Merge changes I22b42795,I08207543,Ia5fa674a into msm-3.0

* changes:
  arm/dt: msm-copper: Device tree source file for MSM Copper
  dt/irq: add irq_domain_generate_simple() helper
  irq: add irq_domain translation infrastructure
diff --git a/arch/arm/mach-msm/board-9615.c b/arch/arm/mach-msm/board-9615.c
index 82a0bb9..40cbee0 100644
--- a/arch/arm/mach-msm/board-9615.c
+++ b/arch/arm/mach-msm/board-9615.c
@@ -29,6 +29,7 @@
 #include "board-9615.h"
 #include "cpuidle.h"
 #include "pm.h"
+#include "acpuclock.h"
 
 static struct pm8xxx_irq_platform_data pm8xxx_irq_pdata __devinitdata = {
 	.irq_base		= PM8018_IRQ_BASE,
@@ -563,6 +564,9 @@
 	msm_device_gadget_peripheral.dev.parent = &msm_device_otg.dev;
 	platform_add_devices(common_devices, ARRAY_SIZE(common_devices));
 
+	msm_clock_init(&msm9615_clock_init_data);
+	acpuclk_init(&acpuclk_9615_soc_data);
+
 	msm9615_init_mmc();
 	msm_pm_set_platform_data(msm_pm_data, ARRAY_SIZE(msm_pm_data));
 	msm_pm_set_rpm_wakeup_irq(RPM_APCC_CPU0_WAKE_UP_IRQ);
diff --git a/arch/arm/mach-msm/board-msm8x60.c b/arch/arm/mach-msm/board-msm8x60.c
index dab800f..6141e1f 100644
--- a/arch/arm/mach-msm/board-msm8x60.c
+++ b/arch/arm/mach-msm/board-msm8x60.c
@@ -2548,19 +2548,15 @@
 	 */
 	if (machine_is_msm8x60_fluid()) {
 		/* fluid has different firmware, gpios */
-		peripheral_dsps.name = DSPS_PIL_FLUID_NAME;
 		pdata->pil_name = DSPS_PIL_FLUID_NAME;
 		pdata->gpios = dsps_fluid_gpios;
 		pdata->gpios_num = ARRAY_SIZE(dsps_fluid_gpios);
 	} else {
-		peripheral_dsps.name = DSPS_PIL_GENERIC_NAME;
 		pdata->pil_name = DSPS_PIL_GENERIC_NAME;
 		pdata->gpios = dsps_surf_gpios;
 		pdata->gpios_num = ARRAY_SIZE(dsps_surf_gpios);
 	}
 
-	msm_pil_add_device(&peripheral_dsps);
-
 	platform_device_register(&msm_dsps_device);
 }
 #endif /* CONFIG_MSM_DSPS */
diff --git a/arch/arm/mach-msm/clock-8960.c b/arch/arm/mach-msm/clock-8960.c
index 734b1fe..ee122ec 100644
--- a/arch/arm/mach-msm/clock-8960.c
+++ b/arch/arm/mach-msm/clock-8960.c
@@ -5159,6 +5159,7 @@
 	CLK_LOOKUP("afab_a_clk",	afab_a_clk.c,	NULL),
 	CLK_LOOKUP("cfpb_clk",		cfpb_clk.c,	NULL),
 	CLK_LOOKUP("cfpb_a_clk",	cfpb_a_clk.c,	NULL),
+	CLK_LOOKUP("cfpb_a_clk",	cfpb_a_clk.c,	"clock-8960"),
 	CLK_LOOKUP("dfab_clk",		dfab_clk.c,	NULL),
 	CLK_LOOKUP("dfab_a_clk",	dfab_a_clk.c,	NULL),
 	CLK_LOOKUP("ebi1_clk",		ebi1_clk.c,	NULL),
@@ -5821,6 +5822,7 @@
 {
 	int rc;
 	struct clk *mmfpb_a_clk = clk_get_sys("clock-8960", "mmfpb_a_clk");
+	struct clk *cfpb_a_clk = clk_get_sys("clock-8960", "cfpb_a_clk");
 
 	/* Vote for MMFPB to be at least 76.8MHz when an Apps CPU is active. */
 	if (WARN(IS_ERR(mmfpb_a_clk), "mmfpb_a_clk not found (%ld)\n",
@@ -5833,6 +5835,16 @@
 	if (WARN(rc, "mmfpb_a_clk not enabled (%d)\n", rc))
 		return rc;
 
+	/* Vote for CFPB to be at least 64MHz when an Apps CPU is active. */
+	if (WARN(IS_ERR(cfpb_a_clk), "cfpb_a_clk not found (%ld)\n",
+			PTR_ERR(cfpb_a_clk)))
+		return PTR_ERR(cfpb_a_clk);
+	rc = clk_set_min_rate(cfpb_a_clk, 64000000);
+	if (WARN(rc, "cfpb_a_clk rate was not set (%d)\n", rc))
+		return rc;
+	rc = clk_enable(cfpb_a_clk);
+	if (WARN(rc, "cfpb_a_clk not enabled (%d)\n", rc))
+		return rc;
 	return local_unvote_sys_vdd(HIGH);
 }
 
diff --git a/arch/arm/mach-msm/clock-9615.c b/arch/arm/mach-msm/clock-9615.c
index 84121ef..63d3f72 100644
--- a/arch/arm/mach-msm/clock-9615.c
+++ b/arch/arm/mach-msm/clock-9615.c
@@ -27,6 +27,7 @@
 #include <mach/clk.h>
 #include <mach/msm_xo.h>
 #include <mach/rpm-9615.h>
+#include <mach/rpm-regulator.h>
 
 #include "clock-local.h"
 #include "clock-voter.h"
@@ -290,17 +291,14 @@
 /* Update the sys_vdd voltage given a level. */
 static int msm9615_update_sys_vdd(enum sys_vdd_level level)
 {
-	/* TODO: Implement when rpm-regulator is ready.
 	static const int vdd_uv[] = {
-		[NONE...LOW] =  945000,
-		[NOMINAL]    = 1050000,
+		[NONE...LOW] = 1150000,
+		[NOMINAL]    = 1150000,
 		[HIGH]       = 1150000,
 	};
 
-	return rpm_vreg_set_voltage(RPM_VREG_ID_PM8921_S3, RPM_VREG_VOTER3,
+	return rpm_vreg_set_voltage(RPM_VREG_ID_PM8018_S1, RPM_VREG_VOTER3,
 				    vdd_uv[level], vdd_uv[HIGH], 1);
-	*/
-	return 0;
 }
 
 static int soc_clk_reset(struct clk *clk, enum clk_reset_action action)
diff --git a/arch/arm/mach-msm/devices-9615.c b/arch/arm/mach-msm/devices-9615.c
index 77a6556..74e7871 100644
--- a/arch/arm/mach-msm/devices-9615.c
+++ b/arch/arm/mach-msm/devices-9615.c
@@ -30,7 +30,6 @@
 #include <mach/msm_sps.h>
 #include <mach/dma.h>
 #include "devices.h"
-#include "acpuclock.h"
 #include "mpm.h"
 #include "spm.h"
 #include "pm.h"
@@ -791,8 +790,6 @@
 void __init msm9615_device_init(void)
 {
 	msm_spm_init(msm_spm_data, ARRAY_SIZE(msm_spm_data));
-	msm_clock_init(&msm9615_clock_init_data);
-	acpuclk_init(&acpuclk_9615_soc_data);
 	BUG_ON(msm_rpm_init(&msm_rpm_data));
 	BUG_ON(msm_rpmrs_levels_init(msm_rpmrs_levels,
 			ARRAY_SIZE(msm_rpmrs_levels)));
diff --git a/arch/arm/mach-msm/devices.h b/arch/arm/mach-msm/devices.h
index 458b00d..1748838 100644
--- a/arch/arm/mach-msm/devices.h
+++ b/arch/arm/mach-msm/devices.h
@@ -187,7 +187,6 @@
 struct platform_device *msm_add_gsbi9_uart(void);
 extern struct platform_device msm_device_touchscreen;
 
-extern struct pil_device peripheral_dsps;
 extern struct platform_device led_pdev;
 
 extern struct platform_device ion_dev;
diff --git a/arch/arm/mach-msm/peripheral-loader.c b/arch/arm/mach-msm/peripheral-loader.c
index dc3b26f..672f332 100644
--- a/arch/arm/mach-msm/peripheral-loader.c
+++ b/arch/arm/mach-msm/peripheral-loader.c
@@ -12,13 +12,14 @@
 
 #include <linux/module.h>
 #include <linux/string.h>
-#include <linux/platform_device.h>
+#include <linux/device.h>
 #include <linux/firmware.h>
 #include <linux/io.h>
 #include <linux/debugfs.h>
 #include <linux/elf.h>
 #include <linux/mutex.h>
 #include <linux/memblock.h>
+#include <linux/slab.h>
 
 #include <mach/socinfo.h>
 
@@ -27,6 +28,13 @@
 
 #include "peripheral-loader.h"
 
+struct pil_device {
+	struct pil_desc *desc;
+	int count;
+	struct mutex lock;
+	struct list_head list;
+};
+
 static DEFINE_MUTEX(pil_list_lock);
 static LIST_HEAD(pil_list);
 
@@ -35,7 +43,7 @@
 	struct pil_device *dev;
 
 	list_for_each_entry(dev, &pil_list, list)
-		if (!strcmp(dev->name, str))
+		if (!strcmp(dev->desc->name, str))
 			return dev;
 	return NULL;
 }
@@ -65,24 +73,24 @@
 	const u8 *data;
 
 	if (memblock_is_region_memory(phdr->p_paddr, phdr->p_memsz)) {
-		dev_err(&pil->pdev.dev, "Kernel memory would be overwritten");
+		dev_err(pil->desc->dev, "Kernel memory would be overwritten");
 		return -EPERM;
 	}
 
 	if (phdr->p_filesz) {
-		snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d", pil->name,
-				num);
-		ret = request_firmware(&fw, fw_name, &pil->pdev.dev);
+		snprintf(fw_name, ARRAY_SIZE(fw_name), "%s.b%02d",
+				pil->desc->name, num);
+		ret = request_firmware(&fw, fw_name, pil->desc->dev);
 		if (ret) {
-			dev_err(&pil->pdev.dev, "Failed to locate blob %s\n",
+			dev_err(pil->desc->dev, "Failed to locate blob %s\n",
 					fw_name);
 			return ret;
 		}
 
 		if (fw->size != phdr->p_filesz) {
-			dev_err(&pil->pdev.dev,
-					"Blob size %u doesn't match %u\n",
-					fw->size, phdr->p_filesz);
+			dev_err(pil->desc->dev,
+				"Blob size %u doesn't match %u\n", fw->size,
+				phdr->p_filesz);
 			ret = -EPERM;
 			goto release_fw;
 		}
@@ -99,7 +107,7 @@
 		size = min_t(size_t, IOMAP_SIZE, count);
 		buf = ioremap(paddr, size);
 		if (!buf) {
-			dev_err(&pil->pdev.dev, "Failed to map memory\n");
+			dev_err(pil->desc->dev, "Failed to map memory\n");
 			ret = -ENOMEM;
 			goto release_fw;
 		}
@@ -120,7 +128,7 @@
 		size = min_t(size_t, IOMAP_SIZE, count);
 		buf = ioremap(paddr, size);
 		if (!buf) {
-			dev_err(&pil->pdev.dev, "Failed to map memory\n");
+			dev_err(pil->desc->dev, "Failed to map memory\n");
 			ret = -ENOMEM;
 			goto release_fw;
 		}
@@ -131,9 +139,10 @@
 		paddr += size;
 	}
 
-	ret = pil->ops->verify_blob(pil, phdr->p_paddr, phdr->p_memsz);
+	ret = pil->desc->ops->verify_blob(pil->desc, phdr->p_paddr,
+					  phdr->p_memsz);
 	if (ret)
-		dev_err(&pil->pdev.dev, "Blob %u failed verification\n", num);
+		dev_err(pil->desc->dev, "Blob %u failed verification\n", num);
 
 release_fw:
 	release_firmware(fw);
@@ -155,41 +164,41 @@
 	const struct elf32_phdr *phdr;
 	const struct firmware *fw;
 
-	snprintf(fw_name, sizeof(fw_name), "%s.mdt", pil->name);
-	ret = request_firmware(&fw, fw_name, &pil->pdev.dev);
+	snprintf(fw_name, sizeof(fw_name), "%s.mdt", pil->desc->name);
+	ret = request_firmware(&fw, fw_name, pil->desc->dev);
 	if (ret) {
-		dev_err(&pil->pdev.dev, "Failed to locate %s\n", fw_name);
+		dev_err(pil->desc->dev, "Failed to locate %s\n", fw_name);
 		goto out;
 	}
 
 	if (fw->size < sizeof(*ehdr)) {
-		dev_err(&pil->pdev.dev, "Not big enough to be an elf header\n");
+		dev_err(pil->desc->dev, "Not big enough to be an elf header\n");
 		ret = -EIO;
 		goto release_fw;
 	}
 
 	ehdr = (struct elf32_hdr *)fw->data;
 	if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
-		dev_err(&pil->pdev.dev, "Not an elf header\n");
+		dev_err(pil->desc->dev, "Not an elf header\n");
 		ret = -EIO;
 		goto release_fw;
 	}
 
 	if (ehdr->e_phnum == 0) {
-		dev_err(&pil->pdev.dev, "No loadable segments\n");
+		dev_err(pil->desc->dev, "No loadable segments\n");
 		ret = -EIO;
 		goto release_fw;
 	}
 	if (sizeof(struct elf32_phdr) * ehdr->e_phnum +
 	    sizeof(struct elf32_hdr) > fw->size) {
-		dev_err(&pil->pdev.dev, "Program headers not within mdt\n");
+		dev_err(pil->desc->dev, "Program headers not within mdt\n");
 		ret = -EIO;
 		goto release_fw;
 	}
 
-	ret = pil->ops->init_image(pil, fw->data, fw->size);
+	ret = pil->desc->ops->init_image(pil->desc, fw->data, fw->size);
 	if (ret) {
-		dev_err(&pil->pdev.dev, "Invalid firmware metadata\n");
+		dev_err(pil->desc->dev, "Invalid firmware metadata\n");
 		goto release_fw;
 	}
 
@@ -200,15 +209,15 @@
 
 		ret = load_segment(phdr, i, pil);
 		if (ret) {
-			dev_err(&pil->pdev.dev, "Failed to load segment %d\n",
+			dev_err(pil->desc->dev, "Failed to load segment %d\n",
 					i);
 			goto release_fw;
 		}
 	}
 
-	ret = pil->ops->auth_and_reset(pil);
+	ret = pil->desc->ops->auth_and_reset(pil->desc);
 	if (ret) {
-		dev_err(&pil->pdev.dev, "Failed to bring out of reset\n");
+		dev_err(pil->desc->dev, "Failed to bring out of reset\n");
 		goto release_fw;
 	}
 
@@ -242,9 +251,9 @@
 	if (!pil)
 		return ERR_PTR(-ENODEV);
 
-	pil_d = find_peripheral(pil->depends_on);
+	pil_d = find_peripheral(pil->desc->depends_on);
 	if (pil_d) {
-		void *p = pil_get(pil_d->name);
+		void *p = pil_get(pil_d->desc->name);
 		if (IS_ERR(p))
 			return p;
 	}
@@ -290,11 +299,11 @@
 	if (pil->count)
 		pil->count--;
 	if (pil->count == 0)
-		pil->ops->shutdown(pil);
+		pil->desc->ops->shutdown(pil->desc);
 unlock:
 	mutex_unlock(&pil->lock);
 
-	pil_d = find_peripheral(pil->depends_on);
+	pil_d = find_peripheral(pil->desc->depends_on);
 	if (pil_d)
 		pil_put(pil_d);
 }
@@ -310,7 +319,7 @@
 
 	mutex_lock(&pil->lock);
 	if (!WARN(!pil->count, "%s: Reference count mismatch\n", __func__))
-		pil->ops->shutdown(pil);
+		pil->desc->ops->shutdown(pil->desc);
 	mutex_unlock(&pil->lock);
 }
 EXPORT_SYMBOL(pil_force_shutdown);
@@ -366,7 +375,7 @@
 		return -EFAULT;
 
 	if (!strncmp(buf, "get", 3)) {
-		if (IS_ERR(pil_get(pil->name)))
+		if (IS_ERR(pil_get(pil->desc->name)))
 			return -EIO;
 	} else if (!strncmp(buf, "put", 3))
 		pil_put(pil);
@@ -401,8 +410,8 @@
 	if (!pil_base_dir)
 		return -ENOMEM;
 
-	if (!debugfs_create_file(pil->name, S_IRUGO | S_IWUSR, pil_base_dir,
-				pil, &msm_pil_debugfs_fops))
+	if (!debugfs_create_file(pil->desc->name, S_IRUGO | S_IWUSR,
+				pil_base_dir, pil, &msm_pil_debugfs_fops))
 		return -ENOMEM;
 	return 0;
 }
@@ -416,29 +425,30 @@
 
 	mutex_lock(&pil_list_lock);
 	list_for_each_entry(pil, &pil_list, list)
-		pil->ops->shutdown(pil);
+		pil->desc->ops->shutdown(pil->desc);
 	mutex_unlock(&pil_list_lock);
 
 	return 0;
 }
 late_initcall(msm_pil_shutdown_at_boot);
 
-int msm_pil_add_device(struct pil_device *pil)
+int msm_pil_register(struct pil_desc *desc)
 {
-	int ret;
-	ret = platform_device_register(&pil->pdev);
-	if (ret)
-		return ret;
+	struct pil_device *pil = kzalloc(sizeof(*pil), GFP_KERNEL);
+	if (!pil)
+		return -ENOMEM;
 
 	mutex_init(&pil->lock);
+	INIT_LIST_HEAD(&pil->list);
+	pil->desc = desc;
 
 	mutex_lock(&pil_list_lock);
 	list_add(&pil->list, &pil_list);
 	mutex_unlock(&pil_list_lock);
 
-	msm_pil_debugfs_add(pil);
-	return 0;
+	return msm_pil_debugfs_add(pil);
 }
+EXPORT_SYMBOL(msm_pil_register);
 
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Load peripheral images and bring peripherals out of reset");
diff --git a/arch/arm/mach-msm/peripheral-loader.h b/arch/arm/mach-msm/peripheral-loader.h
index 097d9d7..3d4b4b2 100644
--- a/arch/arm/mach-msm/peripheral-loader.h
+++ b/arch/arm/mach-msm/peripheral-loader.h
@@ -12,28 +12,23 @@
 #ifndef __MSM_PERIPHERAL_LOADER_H
 #define __MSM_PERIPHERAL_LOADER_H
 
-#include <linux/list.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
+struct device;
 
-struct pil_device {
+struct pil_desc {
 	const char *name;
 	const char *depends_on;
-	int count;
-	struct mutex lock;
-	struct platform_device pdev;
-	struct list_head list;
-	struct pil_reset_ops *ops;
+	struct device *dev;
+	const struct pil_reset_ops *ops;
 };
 
 struct pil_reset_ops {
-	int (*init_image)(struct pil_device *pil, const u8 *metadata,
+	int (*init_image)(struct pil_desc *pil, const u8 *metadata,
 			  size_t size);
-	int (*verify_blob)(struct pil_device *pil, u32 phy_addr, size_t size);
-	int (*auth_and_reset)(struct pil_device *pil);
-	int (*shutdown)(struct pil_device *pil);
+	int (*verify_blob)(struct pil_desc *pil, u32 phy_addr, size_t size);
+	int (*auth_and_reset)(struct pil_desc *pil);
+	int (*shutdown)(struct pil_desc *pil);
 };
 
-extern int msm_pil_add_device(struct pil_device *pil);
+extern int msm_pil_register(struct pil_desc *desc);
 
 #endif
diff --git a/arch/arm/mach-msm/peripheral-reset-8960.c b/arch/arm/mach-msm/peripheral-reset-8960.c
index 2c47ee0..b964417 100644
--- a/arch/arm/mach-msm/peripheral-reset-8960.c
+++ b/arch/arm/mach-msm/peripheral-reset-8960.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/regulator/consumer.h>
+#include <linux/platform_device.h>
 
 #include <asm/mach-types.h>
 
@@ -167,25 +168,25 @@
 static void __iomem *msm_riva_base;
 static unsigned long riva_start;
 
-static int init_image_lpass_q6_trusted(struct pil_device *pil,
+static int init_image_lpass_q6_trusted(struct pil_desc *pil,
 				       const u8 *metadata, size_t size)
 {
 	return pas_init_image(PAS_Q6, metadata, size);
 }
 
-static int init_image_modem_fw_q6_trusted(struct pil_device *pil,
+static int init_image_modem_fw_q6_trusted(struct pil_desc *pil,
 					  const u8 *metadata, size_t size)
 {
 	return pas_init_image(PAS_MODEM_FW, metadata, size);
 }
 
-static int init_image_modem_sw_q6_trusted(struct pil_device *pil,
+static int init_image_modem_sw_q6_trusted(struct pil_desc *pil,
 					  const u8 *metadata, size_t size)
 {
 	return pas_init_image(PAS_MODEM_SW, metadata, size);
 }
 
-static int init_image_lpass_q6_untrusted(struct pil_device *pil,
+static int init_image_lpass_q6_untrusted(struct pil_desc *pil,
 					 const u8 *metadata, size_t size)
 {
 	const struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -193,7 +194,7 @@
 	return 0;
 }
 
-static int init_image_modem_fw_q6_untrusted(struct pil_device *pil,
+static int init_image_modem_fw_q6_untrusted(struct pil_desc *pil,
 					    const u8 *metadata, size_t size)
 {
 	const struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -201,7 +202,7 @@
 	return 0;
 }
 
-static int init_image_modem_sw_q6_untrusted(struct pil_device *pil,
+static int init_image_modem_sw_q6_untrusted(struct pil_desc *pil,
 					    const u8 *metadata, size_t size)
 {
 	const struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -209,7 +210,7 @@
 	return 0;
 }
 
-static int verify_blob(struct pil_device *pil, u32 phy_addr, size_t size)
+static int verify_blob(struct pil_desc *pil, u32 phy_addr, size_t size)
 {
 	return 0;
 }
@@ -245,17 +246,17 @@
 	return pas_auth_and_reset(id);
 }
 
-static int reset_lpass_q6_trusted(struct pil_device *pil)
+static int reset_lpass_q6_trusted(struct pil_desc *pil)
 {
 	return reset_q6_trusted(PAS_Q6, &q6_lpass);
 }
 
-static int reset_modem_fw_q6_trusted(struct pil_device *pil)
+static int reset_modem_fw_q6_trusted(struct pil_desc *pil)
 {
 	return reset_q6_trusted(PAS_MODEM_FW, &q6_modem_fw);
 }
 
-static int reset_modem_sw_q6_trusted(struct pil_device *pil)
+static int reset_modem_sw_q6_trusted(struct pil_desc *pil)
 {
 	return reset_q6_trusted(PAS_MODEM_SW, &q6_modem_sw);
 }
@@ -364,17 +365,17 @@
 	return 0;
 }
 
-static int reset_lpass_q6_untrusted(struct pil_device *pil)
+static int reset_lpass_q6_untrusted(struct pil_desc *pil)
 {
 	return reset_q6_untrusted(&q6_lpass);
 }
 
-static int reset_modem_fw_q6_untrusted(struct pil_device *pil)
+static int reset_modem_fw_q6_untrusted(struct pil_desc *pil)
 {
 	return reset_q6_untrusted(&q6_modem_fw);
 }
 
-static int reset_modem_sw_q6_untrusted(struct pil_device *pil)
+static int reset_modem_sw_q6_untrusted(struct pil_desc *pil)
 {
 	return reset_q6_untrusted(&q6_modem_sw);
 }
@@ -395,17 +396,17 @@
 	return ret;
 }
 
-static int shutdown_lpass_q6_trusted(struct pil_device *pil)
+static int shutdown_lpass_q6_trusted(struct pil_desc *pil)
 {
 	return shutdown_q6_trusted(PAS_Q6, &q6_lpass);
 }
 
-static int shutdown_modem_fw_q6_trusted(struct pil_device *pil)
+static int shutdown_modem_fw_q6_trusted(struct pil_desc *pil)
 {
 	return shutdown_q6_trusted(PAS_MODEM_FW, &q6_modem_fw);
 }
 
-static int shutdown_modem_sw_q6_trusted(struct pil_device *pil)
+static int shutdown_modem_sw_q6_trusted(struct pil_desc *pil)
 {
 	return shutdown_q6_trusted(PAS_MODEM_SW, &q6_modem_sw);
 }
@@ -438,22 +439,22 @@
 	return 0;
 }
 
-static int shutdown_lpass_q6_untrusted(struct pil_device *pil)
+static int shutdown_lpass_q6_untrusted(struct pil_desc *pil)
 {
 	return shutdown_q6_untrusted(&q6_lpass);
 }
 
-static int shutdown_modem_fw_q6_untrusted(struct pil_device *pil)
+static int shutdown_modem_fw_q6_untrusted(struct pil_desc *pil)
 {
 	return shutdown_q6_untrusted(&q6_modem_fw);
 }
 
-static int shutdown_modem_sw_q6_untrusted(struct pil_device *pil)
+static int shutdown_modem_sw_q6_untrusted(struct pil_desc *pil)
 {
 	return shutdown_q6_untrusted(&q6_modem_sw);
 }
 
-static int init_image_riva_untrusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_riva_untrusted(struct pil_desc *pil, const u8 *metadata,
 				     size_t size)
 {
 	const struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -461,7 +462,7 @@
 	return 0;
 }
 
-static int reset_riva_untrusted(struct pil_device *pil)
+static int reset_riva_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 	bool xo;
@@ -552,7 +553,7 @@
 	return 0;
 }
 
-static int shutdown_riva_untrusted(struct pil_device *pil)
+static int shutdown_riva_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 	/* Put riva into reset */
@@ -562,23 +563,23 @@
 	return 0;
 }
 
-static int init_image_riva_trusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_riva_trusted(struct pil_desc *pil, const u8 *metadata,
 				   size_t size)
 {
 	return pas_init_image(PAS_RIVA, metadata, size);
 }
 
-static int reset_riva_trusted(struct pil_device *pil)
+static int reset_riva_trusted(struct pil_desc *pil)
 {
 	return pas_auth_and_reset(PAS_RIVA);
 }
 
-static int shutdown_riva_trusted(struct pil_device *pil)
+static int shutdown_riva_trusted(struct pil_desc *pil)
 {
 	return pas_shutdown(PAS_RIVA);
 }
 
-static int init_image_dsps_untrusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_dsps_untrusted(struct pil_desc *pil, const u8 *metadata,
 				     size_t size)
 {
 	/* Bring memory and bus interface out of reset */
@@ -587,7 +588,7 @@
 	return 0;
 }
 
-static int reset_dsps_untrusted(struct pil_device *pil)
+static int reset_dsps_untrusted(struct pil_desc *pil)
 {
 	writel_relaxed(0x10, PPSS_PROC_CLK_CTL);
 	/* Bring DSPS out of reset */
@@ -595,41 +596,41 @@
 	return 0;
 }
 
-static int shutdown_dsps_untrusted(struct pil_device *pil)
+static int shutdown_dsps_untrusted(struct pil_desc *pil)
 {
 	writel_relaxed(0x2, PPSS_RESET);
 	writel_relaxed(0x0, PPSS_PROC_CLK_CTL);
 	return 0;
 }
 
-static int init_image_dsps_trusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_dsps_trusted(struct pil_desc *pil, const u8 *metadata,
 				   size_t size)
 {
 	return pas_init_image(PAS_DSPS, metadata, size);
 }
 
-static int reset_dsps_trusted(struct pil_device *pil)
+static int reset_dsps_trusted(struct pil_desc *pil)
 {
 	return pas_auth_and_reset(PAS_DSPS);
 }
 
-static int shutdown_dsps_trusted(struct pil_device *pil)
+static int shutdown_dsps_trusted(struct pil_desc *pil)
 {
 	return pas_shutdown(PAS_DSPS);
 }
 
-static int init_image_tzapps(struct pil_device *pil, const u8 *metadata,
+static int init_image_tzapps(struct pil_desc *pil, const u8 *metadata,
 			     size_t size)
 {
 	return pas_init_image(PAS_TZAPPS, metadata, size);
 }
 
-static int reset_tzapps(struct pil_device *pil)
+static int reset_tzapps(struct pil_desc *pil)
 {
 	return pas_auth_and_reset(PAS_TZAPPS);
 }
 
-static int shutdown_tzapps(struct pil_device *pil)
+static int shutdown_tzapps(struct pil_desc *pil)
 {
 	return pas_shutdown(PAS_TZAPPS);
 }
@@ -676,59 +677,65 @@
 	.shutdown = shutdown_tzapps,
 };
 
-static struct pil_device pil_lpass_q6 = {
+static struct platform_device pil_lpass_q6 = {
+	.name = "pil_lpass_q6",
+};
+
+static struct pil_desc pil_lpass_q6_desc = {
 	.name = "q6",
-	.pdev = {
-		.name = "pil_lpass_q6",
-		.id = -1,
-	},
+	.dev = &pil_lpass_q6.dev,
 	.ops = &pil_lpass_q6_ops,
 };
 
-static struct pil_device pil_modem_fw_q6 = {
+static struct platform_device pil_modem_fw_q6 = {
+	.name = "pil_modem_fw_q6",
+};
+
+static struct pil_desc pil_modem_fw_q6_desc = {
 	.name = "modem_fw",
 	.depends_on = "q6",
-	.pdev = {
-		.name = "pil_modem_fw_q6",
-		.id = -1,
-	},
+	.dev = &pil_modem_fw_q6.dev,
 	.ops = &pil_modem_fw_q6_ops,
 };
 
-static struct pil_device pil_modem_sw_q6 = {
+static struct platform_device pil_modem_sw_q6 = {
+	.name = "pil_modem_sw_q6",
+};
+
+static struct pil_desc pil_modem_sw_q6_desc = {
 	.name = "modem",
 	.depends_on = "modem_fw",
-	.pdev = {
-		.name = "pil_modem_sw_q6",
-		.id = -1,
-	},
+	.dev = &pil_modem_sw_q6.dev,
 	.ops = &pil_modem_sw_q6_ops,
 };
 
-static struct pil_device pil_riva = {
+static struct platform_device pil_riva = {
+	.name = "pil_riva",
+};
+
+static struct pil_desc pil_riva_desc = {
 	.name = "wcnss",
-	.pdev = {
-		.name = "pil_riva",
-		.id = -1,
-	},
+	.dev = &pil_riva.dev,
 	.ops = &pil_riva_ops,
 };
 
-static struct pil_device pil_dsps = {
+static struct platform_device pil_dsps = {
+	.name = "pil_dsps",
+};
+
+static struct pil_desc pil_dsps_desc = {
 	.name = "dsps",
-	.pdev = {
-		.name = "pil_dsps",
-		.id = -1,
-	},
+	.dev = &pil_dsps.dev,
 	.ops = &pil_dsps_ops,
 };
 
-static struct pil_device pil_tzapps = {
+static struct platform_device pil_tzapps = {
+	.name = "pil_tzapps",
+};
+
+static struct pil_desc pil_tzapps_desc = {
 	.name = "tzapps",
-	.pdev = {
-		.name = "pil_tzapps",
-		.id = -1,
-	},
+	.dev = &pil_tzapps.dev,
 	.ops = &pil_tzapps_ops,
 };
 
@@ -807,7 +814,8 @@
 	err = q6_reset_init(&q6_lpass);
 	if (err)
 		return err;
-	msm_pil_add_device(&pil_lpass_q6);
+	BUG_ON(platform_device_register(&pil_lpass_q6));
+	BUG_ON(msm_pil_register(&pil_lpass_q6_desc));
 
 	mss_enable_reg = ioremap(MSM_MSS_ENABLE_PHYS, 4);
 	if (!mss_enable_reg)
@@ -818,20 +826,29 @@
 		iounmap(mss_enable_reg);
 		return err;
 	}
-	msm_pil_add_device(&pil_modem_fw_q6);
+	BUG_ON(platform_device_register(&pil_modem_fw_q6));
+	if (err) {
+		iounmap(mss_enable_reg);
+		return err;
+	}
+	BUG_ON(msm_pil_register(&pil_modem_fw_q6_desc));
 
 	err = q6_reset_init(&q6_modem_sw);
 	if (err)
 		return err;
-	msm_pil_add_device(&pil_modem_sw_q6);
+	BUG_ON(platform_device_register(&pil_modem_sw_q6));
+	BUG_ON(msm_pil_register(&pil_modem_sw_q6_desc));
 
-	msm_pil_add_device(&pil_dsps);
-	msm_pil_add_device(&pil_tzapps);
+	BUG_ON(platform_device_register(&pil_dsps));
+	BUG_ON(msm_pil_register(&pil_dsps_desc));
+	BUG_ON(platform_device_register(&pil_tzapps));
+	BUG_ON(msm_pil_register(&pil_tzapps_desc));
 
 	msm_riva_base = ioremap(MSM_RIVA_PHYS, SZ_256);
 	if (!msm_riva_base)
 		return -ENOMEM;
-	msm_pil_add_device(&pil_riva);
+	BUG_ON(platform_device_register(&pil_riva));
+	BUG_ON(msm_pil_register(&pil_riva_desc));
 
 	return 0;
 }
diff --git a/arch/arm/mach-msm/peripheral-reset.c b/arch/arm/mach-msm/peripheral-reset.c
index 5456e14..f3f5388 100644
--- a/arch/arm/mach-msm/peripheral-reset.c
+++ b/arch/arm/mach-msm/peripheral-reset.c
@@ -20,6 +20,9 @@
 #include <linux/clk.h>
 #include <linux/timer.h>
 #include <linux/jiffies.h>
+#include <linux/platform_device.h>
+
+#include <asm/mach-types.h>
 
 #include <mach/scm.h>
 #include <mach/msm_iomap.h>
@@ -68,13 +71,13 @@
 static void __iomem *msm_mms_regs_base;
 static void __iomem *msm_lpass_qdsp6ss_base;
 
-static int init_image_modem_trusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_modem_trusted(struct pil_desc *pil, const u8 *metadata,
 				    size_t size)
 {
 	return pas_init_image(PAS_MODEM, metadata, size);
 }
 
-static int init_image_modem_untrusted(struct pil_device *pil,
+static int init_image_modem_untrusted(struct pil_desc *pil,
 				      const u8 *metadata, size_t size)
 {
 	struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -82,13 +85,13 @@
 	return 0;
 }
 
-static int init_image_q6_trusted(struct pil_device *pil,
+static int init_image_q6_trusted(struct pil_desc *pil,
 				 const u8 *metadata, size_t size)
 {
 	return pas_init_image(PAS_Q6, metadata, size);
 }
 
-static int init_image_q6_untrusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_q6_untrusted(struct pil_desc *pil, const u8 *metadata,
 				   size_t size)
 {
 	struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -96,13 +99,13 @@
 	return 0;
 }
 
-static int init_image_dsps_trusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_dsps_trusted(struct pil_desc *pil, const u8 *metadata,
 				   size_t size)
 {
 	return pas_init_image(PAS_DSPS, metadata, size);
 }
 
-static int init_image_dsps_untrusted(struct pil_device *pil, const u8 *metadata,
+static int init_image_dsps_untrusted(struct pil_desc *pil, const u8 *metadata,
 				     size_t size)
 {
 	struct elf32_hdr *ehdr = (struct elf32_hdr *)metadata;
@@ -113,7 +116,7 @@
 	return 0;
 }
 
-static int verify_blob(struct pil_device *pil, u32 phy_addr, size_t size)
+static int verify_blob(struct pil_desc *pil, u32 phy_addr, size_t size)
 {
 	return 0;
 }
@@ -142,7 +145,7 @@
 		remove_modem_proxy_votes(0);
 }
 
-static int reset_modem_untrusted(struct pil_device *pil)
+static int reset_modem_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 
@@ -221,7 +224,7 @@
 	return 0;
 }
 
-static int reset_modem_trusted(struct pil_device *pil)
+static int reset_modem_trusted(struct pil_desc *pil)
 {
 	int ret;
 
@@ -234,7 +237,7 @@
 	return ret;
 }
 
-static int shutdown_modem_untrusted(struct pil_device *pil)
+static int shutdown_modem_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 
@@ -275,7 +278,7 @@
 	return 0;
 }
 
-static int shutdown_modem_trusted(struct pil_device *pil)
+static int shutdown_modem_trusted(struct pil_desc *pil)
 {
 	int ret;
 
@@ -343,7 +346,7 @@
 		remove_q6_proxy_votes(0);
 }
 
-static int reset_q6_untrusted(struct pil_device *pil)
+static int reset_q6_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 
@@ -389,14 +392,14 @@
 	return 0;
 }
 
-static int reset_q6_trusted(struct pil_device *pil)
+static int reset_q6_trusted(struct pil_desc *pil)
 {
 	make_q6_proxy_votes();
 
 	return pas_auth_and_reset(PAS_Q6);
 }
 
-static int shutdown_q6_untrusted(struct pil_device *pil)
+static int shutdown_q6_untrusted(struct pil_desc *pil)
 {
 	u32 reg;
 
@@ -423,7 +426,7 @@
 	return 0;
 }
 
-static int shutdown_q6_trusted(struct pil_device *pil)
+static int shutdown_q6_trusted(struct pil_desc *pil)
 {
 	int ret;
 
@@ -436,7 +439,7 @@
 	return 0;
 }
 
-static int reset_dsps_untrusted(struct pil_device *pil)
+static int reset_dsps_untrusted(struct pil_desc *pil)
 {
 	__raw_writel(0x10, PPSS_PROC_CLK_CTL);
 	while (__raw_readl(CLK_HALT_DFAB_STATE) & BIT(18))
@@ -447,35 +450,35 @@
 	return 0;
 }
 
-static int reset_dsps_trusted(struct pil_device *pil)
+static int reset_dsps_trusted(struct pil_desc *pil)
 {
 	return pas_auth_and_reset(PAS_DSPS);
 }
 
-static int shutdown_dsps_trusted(struct pil_device *pil)
+static int shutdown_dsps_trusted(struct pil_desc *pil)
 {
 	return pas_shutdown(PAS_DSPS);
 }
 
-static int shutdown_dsps_untrusted(struct pil_device *pil)
+static int shutdown_dsps_untrusted(struct pil_desc *pil)
 {
 	__raw_writel(0x2, PPSS_RESET);
 	__raw_writel(0x0, PPSS_PROC_CLK_CTL);
 	return 0;
 }
 
-static int init_image_playready(struct pil_device *pil, const u8 *metadata,
+static int init_image_playready(struct pil_desc *pil, const u8 *metadata,
 		size_t size)
 {
 	return pas_init_image(PAS_PLAYREADY, metadata, size);
 }
 
-static int reset_playready(struct pil_device *pil)
+static int reset_playready(struct pil_desc *pil)
 {
 	return pas_auth_and_reset(PAS_PLAYREADY);
 }
 
-static int shutdown_playready(struct pil_device *pil)
+static int shutdown_playready(struct pil_desc *pil)
 {
 	return pas_shutdown(PAS_PLAYREADY);
 }
@@ -508,47 +511,49 @@
 	.shutdown = shutdown_playready,
 };
 
-static struct pil_device peripherals[] = {
-	{
-		.name = "modem",
-		.depends_on = "q6",
-		.pdev = {
-			.name = "pil_modem",
-			.id = -1,
-		},
-		.ops = &pil_modem_ops,
-	},
-	{
-		.name = "q6",
-		.pdev = {
-			.name = "pil_q6",
-			.id = -1,
-		},
-		.ops = &pil_q6_ops,
-	},
-	{
-		.name = "tzapps",
-		.pdev = {
-			.name = "pil_playready",
-			.id = -1,
-		},
-		.ops = &pil_playready_ops,
-	},
+static struct platform_device pil_modem = {
+	.name = "pil_modem",
 };
 
-struct pil_device peripheral_dsps = {
+static struct pil_desc pil_modem_desc = {
+	.name = "modem",
+	.depends_on = "q6",
+	.dev = &pil_modem.dev,
+	.ops = &pil_modem_ops,
+};
+
+static struct platform_device pil_q6 = {
+	.name = "pil_q6",
+};
+
+static struct pil_desc pil_q6_desc = {
+	.name = "q6",
+	.dev = &pil_q6.dev,
+	.ops = &pil_q6_ops,
+};
+
+static struct platform_device pil_playready = {
+	.name = "pil_playready",
+};
+
+static struct pil_desc pil_playready_desc = {
+	.name = "tzapps",
+	.dev = &pil_playready.dev,
+	.ops = &pil_playready_ops,
+};
+
+static struct platform_device pil_dsps = {
+	.name = "pil_dsps",
+};
+
+static struct pil_desc pil_dsps_desc = {
 	.name = "dsps",
-	.pdev = {
-		.name = "pil_dsps",
-		.id = -1,
-	},
+	.dev = &pil_dsps.dev,
 	.ops = &pil_dsps_ops,
 };
 
 static int __init msm_peripheral_reset_init(void)
 {
-	unsigned i;
-
 	msm_mms_regs_base = ioremap(MSM_MMS_REGS_BASE, SZ_256);
 	if (!msm_mms_regs_base)
 		goto err;
@@ -583,8 +588,17 @@
 		pil_dsps_ops.shutdown = shutdown_dsps_trusted;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(peripherals); i++)
-		msm_pil_add_device(&peripherals[i]);
+	BUG_ON(platform_device_register(&pil_q6));
+	BUG_ON(msm_pil_register(&pil_q6_desc));
+	BUG_ON(platform_device_register(&pil_modem));
+	BUG_ON(msm_pil_register(&pil_modem_desc));
+	BUG_ON(platform_device_register(&pil_playready));
+	BUG_ON(msm_pil_register(&pil_playready_desc));
+
+	if (machine_is_msm8x60_fluid())
+		pil_dsps_desc.name = "dsps_fluid";
+	BUG_ON(platform_device_register(&pil_dsps));
+	BUG_ON(msm_pil_register(&pil_dsps_desc));
 
 	return 0;
 
diff --git a/arch/arm/mach-msm/qdsp5v2/audio_lpa.c b/arch/arm/mach-msm/qdsp5v2/audio_lpa.c
index 9baf521..c38fefc 100644
--- a/arch/arm/mach-msm/qdsp5v2/audio_lpa.c
+++ b/arch/arm/mach-msm/qdsp5v2/audio_lpa.c
@@ -603,16 +603,14 @@
 			temp = audio->bytecount_head;
 			used_buf = list_first_entry(&audio->out_queue,
 					struct audlpa_buffer_node, list);
-			if ((audio->bytecount_head + used_buf->buf.data_len) <
-				audio->bytecount_consumed) {
-				audio->bytecount_head += used_buf->buf.data_len;
-				temp = audio->bytecount_head;
-				list_del(&used_buf->list);
-				evt_payload.aio_buf = used_buf->buf;
-				audlpa_post_event(audio, AUDIO_EVENT_WRITE_DONE,
-						  evt_payload);
-				kfree(used_buf);
-			}
+
+			audio->bytecount_head += used_buf->buf.data_len;
+			temp = audio->bytecount_head;
+			list_del(&used_buf->list);
+			evt_payload.aio_buf = used_buf->buf;
+			audlpa_post_event(audio, AUDIO_EVENT_WRITE_DONE,
+					  evt_payload);
+			kfree(used_buf);
 			audio->drv_status &= ~ADRV_STATUS_OBUF_GIVEN;
 		}
 	}
diff --git a/arch/arm/mach-msm/sysmon.h b/arch/arm/mach-msm/sysmon.h
index 5fb75bc..429a155 100644
--- a/arch/arm/mach-msm/sysmon.h
+++ b/arch/arm/mach-msm/sysmon.h
@@ -17,6 +17,9 @@
 
 #include <mach/subsystem_notif.h>
 
+/**
+ * enum subsys_id - Destination subsystems for events.
+ */
 enum subsys_id {
 	SYSMON_SS_MODEM,
 	SYSMON_SS_LPASS,
@@ -26,6 +29,20 @@
 	SYSMON_NUM_SS
 };
 
+
+/**
+ * sysmon_send_event() - Notify a subsystem of another's state change.
+ * @dest_ss:	ID of subsystem the notification should be sent to.
+ * @event_ss:	String name of the subsystem that generated the notification.
+ * @notif:	ID of the notification type (ex. SUBSYS_BEFORE_SHUTDOWN)
+ *
+ * Returns 0 for success, -EINVAL for invalid destination or notification IDs,
+ * -ENODEV if the SMD channel is not open, -ETIMEDOUT if the destination
+ * subsystem does not respond, and -ENOSYS if the destination subsystem
+ * responds, but with something other than an acknowledgement.
+ *
+ * If CONFIG_MSM_SYSMON_COMM is not defined, always return success (0).
+ */
 #ifdef CONFIG_MSM_SYSMON_COMM
 int sysmon_send_event(enum subsys_id dest_ss, const char *event_ss,
 		      enum subsys_notif_type notif);
diff --git a/drivers/char/msm_rotator.c b/drivers/char/msm_rotator.c
index 555e4fa..bb31b6a 100644
--- a/drivers/char/msm_rotator.c
+++ b/drivers/char/msm_rotator.c
@@ -61,10 +61,6 @@
 #define MSM_ROTATOR_MAX_H	0x1fff
 #define MSM_ROTATOR_MAX_W	0x1fff
 
-#define IS_NONPLANAR		0x0
-#define IS_PLANAR		0x1
-#define IS_PLANAR_16ALIGNED	0x2
-
 /* from lsb to msb */
 #define GET_PACK_PATTERN(a, x, y, z, bit) \
 			(((a)<<((bit)*3))|((x)<<((bit)*2))|((y)<<(bit))|(z))
@@ -94,6 +90,15 @@
 	unsigned int row_tile_h; /* tiles per row's height */
 };
 
+struct msm_rotator_mem_planes {
+	unsigned int num_planes;
+	unsigned int plane_size[4];
+	unsigned int total_size;
+};
+
+#define checkoffset(offset, size, max_size) \
+	((size) > (max_size) || (offset) > ((max_size) - (size)))
+
 struct msm_rotator_dev {
 	void __iomem *io_base;
 	int irq;
@@ -120,8 +125,6 @@
 	wait_queue_head_t wq;
 };
 
-#define chroma_addr(start, w, h, bpp) ((start) + ((h) * (w) * (bpp)))
-
 #define COMPONENT_5BITS 1
 #define COMPONENT_6BITS 2
 #define COMPONENT_8BITS 3
@@ -246,6 +249,19 @@
 	return IRQ_HANDLED;
 }
 
+static unsigned int tile_size(unsigned int src_width,
+		unsigned int src_height,
+		const struct tile_parm *tp)
+{
+	unsigned int tile_w, tile_h;
+	unsigned int row_num_w, row_num_h;
+	tile_w = tp->width * tp->row_tile_w;
+	tile_h = tp->height * tp->row_tile_h;
+	row_num_w = (src_width + tile_w - 1) / tile_w;
+	row_num_h = (src_height + tile_h - 1) / tile_h;
+	return ((row_num_w * row_num_h * tile_w * tile_h) + 8191) & ~8191;
+}
+
 static int get_bpp(int format)
 {
 	switch (format) {
@@ -285,6 +301,81 @@
 
 }
 
+static int msm_rotator_get_plane_sizes(uint32_t format,	uint32_t w, uint32_t h,
+				       struct msm_rotator_mem_planes *p)
+{
+	/*
+	 * each row of samsung tile consists of two tiles in height
+	 * and two tiles in width which means width should align to
+	 * 64 x 2 bytes and height should align to 32 x 2 bytes.
+	 * video decoder generate two tiles in width and one tile
+	 * in height which ends up height align to 32 X 1 bytes.
+	 */
+	const struct tile_parm tile = {64, 32, 2, 1};
+	int i;
+
+	if (p == NULL)
+		return -EINVAL;
+
+	if ((w > MSM_ROTATOR_MAX_W) || (h > MSM_ROTATOR_MAX_H))
+		return -ERANGE;
+
+	memset(p, 0, sizeof(*p));
+
+	switch (format) {
+	case MDP_XRGB_8888:
+	case MDP_ARGB_8888:
+	case MDP_RGBA_8888:
+	case MDP_BGRA_8888:
+	case MDP_RGBX_8888:
+	case MDP_RGB_888:
+	case MDP_RGB_565:
+	case MDP_BGR_565:
+	case MDP_YCRYCB_H2V1:
+		p->num_planes = 1;
+		p->plane_size[0] = w * h * get_bpp(format);
+		break;
+	case MDP_Y_CRCB_H2V1:
+	case MDP_Y_CBCR_H2V1:
+		p->num_planes = 2;
+		p->plane_size[0] = w * h;
+		p->plane_size[1] = w * h;
+		break;
+	case MDP_Y_CBCR_H2V2:
+	case MDP_Y_CRCB_H2V2:
+		p->num_planes = 2;
+		p->plane_size[0] = w * h;
+		p->plane_size[1] = w * h / 2;
+		break;
+	case MDP_Y_CRCB_H2V2_TILE:
+	case MDP_Y_CBCR_H2V2_TILE:
+		p->num_planes = 2;
+		p->plane_size[0] = tile_size(w, h, &tile);
+		p->plane_size[1] = tile_size(w, h/2, &tile);
+		break;
+	case MDP_Y_CB_CR_H2V2:
+	case MDP_Y_CR_CB_H2V2:
+		p->num_planes = 3;
+		p->plane_size[0] = w * h;
+		p->plane_size[1] = (w / 2) * (h / 2);
+		p->plane_size[2] = (w / 2) * (h / 2);
+		break;
+	case MDP_Y_CR_CB_GH2V2:
+		p->num_planes = 3;
+		p->plane_size[0] = ALIGN(w, 16) * h;
+		p->plane_size[1] = ALIGN(w / 2, 16) * (h / 2);
+		p->plane_size[2] = ALIGN(w / 2, 16) * (h / 2);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	for (i = 0; i < p->num_planes; i++)
+		p->total_size += p->plane_size[i];
+
+	return 0;
+}
+
 static int msm_rotator_ycxcx_h2v1(struct msm_rotator_img_info *info,
 				  unsigned int in_paddr,
 				  unsigned int out_paddr,
@@ -294,7 +385,6 @@
 				  unsigned int out_chroma_paddr)
 {
 	int bpp;
-	unsigned int in_chr_addr, out_chr_addr;
 
 	if (info->src.format != info->dst.format)
 		return -EINVAL;
@@ -303,28 +393,12 @@
 	if (bpp < 0)
 		return -ENOTTY;
 
-	if (!in_chroma_paddr) {
-		in_chr_addr = chroma_addr(in_paddr, info->src.width,
-				info->src.height,
-				bpp);
-	} else
-		in_chr_addr = in_chroma_paddr;
-
-	if (!out_chroma_paddr) {
-		out_chr_addr = chroma_addr(out_paddr, info->dst.width,
-				info->dst.height,
-				bpp);
-	} else
-		out_chr_addr = out_chroma_paddr;
-
 	iowrite32(in_paddr, MSM_ROTATOR_SRCP0_ADDR);
-
-	iowrite32(in_paddr, MSM_ROTATOR_SRCP0_ADDR);
-	iowrite32(in_chr_addr, MSM_ROTATOR_SRCP1_ADDR);
+	iowrite32(in_chroma_paddr, MSM_ROTATOR_SRCP1_ADDR);
 	iowrite32(out_paddr +
 			((info->dst_y * info->dst.width) + info->dst_x),
 		  MSM_ROTATOR_OUTP0_ADDR);
-	iowrite32(out_chr_addr +
+	iowrite32(out_chroma_paddr +
 			((info->dst_y * info->dst.width) + info->dst_x),
 		  MSM_ROTATOR_OUTP1_ADDR);
 
@@ -380,60 +454,45 @@
 				  int new_session,
 				  unsigned int in_chroma_paddr,
 				  unsigned int out_chroma_paddr,
-				  int planar_mode)
+				  unsigned int in_chroma2_paddr)
 {
-	int bpp;
-	unsigned int in_chr_addr, out_chr_addr;
+	uint32_t dst_format;
+	int is_tile = 0;
 
-	bpp = get_bpp(info->src.format);
-	if (bpp < 0)
-		return -ENOTTY;
-
-	if (!in_chroma_paddr) {
-		if (planar_mode & IS_PLANAR_16ALIGNED)
-			in_chr_addr = chroma_addr(in_paddr,
-				ALIGN(info->src.width, 16),
-				info->src.height,
-				bpp);
-		else
-			in_chr_addr = chroma_addr(in_paddr, info->src.width,
-				info->src.height,
-				bpp);
-	} else
-		in_chr_addr = in_chroma_paddr;
-
-	if (!out_chroma_paddr) {
-		out_chr_addr = chroma_addr(out_paddr, info->dst.width,
-				info->dst.height,
-				bpp);
-	} else
-		out_chr_addr = out_chroma_paddr;
+	switch (info->src.format) {
+	case MDP_Y_CRCB_H2V2_TILE:
+		is_tile = 1;
+	case MDP_Y_CR_CB_H2V2:
+	case MDP_Y_CR_CB_GH2V2:
+	case MDP_Y_CRCB_H2V2:
+		dst_format = MDP_Y_CRCB_H2V2;
+		break;
+	case MDP_Y_CBCR_H2V2_TILE:
+		is_tile = 1;
+	case MDP_Y_CB_CR_H2V2:
+	case MDP_Y_CBCR_H2V2:
+		dst_format = MDP_Y_CBCR_H2V2;
+		break;
+	default:
+		return -EINVAL;
+	}
+	if (info->dst.format  != dst_format)
+		return -EINVAL;
 
 	iowrite32(in_paddr, MSM_ROTATOR_SRCP0_ADDR);
-	iowrite32(in_chr_addr,
-		  MSM_ROTATOR_SRCP1_ADDR);
+	iowrite32(in_chroma_paddr, MSM_ROTATOR_SRCP1_ADDR);
+	iowrite32(in_chroma2_paddr, MSM_ROTATOR_SRCP2_ADDR);
+
 	iowrite32(out_paddr +
 			((info->dst_y * info->dst.width) + info->dst_x),
 		  MSM_ROTATOR_OUTP0_ADDR);
-	iowrite32(out_chr_addr +
+	iowrite32(out_chroma_paddr +
 			((info->dst_y * info->dst.width)/2 + info->dst_x),
 		  MSM_ROTATOR_OUTP1_ADDR);
 
-	if (planar_mode & IS_PLANAR) {
-		if (planar_mode & IS_PLANAR_16ALIGNED)
-			iowrite32(in_chr_addr +
-				ALIGN((info->src.width / 2), 16) *
-				(info->src.height / 2),
-				MSM_ROTATOR_SRCP2_ADDR);
-		else
-			iowrite32(in_chr_addr +
-				(info->src.width / 2) * (info->src.height / 2),
-				MSM_ROTATOR_SRCP2_ADDR);
-	}
-
 	if (new_session) {
-		if (planar_mode & IS_PLANAR) {
-			if (planar_mode & IS_PLANAR_16ALIGNED) {
+		if (in_chroma2_paddr) {
+			if (info->src.format == MDP_Y_CR_CB_GH2V2) {
 				iowrite32(ALIGN(info->src.width, 16) |
 					ALIGN((info->src.width / 2), 16) << 16,
 					MSM_ROTATOR_SRC_YSTRIDE1);
@@ -455,8 +514,7 @@
 				info->dst.width << 16,
 				MSM_ROTATOR_OUT_YSTRIDE1);
 
-		if ((info->src.format == MDP_Y_CBCR_H2V2) ||
-		    (info->src.format == MDP_Y_CB_CR_H2V2)) {
+		if (dst_format == MDP_Y_CBCR_H2V2) {
 			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CB, CLR_CR, 8),
 				  MSM_ROTATOR_SRC_UNPACK_PATTERN1);
 			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CB, CLR_CR, 8),
@@ -471,118 +529,14 @@
 			  (ROTATIONS_TO_BITMASK(info->rotations) << 9) |
 			  1 << 8,      		/* ROT_EN */
 			  MSM_ROTATOR_SUB_BLOCK_CFG);
-		iowrite32(0 << 29 | 		/* frame format 0 = linear */
+
+		iowrite32((is_tile ? 2 : 0) << 29 |  /* frame format */
 			  (use_imem ? 0 : 1) << 22 | /* tile size */
-			  ((planar_mode & IS_PLANAR) ?
-				1 : 2) << 19 |  /* fetch planes */
+			  (in_chroma2_paddr ? 1 : 2) << 19 | /* fetch planes */
 			  0 << 18 | 		/* unpack align */
 			  1 << 17 | 		/* unpack tight */
 			  1 << 13 | 		/* unpack count 0=1 component */
-			  (bpp-1) << 9  |	/* src Bpp 0=1 byte ... */
-			  0 << 8  | 		/* has alpha */
-			  0 << 6  | 		/* alpha bits 3=8bits */
-			  3 << 4  | 		/* R/Cr bits 1=5 2=6 3=8 */
-			  3 << 2  | 		/* B/Cb bits 1=5 2=6 3=8 */
-			  3 << 0,   		/* G/Y  bits 1=5 2=6 3=8 */
-			  MSM_ROTATOR_SRC_FORMAT);
-	}
-	return 0;
-}
-
-static unsigned int tile_size(unsigned int src_width,
-		unsigned int src_height,
-		const struct tile_parm *tp)
-{
-	unsigned int tile_w, tile_h;
-	unsigned int row_num_w, row_num_h;
-	tile_w = tp->width * tp->row_tile_w;
-	tile_h = tp->height * tp->row_tile_h;
-	row_num_w = (src_width + tile_w - 1) / tile_w;
-	row_num_h = (src_height + tile_h - 1) / tile_h;
-	return ((row_num_w * row_num_h * tile_w * tile_h) + 8191) & ~8191;
-}
-
-static int msm_rotator_ycxcx_h2v2_tile(struct msm_rotator_img_info *info,
-				  unsigned int in_paddr,
-				  unsigned int out_paddr,
-				  unsigned int use_imem,
-				  int new_session,
-				  unsigned in_chroma_paddr,
-				  unsigned out_chroma_paddr)
-{
-	int bpp;
-	unsigned int offset = 0;
-	unsigned int in_chr_addr, out_chr_addr;
-	/*
-	 * each row of samsung tile consists of two tiles in height
-	 * and two tiles in width which means width should align to
-	 * 64 x 2 bytes and height should align to 32 x 2 bytes.
-	 * video decoder generate two tiles in width and one tile
-	 * in height which ends up height align to 32 X 1 bytes.
-	 */
-	const struct tile_parm tile = {64, 32, 2, 1};
-	if ((info->src.format == MDP_Y_CRCB_H2V2_TILE &&
-		info->dst.format != MDP_Y_CRCB_H2V2) ||
-		(info->src.format == MDP_Y_CBCR_H2V2_TILE &&
-		info->dst.format != MDP_Y_CBCR_H2V2))
-		return -EINVAL;
-
-	bpp = get_bpp(info->src.format);
-	if (bpp < 0)
-		return -ENOTTY;
-
-	offset = tile_size(info->src.width, info->src.height, &tile);
-	if (!in_chroma_paddr)
-		in_chr_addr = in_paddr + offset;
-	else
-		in_chr_addr = in_chroma_paddr;
-
-	if (!out_chroma_paddr) {
-		out_chr_addr = chroma_addr(out_paddr, info->dst.width,
-				info->dst.height,
-				bpp);
-	} else
-		out_chr_addr = out_chroma_paddr;
-
-	iowrite32(in_paddr, MSM_ROTATOR_SRCP0_ADDR);
-	iowrite32(in_paddr + offset, MSM_ROTATOR_SRCP1_ADDR);
-	iowrite32(out_paddr +
-			((info->dst_y * info->dst.width) + info->dst_x),
-		  MSM_ROTATOR_OUTP0_ADDR);
-	iowrite32(out_chr_addr +
-			((info->dst_y * info->dst.width)/2 + info->dst_x),
-		  MSM_ROTATOR_OUTP1_ADDR);
-
-	if (new_session) {
-		iowrite32(info->src.width |
-			  info->src.width << 16,
-			  MSM_ROTATOR_SRC_YSTRIDE1);
-
-		iowrite32(info->dst.width |
-			  info->dst.width << 16,
-			  MSM_ROTATOR_OUT_YSTRIDE1);
-		if (info->src.format == MDP_Y_CBCR_H2V2_TILE) {
-			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CB, CLR_CR, 8),
-				  MSM_ROTATOR_SRC_UNPACK_PATTERN1);
-			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CB, CLR_CR, 8),
-				  MSM_ROTATOR_OUT_PACK_PATTERN1);
-		} else {
-			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CR, CLR_CB, 8),
-				  MSM_ROTATOR_SRC_UNPACK_PATTERN1);
-			iowrite32(GET_PACK_PATTERN(0, 0, CLR_CR, CLR_CB, 8),
-				  MSM_ROTATOR_OUT_PACK_PATTERN1);
-		}
-		iowrite32((3  << 18) | 		/* chroma sampling 3=4:2:0 */
-			  (ROTATIONS_TO_BITMASK(info->rotations) << 9) |
-			  1 << 8,      		/* ROT_EN */
-			  MSM_ROTATOR_SUB_BLOCK_CFG);
-		iowrite32(2 << 29 | 		/* frame format 2 = supertile */
-			  (use_imem ? 0 : 1) << 22 | /* tile size */
-			  2 << 19 | 		/* fetch planes 2 = pseudo */
-			  0 << 18 | 		/* unpack align */
-			  1 << 17 | 		/* unpack tight */
-			  1 << 13 | 		/* unpack count 0=1 component */
-			  (bpp-1) << 9  |	/* src Bpp 0=1 byte ... */
+			  0 << 9  |		/* src Bpp 0=1 byte ... */
 			  0 << 8  | 		/* has alpha */
 			  0 << 6  | 		/* alpha bits 3=8bits */
 			  3 << 4  | 		/* R/Cr bits 1=5 2=6 3=8 */
@@ -796,7 +750,7 @@
 	unsigned int status;
 	struct msm_rotator_data_info info;
 	unsigned int in_paddr, out_paddr;
-	unsigned long len;
+	unsigned long src_len, dst_len;
 	struct file *src_file = 0;
 	struct file *dst_file = 0;
 	int use_imem = 0;
@@ -804,29 +758,14 @@
 	struct file *src_chroma_file = 0;
 	struct file *dst_chroma_file = 0;
 	unsigned int in_chroma_paddr = 0, out_chroma_paddr = 0;
+	unsigned int in_chroma2_paddr = 0;
 	uint32_t format;
+	struct msm_rotator_img_info *img_info;
+	struct msm_rotator_mem_planes src_planes, dst_planes;
 
 	if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
 		return -EFAULT;
 
-	rc = get_img(info.src.memory_id, (unsigned long *)&in_paddr,
-			(unsigned long *)&len, &src_file);
-	if (rc) {
-		printk(KERN_ERR "%s: in get_img() failed id=0x%08x\n",
-		       DRIVER_NAME, info.src.memory_id);
-		return rc;
-	}
-	in_paddr += info.src.offset;
-
-	rc = get_img(info.dst.memory_id, (unsigned long *)&out_paddr,
-			(unsigned long *)&len, &dst_file);
-	if (rc) {
-		printk(KERN_ERR "%s: out get_img() failed id=0x%08x\n",
-		       DRIVER_NAME, info.dst.memory_id);
-		goto do_rotate_fail_dst_img;
-	}
-	out_paddr += info.dst.offset;
-
 	mutex_lock(&msm_rotator_dev->rotator_lock);
 	for (s = 0; s < MAX_SESSIONS; s++)
 		if ((msm_rotator_dev->img_info[s] != NULL) &&
@@ -851,36 +790,128 @@
 		goto do_rotate_unlock_mutex;
 	}
 
+	img_info = msm_rotator_dev->img_info[s];
+	if (msm_rotator_get_plane_sizes(img_info->src.format,
+					img_info->src.width,
+					img_info->src.height,
+					&src_planes)) {
+		pr_err("%s: invalid src format\n", __func__);
+		rc = -EINVAL;
+		goto do_rotate_unlock_mutex;
+	}
+	if (msm_rotator_get_plane_sizes(img_info->dst.format,
+					img_info->dst.width,
+					img_info->dst.height,
+					&dst_planes)) {
+		pr_err("%s: invalid dst format\n", __func__);
+		rc = -EINVAL;
+		goto do_rotate_unlock_mutex;
+	}
+
+	rc = get_img(info.src.memory_id, (unsigned long *)&in_paddr,
+			(unsigned long *)&src_len, &src_file);
+	if (rc) {
+		pr_err("%s: in get_img() failed id=0x%08x\n",
+			DRIVER_NAME, info.src.memory_id);
+		goto do_rotate_unlock_mutex;
+	}
+
+	rc = get_img(info.dst.memory_id, (unsigned long *)&out_paddr,
+			(unsigned long *)&dst_len, &dst_file);
+	if (rc) {
+		pr_err("%s: out get_img() failed id=0x%08x\n",
+		       DRIVER_NAME, info.dst.memory_id);
+		goto do_rotate_unlock_mutex;
+	}
+
 	format = msm_rotator_dev->img_info[s]->src.format;
 	if (((info.version_key & VERSION_KEY_MASK) == 0xA5B4C300) &&
-		((info.version_key & ~VERSION_KEY_MASK) > 0) &&
-		 (format == MDP_Y_CBCR_H2V2 ||
-		  format == MDP_Y_CRCB_H2V2 ||
-		  format == MDP_Y_CRCB_H2V2_TILE ||
-		  format == MDP_Y_CBCR_H2V2_TILE ||
-		  format == MDP_Y_CBCR_H2V1 ||
-		  format == MDP_Y_CRCB_H2V1)) {
+			((info.version_key & ~VERSION_KEY_MASK) > 0) &&
+			(src_planes.num_planes == 2)) {
+		if (checkoffset(info.src.offset,
+				src_planes.plane_size[0],
+				src_len)) {
+			pr_err("%s: invalid src buffer (len=%lu offset=%x)\n",
+			       __func__, src_len, info.src.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
+		if (checkoffset(info.dst.offset,
+				dst_planes.plane_size[0],
+				dst_len)) {
+			pr_err("%s: invalid dst buffer (len=%lu offset=%x)\n",
+			       __func__, dst_len, info.dst.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
+
 		rc = get_img(info.src_chroma.memory_id,
 				(unsigned long *)&in_chroma_paddr,
-				(unsigned long *)&len, &src_chroma_file);
+				(unsigned long *)&src_len, &src_chroma_file);
 		if (rc) {
-			printk(KERN_ERR "%s: in chroma get_img() failed id=0x%08x\n",
+			pr_err("%s: in chroma get_img() failed id=0x%08x\n",
 				DRIVER_NAME, info.src_chroma.memory_id);
 			goto do_rotate_unlock_mutex;
 		}
-		in_chroma_paddr += info.src_chroma.offset;
 
 		rc = get_img(info.dst_chroma.memory_id,
 				(unsigned long *)&out_chroma_paddr,
-				(unsigned long *)&len, &dst_chroma_file);
+				(unsigned long *)&dst_len, &dst_chroma_file);
 		if (rc) {
-			printk(KERN_ERR "%s: out chroma get_img() failed id=0x%08x\n",
+			pr_err("%s: out chroma get_img() failed id=0x%08x\n",
 				DRIVER_NAME, info.dst_chroma.memory_id);
-			goto do_rotate_fail_dst_chr_img;
+			goto do_rotate_unlock_mutex;
 		}
+
+		if (checkoffset(info.src_chroma.offset,
+				src_planes.plane_size[1],
+				src_len)) {
+			pr_err("%s: invalid chr src buf len=%lu offset=%x\n",
+			       __func__, src_len, info.src_chroma.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
+
+		if (checkoffset(info.dst_chroma.offset,
+				src_planes.plane_size[1],
+				dst_len)) {
+			pr_err("%s: invalid chr dst buf len=%lu offset=%x\n",
+			       __func__, dst_len, info.dst_chroma.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
+
+		in_chroma_paddr += info.src_chroma.offset;
 		out_chroma_paddr += info.dst_chroma.offset;
+	} else {
+		if (checkoffset(info.src.offset,
+				src_planes.total_size,
+				src_len)) {
+			pr_err("%s: invalid src buffer (len=%lu offset=%x)\n",
+			       __func__, src_len, info.src.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
+		if (checkoffset(info.dst.offset,
+				dst_planes.total_size,
+				dst_len)) {
+			pr_err("%s: invalid dst buffer (len=%lu offset=%x)\n",
+			       __func__, dst_len, info.dst.offset);
+			rc = -ERANGE;
+			goto do_rotate_unlock_mutex;
+		}
 	}
 
+	in_paddr += info.src.offset;
+	out_paddr += info.dst.offset;
+
+	if (!in_chroma_paddr && src_planes.num_planes >= 2)
+		in_chroma_paddr = in_paddr + src_planes.plane_size[0];
+	if (!out_chroma_paddr && dst_planes.num_planes >= 2)
+		out_chroma_paddr = out_paddr + dst_planes.plane_size[0];
+	if (src_planes.num_planes >= 3)
+		in_chroma2_paddr = in_chroma_paddr + src_planes.plane_size[1];
+
 	cancel_delayed_work(&msm_rotator_dev->rot_clk_work);
 	if (msm_rotator_dev->rot_clk_state != CLK_EN) {
 		enable_rot_clks();
@@ -931,43 +962,19 @@
 		break;
 	case MDP_Y_CBCR_H2V2:
 	case MDP_Y_CRCB_H2V2:
-		rc = msm_rotator_ycxcx_h2v2(msm_rotator_dev->img_info[s],
-					    in_paddr, out_paddr, use_imem,
-					    msm_rotator_dev->last_session_idx
-								!= s,
-					    in_chroma_paddr,
-					    out_chroma_paddr,
-					    IS_NONPLANAR);
-		break;
 	case MDP_Y_CB_CR_H2V2:
 	case MDP_Y_CR_CB_H2V2:
-		rc = msm_rotator_ycxcx_h2v2(msm_rotator_dev->img_info[s],
-					    in_paddr, out_paddr, use_imem,
-					    msm_rotator_dev->last_session_idx
-								!= s,
-					    in_chroma_paddr,
-					    out_chroma_paddr,
-					    IS_PLANAR);
-		break;
 	case MDP_Y_CR_CB_GH2V2:
-		rc = msm_rotator_ycxcx_h2v2(msm_rotator_dev->img_info[s],
-					    in_paddr, out_paddr, use_imem,
-					    msm_rotator_dev->last_session_idx
-								!= s,
-					    in_chroma_paddr,
-					    out_chroma_paddr,
-					    IS_PLANAR | IS_PLANAR_16ALIGNED);
-		break;
 	case MDP_Y_CRCB_H2V2_TILE:
 	case MDP_Y_CBCR_H2V2_TILE:
-		rc = msm_rotator_ycxcx_h2v2_tile(msm_rotator_dev->img_info[s],
-				in_paddr, out_paddr, use_imem,
-				msm_rotator_dev->last_session_idx
-				!= s,
-				in_chroma_paddr,
-				out_chroma_paddr);
-	break;
-
+		rc = msm_rotator_ycxcx_h2v2(msm_rotator_dev->img_info[s],
+					    in_paddr, out_paddr, use_imem,
+					    msm_rotator_dev->last_session_idx
+								!= s,
+					    in_chroma_paddr,
+					    out_chroma_paddr,
+					    in_chroma2_paddr);
+		break;
 	case MDP_Y_CBCR_H2V1:
 	case MDP_Y_CRCB_H2V1:
 		rc = msm_rotator_ycxcx_h2v1(msm_rotator_dev->img_info[s],
@@ -1011,18 +1018,16 @@
 	msm_rotator_imem_free(ROTATOR_REQUEST);
 #endif
 	schedule_delayed_work(&msm_rotator_dev->rot_clk_work, HZ);
+do_rotate_unlock_mutex:
 	if (dst_chroma_file)
 		put_pmem_file(dst_chroma_file);
-do_rotate_fail_dst_chr_img:
 	if (src_chroma_file)
 		put_pmem_file(src_chroma_file);
-do_rotate_unlock_mutex:
-	mutex_unlock(&msm_rotator_dev->rotator_lock);
 	if (dst_file)
 		put_pmem_file(dst_file);
-do_rotate_fail_dst_img:
 	if (src_file)
 		put_pmem_file(src_file);
+	mutex_unlock(&msm_rotator_dev->rotator_lock);
 	dev_dbg(msm_rotator_dev->device, "%s() returning rc = %d\n",
 		__func__, rc);
 	return rc;
@@ -1034,25 +1039,28 @@
 	int rc = 0;
 	int s;
 	int first_free_index = INVALID_SESSION;
+	unsigned int dst_w, dst_h;
 
 	if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
 		return -EFAULT;
 
+	if (info.rotations & MDP_ROT_90) {
+		dst_w = info.src_rect.h;
+		dst_h = info.src_rect.w;
+	} else {
+		dst_w = info.src_rect.w;
+		dst_h = info.src_rect.h;
+	}
+
 	if ((info.rotations > MSM_ROTATOR_MAX_ROT) ||
 	    (info.src.height > MSM_ROTATOR_MAX_H) ||
 	    (info.src.width > MSM_ROTATOR_MAX_W) ||
 	    (info.dst.height > MSM_ROTATOR_MAX_H) ||
 	    (info.dst.width > MSM_ROTATOR_MAX_W) ||
-	    ((info.src_rect.x + info.src_rect.w) > info.src.width) ||
-	    ((info.src_rect.y + info.src_rect.h) > info.src.height) ||
-	    ((info.rotations & MDP_ROT_90) &&
-		((info.dst_x + info.src_rect.h) > info.dst.width)) ||
-	    ((info.rotations & MDP_ROT_90) &&
-		((info.dst_y + info.src_rect.w) > info.dst.height)) ||
-	    (!(info.rotations & MDP_ROT_90) &&
-		((info.dst_x + info.src_rect.w) > info.dst.width)) ||
-	    (!(info.rotations & MDP_ROT_90) &&
-		((info.dst_y + info.src_rect.h) > info.dst.height)))
+	    checkoffset(info.src_rect.x, info.src_rect.w, info.src.width) ||
+	    checkoffset(info.src_rect.y, info.src_rect.h, info.src.height) ||
+	    checkoffset(info.dst_x, dst_w, info.dst.width) ||
+	    checkoffset(info.dst_y, dst_h, info.dst.height))
 		return -EINVAL;
 
 	switch (info.src.format) {
diff --git a/drivers/input/keyboard/pmic8xxx-keypad.c b/drivers/input/keyboard/pmic8xxx-keypad.c
index f0629ce..0866332 100644
--- a/drivers/input/keyboard/pmic8xxx-keypad.c
+++ b/drivers/input/keyboard/pmic8xxx-keypad.c
@@ -710,9 +710,9 @@
 	return 0;
 
 err_pmic_reg_read:
-	free_irq(kp->key_stuck_irq, NULL);
+	free_irq(kp->key_stuck_irq, kp);
 err_req_stuck_irq:
-	free_irq(kp->key_sense_irq, NULL);
+	free_irq(kp->key_sense_irq, kp);
 err_gpio_config:
 err_get_irq:
 	input_free_device(kp->input);
@@ -727,8 +727,8 @@
 	struct pmic8xxx_kp *kp = platform_get_drvdata(pdev);
 
 	device_init_wakeup(&pdev->dev, 0);
-	free_irq(kp->key_stuck_irq, NULL);
-	free_irq(kp->key_sense_irq, NULL);
+	free_irq(kp->key_stuck_irq, kp);
+	free_irq(kp->key_sense_irq, kp);
 	input_unregister_device(kp->input);
 	kfree(kp);
 
diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c
index a86e049..8d58833 100644
--- a/drivers/usb/gadget/android.c
+++ b/drivers/usb/gadget/android.c
@@ -320,7 +320,7 @@
 		struct device *device, struct device_attribute *attr,
 		const char *buff, size_t size)
 {
-	strncpy(diag_clients, buff, sizeof(diag_clients));
+	strlcpy(diag_clients, buff, sizeof(diag_clients));
 
 	return size;
 }
@@ -348,7 +348,7 @@
 	int once = 0, err = -1;
 	int (*notify)(uint32_t, const char *) = NULL;
 
-	strncpy(buf, diag_clients, sizeof(buf));
+	strlcpy(buf, diag_clients, sizeof(buf));
 	b = strim(buf);
 
 	while (b) {
@@ -381,7 +381,7 @@
 		struct device *device, struct device_attribute *attr,
 		const char *buff, size_t size)
 {
-	strncpy(serial_transports, buff, sizeof(serial_transports));
+	strlcpy(serial_transports, buff, sizeof(serial_transports));
 
 	return size;
 }
@@ -407,7 +407,7 @@
 		goto bind_config;
 
 	serial_initialized = 1;
-	strncpy(buf, serial_transports, sizeof(buf));
+	strlcpy(buf, serial_transports, sizeof(buf));
 	b = strim(buf);
 
 	while (b) {
@@ -673,7 +673,7 @@
 {
 	struct android_usb_function *f = dev_get_drvdata(dev);
 	struct rndis_function_config *config = f->config;
-	return sprintf(buf, "%s\n", config->manufacturer);
+	return snprintf(buf, PAGE_SIZE, "%s\n", config->manufacturer);
 }
 
 static ssize_t rndis_manufacturer_store(struct device *dev,
@@ -684,7 +684,7 @@
 
 	if (size >= sizeof(config->manufacturer))
 		return -EINVAL;
-	if (sscanf(buf, "%s", config->manufacturer) == 1)
+	if (sscanf(buf, "%255s", config->manufacturer) == 1)
 		return size;
 	return -1;
 }
@@ -697,7 +697,7 @@
 {
 	struct android_usb_function *f = dev_get_drvdata(dev);
 	struct rndis_function_config *config = f->config;
-	return sprintf(buf, "%d\n", config->wceis);
+	return snprintf(buf, PAGE_SIZE, "%d\n", config->wceis);
 }
 
 static ssize_t rndis_wceis_store(struct device *dev,
@@ -722,7 +722,7 @@
 {
 	struct android_usb_function *f = dev_get_drvdata(dev);
 	struct rndis_function_config *rndis = f->config;
-	return sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
 		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
 		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
 }
@@ -749,7 +749,7 @@
 {
 	struct android_usb_function *f = dev_get_drvdata(dev);
 	struct rndis_function_config *config = f->config;
-	return sprintf(buf, "%04x\n", config->vendorID);
+	return snprintf(buf, PAGE_SIZE, "%04x\n", config->vendorID);
 }
 
 static ssize_t rndis_vendorID_store(struct device *dev,
@@ -844,7 +844,7 @@
 {
 	struct android_usb_function *f = dev_get_drvdata(dev);
 	struct mass_storage_function_config *config = f->config;
-	return sprintf(buf, "%s\n", config->common->inquiry_string);
+	return snprintf(buf, PAGE_SIZE, "%s\n", config->common->inquiry_string);
 }
 
 static ssize_t mass_storage_inquiry_store(struct device *dev,
@@ -854,7 +854,7 @@
 	struct mass_storage_function_config *config = f->config;
 	if (size >= sizeof(config->common->inquiry_string))
 		return -EINVAL;
-	if (sscanf(buf, "%s", config->common->inquiry_string) != 1)
+	if (sscanf(buf, "%28s", config->common->inquiry_string) != 1)
 		return -EINVAL;
 	return size;
 }
@@ -935,7 +935,7 @@
 	struct android_usb_function *f;
 	struct device_attribute **attrs;
 	struct device_attribute *attr;
-	int err;
+	int err = 0;
 	int index = 0;
 
 	for (; (f = *functions++); index++) {
@@ -1048,7 +1048,7 @@
 	char *buff = buf;
 
 	list_for_each_entry(f, &dev->enabled_functions, enabled_list)
-		buff += sprintf(buff, "%s,", f->name);
+		buff += snprintf(buff, PAGE_SIZE, "%s,", f->name);
 	if (buff != buf)
 		*(buff-1) = '\n';
 	return buff - buf;
@@ -1065,7 +1065,7 @@
 
 	INIT_LIST_HEAD(&dev->enabled_functions);
 
-	strncpy(buf, buff, sizeof(buf));
+	strlcpy(buf, buff, sizeof(buf));
 	b = strim(buf);
 
 	while (b) {
@@ -1084,7 +1084,7 @@
 			   char *buf)
 {
 	struct android_dev *dev = dev_get_drvdata(pdev);
-	return sprintf(buf, "%d\n", dev->enabled);
+	return snprintf(buf, PAGE_SIZE, "%d\n", dev->enabled);
 }
 
 static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
@@ -1138,7 +1138,7 @@
 		state = "CONNECTED";
 	spin_unlock_irqrestore(&cdev->lock, flags);
 out:
-	return sprintf(buf, "%s\n", state);
+	return snprintf(buf, PAGE_SIZE, "%s\n", state);
 }
 
 #define DESCRIPTOR_ATTR(field, format_string)				\
@@ -1146,7 +1146,8 @@
 field ## _show(struct device *dev, struct device_attribute *attr,	\
 		char *buf)						\
 {									\
-	return sprintf(buf, format_string, device_desc.field);		\
+	return snprintf(buf, PAGE_SIZE,					\
+			format_string, device_desc.field);		\
 }									\
 static ssize_t								\
 field ## _store(struct device *dev, struct device_attribute *attr,	\
@@ -1166,14 +1167,14 @@
 field ## _show(struct device *dev, struct device_attribute *attr,	\
 		char *buf)						\
 {									\
-	return sprintf(buf, "%s", buffer);				\
+	return snprintf(buf, PAGE_SIZE, "%s", buffer);			\
 }									\
 static ssize_t								\
 field ## _store(struct device *dev, struct device_attribute *attr,	\
 		const char *buf, size_t size)		       		\
 {									\
 	if (size >= sizeof(buffer)) return -EINVAL;			\
-	if (sscanf(buf, "%s", buffer) == 1) {			       	\
+	if (sscanf(buf, "%255s", buffer) == 1) {			\
 		return size;						\
 	}								\
 	return -1;							\
@@ -1261,9 +1262,10 @@
 	device_desc.iProduct = id;
 
 	/* Default strings - should be updated by userspace */
-	strncpy(manufacturer_string, "Android", sizeof(manufacturer_string) - 1);
-	strncpy(product_string, "Android", sizeof(product_string) - 1);
-	strncpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
+	strlcpy(manufacturer_string, "Android",
+		sizeof(manufacturer_string) - 1);
+	strlcpy(product_string, "Android", sizeof(product_string) - 1);
+	strlcpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
 
 	id = usb_string_id(cdev);
 	if (id < 0)
diff --git a/drivers/usb/gadget/f_rmnet.c b/drivers/usb/gadget/f_rmnet.c
index ebbd1d8..69f158a 100644
--- a/drivers/usb/gadget/f_rmnet.c
+++ b/drivers/usb/gadget/f_rmnet.c
@@ -701,6 +701,9 @@
 
 	f->descriptors = usb_copy_descriptors(rmnet_fs_function);
 
+	if (!f->descriptors)
+		goto fail;
+
 	dev->fs.in = usb_find_endpoint(rmnet_fs_function,
 					f->descriptors,
 					&rmnet_fs_in_desc);
@@ -722,6 +725,9 @@
 		/* copy descriptors, and track endpoint copies */
 		f->hs_descriptors = usb_copy_descriptors(rmnet_hs_function);
 
+		if (!f->hs_descriptors)
+			goto fail;
+
 		dev->hs.in = usb_find_endpoint(rmnet_hs_function,
 				f->hs_descriptors, &rmnet_hs_in_desc);
 		dev->hs.out = usb_find_endpoint(rmnet_hs_function,
@@ -737,6 +743,9 @@
 
 	return 0;
 
+fail:
+	if (f->descriptors)
+		usb_free_descriptors(f->descriptors);
 ep_notify_alloc_fail:
 	dev->notify->driver_data = NULL;
 	dev->notify = NULL;