_reset(ss))
+		return 0;
+
+	if (mcs7830_read_mac(eth))
+		return 0;
+	debug("MAC %pM\n", eth->enetaddr);
+
+	return 1;
+}
diff --git a/drivers/usb/eth/usb_ether.c b/drivers/usb/eth/usb_ether.c
index 2c4126b..1dda54c 100644
--- a/drivers/usb/eth/usb_ether.c
+++ b/drivers/usb/eth/usb_ether.c
@@ -30,6 +30,13 @@ static const struct usb_eth_prob_dev prob_dev[] = {
 		.get_info = asix_eth_get_info,
 	},
 #endif
+#ifdef CONFIG_USB_ETHER_MCS7830
+	{
+		.before_probe = mcs7830_eth_before_probe,
+		.probe = mcs7830_eth_probe,
+		.get_info = mcs7830_eth_get_info,
+	},
+#endif
 #ifdef CONFIG_USB_ETHER_SMSC95XX
 	{
 		.before_probe = smsc95xx_eth_before_probe,
diff --git a/drivers/usb/gadget/f_thor.h b/drivers/usb/gadget/f_thor.h
index 04ee9a2..833a9d2 100644
--- a/drivers/usb/gadget/f_thor.h
+++ b/drivers/usb/gadget/f_thor.h
@@ -11,7 +11,7 @@
 #define _USB_THOR_H_
 
 #include <linux/compiler.h>
-#include <asm/sizes.h>
+#include <linux/sizes.h>
 
 /* THOR Composite Gadget */
 #define STRING_MANUFACTURER_IDX	0
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 17187ca..6017090 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -395,6 +395,7 @@ ehci_submit_async(struct usb_device *dev, unsigned long pipe, void *buffer,
 		QH_ENDPT2_UFCMASK(0) | QH_ENDPT2_UFSMASK(0);
 	qh->qh_endpt2 = cpu_to_hc32(endpt);
 	qh->qh_overlay.qt_next = cpu_to_hc32(QT_NEXT_TERMINATE);
+	qh->qh_overlay.qt_altnext = cpu_to_hc32(QT_NEXT_TERMINATE);
 
 	tdp = &qh->qh_overlay.qt_next;
 
@@ -1161,14 +1162,16 @@ create_int_queue(struct usb_device *dev, unsigned long pipe, int queuesize,
 		debug("ehci intr queue: out of memory\n");
 		goto fail1;
 	}
-	result->first = memalign(32, sizeof(struct QH) * queuesize);
+	result->first = memalign(USB_DMA_MINALIGN,
+				 sizeof(struct QH) * queuesize);
 	if (!result->first) {
 		debug("ehci intr queue: out of memory\n");
 		goto fail2;
 	}
 	result->current = result->first;
 	result->last = result->first + queuesize - 1;
-	result->tds = memalign(32, sizeof(struct qTD) * queuesize);
+	result->tds = memalign(USB_DMA_MINALIGN,
+			       sizeof(struct qTD) * queuesize);
 	if (!result->tds) {
 		debug("ehci intr queue: out of memory\n");
 		goto fail3;
@@ -1186,6 +1189,7 @@ create_int_queue(struct usb_device *dev, unsigned long pipe, int queuesize,
 			qh->qh_link = QH_LINK_TERMINATE;
 
 		qh->qh_overlay.qt_next = (uint32_t)td;
+		qh->qh_overlay.qt_altnext = QT_NEXT_TERMINATE;
 		qh->qh_endpt1 = (0 << 28) | /* No NAK reload (ehci 4.9) */
 			(usb_maxpacket(dev, pipe) << 16) | /* MPS */
 			(1 << 14) |
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 5aa190b..46e4cee 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -254,105 +254,7 @@ static inline void dump_ptd_data(struct ptd *ptd, u8 * buf, int type)
 
 /* --- Virtual Root Hub ---------------------------------------------------- */
 
-/* Device descriptor */
-static __u8 root_hub_dev_des[] = {
-	0x12,			/*  __u8  bLength; */
-	0x01,			/*  __u8  bDescriptorType; Device */
-	0x10,			/*  __u16 bcdUSB; v1.1 */
-	0x01,
-	0x09,			/*  __u8  bDeviceClass; HUB_CLASSCODE */
-	0x00,			/*  __u8  bDeviceSubClass; */
-	0x00,			/*  __u8  bDeviceProtocol; */
-	0x08,			/*  __u8  bMaxPacketSize0; 8 Bytes */
-	0x00,			/*  __u16 idVendor; */
-	0x00,
-	0x00,			/*  __u16 idProduct; */
-	0x00,
-	0x00,			/*  __u16 bcdDevice; */
-	0x00,
-	0x00,			/*  __u8  iManufacturer; */
-	0x01,			/*  __u8  iProduct; */
-	0x00,			/*  __u8  iSerialNumber; */
-	0x01			/*  __u8  bNumConfigurations; */
-};
-
-/* Configuration descriptor */
-static __u8 root_hub_config_des[] = {
-	0x09,			/*  __u8  bLength; */
-	0x02,			/*  __u8  bDescriptorType; Configuration */
-	0x19,			/*  __u16 wTotalLength; */
-	0x00,
-	0x01,			/*  __u8  bNumInterfaces; */
-	0x01,			/*  __u8  bConfigurationValue; */
-	0x00,			/*  __u8  iConfiguration; */
-	0x40,			/*  __u8  bmAttributes;
-				   Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
-	0x00,			/*  __u8  MaxPower; */
-
-	/* interface */
-	0x09,			/*  __u8  if_bLength; */
-	0x04,			/*  __u8  if_bDescriptorType; Interface */
-	0x00,			/*  __u8  if_bInterfaceNumber; */
-	0x00,			/*  __u8  if_bAlternateSetting; */
-	0x01,			/*  __u8  if_bNumEndpoints; */
-	0x09,			/*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
-	0x00,			/*  __u8  if_bInterfaceSubClass; */
-	0x00,			/*  __u8  if_bInterfaceProtocol; */
-	0x00,			/*  __u8  if_iInterface; */
-
-	/* endpoint */
-	0x07,			/*  __u8  ep_bLength; */
-	0x05,			/*  __u8  ep_bDescriptorType; Endpoint */
-	0x81,			/*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
-	0x03,			/*  __u8  ep_bmAttributes; Interrupt */
-	0x00,			/*  __u16 ep_wMaxPacketSize; ((MAX_ROOT_PORTS + 1) / 8 */
-	0x02,
-	0xff			/*  __u8  ep_bInterval; 255 ms */
-};
-
-static unsigned char root_hub_str_index0[] = {
-	0x04,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	0x09,			/*  __u8  lang ID */
-	0x04,			/*  __u8  lang ID */
-};
-
-static unsigned char root_hub_str_index1[] = {
-	0x22,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	'I',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'S',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'P',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'1',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'1',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'6',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'x',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'R',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	't',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'H',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'u',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'b',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-};
+#include <usbroothubdes.h>
 
 /*
  * Hub class-specific descriptor is constructed dynamically
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 219d182..dc0a4e3 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -1094,103 +1094,7 @@ static int dl_done_list(ohci_t *ohci)
  * Virtual Root Hub
  *-------------------------------------------------------------------------*/
 
-/* Device descriptor */
-static __u8 root_hub_dev_des[] =
-{
-	0x12,	    /*	__u8  bLength; */
-	0x01,	    /*	__u8  bDescriptorType; Device */
-	0x10,	    /*	__u16 bcdUSB; v1.1 */
-	0x01,
-	0x09,	    /*	__u8  bDeviceClass; HUB_CLASSCODE */
-	0x00,	    /*	__u8  bDeviceSubClass; */
-	0x00,	    /*	__u8  bDeviceProtocol; */
-	0x08,	    /*	__u8  bMaxPacketSize0; 8 Bytes */
-	0x00,	    /*	__u16 idVendor; */
-	0x00,
-	0x00,	    /*	__u16 idProduct; */
-	0x00,
-	0x00,	    /*	__u16 bcdDevice; */
-	0x00,
-	0x00,	    /*	__u8  iManufacturer; */
-	0x01,	    /*	__u8  iProduct; */
-	0x00,	    /*	__u8  iSerialNumber; */
-	0x01	    /*	__u8  bNumConfigurations; */
-};
-
-/* Configuration descriptor */
-static __u8 root_hub_config_des[] =
-{
-	0x09,	    /*	__u8  bLength; */
-	0x02,	    /*	__u8  bDescriptorType; Configuration */
-	0x19,	    /*	__u16 wTotalLength; */
-	0x00,
-	0x01,	    /*	__u8  bNumInterfaces; */
-	0x01,	    /*	__u8  bConfigurationValue; */
-	0x00,	    /*	__u8  iConfiguration; */
-	0x40,	    /*	__u8  bmAttributes;
-	 Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
-	0x00,	    /*	__u8  MaxPower; */
-
-	/* interface */
-	0x09,	    /*	__u8  if_bLength; */
-	0x04,	    /*	__u8  if_bDescriptorType; Interface */
-	0x00,	    /*	__u8  if_bInterfaceNumber; */
-	0x00,	    /*	__u8  if_bAlternateSetting; */
-	0x01,	    /*	__u8  if_bNumEndpoints; */
-	0x09,	    /*	__u8  if_bInterfaceClass; HUB_CLASSCODE */
-	0x00,	    /*	__u8  if_bInterfaceSubClass; */
-	0x00,	    /*	__u8  if_bInterfaceProtocol; */
-	0x00,	    /*	__u8  if_iInterface; */
-
-	/* endpoint */
-	0x07,	    /*	__u8  ep_bLength; */
-	0x05,	    /*	__u8  ep_bDescriptorType; Endpoint */
-	0x81,	    /*	__u8  ep_bEndpointAddress; IN Endpoint 1 */
-	0x03,	    /*	__u8  ep_bmAttributes; Interrupt */
-	0x02,	    /*	__u16 ep_wMaxPacketSize; ((MAX_ROOT_PORTS + 1) / 8 */
-	0x00,
-	0xff	    /*	__u8  ep_bInterval; 255 ms */
-};
-
-static unsigned char root_hub_str_index0[] =
-{
-	0x04,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	0x09,			/*  __u8  lang ID */
-	0x04,			/*  __u8  lang ID */
-};
-
-static unsigned char root_hub_str_index1[] =
-{
-	28,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	'O',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'H',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'C',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'I',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'R',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	't',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'H',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'u',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'b',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-};
+#include <usbroothubdes.h>
 
 /* Hub class-specific descriptor is constructed dynamically */
 
diff --git a/drivers/usb/host/ohci-s3c24xx.c b/drivers/usb/host/ohci-s3c24xx.c
index 42e564e..3c659c6 100644
--- a/drivers/usb/host/ohci-s3c24xx.c
+++ b/drivers/usb/host/ohci-s3c24xx.c
@@ -873,100 +873,7 @@ static int dl_done_list(struct ohci *ohci, struct td *td_list)
  * Virtual Root Hub
  *-------------------------------------------------------------------------*/
 
-/* Device descriptor */
-static __u8 root_hub_dev_des[] = {
-	0x12,	/*  __u8  bLength; */
-	0x01,	/*  __u8  bDescriptorType; Device */
-	0x10,	/*  __u16 bcdUSB; v1.1 */
-	0x01,
-	0x09,	/*  __u8  bDeviceClass; HUB_CLASSCODE */
-	0x00,	/*  __u8  bDeviceSubClass; */
-	0x00,	/*  __u8  bDeviceProtocol; */
-	0x08,	/*  __u8  bMaxPacketSize0; 8 Bytes */
-	0x00,	/*  __u16 idVendor; */
-	0x00,
-	0x00,	/*  __u16 idProduct; */
-	0x00,
-	0x00,	/*  __u16 bcdDevice; */
-	0x00,
-	0x00,	/*  __u8  iManufacturer; */
-	0x01,	/*  __u8  iProduct; */
-	0x00,	/*  __u8  iSerialNumber; */
-	0x01	/*  __u8  bNumConfigurations; */
-};
-
-/* Configuration descriptor */
-static __u8 root_hub_config_des[] = {
-	0x09,	/*  __u8  bLength; */
-	0x02,	/*  __u8  bDescriptorType; Configuration */
-	0x19,	/*  __u16 wTotalLength; */
-	0x00,
-	0x01,	/*  __u8  bNumInterfaces; */
-	0x01,	/*  __u8  bConfigurationValue; */
-	0x00,	/*  __u8  iConfiguration; */
-	0x40,	/*  __u8  bmAttributes;
-		   Bit 7: Bus-powered, 6: Self-powered,
-		   5 Remote-wakwup, 4..0: resvd */
-	0x00,	/*  __u8  MaxPower; */
-
-	/* interface */
-	0x09,	/*  __u8  if_bLength; */
-	0x04,	/*  __u8  if_bDescriptorType; Interface */
-	0x00,	/*  __u8  if_bInterfaceNumber; */
-	0x00,	/*  __u8  if_bAlternateSetting; */
-	0x01,	/*  __u8  if_bNumEndpoints; */
-	0x09,	/*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
-	0x00,	/*  __u8  if_bInterfaceSubClass; */
-	0x00,	/*  __u8  if_bInterfaceProtocol; */
-	0x00,	/*  __u8  if_iInterface; */
-
-	/* endpoint */
-	0x07,	/*  __u8  ep_bLength; */
-	0x05,	/*  __u8  ep_bDescriptorType; Endpoint */
-	0x81,	/*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
-	0x03,	/*  __u8  ep_bmAttributes; Interrupt */
-	0x02,	/*  __u16 ep_wMaxPacketSize; ((MAX_ROOT_PORTS + 1) / 8 */
-	0x00,
-	0xff	/*  __u8  ep_bInterval; 255 ms */
-};
-
-static unsigned char root_hub_str_index0[] = {
-	0x04,	/*  __u8  bLength; */
-	0x03,	/*  __u8  bDescriptorType; String-descriptor */
-	0x09,	/*  __u8  lang ID */
-	0x04,	/*  __u8  lang ID */
-};
-
-static unsigned char root_hub_str_index1[] = {
-	28,	/*  __u8  bLength; */
-	0x03,	/*  __u8  bDescriptorType; String-descriptor */
-	'O',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'H',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'C',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'I',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	' ',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'R',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'o',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'o',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	't',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	' ',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'H',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'u',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-	'b',	/*  __u8  Unicode */
-	0,	/*  __u8  Unicode */
-};
+#include <usbroothubdes.h>
 
 /* Hub class-specific descriptor is constructed dynamically */
 
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index fd30d67..dfe5423 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -557,109 +557,7 @@ static int check_usb_device_connecting(struct r8a66597 *r8a66597)
  * Virtual Root Hub
  *-------------------------------------------------------------------------*/
 
-/* Device descriptor */
-static __u8 root_hub_dev_des[] =
-{
-	0x12,	    /*	__u8  bLength; */
-	0x01,	    /*	__u8  bDescriptorType; Device */
-	0x10,	    /*	__u16 bcdUSB; v1.1 */
-	0x01,
-	0x09,	    /*	__u8  bDeviceClass; HUB_CLASSCODE */
-	0x00,	    /*	__u8  bDeviceSubClass; */
-	0x00,	    /*	__u8  bDeviceProtocol; */
-	0x08,	    /*	__u8  bMaxPacketSize0; 8 Bytes */
-	0x00,	    /*	__u16 idVendor; */
-	0x00,
-	0x00,	    /*	__u16 idProduct; */
-	0x00,
-	0x00,	    /*	__u16 bcdDevice; */
-	0x00,
-	0x00,	    /*	__u8  iManufacturer; */
-	0x01,	    /*	__u8  iProduct; */
-	0x00,	    /*	__u8  iSerialNumber; */
-	0x01	    /*	__u8  bNumConfigurations; */
-};
-
-/* Configuration descriptor */
-static __u8 root_hub_config_des[] =
-{
-	0x09,	    /*	__u8  bLength; */
-	0x02,	    /*	__u8  bDescriptorType; Configuration */
-	0x19,	    /*	__u16 wTotalLength; */
-	0x00,
-	0x01,	    /*	__u8  bNumInterfaces; */
-	0x01,	    /*	__u8  bConfigurationValue; */
-	0x00,	    /*	__u8  iConfiguration; */
-	0x40,	    /*	__u8  bmAttributes; */
-
-	0x00,	    /*	__u8  MaxPower; */
-
-	/* interface */
-	0x09,	    /*	__u8  if_bLength; */
-	0x04,	    /*	__u8  if_bDescriptorType; Interface */
-	0x00,	    /*	__u8  if_bInterfaceNumber; */
-	0x00,	    /*	__u8  if_bAlternateSetting; */
-	0x01,	    /*	__u8  if_bNumEndpoints; */
-	0x09,	    /*	__u8  if_bInterfaceClass; HUB_CLASSCODE */
-	0x00,	    /*	__u8  if_bInterfaceSubClass; */
-	0x00,	    /*	__u8  if_bInterfaceProtocol; */
-	0x00,	    /*	__u8  if_iInterface; */
-
-	/* endpoint */
-	0x07,	    /*	__u8  ep_bLength; */
-	0x05,	    /*	__u8  ep_bDescriptorType; Endpoint */
-	0x81,	    /*	__u8  ep_bEndpointAddress; IN Endpoint 1 */
-	0x03,	    /*	__u8  ep_bmAttributes; Interrupt */
-	0x02,	    /*	__u16 ep_wMaxPacketSize; ((MAX_ROOT_PORTS + 1) / 8 */
-	0x00,
-	0xff	    /*	__u8  ep_bInterval; 255 ms */
-};
-
-static unsigned char root_hub_str_index0[] =
-{
-	0x04,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	0x09,			/*  __u8  lang ID */
-	0x04,			/*  __u8  lang ID */
-};
-
-static unsigned char root_hub_str_index1[] =
-{
-	34,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	'R',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'8',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'A',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'6',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'6',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'5',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'9',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'7',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'R',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	't',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'H',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'u',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-	'b',			/*  __u8  Unicode */
-	0,				/*  __u8  Unicode */
-};
+#include <usbroothubdes.h>
 
 static int r8a66597_submit_rh_msg(struct usb_device *dev, unsigned long pipe,
 			void *buffer, int transfer_len, struct devrequest *cmd)
diff --git a/drivers/usb/musb/musb_hcd.c b/drivers/usb/musb/musb_hcd.c
index 799bd30..f0ba8aa 100644
--- a/drivers/usb/musb/musb_hcd.c
+++ b/drivers/usb/musb/musb_hcd.c
@@ -28,99 +28,8 @@ static const struct musb_epinfo epinfo[3] = {
 static int rh_devnum;
 static u32 port_status;
 
-/* Device descriptor */
-static const u8 root_hub_dev_des[] = {
-	0x12,			/*  __u8  bLength; */
-	0x01,			/*  __u8  bDescriptorType; Device */
-	0x00,			/*  __u16 bcdUSB; v1.1 */
-	0x02,
-	0x09,			/*  __u8  bDeviceClass; HUB_CLASSCODE */
-	0x00,			/*  __u8  bDeviceSubClass; */
-	0x00,			/*  __u8  bDeviceProtocol; */
-	0x08,			/*  __u8  bMaxPacketSize0; 8 Bytes */
-	0x00,			/*  __u16 idVendor; */
-	0x00,
-	0x00,			/*  __u16 idProduct; */
-	0x00,
-	0x00,			/*  __u16 bcdDevice; */
-	0x00,
-	0x00,			/*  __u8  iManufacturer; */
-	0x01,			/*  __u8  iProduct; */
-	0x00,			/*  __u8  iSerialNumber; */
-	0x01			/*  __u8  bNumConfigurations; */
-};
-
-/* Configuration descriptor */
-static const u8 root_hub_config_des[] = {
-	0x09,			/*  __u8  bLength; */
-	0x02,			/*  __u8  bDescriptorType; Configuration */
-	0x19,			/*  __u16 wTotalLength; */
-	0x00,
-	0x01,			/*  __u8  bNumInterfaces; */
-	0x01,			/*  __u8  bConfigurationValue; */
-	0x00,			/*  __u8  iConfiguration; */
-	0x40,			/*  __u8  bmAttributes;
-				   Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
-	0x00,			/*  __u8  MaxPower; */
-
-	/* interface */
-	0x09,			/*  __u8  if_bLength; */
-	0x04,			/*  __u8  if_bDescriptorType; Interface */
-	0x00,			/*  __u8  if_bInterfaceNumber; */
-	0x00,			/*  __u8  if_bAlternateSetting; */
-	0x01,			/*  __u8  if_bNumEndpoints; */
-	0x09,			/*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
-	0x00,			/*  __u8  if_bInterfaceSubClass; */
-	0x00,			/*  __u8  if_bInterfaceProtocol; */
-	0x00,			/*  __u8  if_iInterface; */
-
-	/* endpoint */
-	0x07,			/*  __u8  ep_bLength; */
-	0x05,			/*  __u8  ep_bDescriptorType; Endpoint */
-	0x81,			/*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
-	0x03,			/*  __u8  ep_bmAttributes; Interrupt */
-	0x00,			/*  __u16 ep_wMaxPacketSize; ((MAX_ROOT_PORTS + 1) / 8 */
-	0x02,
-	0xff			/*  __u8  ep_bInterval; 255 ms */
-};
+#include <usbroothubdes.h>
 
-static const unsigned char root_hub_str_index0[] = {
-	0x04,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	0x09,			/*  __u8  lang ID */
-	0x04,			/*  __u8  lang ID */
-};
-
-static const unsigned char root_hub_str_index1[] = {
-	0x1c,			/*  __u8  bLength; */
-	0x03,			/*  __u8  bDescriptorType; String-descriptor */
-	'M',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'U',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'S',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'B',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'R',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'o',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	't',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	' ',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'H',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'u',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-	'b',			/*  __u8  Unicode */
-	0,			/*  __u8  Unicode */
-};
 #endif
 
 /*
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index a7f5469..c527029 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_VIDEO_MX3) += mx3fb.o videomodes.o
 obj-$(CONFIG_VIDEO_IPUV3) += mxc_ipuv3_fb.o ipu_common.o ipu_disp.o
 obj-$(CONFIG_VIDEO_MXS) += mxsfb.o videomodes.o
 obj-$(CONFIG_VIDEO_OMAP3) += omap3_dss.o
+obj-$(CONFIG_VIDEO_SANDBOX_SDL) += sandbox_sdl.o
 obj-$(CONFIG_VIDEO_SED13806) += sed13806.o
 obj-$(CONFIG_VIDEO_SM501) += sm501.o
 obj-$(CONFIG_VIDEO_SMI_LYNXEM) += smiLynxEM.o videomodes.o
diff --git a/drivers/video/cfb_console.c b/drivers/video/cfb_console.c
index 6db4073..b52e9ed 100644
--- a/drivers/video/cfb_console.c
+++ b/drivers/video/cfb_console.c
@@ -1473,7 +1473,11 @@ int video_display_bitmap(ulong bmp_image, int x, int y)
 			printf("Error: malloc in gunzip failed!\n");
 			return 1;
 		}
-		if (gunzip(dst, CONFIG_SYS_VIDEO_LOGO_MAX_SIZE,
+		/*
+		 * NB: we need to force offset of +2
+		 * See doc/README.displaying-bmps
+		 */
+		if (gunzip(dst+2, CONFIG_SYS_VIDEO_LOGO_MAX_SIZE-2,
 			   (uchar *) bmp_image,
 			   &len) != 0) {
 			printf("Error: no valid bmp or bmp.gz image at %lx\n",
@@ -1489,7 +1493,7 @@ int video_display_bitmap(ulong bmp_image, int x, int y)
 		/*
 		 * Set addr to decompressed image
 		 */
-		bmp = (bmp_image_t *) dst;
+		bmp = (bmp_image_t *)(dst+2);
 
 		if (!((bmp->header.signature[0] == 'B') &&
 		      (bmp->header.signature[1] == 'M'))) {
diff --git a/drivers/video/exynos_fb.c b/drivers/video/exynos_fb.c
index 00a0a11..e1e0d80 100644
--- a/drivers/video/exynos_fb.c
+++ b/drivers/video/exynos_fb.c
@@ -104,6 +104,13 @@ void __exynos_backlight_reset(void)
 void exynos_backlight_reset(void)
 	__attribute__((weak, alias("__exynos_backlight_reset")));
 
+int __exynos_lcd_misc_init(vidinfo_t *vid)
+{
+	return 0;
+}
+int exynos_lcd_misc_init(vidinfo_t *vid)
+	__attribute__((weak, alias("__exynos_lcd_misc_init")));
+
 static void lcd_panel_on(vidinfo_t *vid)
 {
 	udelay(vid->init_delay);
@@ -281,10 +288,15 @@ void lcd_ctrl_init(void *lcdbase)
 #ifdef CONFIG_OF_CONTROL
 	if (exynos_fimd_parse_dt(gd->fdt_blob))
 		debug("Can't get proper panel info\n");
+#ifdef CONFIG_EXYNOS_MIPI_DSIM
+	exynos_init_dsim_platform_data(&panel_info);
+#endif
+	exynos_lcd_misc_init(&panel_info);
 #else
 	/* initialize parameters which is specific to panel. */
 	init_panel_info(&panel_info);
 #endif
+
 	panel_width = panel_info.vl_width;
 	panel_height = panel_info.vl_height;
 
diff --git a/drivers/video/exynos_mipi_dsi.c b/drivers/video/exynos_mipi_dsi.c
index 8bb8fea..7dd4652 100644
--- a/drivers/video/exynos_mipi_dsi.c
+++ b/drivers/video/exynos_mipi_dsi.c
@@ -9,6 +9,8 @@
 
 #include <common.h>
 #include <malloc.h>
+#include <fdtdec.h>
+#include <libfdt.h>
 #include <linux/err.h>
 #include <asm/arch/dsim.h>
 #include <asm/arch/mipi_dsim.h>
@@ -22,7 +24,14 @@
 #define master_to_driver(a)	(a->dsim_lcd_drv)
 #define master_to_device(a)	(a->dsim_lcd_dev)
 
+DECLARE_GLOBAL_DATA_PTR;
+
 static struct exynos_platform_mipi_dsim *dsim_pd;
+#ifdef CONFIG_OF_CONTROL
+static struct mipi_dsim_config dsim_config_dt;
+static struct exynos_platform_mipi_dsim dsim_platform_data_dt;
+static struct mipi_dsim_lcd_device mipi_lcd_device_dt;
+#endif
 
 struct mipi_dsim_ddi {
 	int				bus_id;
@@ -238,3 +247,90 @@ void exynos_set_dsim_platform_data(struct exynos_platform_mipi_dsim *pd)
 
 	dsim_pd = pd;
 }
+
+#ifdef CONFIG_OF_CONTROL
+int exynos_dsim_config_parse_dt(const void *blob)
+{
+	int node;
+
+	node = fdtdec_next_compatible(blob, 0, COMPAT_SAMSUNG_EXYNOS_MIPI_DSI);
+	if (node <= 0) {
+		printf("exynos_mipi_dsi: Can't get device node for mipi dsi\n");
+		return -ENODEV;
+	}
+
+	dsim_config_dt.e_interface = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-interface", 0);
+
+	dsim_config_dt.e_virtual_ch = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-virtual-ch", 0);
+
+	dsim_config_dt.e_pixel_format = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-pixel-format", 0);
+
+	dsim_config_dt.e_burst_mode = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-burst-mode", 0);
+
+	dsim_config_dt.e_no_data_lane = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-no-data-lane", 0);
+
+	dsim_config_dt.e_byte_clk = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-e-byte-clk", 0);
+
+	dsim_config_dt.hfp = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-hfp", 0);
+
+	dsim_config_dt.p = fdtdec_get_int(blob, node,
+					  "samsung,dsim-config-p", 0);
+	dsim_config_dt.m = fdtdec_get_int(blob, node,
+					  "samsung,dsim-config-m", 0);
+	dsim_config_dt.s = fdtdec_get_int(blob, node,
+					  "samsung,dsim-config-s", 0);
+
+	dsim_config_dt.pll_stable_time = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-pll-stable-time", 0);
+
+	dsim_config_dt.esc_clk = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-esc-clk", 0);
+
+	dsim_config_dt.stop_holding_cnt = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-stop-holding-cnt", 0);
+
+	dsim_config_dt.bta_timeout = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-bta-timeout", 0);
+
+	dsim_config_dt.rx_timeout = fdtdec_get_int(blob, node,
+				"samsung,dsim-config-rx-timeout", 0);
+
+	mipi_lcd_device_dt.name = fdtdec_get_config_string(blob,
+				"samsung,dsim-device-name");
+
+	mipi_lcd_device_dt.id = fdtdec_get_int(blob, node,
+				"samsung,dsim-device-id", 0);
+
+	mipi_lcd_device_dt.bus_id = fdtdec_get_int(blob, node,
+				"samsung,dsim-device-bus_id", 0);
+
+	mipi_lcd_device_dt.reverse_panel = fdtdec_get_int(blob, node,
+				"samsung,dsim-device-reverse-panel", 0);
+
+	return 0;
+}
+
+void exynos_init_dsim_platform_data(vidinfo_t *vid)
+{
+	if (exynos_dsim_config_parse_dt(gd->fdt_blob))
+		debug("Can't get proper dsim config.\n");
+
+	strcpy(dsim_platform_data_dt.lcd_panel_name, mipi_lcd_device_dt.name);
+	dsim_platform_data_dt.dsim_config = &dsim_config_dt;
+	dsim_platform_data_dt.mipi_power = mipi_power;
+	dsim_platform_data_dt.phy_enable = set_mipi_phy_ctrl;
+	dsim_platform_data_dt.lcd_panel_info = (void *)vid;
+
+	mipi_lcd_device_dt.platform_data = (void *)&dsim_platform_data_dt;
+	exynos_mipi_dsi_register_lcd_device(&mipi_lcd_device_dt);
+
+	dsim_pd = &dsim_platform_data_dt;
+}
+#endif
diff --git a/drivers/video/sandbox_sdl.c b/drivers/video/sandbox_sdl.c
new file mode 100644
index 0000000..ba4578e
--- /dev/null
+++ b/drivers/video/sandbox_sdl.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2013 Google, Inc
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <common.h>
+#include <fdtdec.h>
+#include <lcd.h>
+#include <malloc.h>
+#include <asm/sdl.h>
+#include <asm/u-boot-sandbox.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+enum {
+	/* Maximum LCD size we support */
+	LCD_MAX_WIDTH		= 1366,
+	LCD_MAX_HEIGHT		= 768,
+	LCD_MAX_LOG2_BPP	= 4,		/* 2^4 = 16 bpp */
+};
+
+vidinfo_t panel_info;
+
+void lcd_setcolreg(ushort regno, ushort red, ushort green, ushort blue)
+{
+}
+
+void lcd_ctrl_init(void *lcdbase)
+{
+	/*
+	 * Allocate memory to keep BMP color conversion map. This is required
+	 * for 8 bit BMPs only (hence 256 colors). If malloc fails - keep
+	 * going, it is not even clear if displyaing the bitmap will be
+	 * required on the way up.
+	 */
+	panel_info.cmap = malloc(256 * NBITS(panel_info.vl_bpix) / 8);
+}
+
+void lcd_enable(void)
+{
+	if (sandbox_sdl_init_display(panel_info.vl_col, panel_info.vl_row,
+				     panel_info.vl_bpix))
+		puts("LCD init failed\n");
+}
+
+int sandbox_lcd_sdl_early_init(void)
+{
+	const void *blob = gd->fdt_blob;
+	int xres = LCD_MAX_WIDTH, yres = LCD_MAX_HEIGHT;
+	int node;
+	int ret = 0;
+
+	/*
+	 * The code in common/lcd.c does not cope with not being able to
+	 * set up a frame buffer. It will just happily keep writing to
+	 * invalid memory. So here we make sure that at least some buffer
+	 * is available even if it actually won't be displayed.
+	 */
+	node = fdtdec_next_compatible(blob, 0, COMPAT_SANDBOX_LCD_SDL);
+	if (node >= 0) {
+		xres = fdtdec_get_int(blob, node, "xres", LCD_MAX_WIDTH);
+		yres = fdtdec_get_int(blob, node, "yres", LCD_MAX_HEIGHT);
+		if (xres < 0 || xres > LCD_MAX_WIDTH) {
+			xres = LCD_MAX_WIDTH;
+			ret = -EINVAL;
+		}
+		if (yres < 0 || yres > LCD_MAX_HEIGHT) {
+			yres = LCD_MAX_HEIGHT;
+			ret = -EINVAL;
+		}
+	}
+
+	panel_info.vl_col = xres;
+	panel_info.vl_row = yres;
+	panel_info.vl_bpix = LCD_COLOR16;
+
+	return ret;
+}