diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 98352b5..193e08e 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -92,6 +92,14 @@
 		firmware = <&firmware>;
 		status = "okay";
 	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
 };
 
 &fb {
@@ -164,6 +172,16 @@
 		linux,default-trigger = "mmc0";
 		gpios = <&virtgpio 0 0>;
 	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&expgpio 7 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
 };
 
 &audio {
@@ -196,6 +214,10 @@
 		act_led_activelow = <&act_led>,"gpios:8";
 		act_led_trigger = <&act_led>,"linux,default-trigger";
 
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+
 		audio = <&audio>,"status";
 		watchdog = <&watchdog>,"status";
 		random = <&random>,"status";
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 7ceb16b..40f6066 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -66,6 +66,14 @@
 		firmware = <&firmware>;
 		status = "okay";
 	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
 };
 
 &fb {
@@ -129,7 +137,7 @@
 };
 
 &hdmi {
-	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
 };
 
 &audio {
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 783d2c2..6e7f1e6 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -624,6 +624,7 @@ CONFIG_PPS=m
 CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_BCM_EXP=y
 CONFIG_GPIO_BCM_VIRT=y
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 45e6729..f2eaf8b 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -127,6 +127,13 @@ config GPIO_AMDPT
 	  driver for GPIO functionality on Promontory IOHub
 	  Require ACPI ASL code to enumerate as a platform device.
 
+config GPIO_BCM_EXP
+	bool "Broadcom Exp GPIO"
+	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
+	help
+	  Turn on GPIO support for Broadcom chips using the firmware mailbox
+	  to communicate with VideoCore on BCM283x chips.
+
 config GPIO_BCM_KONA
 	bool "Broadcom Kona GPIO"
 	depends on OF_GPIO && (ARCH_BCM_MOBILE || COMPILE_TEST)
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index b2ccc9f..1270487 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_GPIO_AMD8111)	+= gpio-amd8111.o
 obj-$(CONFIG_GPIO_AMDPT)	+= gpio-amdpt.o
 obj-$(CONFIG_GPIO_ARIZONA)	+= gpio-arizona.o
 obj-$(CONFIG_ATH79)		+= gpio-ath79.o
+obj-$(CONFIG_GPIO_BCM_EXP)	+= gpio-bcm-exp.o
 obj-$(CONFIG_GPIO_BCM_KONA)	+= gpio-bcm-kona.o
 obj-$(CONFIG_GPIO_BCM_VIRT)	+= gpio-bcm-virt.o
 obj-$(CONFIG_GPIO_BRCMSTB)	+= gpio-brcmstb.o
diff --git a/drivers/gpio/gpio-bcm-exp.c b/drivers/gpio/gpio-bcm-exp.c
new file mode 100644
index 0000000..681a914
--- /dev/null
+++ b/drivers/gpio/gpio-bcm-exp.c
@@ -0,0 +1,256 @@
+/*
+ *  Broadcom expander GPIO driver
+ *
+ *  Uses the firmware mailbox service to communicate with the
+ *  GPIO expander on the VPU.
+ *
+ *  Copyright (C) 2017 Raspberry Pi Trading Ltd.
+ *
+ *  Author: Dave Stevenson <dave.stevenson@raspberrypi.org>
+ *  Based on gpio-bcm-virt.c by Dom Cobley <popcornmix@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MODULE_NAME "brcmexp-gpio"
+#define NUM_GPIO 8
+
+struct brcmexp_gpio {
+	struct gpio_chip gc;
+	struct device *dev;
+	struct rpi_firmware *fw;
+};
+
+struct gpio_set_config {
+	u32 gpio, direction, polarity, term_en, term_pull_up, state;
+};
+
+struct gpio_get_config {
+	u32 gpio, direction, polarity, term_en, term_pull_up;
+};
+
+struct gpio_get_set_state {
+	u32 gpio, state;
+};
+
+static int brcmexp_gpio_get_polarity(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_config get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
+				    &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u config (%d)\n", off, ret);
+		return ret;
+	}
+	return get.polarity;
+}
+
+static int brcmexp_gpio_dir_in(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_set_config set_in;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	set_in.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set_in.direction = 0;		/* Input */
+	set_in.polarity = brcmexp_gpio_get_polarity(gc, off);
+					/* Retain existing setting */
+	set_in.term_en = 0;		/* termination disabled */
+	set_in.term_pull_up = 0;	/* n/a as termination disabled */
+	set_in.state = 0;		/* n/a as configured as an input */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
+				    &set_in, sizeof(set_in));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u to input (%d)\n",
+			off, ret);
+		return ret;
+	}
+	return 0;
+}
+
+static int brcmexp_gpio_dir_out(struct gpio_chip *gc, unsigned int off, int val)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_set_config set_out;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	set_out.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set_out.direction = 1;		/* Output */
+	set_out.polarity = brcmexp_gpio_get_polarity(gc, off);
+					/* Retain existing setting */
+	set_out.term_en = 0;		/* n/a as an output */
+	set_out.term_pull_up = 0;	/* n/a as termination disabled */
+	set_out.state = val;		/* Output state */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
+				    &set_out, sizeof(set_out));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u to output (%d)\n", off, ret);
+		return ret;
+	}
+	return 0;
+}
+
+static int brcmexp_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_config get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
+				    &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u config (%d)\n", off, ret);
+		return ret;
+	}
+	return get.direction ? GPIOF_DIR_OUT : GPIOF_DIR_IN;
+}
+
+static int brcmexp_gpio_get(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_set_state get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+	get.state = 0;		/* storage for returned value */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_STATE,
+					 &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u state (%d)\n", off, ret);
+		return ret;
+	}
+	return !!get.state;
+}
+
+static void brcmexp_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_set_state set;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	off += gpio->gc.base;
+
+	set.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set.state = val;	/* Output state */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_STATE,
+					 &set, sizeof(set));
+	if (ret)
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u state (%d)\n", off, ret);
+}
+
+static int brcmexp_gpio_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	struct brcmexp_gpio *ucb;
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ucb = devm_kzalloc(dev, sizeof(*ucb), GFP_KERNEL);
+	if (!ucb)
+		return -EINVAL;
+
+	ucb->fw = fw;
+	ucb->dev = dev;
+	ucb->gc.label = MODULE_NAME;
+	ucb->gc.owner = THIS_MODULE;
+	ucb->gc.of_node = np;
+	ucb->gc.base = 128;
+	ucb->gc.ngpio = NUM_GPIO;
+
+	ucb->gc.direction_input = brcmexp_gpio_dir_in;
+	ucb->gc.direction_output = brcmexp_gpio_dir_out;
+	ucb->gc.get_direction = brcmexp_gpio_get_direction;
+	ucb->gc.get = brcmexp_gpio_get;
+	ucb->gc.set = brcmexp_gpio_set;
+	ucb->gc.can_sleep = true;
+
+	err = gpiochip_add(&ucb->gc);
+	if (err)
+		return err;
+
+	platform_set_drvdata(pdev, ucb);
+
+	return 0;
+}
+
+static int brcmexp_gpio_remove(struct platform_device *pdev)
+{
+	struct brcmexp_gpio *ucb = platform_get_drvdata(pdev);
+
+	gpiochip_remove(&ucb->gc);
+
+	return 0;
+}
+
+static const struct of_device_id __maybe_unused brcmexp_gpio_ids[] = {
+	{ .compatible = "brcm,bcm2835-expgpio" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, brcmexp_gpio_ids);
+
+static struct platform_driver brcmexp_gpio_driver = {
+	.driver	= {
+		.name		= MODULE_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= of_match_ptr(brcmexp_gpio_ids),
+	},
+	.probe	= brcmexp_gpio_probe,
+	.remove	= brcmexp_gpio_remove,
+};
+module_platform_driver(brcmexp_gpio_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.org>");
+MODULE_DESCRIPTION("brcm-exp GPIO driver");
+MODULE_ALIAS("platform:brcmexp-gpio");
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 2859db0..56b3f0f 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -83,7 +83,11 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_SET_TURBO =                              0x00038009,
 	RPI_FIRMWARE_SET_CUSTOMER_OTP =                       0x00038021,
 	RPI_FIRMWARE_SET_DOMAIN_STATE =                       0x00038030,
+	RPI_FIRMWARE_GET_GPIO_STATE =                         0x00030041,
+	RPI_FIRMWARE_SET_GPIO_STATE =                         0x00038041,
 	RPI_FIRMWARE_SET_SDHOST_CLOCK =                       0x00038042,
+	RPI_FIRMWARE_GET_GPIO_CONFIG =                        0x00030043,
+	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
 
 	/* Dispmanx TAGS */
 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
