Merge rsync://rsync.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

48 files changed, 2235 insertions, 1403 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 889cad07774e..402296670d3a 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -805,10 +805,6 @@ config S3C2410_RTC
           Samsung S3C2410. This can provide periodic interrupt rates
           from 1Hz to 64Hz for user programs, and wakeup from Alarm.
 
-config RTC_VR41XX
-        tristate "NEC VR4100 series Real Time Clock Support"
-        depends on CPU_VR41XX
-
 config COBALT_LCD
         bool "Support for Cobalt LCD"
         depends on MIPS_COBALT
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index a73cb4956928..f5b01c6d498e 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -67,7 +67,6 @@ obj-$(CONFIG_SGI_DS1286)	+= ds1286.o
 obj-$(CONFIG_SGI_IP27_RTC)      += ip27-rtc.o
 obj-$(CONFIG_DS1302)            += ds1302.o
 obj-$(CONFIG_S3C2410_RTC)       += s3c2410-rtc.o
-obj-$(CONFIG_RTC_VR41XX)        += vr41xx_rtc.o
 ifeq ($(CONFIG_GENERIC_NVRAM),y)
   obj-$(CONFIG_NVRAM)   += generic_nvram.o
 else
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index fed0a87448d8..86a966b65236 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -64,6 +64,12 @@ static struct gatt_mask efficeon_generic_masks[] =
         {.mask = 0x00000001, .type = 0}
 };
 
+/* This function does the same thing as mask_memory() for this chipset... */
+static inline unsigned long efficeon_mask_memory(unsigned long addr)
+{
+        return addr | 0x00000001;
+}
+
 static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
 {
         {256, 65536, 0},
@@ -251,7 +257,7 @@ static int efficeon_insert_memory(struct agp_memory * mem, off_t pg_start, int t
         last_page = NULL;
         for (i = 0; i < count; i++) {
                 int index = pg_start + i;
-                unsigned long insert = mem->memory[i];
+                unsigned long insert = efficeon_mask_memory(mem->memory[i]);
 
                 page = (unsigned int *) efficeon_private.l1_table[index >> 10];
 
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 927a5bbe112c..a370e7a0bad5 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -142,7 +142,7 @@ static int ac_register_board(unsigned long physloc, void __iomem *loc,
         if (!boardno)
                 boardno = readb(loc + NUMCARD_OWNER_TO_PC);
 
-        if (!boardno && boardno > MAX_BOARD) {
+        if (!boardno || boardno > MAX_BOARD) {
                 printk(KERN_WARNING "Board #%d (at 0x%lx) is out of range (1 <= x <= %d).\n",
                        boardno, physloc, MAX_BOARD);
                 return 0;
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 5d72f50de1ac..46d66037b917 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
         dev_t dev_id = MKDEV(major, 0);
+
+        cdev_del(&cs5535_gpio_cdev);
         unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-        if (gpio_base != 0)
-                release_region(gpio_base, CS5535_GPIO_SIZE);
+        release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(cs5535_gpio_init);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index edc72a6348a7..cb76e5ca9a23 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -815,8 +815,6 @@ extern int drm_mem_info(char *buf, char **start, off_t offset,
 extern void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area);
 extern void *drm_ioremap(unsigned long offset, unsigned long size,
                          drm_device_t * dev);
-extern void *drm_ioremap_nocache(unsigned long offset, unsigned long size,
-                                 drm_device_t * dev);
 extern void drm_ioremapfree(void *pt, unsigned long size, drm_device_t * dev);
 
 extern DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type);
@@ -891,7 +889,6 @@ extern int drm_lock_free(drm_device_t * dev,
                                 /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
-extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                       unsigned int size, drm_map_type_t type,
                       drm_map_flags_t flags, drm_local_map_t ** map_ptr);
@@ -1022,11 +1019,13 @@ static __inline__ void drm_core_ioremap(struct drm_map *map,
         map->handle = drm_ioremap(map->offset, map->size, dev);
 }
 
+#if 0
 static __inline__ void drm_core_ioremap_nocache(struct drm_map *map,
                                                 struct drm_device *dev)
 {
         map->handle = drm_ioremap_nocache(map->offset, map->size, dev);
 }
+#endif  /*  0  */
 
 static __inline__ void drm_core_ioremapfree(struct drm_map *map,
                                             struct drm_device *dev)
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index fabc930c67a2..40bfd9b01e39 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -503,8 +503,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start)
         return agp_bind_memory(handle, start);
 }
 
-EXPORT_SYMBOL(drm_agp_bind_memory);
-
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM * handle)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 8a9cf12e6183..006b06d29727 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -386,7 +386,6 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         return 0;
 }
-EXPORT_SYMBOL(drm_rmmap_locked);
 
 int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
@@ -398,7 +397,6 @@ int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 
         return ret;
 }
-EXPORT_SYMBOL(drm_rmmap);
 
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
  * the last close of the device, and this is necessary for cleanup when things
@@ -1053,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
         return 0;
 }
 
-int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
         drm_device_dma_t *dma = dev->dma;
         drm_buf_entry_t *entry;
@@ -1212,7 +1210,6 @@ int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
         atomic_dec(&dev->buf_alloc);
         return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_fb);
 
 
 /**
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index dc6bbe8a18dc..3c0b882a8e72 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -75,8 +75,8 @@ static drm_ioctl_desc_t drm_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = {drm_setsareactx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = {drm_getsareactx, DRM_AUTH},
 
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)] = {drm_modctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)] = {drm_getctx, DRM_AUTH},
         [DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)] = {drm_switchctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index dddf8de66143..7e3318e1d1c6 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -80,6 +80,71 @@ void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
 }
 
 #if __OS_HAS_AGP
+/*
+ * Find the drm_map that covers the range [offset, offset+size).
+ */
+static drm_map_t *drm_lookup_map(unsigned long offset,
+                                 unsigned long size, drm_device_t * dev)
+{
+        struct list_head *list;
+        drm_map_list_t *r_list;
+        drm_map_t *map;
+
+        list_for_each(list, &dev->maplist->head) {
+                r_list = (drm_map_list_t *) list;
+                map = r_list->map;
+                if (!map)
+                        continue;
+                if (map->offset <= offset
+                    && (offset + size) <= (map->offset + map->size))
+                        return map;
+        }
+        return NULL;
+}
+
+static void *agp_remap(unsigned long offset, unsigned long size,
+                       drm_device_t * dev)
+{
+        unsigned long *phys_addr_map, i, num_pages =
+            PAGE_ALIGN(size) / PAGE_SIZE;
+        struct drm_agp_mem *agpmem;
+        struct page **page_map;
+        void *addr;
+
+        size = PAGE_ALIGN(size);
+
+#ifdef __alpha__
+        offset -= dev->hose->mem_space->start;
+#endif
+
+        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
+                if (agpmem->bound <= offset
+                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
+                    (offset + size))
+                        break;
+        if (!agpmem)
+                return NULL;
+
+        /*
+         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
+         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
+         * page-table instead (that's probably faster anyhow...).
+         */
+        /* note: use vmalloc() because num_pages could be large... */
+        page_map = vmalloc(num_pages * sizeof(struct page *));
+        if (!page_map)
+                return NULL;
+
+        phys_addr_map =
+            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
+        for (i = 0; i < num_pages; ++i)
+                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
+        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
+        vfree(page_map);
+
+        return addr;
+}
+
 /** Wrapper around agp_allocate_memory() */
 DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type)
 {
@@ -103,5 +168,74 @@ int drm_unbind_agp(DRM_AGP_MEM * handle)
 {
         return drm_agp_unbind_memory(handle);
 }
+
+#else  /*  __OS_HAS_AGP  */
+
+static inline drm_map_t *drm_lookup_map(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        return NULL;
+}
+
+static inline void *agp_remap(unsigned long offset, unsigned long size,
+                              drm_device_t * dev)
+{
+        return NULL;
+}
+
 #endif                          /* agp */
+
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap(offset, size);
+}
+EXPORT_SYMBOL(drm_ioremap);
+
+#if 0
+void *drm_ioremap_nocache(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap_nocache(offset, size);
+}
+#endif  /*  0  */
+
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev)
+{
+        /*
+         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
+         * routines for handling mappings in the AGP space.  Hopefully this can be done in
+         * a future revision of the interface...
+         */
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
+            && ((unsigned long)pt >= VMALLOC_START
+                && (unsigned long)pt < VMALLOC_END)) {
+                unsigned long offset;
+                drm_map_t *map;
+
+                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
+                map = drm_lookup_map(offset, size, dev);
+                if (map && map->type == _DRM_AGP) {
+                        vunmap(pt);
+                        return;
+                }
+        }
+
+        iounmap(pt);
+}
+EXPORT_SYMBOL(drm_ioremapfree);
+
 #endif                          /* debug_memory */
diff --git a/drivers/char/drm/drm_memory.h b/drivers/char/drm/drm_memory.h
index 3732a61c3762..714d9aedcff5 100644
--- a/drivers/char/drm/drm_memory.h
+++ b/drivers/char/drm/drm_memory.h
@@ -57,71 +57,6 @@
 # endif
 #endif
 
-/*
- * Find the drm_map that covers the range [offset, offset+size).
- */
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        struct list_head *list;
-        drm_map_list_t *r_list;
-        drm_map_t *map;
-
-        list_for_each(list, &dev->maplist->head) {
-                r_list = (drm_map_list_t *) list;
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (map->offset <= offset
-                    && (offset + size) <= (map->offset + map->size))
-                        return map;
-        }
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        unsigned long *phys_addr_map, i, num_pages =
-            PAGE_ALIGN(size) / PAGE_SIZE;
-        struct drm_agp_mem *agpmem;
-        struct page **page_map;
-        void *addr;
-
-        size = PAGE_ALIGN(size);
-
-#ifdef __alpha__
-        offset -= dev->hose->mem_space->start;
-#endif
-
-        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
-                if (agpmem->bound <= offset
-                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
-                    (offset + size))
-                        break;
-        if (!agpmem)
-                return NULL;
-
-        /*
-         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
-         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
-         * page-table instead (that's probably faster anyhow...).
-         */
-        /* note: use vmalloc() because num_pages could be large... */
-        page_map = vmalloc(num_pages * sizeof(struct page *));
-        if (!page_map)
-                return NULL;
-
-        phys_addr_map =
-            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
-        for (i = 0; i < num_pages; ++i)
-                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
-        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
-        vfree(page_map);
-
-        return addr;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         pgd_t *pgd = pgd_offset_k((unsigned long)vaddr);
@@ -133,18 +68,6 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #else                           /* __OS_HAS_AGP */
 
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        return NULL;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         return 0;
@@ -152,51 +75,8 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #endif
 
-static inline void *drm_ioremap(unsigned long offset, unsigned long size,
-                                drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap(offset, size);
-}
-
-static inline void *drm_ioremap_nocache(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap_nocache(offset, size);
-}
-
-static inline void drm_ioremapfree(void *pt, unsigned long size,
-                                   drm_device_t * dev)
-{
-        /*
-         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
-         * routines for handling mappings in the AGP space.  Hopefully this can be done in
-         * a future revision of the interface...
-         */
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
-            && ((unsigned long)pt >= VMALLOC_START
-                && (unsigned long)pt < VMALLOC_END)) {
-                unsigned long offset;
-                drm_map_t *map;
-
-                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
-                map = drm_lookup_map(offset, size, dev);
-                if (map && map->type == _DRM_AGP) {
-                        vunmap(pt);
-                        return;
-                }
-        }
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev);
 
-        iounmap(pt);
-}
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev);
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index 7868341817da..6543b9a14c42 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -229,6 +229,7 @@ void *drm_ioremap (unsigned long offset, unsigned long size,
         return pt;
 }
 
+#if 0
 void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
                             drm_device_t * dev) {
         void *pt;
@@ -251,6 +252,7 @@ void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
         spin_unlock(&drm_mem_lock);
         return pt;
 }
+#endif  /*  0  */
 
 void drm_ioremapfree (void *pt, unsigned long size, drm_device_t * dev) {
         int alloc_count;
diff --git a/drivers/char/drm/drm_pci.c b/drivers/char/drm/drm_pci.c
index b28ca9cea8a2..86a0f1c22091 100644
--- a/drivers/char/drm/drm_pci.c
+++ b/drivers/char/drm/drm_pci.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include "drmP.h"
 
 /**********************************************************************/
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 68073e14fdec..9a842a36bb27 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -229,8 +229,6 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         return ret;
 }
 
-EXPORT_SYMBOL(drm_get_dev);
-
 /**
  * Put a device minor number.
  *
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index b108c7f913b2..26bdf2ca59d7 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -723,7 +723,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
         
         dev_priv->scratch_ages[header.scratch.reg]++;
         
-        ref_age_base = *(u32 **)cmdbuf->buf;
+        ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
         
         cmdbuf->buf += sizeof(u64);
         cmdbuf->bufsz -= sizeof(u64);
diff --git a/drivers/char/drm/via_irq.c b/drivers/char/drm/via_irq.c
index 6152415644e9..c33d068cde19 100644
--- a/drivers/char/drm/via_irq.c
+++ b/drivers/char/drm/via_irq.c
@@ -196,9 +196,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         unsigned int cur_irq_sequence;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int ret = 0;
-        maskarray_t *masks = dev_priv->irq_masks;
+        maskarray_t *masks;
         int real_irq;
 
         DRM_DEBUG("%s\n", __FUNCTION__);
@@ -221,8 +221,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
                           __FUNCTION__, irq);
                 return DRM_ERR(EINVAL);
         }
-        
-        cur_irq += real_irq;
+
+        masks = dev_priv->irq_masks;
+        cur_irq = dev_priv->via_irqs + real_irq;
 
         if (masks[real_irq][2] && !force_sequence) {
                 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
@@ -247,11 +248,12 @@ void via_driver_irq_preinstall(drm_device_t * dev)
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         u32 status;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int i;
 
         DRM_DEBUG("driver_irq_preinstall: dev_priv: %p\n", dev_priv);
         if (dev_priv) {
+                cur_irq = dev_priv->via_irqs;
 
                 dev_priv->irq_enable_mask = VIA_IRQ_VBLANK_ENABLE;
                 dev_priv->irq_pending_mask = VIA_IRQ_VBLANK_PENDING;
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index a229915ce1b2..87dcaa237f07 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -490,7 +490,7 @@ for (i = 0; i < 10; i++)			\
                 release_region(dtlk_portlist[i], DTLK_IO_EXTENT);
         }
 
-        printk(KERN_INFO "\nDoubleTalk PC - not found\n");
+        printk(KERN_INFO "DoubleTalk PC - not found\n");
         return -ENODEV;
 }
 
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 327b00c3c45e..8d97b3911293 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -904,7 +904,7 @@ static int hvcs_enable_device(struct hvcs_struct *hvcsd, uint32_t unit_address,
                  * It is possible the vty-server was removed after the irq was
                  * requested but before we have time to enable interrupts.
                  */
-                if (vio_enable_interrupts(vdev) == H_Success)
+                if (vio_enable_interrupts(vdev) == H_SUCCESS)
                         return 0;
                 else {
                         printk(KERN_ERR "HVCS: int enable failed for"
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 58dcdee1cd71..0030cd8e2e95 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct si_sm_data *bt,
 {
         unsigned int i;
 
-        if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+        if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
                return -1;
 
         if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0ded046d5aa8..9f2f8fdec69a 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -941,6 +941,7 @@ int ipmi_set_gets_events(ipmi_user_t user, int val)
                         list_del(&msg->link);
                         list_add_tail(&msg->link, &msgs);
                 }
+                intf->waiting_events_count = 0;
         }
 
         /* Hold the events lock while doing this to preserve order. */
@@ -2916,6 +2917,7 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
 
                 copy_event_into_recv_msg(recv_msg, msg);
                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
+                intf->waiting_events_count++;
         } else {
                 /* There's too many things in the queue, discard this
                    message. */
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index a86c0f29953e..b36eef0e9d19 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2198,11 +2198,11 @@ static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
         }
 }
 
-static struct ipmi_default_vals
+static __devinitdata struct ipmi_default_vals
 {
         int type;
         int port;
-} __devinit ipmi_defaults[] =
+} ipmi_defaults[] =
 {
         { .type = SI_KCS, .port = 0xca2 },
         { .type = SI_SMIC, .port = 0xca9 },
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 66719f9d294c..1fa9fa157c12 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,6 +27,7 @@
 #include <linux/crash_dump.h>
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -578,6 +579,18 @@ static ssize_t write_null(struct file * file, const char __user * buf,
         return count;
 }
 
+static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
+                        struct splice_desc *sd)
+{
+        return sd->len;
+}
+
+static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
+}
+
 #ifdef CONFIG_MMU
 /*
  * For fun, we are using the MMU for this.
@@ -785,6 +798,7 @@ static struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
+        .splice_write   = splice_write_null,
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index 8666171e187b..d3ba2f860ef0 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
         
-                        if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+                        if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {
                                 PRINTK_ERROR(KERN_ERR_MWAVE
                                                 "mwavedd::mwave_ioctl:"
                                                 " IOCTL_MW_REGISTER_IPC:"
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 5fdf18515433..02114a0bd0d9 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -46,7 +46,7 @@
 /* #define ATR_CSUM */
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -67,7 +67,7 @@ static char *version = "cm4000_cs.c v2.4.0gm6 - All bugs added by Harald Welte";
 #define T_100MSEC       msecs_to_jiffies(100)
 #define T_500MSEC       msecs_to_jiffies(500)
 
-static void cm4000_release(dev_link_t *link);
+static void cm4000_release(struct pcmcia_device *link);
 
 static int major;               /* major number we get from the kernel */
 
@@ -106,7 +106,7 @@ static int major;		/* major number we get from the kernel */
 #define REG_STOPBITS(x)         (x + 7)
 
 struct cm4000_dev {
-        dev_link_t link;                /* pcmcia link */
+        struct pcmcia_device *p_dev;
         dev_node_t node;                /* OS node (major,minor) */
 
         unsigned char atr[MAX_ATR];
@@ -149,14 +149,14 @@ struct cm4000_dev {
 #define ZERO_DEV(dev)                                           \
         memset(&dev->atr_csum,0,                                \
                 sizeof(struct cm4000_dev) -                     \
-                /*link*/ sizeof(dev_link_t) -                   \
+                /*link*/ sizeof(struct pcmcia_device) -         \
                 /*node*/ sizeof(dev_node_t) -                   \
                 /*atr*/ MAX_ATR*sizeof(char) -                  \
                 /*rbuf*/ 512*sizeof(char) -                     \
                 /*sbuf*/ 512*sizeof(char) -                     \
                 /*queue*/ 4*sizeof(wait_queue_head_t))
 
-static dev_link_t *dev_table[CM4000_MAX_DEV];
+static struct pcmcia_device *dev_table[CM4000_MAX_DEV];
 static struct class *cmm_class;
 
 /* This table doesn't use spaces after the comma between fields and thus
@@ -454,7 +454,7 @@ static struct card_fixup card_fixups[] = {
 static void set_cardparameter(struct cm4000_dev *dev)
 {
         int i;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         u_int8_t stopbits = 0x02; /* ISO default */
 
         DEBUGP(3, dev, "-> set_cardparameter\n");
@@ -487,7 +487,7 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
         unsigned short num_bytes_read;
         unsigned char pts_reply[4];
         ssize_t rc;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
 
         rc = 0;
 
@@ -699,7 +699,7 @@ static void terminate_monitor(struct cm4000_dev *dev)
 static void monitor_card(unsigned long p)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) p;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         struct ptsreq ptsreq;
         int i, atrc;
@@ -962,7 +962,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
                         loff_t *ppos)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i, j, k;
 
@@ -971,7 +971,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
         if (count == 0)         /* according to manpage */
                 return 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1083,7 +1083,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         unsigned char tmp;
         unsigned char infolen;
@@ -1108,7 +1108,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
 
         sendT0 = dev->proto ? 0 : nr > 5 ? 0x08 : 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1440,8 +1440,8 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                      unsigned long arg)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
-        dev_link_t *link;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
+        struct pcmcia_device *link;
         int size;
         int rc;
         void __user *argp = (void __user *)arg;
@@ -1458,7 +1458,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                iminor(inode), ioctl_names[_IOC_NR(cmd)]);
 
         link = dev_table[iminor(inode)];
-        if (!(DEV_OK(link))) {
+        if (!pcmcia_dev_present(link)) {
                 DEBUGP(4, dev, "DEV_OK false\n");
                 return -ENODEV;
         }
@@ -1660,14 +1660,14 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
 static int cmm_open(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int rc, minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -1709,7 +1709,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
 static int cmm_close(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
@@ -1735,7 +1735,7 @@ static int cmm_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cmm_cm4000_release(dev_link_t * link)
+static void cmm_cm4000_release(struct pcmcia_device * link)
 {
         struct cm4000_dev *dev = link->priv;
 
@@ -1759,13 +1759,11 @@ static void cmm_cm4000_release(dev_link_t * link)
 
 /*==== Interface to PCMCIA Layer =======================================*/
 
-static void cm4000_config(dev_link_t * link, int devno)
+static int cm4000_config(struct pcmcia_device * link, int devno)
 {
-        client_handle_t handle = link->handle;
         struct cm4000_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
@@ -1777,41 +1775,34 @@ static void cm4000_config(dev_link_t * link, int devno)
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
         if ((fail_rc =
-             pcmcia_parse_tuple(handle, &tuple, &parse)) != CS_SUCCESS) {
+             pcmcia_parse_tuple(link, &tuple, &parse)) != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc =
-             pcmcia_get_configuration_info(handle, &conf)) != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
-             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(handle, &tuple)) {
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
+             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(link, &tuple)) {
 
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -1831,7 +1822,7 @@ static void cm4000_config(dev_link_t * link, int devno)
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                     & CISTPL_IO_LINES_MASK;
 
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
                 if (rc == CS_SUCCESS)
                         break;  /* we are done */
         }
@@ -1841,7 +1832,7 @@ static void cm4000_config(dev_link_t * link, int devno)
         link->conf.IntType = 00000002;
 
         if ((fail_rc =
-             pcmcia_request_configuration(handle, &link->conf)) != CS_SUCCESS) {
+             pcmcia_request_configuration(link, &link->conf)) != CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
                 goto cs_release;
         }
@@ -1851,63 +1842,48 @@ static void cm4000_config(dev_link_t * link, int devno)
         dev->node.major = major;
         dev->node.minor = devno;
         dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &dev->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         cm4000_release(link);
-
-        link->state &= ~DEV_CONFIG_PENDING;
+        return -ENODEV;
 }
 
-static int cm4000_suspend(struct pcmcia_device *p_dev)
+static int cm4000_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
         stop_monitor(dev);
 
         return 0;
 }
 
-static int cm4000_resume(struct pcmcia_device *p_dev)
+static int cm4000_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
         if (link->open)
                 start_monitor(dev);
 
         return 0;
 }
 
-static void cm4000_release(dev_link_t *link)
+static void cm4000_release(struct pcmcia_device *link)
 {
         cmm_cm4000_release(link->priv); /* delay release until device closed */
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int cm4000_attach(struct pcmcia_device *p_dev)
+static int cm4000_probe(struct pcmcia_device *link)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM4000_MAX_DEV; i++)
                 if (dev_table[i] == NULL)
@@ -1923,7 +1899,7 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         if (dev == NULL)
                 return -ENOMEM;
 
-        link = &dev->link;
+        dev->p_dev = link;
         link->priv = dev;
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -1933,11 +1909,9 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         init_waitqueue_head(&dev->atrq);
         init_waitqueue_head(&dev->readq);
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        cm4000_config(link, i);
+        ret = cm4000_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmm_class, NULL, MKDEV(major, i), NULL,
                             "cmm%d", i);
@@ -1945,9 +1919,8 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void cm4000_detach(struct pcmcia_device *p_dev)
+static void cm4000_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev = link->priv;
         int devno;
 
@@ -1958,11 +1931,9 @@ static void cm4000_detach(struct pcmcia_device *p_dev)
         if (devno == CM4000_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
         stop_monitor(dev);
 
-        if (link->state & DEV_CONFIG)
-                cm4000_release(link);
+        cm4000_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -1993,7 +1964,7 @@ static struct pcmcia_driver cm4000_driver = {
         .drv      = {
                 .name = "cm4000_cs",
                 },
-        .probe    = cm4000_attach,
+        .probe    = cm4000_probe,
         .remove   = cm4000_detach,
         .suspend  = cm4000_suspend,
         .resume   = cm4000_resume,
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 466e33bab029..29efa64580a8 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -41,7 +41,7 @@
 
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -65,7 +65,7 @@ static char *version =
 /* how often to poll for fifo status change */
 #define POLL_PERIOD                             msecs_to_jiffies(10)
 
-static void reader_release(dev_link_t *link);
+static void reader_release(struct pcmcia_device *link);
 
 static int major;
 static struct class *cmx_class;
@@ -74,7 +74,7 @@ static struct class *cmx_class;
 #define         BS_WRITABLE     0x02
 
 struct reader_dev {
-        dev_link_t              link;
+        struct pcmcia_device    *p_dev;
         dev_node_t              node;
         wait_queue_head_t       devq;
         wait_queue_head_t       poll_wait;
@@ -87,7 +87,7 @@ struct reader_dev {
         struct timer_list       poll_timer;
 };
 
-static dev_link_t *dev_table[CM_MAX_DEV];
+static struct pcmcia_device *dev_table[CM_MAX_DEV];
 
 #ifndef PCMCIA_DEBUG
 #define xoutb   outb
@@ -116,7 +116,7 @@ static inline unsigned char xinb(unsigned short port)
 static void cm4040_do_poll(unsigned long dummy)
 {
         struct reader_dev *dev = (struct reader_dev *) dummy;
-        unsigned int obs = xinb(dev->link.io.BasePort1
+        unsigned int obs = xinb(dev->p_dev->io.BasePort1
                                 + REG_OFFSET_BUFFER_STATUS);
 
         if ((obs & BSR_BULK_IN_FULL)) {
@@ -147,7 +147,7 @@ static void cm4040_stop_poll(struct reader_dev *dev)
 static int wait_for_bulk_out_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -177,7 +177,7 @@ static int wait_for_bulk_out_ready(struct reader_dev *dev)
 /* Write to Sync Control Register */
 static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 {
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         int rc;
 
         rc = wait_for_bulk_out_ready(dev);
@@ -195,7 +195,7 @@ static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 static int wait_for_bulk_in_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -225,7 +225,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                         size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         size_t bytes_to_read;
         unsigned long i;
         size_t min_bytes_to_read;
@@ -246,7 +246,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT)==0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         for (i = 0; i < 5; i++) {
@@ -328,7 +328,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i;
         unsigned int bytes_to_write;
@@ -351,7 +351,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT) == 0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         bytes_to_write = count;
@@ -445,14 +445,14 @@ static unsigned int cm4040_poll(struct file *filp, poll_table *wait)
 static int cm4040_open(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -478,7 +478,7 @@ static int cm4040_open(struct inode *inode, struct file *filp)
 static int cm4040_close(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev = filp->private_data;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         DEBUGP(2, dev, "-> cm4040_close(maj/min=%d.%d)\n", imajor(inode),
@@ -500,7 +500,7 @@ static int cm4040_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cm4040_reader_release(dev_link_t *link)
+static void cm4040_reader_release(struct pcmcia_device *link)
 {
         struct reader_dev *dev = link->priv;
 
@@ -514,60 +514,49 @@ static void cm4040_reader_release(dev_link_t *link)
         return;
 }
 
-static void reader_config(dev_link_t *link, int devno)
+static int reader_config(struct pcmcia_device *link, int devno)
 {
-        client_handle_t handle;
         struct reader_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
 
-        handle = link->handle;
-
         tuple.DesiredTuple = CISTPL_CONFIG;
         tuple.Attributes = 0;
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_parse_tuple(handle, &tuple, &parse))
+        if ((fail_rc = pcmcia_parse_tuple(link, &tuple, &parse))
                                                         != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_configuration_info(handle, &conf))
-                                                        != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
              rc == CS_SUCCESS;
-             rc = pcmcia_get_next_tuple(handle, &tuple)) {
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+             rc = pcmcia_get_next_tuple(link, &tuple)) {
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -585,13 +574,13 @@ static void reader_config(dev_link_t *link, int devno)
                         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                                                 & CISTPL_IO_LINES_MASK;
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
 
-                dev_printk(KERN_INFO, &handle_to_dev(handle), "foo");
+                dev_printk(KERN_INFO, &handle_to_dev(link), "foo");
                 if (rc == CS_SUCCESS)
                         break;
                 else
-                        dev_printk(KERN_INFO, &handle_to_dev(handle),
+                        dev_printk(KERN_INFO, &handle_to_dev(link),
                                    "pcmcia_request_io failed 0x%x\n", rc);
         }
         if (rc != CS_SUCCESS)
@@ -599,10 +588,10 @@ static void reader_config(dev_link_t *link, int devno)
 
         link->conf.IntType = 00000002;
 
-        if ((fail_rc = pcmcia_request_configuration(handle,&link->conf))
+        if ((fail_rc = pcmcia_request_configuration(link,&link->conf))
                                                                 !=CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
-                dev_printk(KERN_INFO, &handle_to_dev(handle),
+                dev_printk(KERN_INFO, &handle_to_dev(link),
                            "pcmcia_request_configuration failed 0x%x\n",
                            fail_rc);
                 goto cs_release;
@@ -612,57 +601,31 @@ static void reader_config(dev_link_t *link, int devno)
         sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
         dev->node.major = major;
         dev->node.minor = devno;
-        dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        dev->node.next = &dev->node;
 
         DEBUGP(2, dev, "device " DEVICE_NAME "%d at 0x%.4x-0x%.4x\n", devno,
               link->io.BasePort1, link->io.BasePort1+link->io.NumPorts1);
         DEBUGP(2, dev, "<- reader_config (succ)\n");
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         reader_release(link);
-        link->state &= ~DEV_CONFIG_PENDING;
-}
-
-static int reader_suspend(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
+        return -ENODEV;
 }
 
-static int reader_resume(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
-
-static void reader_release(dev_link_t *link)
+static void reader_release(struct pcmcia_device *link)
 {
         cm4040_reader_release(link->priv);
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int reader_attach(struct pcmcia_device *p_dev)
+static int reader_probe(struct pcmcia_device *link)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM_MAX_DEV; i++) {
                 if (dev_table[i] == NULL)
@@ -679,8 +642,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         dev->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
         dev->buffer_status = 0;
 
-        link = &dev->link;
         link->priv = dev;
+        dev->p_dev = link;
 
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -692,11 +655,9 @@ static int reader_attach(struct pcmcia_device *p_dev)
         init_timer(&dev->poll_timer);
         dev->poll_timer.function = &cm4040_do_poll;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        reader_config(link, i);
+        ret = reader_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
                             "cmx%d", i);
@@ -704,9 +665,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void reader_detach(struct pcmcia_device *p_dev)
+static void reader_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct reader_dev *dev = link->priv;
         int devno;
 
@@ -718,10 +678,7 @@ static void reader_detach(struct pcmcia_device *p_dev)
         if (devno == CM_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
-
-        if (link->state & DEV_CONFIG)
-                reader_release(link);
+        reader_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -753,10 +710,8 @@ static struct pcmcia_driver reader_driver = {
         .drv            = {
                 .name   = "cm4040_cs",
         },
-        .probe          = reader_attach,
+        .probe          = reader_probe,
         .remove         = reader_detach,
-        .suspend        = reader_suspend,
-        .resume         = reader_resume,
         .id_table       = cm4040_ids,
 };
 
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index e6b714b6390d..07213454c458 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -228,7 +228,7 @@ typedef struct _mgslpc_info {
         struct  _input_signal_events    input_signal_events;
 
         /* PCMCIA support */
-        dev_link_t            link;
+        struct pcmcia_device    *p_dev;
         dev_node_t            node;
         int                   stop;
 
@@ -484,7 +484,7 @@ static void mgslpc_wait_until_sent(struct tty_struct *tty, int timeout);
 
 /* PCMCIA prototypes */
 
-static void mgslpc_config(dev_link_t *link);
+static int mgslpc_config(struct pcmcia_device *link);
 static void mgslpc_release(u_long arg);
 static void mgslpc_detach(struct pcmcia_device *p_dev);
 
@@ -533,14 +533,14 @@ static void ldisc_receive_buf(struct tty_struct *tty,
         }
 }
 
-static int mgslpc_attach(struct pcmcia_device *p_dev)
+static int mgslpc_probe(struct pcmcia_device *link)
 {
     MGSLPC_INFO *info;
-    dev_link_t *link;
-    
+    int ret;
+
     if (debug_level >= DEBUG_LEVEL_INFO)
             printk("mgslpc_attach\n");
-        
+
     info = (MGSLPC_INFO *)kmalloc(sizeof(MGSLPC_INFO), GFP_KERNEL);
     if (!info) {
             printk("Error can't allocate device instance data\n");
@@ -565,25 +565,22 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
     info->imrb_value = 0xffff;
     info->pim_value = 0xff;
 
-    link = &info->link;
+    info->p_dev = link;
     link->priv = info;
-    
-    /* Initialize the dev_link_t structure */
+
+    /* Initialize the struct pcmcia_device structure */
 
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1   = IRQ_LEVEL_ID;
     link->irq.Handler = NULL;
-    
+
     link->conf.Attributes = 0;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    mgslpc_config(link);
+    ret = mgslpc_config(link);
+    if (ret)
+            return ret;
 
     mgslpc_add_device(info);
 
@@ -596,15 +593,13 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void mgslpc_config(dev_link_t *link)
+static int mgslpc_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     MGSLPC_INFO *info = link->priv;
     tuple_t tuple;
     cisparse_t parse;
     int last_fn, last_ret;
     u_char buf[64];
-    config_info_t conf;
     cistpl_cftable_entry_t dflt = { 0 };
     cistpl_cftable_entry_t *cfg;
     
@@ -617,27 +612,20 @@ static void mgslpc_config(dev_link_t *link)
     tuple.TupleData = buf;
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
-    /* Look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
 
     /* get CIS configuration entry */
 
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
 
     cfg = &(parse.cftable_entry);
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
 
     if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
     if (cfg->index == 0)
@@ -658,11 +646,10 @@ static void mgslpc_config(dev_link_t *link)
             link->io.IOAddrLines = io->flags & CISTPL_IO_LINES_MASK;
             link->io.BasePort1 = io->win[0].base;
             link->io.NumPorts1 = io->win[0].len;
-            CS_CHECK(RequestIO, pcmcia_request_io(link->handle, &link->io));
+            CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
     }
 
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 8;
     link->conf.Present = PRESENT_OPTION;
@@ -670,9 +657,9 @@ static void mgslpc_config(dev_link_t *link)
     link->irq.Attributes |= IRQ_HANDLE_PRESENT;
     link->irq.Handler     = mgslpc_isr;
     link->irq.Instance    = info;
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     info->io_base = link->io.BasePort1;
     info->irq_level = link->irq.AssignedIRQ;
@@ -680,7 +667,7 @@ static void mgslpc_config(dev_link_t *link)
     /* add to linked list of devices */
     sprintf(info->node.dev_name, "mgslpc0");
     info->node.major = info->node.minor = 0;
-    link->dev = &info->node;
+    link->dev_node = &info->node;
 
     printk(KERN_INFO "%s: index 0x%02x:",
            info->node.dev_name, link->conf.ConfigIndex);
@@ -690,13 +677,12 @@ static void mgslpc_config(dev_link_t *link)
             printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                    link->io.BasePort1+link->io.NumPorts1-1);
     printk("\n");
-    
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     mgslpc_release((u_long)link);
+    return -ENODEV;
 }
 
 /* Card has been removed.
@@ -705,58 +691,38 @@ cs_failed:
  */
 static void mgslpc_release(u_long arg)
 {
-    dev_link_t *link = (dev_link_t *)arg;
+        struct pcmcia_device *link = (struct pcmcia_device *)arg;
 
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_release(0x%p)\n", link);
-
-    /* Unlink the device chain */
-    link->dev = NULL;
-    link->state &= ~DEV_CONFIG;
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_release(0x%p)\n", link);
 
-    pcmcia_release_configuration(link->handle);
-    if (link->io.NumPorts1)
-            pcmcia_release_io(link->handle, &link->io);
-    if (link->irq.AssignedIRQ)
-            pcmcia_release_irq(link->handle, &link->irq);
+        pcmcia_disable_device(link);
 }
 
-static void mgslpc_detach(struct pcmcia_device *p_dev)
+static void mgslpc_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_detach(0x%p)\n", link);
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG) {
-            ((MGSLPC_INFO *)link->priv)->stop = 1;
-            mgslpc_release((u_long)link);
-    }
+        ((MGSLPC_INFO *)link->priv)->stop = 1;
+        mgslpc_release((u_long)link);
 
-    mgslpc_remove_device((MGSLPC_INFO *)link->priv);
+        mgslpc_remove_device((MGSLPC_INFO *)link->priv);
 }
 
-static int mgslpc_suspend(struct pcmcia_device *dev)
+static int mgslpc_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state |= DEV_SUSPEND;
         info->stop = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int mgslpc_resume(struct pcmcia_device *dev)
+static int mgslpc_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         info->stop = 0;
 
         return 0;
@@ -1280,7 +1246,7 @@ static irqreturn_t mgslpc_isr(int irq, void *dev_id, struct pt_regs * regs)
         if (!info)
                 return IRQ_NONE;
                 
-        if (!(info->link.state & DEV_CONFIG))
+        if (!(info->p_dev->_locked))
                 return IRQ_HANDLED;
 
         spin_lock(&info->lock);
@@ -3033,7 +2999,7 @@ static struct pcmcia_driver mgslpc_driver = {
         .drv            = {
                 .name   = "synclink_cs",
         },
-        .probe          = mgslpc_attach,
+        .probe          = mgslpc_probe,
         .remove         = mgslpc_detach,
         .id_table       = mgslpc_ids,
         .suspend        = mgslpc_suspend,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 86be04b241e1..58f3512c52e1 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1584,7 +1584,6 @@ u32 secure_ipv6_port_ephemeral(const __u32 *saddr, const __u32 *daddr, __u16 dpo
 
         return twothirdsMD4Transform(daddr, hash);
 }
-EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                         format_module_id(devnamep, geo_module(geoid),
                                          MODULE_FORMAT_BRIEF);
                         devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
 
                         /* allocate sysctl device data */
                         scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index f8dd8527c6aa..a90f5d97df35 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                           PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
         else
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
 
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index eb2eb3e12d6a..079db5a935a1 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -515,7 +515,7 @@ tipar_init_module(void)
                 err = PTR_ERR(tipar_class);
                 goto out_chrdev;
         }
-        if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+        if (parport_register_driver(&tipar_driver)) {
                 printk(KERN_ERR "tipar: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 2546637a55c0..f58ad7f68267 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -327,7 +327,7 @@ static ssize_t store_received_ref_clk3a(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3a);
 
 
@@ -349,7 +349,7 @@ static ssize_t store_received_ref_clk3b(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3b);
 
 
@@ -371,7 +371,7 @@ static ssize_t store_enable_clk3b_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3b_output);
 
 static ssize_t store_enable_clk3a_output(struct device *d,
@@ -392,7 +392,7 @@ static ssize_t store_enable_clk3a_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3a_output);
 
 static ssize_t store_enable_clkb1_output(struct device *d,
@@ -413,7 +413,7 @@ static ssize_t store_enable_clkb1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb1_output);
 
 
@@ -435,7 +435,7 @@ static ssize_t store_enable_clka1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka1_output);
 
 static ssize_t store_enable_clkb0_output(struct device *d,
@@ -456,7 +456,7 @@ static ssize_t store_enable_clkb0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb0_output);
 
 static ssize_t store_enable_clka0_output(struct device *d,
@@ -477,7 +477,7 @@ static ssize_t store_enable_clka0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka0_output);
 
 static ssize_t store_select_amcb2_transmit_clock(struct device *d,
@@ -519,7 +519,7 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
         store_select_amcb2_transmit_clock);
 
 static ssize_t store_select_amcb1_transmit_clock(struct device *d,
@@ -560,7 +560,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_amcb1_transmit_clock);
 
 static ssize_t store_select_redundant_clock(struct device *d,
@@ -581,7 +581,7 @@ static ssize_t store_select_redundant_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_redundant_clock);
 
 static ssize_t store_select_ref_frequency(struct device *d,
@@ -602,7 +602,7 @@ static ssize_t store_select_ref_frequency(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
+static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
                 store_select_ref_frequency);
 
 static ssize_t store_filter_select(struct device *d,
@@ -623,7 +623,7 @@ static ssize_t store_filter_select(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
+static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
 
 static ssize_t store_hardware_switching_mode(struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -643,7 +643,7 @@ static ssize_t store_hardware_switching_mode(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching_mode);
 
 static ssize_t store_hardware_switching(struct device *d,
@@ -664,7 +664,7 @@ static ssize_t store_hardware_switching(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching);
 
 static ssize_t store_refalign (struct device *d,
@@ -684,7 +684,7 @@ static ssize_t store_refalign (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
+static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
 
 static ssize_t store_mode_select (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -704,7 +704,7 @@ static ssize_t store_mode_select (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
+static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
 
 static ssize_t store_reset (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -724,7 +724,7 @@ static ssize_t store_reset (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
+static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
 
 static struct attribute *tlclk_sysfs_entries[] = {
         &dev_attr_current_ref.attr,
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..1efde3b27619 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
           Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
 
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
+
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from National Semicondutor 
           say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
         obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 2048,
         TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
 
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
         schedule_work(&chip->work);
 }
 
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
         struct tpm_chip *chip = ptr;
 
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+
+/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                             size_t bufsiz)
 {
         ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
         unsigned long stop;
 
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
-
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
                 return -ENODATA;
         if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 
         down(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
         }
 
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
         do {
-                u8 status = chip->vendor->status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                u8 status = chip->vendor.status(chip);
+                if ((status & chip->vendor.req_complete_mask) ==
+                    chip->vendor.req_complete_val)
                         goto out_recv;
-                }
 
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                         dev_err(chip->dev, "Operation Canceled\n");
                         rc = -ECANCELED;
                         goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 rmb();
         } while (time_before(jiffies, stop));
 
-
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         dev_err(chip->dev, "Operation Timed out\n");
         rc = -ETIME;
         goto out;
 
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
         if (rc < 0)
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
-static const u8 cap_pcr[] = {
+#define TPM_ERROR_SIZE 10
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+
+static const u8 tpm_cap[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 22,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 1
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
 
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
+
 static const u8 pcrread[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
+        ssize_t rc;
         int i, j, num_pcrs;
         __be32 index;
         char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
-            < CAP_PCR_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the number of PCRS");
+        if (rc)
                 return 0;
-        }
 
         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
-
         for (i = 0; i < num_pcrs; i++) {
                 memcpy(data, pcrread, sizeof(pcrread));
                 index = cpu_to_be32(i);
                 memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
-                    < READ_PCR_RESULT_SIZE){
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
+                rc = transmit_cmd(chip, data, sizeof(data),
+                                "attempting to read a PCR");
+                if (rc)
                         goto out;
-                }
                 str += sprintf(str, "PCR-%02d: ", i);
                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
                         str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                        char *buf)
 {
         u8 *data;
-        ssize_t len;
+        ssize_t err;
         int i, rc;
         char *str = buf;
 
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 
         memcpy(data, readpubek, sizeof(readpubek));
 
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
-            READ_PUBEK_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
+                        "attempting to read the PUBEK");
+        if (err)
                 goto out;
-        }
 
         /* 
            ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                 if ((i + 1) % 16 == 0)
                         str += sprintf(str, "\n");
         }
-        rc = str - buf;
 out:
+        rc = str - buf;
         kfree(data);
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 18,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
         0, 0, 0, 0
 };
 
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
-
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t rc;
         char *str = buf;
 
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_MANUFACTURER_RESULT_SIZE)
-                return len;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the manufacturer");
+        if (rc)
+                return 0;
 
         str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 
         memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_VER_RESULT_SIZE)
-                return len;
-
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
 
+out:
         return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
 
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return 0;
 
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
         spin_lock(&driver_lock);
 
         list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
                         break;
                 }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
 
         return in_size;
 }
-
 EXPORT_SYMBOL_GPL(tpm_write);
 
-ssize_t tpm_read(struct file * file, char __user *buf,
-                 size_t size, loff_t * off)
+ssize_t tpm_read(struct file *file, char __user *buf,
+                 size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
         spin_unlock(&driver_lock);
 
         dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
-        kfree(chip->vendor->miscdev.name);
+        misc_deregister(&chip->vendor.miscdev);
+        kfree(chip->vendor.miscdev.name);
 
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
+        clear_bit(chip->dev_num, dev_mask);
 
         kfree(chip);
 
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
 
         char *devname;
         struct tpm_chip *chip;
-        int i, j;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
 
         init_MUTEX(&chip->buffer_mutex);
         init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
         chip->user_read_timer.function = user_reader_timeout;
         chip->user_read_timer.data = (unsigned long) chip;
 
-        chip->vendor = entry;
-
-        chip->dev_num = -1;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
 
-dev_num_search_complete:
-        if (chip->dev_num < 0) {
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
                 kfree(chip);
-                return -ENODEV;
+                return NULL;
         } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
         else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+
+        set_bit(chip->dev_num, dev_mask);
 
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
 
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
         chip->dev = get_device(dev);
 
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                 dev_err(chip->dev,
                         "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.name,
+                        chip->vendor.miscdev.minor);
                 put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
-                dev_mask[i] &= !(1 << j);
-                return -ENODEV;
+                return NULL;
         }
 
         spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..54a4c804e25f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
-        u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_complete_mask;
+        const u8 req_complete_val;
+        const u8 req_canceled;
         void __iomem *iobase;           /* ioremapped address */
         unsigned long base;             /* TPM base address */
 
+        int irq;
+
         int region_size;
         int have_region;
 
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
         u8 (*status) (struct tpm_chip *);
         struct miscdevice miscdev;
         struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
         struct work_struct work;
         struct semaphore tpm_mutex;     /* tpm is processing */
 
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
 
         struct dentry **bios_dir;
 
         struct list_head list;
 };
 
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
+
 static inline int tpm_read_index(int base, int index)
 {
         outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
         outb(value & 0xFF, base+1);
 }
 
-extern int tpm_register_hardware(struct device *,
-                                 struct tpm_vendor_specific *);
+extern void tpm_get_timeouts(struct tpm_chip *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 return -EIO;
 
         for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading header\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 dev_err(chip->dev,
                         "Recv size(%d) less than available space\n", size);
                 for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                         if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                 dev_err(chip->dev, "error reading data\n");
                                 return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         /* read all the data available */
         for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading data\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
 
         if (status & ATML_STATUS_DATA_AVAIL) {
                 dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
         dev_dbg(chip->dev, "tpm_atml_send:\n");
         for (i = 0; i < count; i++) {
                 dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
         }
 
         return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
 
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
         .recv = tpm_atml_recv,
         .send = tpm_atml_send,
         .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
         struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
 
         if (chip) {
-                if (chip->vendor->have_region)
-                        atmel_release_region(chip->vendor->base,
-                                             chip->vendor->region_size);
-                atmel_put_base_addr(chip->vendor);
+                if (chip->vendor.have_region)
+                        atmel_release_region(chip->vendor.base,
+                                             chip->vendor.region_size);
+                atmel_put_base_addr(chip->vendor.iobase);
                 tpm_remove_hardware(chip->dev);
                 platform_device_unregister(pdev);
         }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
         int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
 
         driver_register(&atml_drv);
 
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
                 goto err_unreg_drv;
         }
 
-        tpm_atmel.have_region =
+        have_region =
             (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
-              "tpm_atmel0") == NULL) ? 0 : 1;
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+
 
         if (IS_ERR
             (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                 goto err_rel_reg;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                 goto err_unreg_dev;
+        }
+
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
+
         return 0;
 
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
-        if (tpm_atmel.have_region)
-                atmel_release_region(tpm_atmel.base,
-                                     tpm_atmel.region_size);
+        atmel_put_base_addr(iobase);
+        if (have_region)
+                atmel_release_region(base,
+                                     region_size);
 err_unreg_drv:
         driver_unregister(&atml_drv);
         return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
 
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         struct device_node *dn;
         unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
         else
                 size = reg[naddrc];
 
-        vendor->base = address;
-        vendor->region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        *base = address;
+        *region_size = size;
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
         return 0;
 }
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
 }
 
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         int lo, hi;
 
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
         lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
         hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
 
-        vendor->base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *base = (hi << 8) | lo;
+        *region_size = 2;
 
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..e45f0d3d12de 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
 
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
+
 struct tpm_bios_log {
         void *bios_event_log;
         void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 
 struct acpi_tcpa {
         struct acpi_table_header hdr;
-        u16 reserved;
-        u32 log_max_len __attribute__ ((packed));
-        u32 log_start_addr __attribute__ ((packed));
+        u16 platform_class;
+        union {
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 
 struct tcpa_event {
@@ -120,6 +134,7 @@ static const char* tcpa_pc_event_id_strings[] = {
         "S-CRTM Version",
         "S-CRTM Contents",
         "S-CRTM POST Contents",
+        "POST Contents",
 };
 
 /* returns pointer to start of pos. entry of tcg log */
@@ -306,6 +321,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
         /* 5th: delimiter */
         seq_putc(m, '\0');
 
+        kfree(eventname);
         return 0;
 }
 
@@ -353,6 +369,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
         /* 4th: eventname <= max + \'0' delimiter */
         seq_printf(m, " %s\n", eventname);
 
+        kfree(eventname);
         return 0;
 }
 
@@ -376,6 +393,7 @@ static int read_log(struct tpm_bios_log *log)
         struct acpi_tcpa *buff;
         acpi_status status;
         struct acpi_table_header *virt;
+        u64 len, start;
 
         if (log->bios_event_log != NULL) {
                 printk(KERN_ERR
@@ -396,27 +414,37 @@ static int read_log(struct tpm_bios_log *log)
                 return -EIO;
         }
 
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                 printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                 return -EIO;
         }
 
         /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
         if (!log->bios_event_log) {
-                printk
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                     __func__);
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
                 return -ENOMEM;
         }
 
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
 
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
 
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
         return 0;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
  * License.
  */
 
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
 
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
 
         if (clear_wrfifo) {
                 for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                         if (status == 0xff) {
                                 if (check == 5)
                                         break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
          */
         i = 0;
         do {
-                status = inb(chip->vendor->base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + RDFIFO);
+                status = inb(chip->vendor.base + STAT);
                 i++;
                 if (i == TPM_MAX_TRIES)
                         return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
         int status;
         int i;
         for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
         wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
 
     /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                 ret = wait(chip, STAT_RDA);
                 if (ret)
                         return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
         }
 
         if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
 
                 for (i = 0; i < size; i++) {
                         wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                 }
 
                 if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
         u8 count_high, count_low, count_4, count_3, count_2, count_1;
 
         /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
 
         ret = empty_fifo(chip, 1);
         if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
         .release = tpm_release,
 };
 
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
         .recv = tpm_inf_recv,
         .send = tpm_inf_send,
         .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         int version[2];
         int productid[2];
         char chipname[20];
+        struct tpm_chip *chip;
 
         /* read IO-ports through PnP */
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
                 /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                 if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
-                                "tpm_infineon0") == NULL) {
+                if (request_region
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 /* configure TPM with IO-ports */
                 outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                 outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
 
                 /* control if IO-ports are set correctly */
                 outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(IOLIML, TPM_INF_ADDR);
                 iol = inb(TPM_INF_DATA);
 
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                         dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
-                                tpm_inf.base);
+                                "Could not set IO-ports to 0x%x\n",
+                                TPM_INF_BASE);
                         rc = -EIO;
                         goto err_release_region;
                 }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&dev->dev, "TPM found: "
                          "config base 0x%x, "
                          "io base 0x%x, "
-                         "chip version %02x%02x, "
-                         "vendor id %x%x (Infineon), "
-                         "product id %02x%02x"
+                         "chip version 0x%02x%02x, "
+                         "vendor id 0x%x%x (Infineon), "
+                         "product id 0x%02x%02x"
                          "%s\n",
                          TPM_INF_ADDR,
                          TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
 
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
-                if (rc < 0) {
-                        rc = -ENODEV;
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
                         goto err_release_region;
                 }
+                chip->vendor.base = TPM_INF_BASE;
                 return 0;
         } else {
                 rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         }
 
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
         release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
         struct tpm_chip *chip = pnp_get_drvdata(dev);
 
         if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
         },
         .id_table = tpm_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         unsigned long stop;
 
         /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
         if ((*data & mask) == val)
                 return 0;
 
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         stop = jiffies + 10 * HZ;
         do {
                 msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                 if ((*data & mask) == val)
                         return 0;
         }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         unsigned long stop;
 
         /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
         if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
         if (status & NSC_STATUS_RDY)
                 return 0;
 
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         stop = jiffies + 100;
         do {
                 msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                 if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                 if (status & NSC_STATUS_RDY)
                         return 0;
         }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
         if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                 dev_err(chip->dev, "not in normal mode (0x%x)\n",
                         data);
                 return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 }
                 if (data & NSC_STATUS_F0)
                         break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
         }
 
         if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 dev_err(chip->dev, "F0 not set\n");
                 return -EIO;
         }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                 dev_err(chip->dev,
                         "expected end of command(0x%x)\n", data);
                 return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
          * fix it. Not sure why this is needed, we followed the flow
          * chart in the manual to the letter.
          */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 
         if (nsc_wait_for_ready(chip) != 0)
                 return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
 
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
         if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                 dev_err(chip->dev, "IBR timeout\n");
                 return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                 "IBF timeout (while writing data)\n");
                         return -EIO;
                 }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
         }
 
         if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                 dev_err(chip->dev, "IBF timeout\n");
                 return -EIO;
         }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
 
         return count;
 }
 
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
 
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
         .recv = tpm_nsc_recv,
         .send = tpm_nsc_send,
         .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
         int rc = 0;
         int lo, hi;
         int nscAddrBase = TPM_ADDR;
-
+        struct tpm_chip *chip;
+        unsigned long base;
 
         /* verify that it is a National part (SID) */
         if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
 
         /* enable the DPM module */
         tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
         if ((rc = platform_device_register(pdev)) < 0)
                 goto err_free_dev;
 
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                 rc = -EBUSY;
                 goto err_unreg_dev;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                 goto err_rel_reg;
+        }
 
         dev_dbg(&pdev->dev, "NSC TPM detected\n");
         dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                  "NSC TPM revision %d\n",
                  tpm_read_index(nscAddrBase, 0x27) & 0x1F);
 
+        chip->vendor.base = base;
+
         return 0;
 
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..b9cae9a238bb
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+
+#define TPM_HEADER_SIZE 10
+
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+
+        return -1;
+}
+
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+
+        if (check_locality(chip, l) >= 0)
+                return l;
+
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        chip->vendor.irq = irq;
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+        if ((vendor & 0xFFFF) == 0xFFFF) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 98b126c2ded8..f07637a8f88f 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -351,10 +351,10 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
         spin_unlock_irqrestore(&tty->buf.lock, flags);
         return size;
 }
-
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
 
-int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, size_t size)
+int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
+                                size_t size)
 {
         int copied = 0;
         do {
@@ -368,17 +368,16 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, s
                 tb->used += space;
                 copied += space;
                 chars += space;
-/*              printk("Flip insert %d.\n", space); */
         }
         /* There is a small chance that we need to split the data over
            several buffers. If this is the case we must loop */
         while (unlikely(size > copied));
         return copied;
 }
-
 EXPORT_SYMBOL(tty_insert_flip_string);
 
-int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size)
+int tty_insert_flip_string_flags(struct tty_struct *tty,
+                const unsigned char *chars, const char *flags, size_t size)
 {
         int copied = 0;
         do {
@@ -399,9 +398,20 @@ int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *ch
         while (unlikely(size > copied));
         return copied;
 }
-
 EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
 
+void tty_schedule_flip(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        if (tty->buf.tail != NULL) {
+                tty->buf.tail->active = 0;
+                tty->buf.tail->commit = tty->buf.tail->used;
+        }
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        schedule_delayed_work(&tty->buf.work, 1);
+}
+EXPORT_SYMBOL(tty_schedule_flip);
 
 /*
  *      Prepare a block of space in the buffer for data. Returns the length
@@ -1730,7 +1740,7 @@ static void release_dev(struct file * filp)
 {
         struct tty_struct *tty, *o_tty;
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
-        int     devpts_master, devpts;
+        int     devpts;
         int     idx;
         char    buf[64];
         unsigned long flags;
@@ -1747,7 +1757,6 @@ static void release_dev(struct file * filp)
         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                       tty->driver->subtype == PTY_TYPE_MASTER);
         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
-        devpts_master = pty_master && devpts;
         o_tty = tty->link;
 
 #ifdef TTY_PARANOIA_CHECK
@@ -2185,6 +2194,7 @@ static int ptmx_open(struct inode * inode, struct file * filp)
                 return 0;
 out1:
         release_dev(filp);
+        return retval;
 out:
         down(&allocated_ptys_lock);
         idr_remove(&allocated_ptys, index);
@@ -2713,7 +2723,11 @@ static void __do_SAK(void *arg)
                 }
                 task_lock(p);
                 if (p->files) {
-                        rcu_read_lock();
+                        /*
+                         * We don't take a ref to the file, so we must
+                         * hold ->file_lock instead.
+                         */
+                        spin_lock(&p->files->file_lock);
                         fdt = files_fdtable(p->files);
                         for (i=0; i < fdt->max_fds; i++) {
                                 filp = fcheck_files(p->files, i);
@@ -2724,11 +2738,11 @@ static void __do_SAK(void *arg)
                                         printk(KERN_NOTICE "SAK: killed process %d"
                                             " (%s): fd#%d opened to the tty\n",
                                             p->pid, p->comm, i);
-                                        send_sig(SIGKILL, p, 1);
+                                        force_sig(SIGKILL, p);
                                         break;
                                 }
                         }
-                        rcu_read_unlock();
+                        spin_unlock(&p->files->file_lock);
                 }
                 task_unlock(p);
         } while_each_thread(g, p);
diff --git a/drivers/char/vr41xx_rtc.c b/drivers/char/vr41xx_rtc.c
deleted file mode 100644
index b109d9a502d6..000000000000
--- a/drivers/char/vr41xx_rtc.c
+++ /dev/null
@@ -1,717 +0,0 @@
-/*
- *  Driver for NEC VR4100 series  Real Time Clock unit.
- *
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#include <linux/platform_device.h>
-#include <linux/fs.h>
-#include <linux/init.h>
-#include <linux/ioport.h>
-#include <linux/irq.h>
-#include <linux/mc146818rtc.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/poll.h>
-#include <linux/rtc.h>
-#include <linux/spinlock.h>
-#include <linux/types.h>
-#include <linux/wait.h>
-
-#include <asm/div64.h>
-#include <asm/io.h>
-#include <asm/time.h>
-#include <asm/uaccess.h>
-#include <asm/vr41xx/vr41xx.h>
-
-MODULE_AUTHOR("Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>");
-MODULE_DESCRIPTION("NEC VR4100 series RTC driver");
-MODULE_LICENSE("GPL");
-
-#define RTC1_TYPE1_START        0x0b0000c0UL
-#define RTC1_TYPE1_END          0x0b0000dfUL
-#define RTC2_TYPE1_START        0x0b0001c0UL
-#define RTC2_TYPE1_END          0x0b0001dfUL
-
-#define RTC1_TYPE2_START        0x0f000100UL
-#define RTC1_TYPE2_END          0x0f00011fUL
-#define RTC2_TYPE2_START        0x0f000120UL
-#define RTC2_TYPE2_END          0x0f00013fUL
-
-#define RTC1_SIZE               0x20
-#define RTC2_SIZE               0x20
-
-/* RTC 1 registers */
-#define ETIMELREG               0x00
-#define ETIMEMREG               0x02
-#define ETIMEHREG               0x04
-/* RFU */
-#define ECMPLREG                0x08
-#define ECMPMREG                0x0a
-#define ECMPHREG                0x0c
-/* RFU */
-#define RTCL1LREG               0x10
-#define RTCL1HREG               0x12
-#define RTCL1CNTLREG            0x14
-#define RTCL1CNTHREG            0x16
-#define RTCL2LREG               0x18
-#define RTCL2HREG               0x1a
-#define RTCL2CNTLREG            0x1c
-#define RTCL2CNTHREG            0x1e
-
-/* RTC 2 registers */
-#define TCLKLREG                0x00
-#define TCLKHREG                0x02
-#define TCLKCNTLREG             0x04
-#define TCLKCNTHREG             0x06
-/* RFU */
-#define RTCINTREG               0x1e
- #define TCLOCK_INT             0x08
- #define RTCLONG2_INT           0x04
- #define RTCLONG1_INT           0x02
- #define ELAPSEDTIME_INT        0x01
-
-#define RTC_FREQUENCY           32768
-#define MAX_PERIODIC_RATE       6553
-#define MAX_USER_PERIODIC_RATE  64
-
-static void __iomem *rtc1_base;
-static void __iomem *rtc2_base;
-
-#define rtc1_read(offset)               readw(rtc1_base + (offset))
-#define rtc1_write(offset, value)       writew((value), rtc1_base + (offset))
-
-#define rtc2_read(offset)               readw(rtc2_base + (offset))
-#define rtc2_write(offset, value)       writew((value), rtc2_base + (offset))
-
-static unsigned long epoch = 1970;      /* Jan 1 1970 00:00:00 */
-
-static spinlock_t rtc_task_lock;
-static wait_queue_head_t rtc_wait;
-static unsigned long rtc_irq_data;
-static struct fasync_struct *rtc_async_queue;
-static rtc_task_t *rtc_callback;
-static char rtc_name[] = "RTC";
-static unsigned long periodic_frequency;
-static unsigned long periodic_count;
-
-typedef enum {
-        RTC_RELEASE,
-        RTC_OPEN,
-} rtc_status_t;
-
-static rtc_status_t rtc_status;
-
-typedef enum {
-        FUNCTION_RTC_IOCTL,
-        FUNCTION_RTC_CONTROL,
-} rtc_callfrom_t;
-
-struct resource rtc_resource[2] = {
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-};
-
-static inline unsigned long read_elapsed_second(void)
-{
-        unsigned long first_low, first_mid, first_high;
-        unsigned long second_low, second_mid, second_high;
-
-        do {
-                first_low = rtc1_read(ETIMELREG);
-                first_mid = rtc1_read(ETIMEMREG);
-                first_high = rtc1_read(ETIMEHREG);
-                second_low = rtc1_read(ETIMELREG);
-                second_mid = rtc1_read(ETIMEMREG);
-                second_high = rtc1_read(ETIMEHREG);
-        } while (first_low != second_low || first_mid != second_mid ||
-                 first_high != second_high);
-
-        return (first_high << 17) | (first_mid << 1) | (first_low >> 15);
-}
-
-static inline void write_elapsed_second(unsigned long sec)
-{
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ETIMELREG, (uint16_t)(sec << 15));
-        rtc1_write(ETIMEMREG, (uint16_t)(sec >> 1));
-        rtc1_write(ETIMEHREG, (uint16_t)(sec >> 17));
-
-        spin_unlock_irq(&rtc_lock);
-}
-
-static void set_alarm(struct rtc_time *time)
-{
-        unsigned long alarm_sec;
-
-        alarm_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
-                           time->tm_hour, time->tm_min, time->tm_sec);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, (uint16_t)(alarm_sec << 15));
-        rtc1_write(ECMPMREG, (uint16_t)(alarm_sec >> 1));
-        rtc1_write(ECMPHREG, (uint16_t)(alarm_sec >> 17));
-
-        spin_unlock_irq(&rtc_lock);
-}
-
-static void read_alarm(struct rtc_time *time)
-{
-        unsigned long low, mid, high;
-
-        spin_lock_irq(&rtc_lock);
-
-        low = rtc1_read(ECMPLREG);
-        mid = rtc1_read(ECMPMREG);
-        high = rtc1_read(ECMPHREG);
-
-        spin_unlock_irq(&rtc_lock);
-
-        to_tm((high << 17) | (mid << 1) | (low >> 15), time);
-        time->tm_year -= 1900;
-}
-
-static void read_time(struct rtc_time *time)
-{
-        unsigned long epoch_sec, elapsed_sec;
-
-        epoch_sec = mktime(epoch, 1, 1, 0, 0, 0);
-        elapsed_sec = read_elapsed_second();
-
-        to_tm(epoch_sec + elapsed_sec, time);
-        time->tm_year -= 1900;
-}
-
-static void set_time(struct rtc_time *time)
-{
-        unsigned long epoch_sec, current_sec;
-
-        epoch_sec = mktime(epoch, 1, 1, 0, 0, 0);
-        current_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
-                             time->tm_hour, time->tm_min, time->tm_sec);
-
-        write_elapsed_second(current_sec - epoch_sec);
-}
-
-static ssize_t rtc_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        unsigned long irq_data;
-        int retval = 0;
-
-        if (count != sizeof(unsigned int) && count != sizeof(unsigned long))
-                return -EINVAL;
-
-        add_wait_queue(&rtc_wait, &wait);
-
-        do {
-                __set_current_state(TASK_INTERRUPTIBLE);
-
-                spin_lock_irq(&rtc_lock);
-                irq_data = rtc_irq_data;
-                rtc_irq_data = 0;
-                spin_unlock_irq(&rtc_lock);
-
-                if (irq_data != 0)
-                        break;
-
-                if (file->f_flags & O_NONBLOCK) {
-                        retval = -EAGAIN;
-                        break;
-                }
-
-                if (signal_pending(current)) {
-                        retval = -ERESTARTSYS;
-                        break;
-                }
-        } while (1);
-
-        if (retval == 0) {
-                if (count == sizeof(unsigned int)) {
-                        retval = put_user(irq_data, (unsigned int __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned int);
-                } else {
-                        retval = put_user(irq_data, (unsigned long __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned long);
-                }
-
-        }
-
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&rtc_wait, &wait);
-
-        return retval;
-}
-
-static unsigned int rtc_poll(struct file *file, struct poll_table_struct *table)
-{
-        poll_wait(file, &rtc_wait, table);
-
-        if (rtc_irq_data != 0)
-                return POLLIN | POLLRDNORM;
-
-        return 0;
-}
-
-static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from)
-{
-        struct rtc_time time;
-        unsigned long count;
-
-        switch (cmd) {
-        case RTC_AIE_ON:
-                enable_irq(ELAPSEDTIME_IRQ);
-                break;
-        case RTC_AIE_OFF:
-                disable_irq(ELAPSEDTIME_IRQ);
-                break;
-        case RTC_PIE_ON:
-                enable_irq(RTCLONG1_IRQ);
-                break;
-        case RTC_PIE_OFF:
-                disable_irq(RTCLONG1_IRQ);
-                break;
-        case RTC_ALM_SET:
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_alarm(&time);
-                break;
-        case RTC_ALM_READ:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_alarm(&time);
-                break;
-        case RTC_RD_TIME:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_time(&time);
-                if (copy_to_user((void __user *)arg, &time, sizeof(struct rtc_time)))
-                        return -EFAULT;
-                break;
-        case RTC_SET_TIME:
-                if (capable(CAP_SYS_TIME) == 0)
-                        return -EACCES;
-
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_time(&time);
-                break;
-        case RTC_IRQP_READ:
-                return put_user(periodic_frequency, (unsigned long __user *)arg);
-                break;
-        case RTC_IRQP_SET:
-                if (arg > MAX_PERIODIC_RATE)
-                        return -EINVAL;
-
-                if (from == FUNCTION_RTC_IOCTL && arg > MAX_USER_PERIODIC_RATE &&
-                    capable(CAP_SYS_RESOURCE) == 0)
-                        return -EACCES;
-
-                periodic_frequency = arg;
-
-                count = RTC_FREQUENCY;
-                do_div(count, arg);
-
-                periodic_count = count;
-
-                spin_lock_irq(&rtc_lock);
-
-                rtc1_write(RTCL1LREG, count);
-                rtc1_write(RTCL1HREG, count >> 16);
-
-                spin_unlock_irq(&rtc_lock);
-                break;
-        case RTC_EPOCH_READ:
-                return put_user(epoch, (unsigned long __user *)arg);
-        case RTC_EPOCH_SET:
-                /* Doesn't support before 1900 */
-                if (arg < 1900)
-                        return -EINVAL;
-
-                if (capable(CAP_SYS_TIME) == 0)
-                        return -EACCES;
-
-                epoch = arg;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-                     unsigned long arg)
-{
-        return rtc_do_ioctl(cmd, arg, FUNCTION_RTC_IOCTL);
-}
-
-static int rtc_open(struct inode *inode, struct file *file)
-{
-        spin_lock_irq(&rtc_lock);
-
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        rtc_status = RTC_OPEN;
-        rtc_irq_data = 0;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-static int rtc_release(struct inode *inode, struct file *file)
-{
-        if (file->f_flags & FASYNC)
-                (void)fasync_helper(-1, file, 0, &rtc_async_queue);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock_irq(&rtc_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-static int rtc_fasync(int fd, struct file *file, int on)
-{
-        return fasync_helper(fd, file, on, &rtc_async_queue);
-}
-
-static struct file_operations rtc_fops = {
-        .owner          = THIS_MODULE,
-        .llseek         = no_llseek,
-        .read           = rtc_read,
-        .poll           = rtc_poll,
-        .ioctl          = rtc_ioctl,
-        .open           = rtc_open,
-        .release        = rtc_release,
-        .fasync         = rtc_fasync,
-};
-
-static irqreturn_t elapsedtime_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-        spin_lock(&rtc_lock);
-        rtc2_write(RTCINTREG, ELAPSEDTIME_INT);
-
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_AF;
-        spin_unlock(&rtc_lock);
-
-        spin_lock(&rtc_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_lock);
-
-        wake_up_interruptible(&rtc_wait);
-
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
-
-        return IRQ_HANDLED;
-}
-
-static irqreturn_t rtclong1_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-        unsigned long count = periodic_count;
-
-        spin_lock(&rtc_lock);
-        rtc2_write(RTCINTREG, RTCLONG1_INT);
-
-        rtc1_write(RTCL1LREG, count);
-        rtc1_write(RTCL1HREG, count >> 16);
-
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_PF;
-        spin_unlock(&rtc_lock);
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_task_lock);
-
-        wake_up_interruptible(&rtc_wait);
-
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
-
-        return IRQ_HANDLED;
-}
-
-int rtc_register(rtc_task_t *task)
-{
-        if (task == NULL || task->func == NULL)
-                return -EINVAL;
-
-        spin_lock_irq(&rtc_lock);
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback != NULL) {
-                spin_unlock(&rtc_task_lock);
-                spin_unlock_irq(&rtc_task_lock);
-                return -EBUSY;
-        }
-
-        rtc_callback = task;
-        spin_unlock(&rtc_task_lock);
-
-        rtc_status = RTC_OPEN;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_register);
-
-int rtc_unregister(rtc_task_t *task)
-{
-        spin_lock_irq(&rtc_task_lock);
-        if (task == NULL || rtc_callback != task) {
-                spin_unlock_irq(&rtc_task_lock);
-                return -ENXIO;
-        }
-
-        spin_lock(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock(&rtc_lock);
-
-        rtc_callback = NULL;
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_unregister);
-
-int rtc_control(rtc_task_t *task, unsigned int cmd, unsigned long arg)
-{
-        int retval = 0;
-
-        spin_lock_irq(&rtc_task_lock);
-
-        if (rtc_callback != task)
-                retval = -ENXIO;
-        else
-                rtc_do_ioctl(cmd, arg, FUNCTION_RTC_CONTROL);
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        return retval;
-}
-
-EXPORT_SYMBOL_GPL(rtc_control);
-
-static struct miscdevice rtc_miscdevice = {
-        .minor  = RTC_MINOR,
-        .name   = rtc_name,
-        .fops   = &rtc_fops,
-};
-
-static int __devinit rtc_probe(struct platform_device *pdev)
-{
-        unsigned int irq;
-        int retval;
-
-        if (pdev->num_resources != 2)
-                return -EBUSY;
-
-        rtc1_base = ioremap(pdev->resource[0].start, RTC1_SIZE);
-        if (rtc1_base == NULL)
-                return -EBUSY;
-
-        rtc2_base = ioremap(pdev->resource[1].start, RTC2_SIZE);
-        if (rtc2_base == NULL) {
-                iounmap(rtc1_base);
-                rtc1_base = NULL;
-                return -EBUSY;
-        }
-
-        retval = misc_register(&rtc_miscdevice);
-        if (retval < 0) {
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return retval;
-        }
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-        rtc_irq_data = 0;
-
-        spin_unlock_irq(&rtc_lock);
-
-        init_waitqueue_head(&rtc_wait);
-
-        irq = ELAPSEDTIME_IRQ;
-        retval = request_irq(irq, elapsedtime_interrupt, SA_INTERRUPT,
-                             "elapsed_time", NULL);
-        if (retval == 0) {
-                irq = RTCLONG1_IRQ;
-                retval = request_irq(irq, rtclong1_interrupt, SA_INTERRUPT,
-                                     "rtclong1", NULL);
-        }
-
-        if (retval < 0) {
-                printk(KERN_ERR "rtc: IRQ%d is busy\n", irq);
-                if (irq == RTCLONG1_IRQ)
-                        free_irq(ELAPSEDTIME_IRQ, NULL);
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return retval;
-        }
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        spin_lock_init(&rtc_task_lock);
-
-        printk(KERN_INFO "rtc: Real Time Clock of NEC VR4100 series\n");
-
-        return 0;
-}
-
-static int __devexit rtc_remove(struct platform_device *dev)
-{
-        int retval;
-
-        retval = misc_deregister(&rtc_miscdevice);
-        if (retval < 0)
-                return retval;
-
-        free_irq(ELAPSEDTIME_IRQ, NULL);
-        free_irq(RTCLONG1_IRQ, NULL);
-        if (rtc1_base != NULL)
-                iounmap(rtc1_base);
-        if (rtc2_base != NULL)
-                iounmap(rtc2_base);
-
-        return 0;
-}
-
-static struct platform_device *rtc_platform_device;
-
-static struct platform_driver rtc_device_driver = {
-        .probe          = rtc_probe,
-        .remove         = __devexit_p(rtc_remove),
-        .driver         = {
-                .name   = rtc_name,
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init vr41xx_rtc_init(void)
-{
-        int retval;
-
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                rtc_resource[0].start = RTC1_TYPE1_START;
-                rtc_resource[0].end = RTC1_TYPE1_END;
-                rtc_resource[1].start = RTC2_TYPE1_START;
-                rtc_resource[1].end = RTC2_TYPE1_END;
-                break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                rtc_resource[0].start = RTC1_TYPE2_START;
-                rtc_resource[0].end = RTC1_TYPE2_END;
-                rtc_resource[1].start = RTC2_TYPE2_START;
-                rtc_resource[1].end = RTC2_TYPE2_END;
-                break;
-        default:
-                return -ENODEV;
-                break;
-        }
-
-        rtc_platform_device = platform_device_alloc("RTC", -1);
-        if (!rtc_platform_device)
-                return -ENOMEM;
-
-        retval = platform_device_add_resources(rtc_platform_device,
-                                rtc_resource, ARRAY_SIZE(rtc_resource));
-
-        if (retval == 0)
-                retval = platform_device_add(rtc_platform_device);
-
-        if (retval < 0) {
-                platform_device_put(rtc_platform_device);
-                return retval;
-        }
-
-        retval = platform_driver_register(&rtc_device_driver);
-        if (retval < 0)
-                platform_device_unregister(rtc_platform_device);
-
-        return retval;
-}
-
-static void __exit vr41xx_rtc_exit(void)
-{
-        platform_driver_unregister(&rtc_device_driver);
-        platform_device_unregister(rtc_platform_device);
-}
-
-module_init(vr41xx_rtc_init);
-module_exit(vr41xx_rtc_exit);
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index 16e99db2e12d..d53f664a4dd8 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -60,6 +60,13 @@ config SOFT_WATCHDOG
 
 # ARM Architecture
 
+config AT91_WATCHDOG
+        tristate "AT91RM9200 watchdog"
+        depends on WATCHDOG && ARCH_AT91RM9200
+        help
+          Watchdog timer embedded into AT91RM9200 chips. This will reboot your
+          system when the timeout is reached.
+
 config 21285_WATCHDOG
         tristate "DC21285 watchdog"
         depends on WATCHDOG && FOOTBRIDGE
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index d6f27fde9905..6ab77b61a643 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_WDTPCI) += wdt_pci.o
 obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 
 # ARM Architecture
+obj-$(CONFIG_AT91_WATCHDOG) += at91_wdt.o
 obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
 obj-$(CONFIG_977_WATCHDOG) += wdt977.o
 obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
diff --git a/drivers/char/watchdog/at91_wdt.c b/drivers/char/watchdog/at91_wdt.c
new file mode 100644
index 000000000000..ac83bc4b019a
--- /dev/null
+++ b/drivers/char/watchdog/at91_wdt.c
@@ -0,0 +1,228 @@
+/*
+ * Watchdog driver for Atmel AT91RM9200 (Thunder)
+ *
+ *  Copyright (C) 2003 SAN People (Pty) Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+#include <asm/bitops.h>
+#include <asm/uaccess.h>
+
+
+#define WDT_DEFAULT_TIME        5       /* 5 seconds */
+#define WDT_MAX_TIME            256     /* 256 seconds */
+
+static int wdt_time = WDT_DEFAULT_TIME;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_time, int, 0);
+MODULE_PARM_DESC(wdt_time, "Watchdog time in seconds. (default="__MODULE_STRING(WDT_DEFAULT_TIME) ")");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+
+static unsigned long at91wdt_busy;
+
+/* ......................................................................... */
+
+/*
+ * Disable the watchdog.
+ */
+static void inline at91_wdt_stop(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN);
+}
+
+/*
+ * Enable and reset the watchdog.
+ */
+static void inline at91_wdt_start(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN | AT91_ST_RSTEN | (((65536 * wdt_time) >> 8) & AT91_ST_WDV));
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/*
+ * Reload the watchdog timer.  (ie, pat the watchdog)
+ */
+static void inline at91_wdt_reload(void)
+{
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/* ......................................................................... */
+
+/*
+ * Watchdog device is opened, and watchdog starts running.
+ */
+static int at91_wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(0, &at91wdt_busy))
+                return -EBUSY;
+
+        at91_wdt_start();
+        return nonseekable_open(inode, file);
+}
+
+/*
+ * Close the watchdog device.
+ * If CONFIG_WATCHDOG_NOWAYOUT is NOT defined then the watchdog is also
+ *  disabled.
+ */
+static int at91_wdt_close(struct inode *inode, struct file *file)
+{
+        if (!nowayout)
+                at91_wdt_stop();        /* Disable the watchdog when file is closed */
+
+        clear_bit(0, &at91wdt_busy);
+        return 0;
+}
+
+/*
+ * Change the watchdog time interval.
+ */
+static int at91_wdt_settimeout(int new_time)
+{
+        /*
+         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         *
+         * Since WDV is a 16-bit counter, the maximum period is
+         * 65536 / 0.256 = 256 seconds.
+         */
+        if ((new_time <= 0) || (new_time > WDT_MAX_TIME))
+                return -EINVAL;
+
+        /* Set new watchdog time. It will be used when at91_wdt_start() is called. */
+        wdt_time = new_time;
+        return 0;
+}
+
+static struct watchdog_info at91_wdt_info = {
+        .identity       = "at91 watchdog",
+        .options        = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+};
+
+/*
+ * Handle commands from user-space.
+ */
+static int at91_wdt_ioctl(struct inode *inode, struct file *file,
+                unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int new_value;
+
+        switch(cmd) {
+                case WDIOC_KEEPALIVE:
+                        at91_wdt_reload();      /* pat the watchdog */
+                        return 0;
+
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &at91_wdt_info, sizeof(at91_wdt_info)) ? -EFAULT : 0;
+
+                case WDIOC_SETTIMEOUT:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+                                
+                        if (at91_wdt_settimeout(new_value))
+                                return -EINVAL;
+
+                        /* Enable new time value */
+                        at91_wdt_start();
+
+                        /* Return current value */
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETTIMEOUT:
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETSTATUS:
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, p);
+
+                case WDIOC_SETOPTIONS:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+
+                        if (new_value & WDIOS_DISABLECARD)
+                                at91_wdt_stop();
+                        if (new_value & WDIOS_ENABLECARD)
+                                at91_wdt_start();
+                        return 0;
+
+                default:
+                        return -ENOIOCTLCMD;
+        }
+}
+
+/*
+ * Pat the watchdog whenever device is written to.
+ */
+static ssize_t at91_wdt_write(struct file *file, const char *data, size_t len, loff_t *ppos)
+{
+        at91_wdt_reload();              /* pat the watchdog */
+        return len;
+}
+
+/* ......................................................................... */
+
+static struct file_operations at91wdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .ioctl          = at91_wdt_ioctl,
+        .open           = at91_wdt_open,
+        .release        = at91_wdt_close,
+        .write          = at91_wdt_write,
+};
+
+static struct miscdevice at91wdt_miscdev = {
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &at91wdt_fops,
+};
+
+static int __init at91_wdt_init(void)
+{
+        int res;
+
+        /* Check that the heartbeat value is within range; if not reset to the default */
+        if (at91_wdt_settimeout(wdt_time)) {
+                at91_wdt_settimeout(WDT_DEFAULT_TIME);
+                printk(KERN_INFO "at91_wdt: wdt_time value must be 1 <= wdt_time <= 256, using %d\n", wdt_time);
+        }
+
+        res = misc_register(&at91wdt_miscdev);
+        if (res)
+                return res;
+
+        printk("AT91 Watchdog Timer enabled (%d seconds, nowayout=%d)\n", wdt_time, nowayout);
+        return 0;
+}
+
+static void __exit at91_wdt_exit(void)
+{
+        misc_deregister(&at91wdt_miscdev);
+}
+
+module_init(at91_wdt_init);
+module_exit(at91_wdt_exit);
+
+MODULE_AUTHOR("Andrew Victor");
+MODULE_DESCRIPTION("Watchdog driver for Atmel AT91RM9200");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 8d6b249ad66b..6d44ca68312d 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -66,15 +66,13 @@
 #include <linux/fs.h>           /* For file operations */
 #include <linux/ioport.h>       /* For io-port access */
 #include <linux/spinlock.h>     /* For spin_lock/spin_unlock/... */
-#include <linux/sched.h>        /* TASK_INTERRUPTIBLE, set_current_state() and friends */
-#include <linux/slab.h>         /* For kmalloc */
 
 #include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.16"
-#define WATCHDOG_DATE "03 Jan 2006"
+#define WATCHDOG_VERSION "1.17"
+#define WATCHDOG_DATE "12 Feb 2006"
 #define WATCHDOG_DRIVER_NAME "ISA-PC Watchdog"
 #define WATCHDOG_NAME "pcwd"
 #define PFX WATCHDOG_NAME ": "
@@ -96,15 +94,19 @@
  * PCI-PC Watchdog card.
 */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision A. */
-#define WD_WDRST                0x01    /* Previously reset state */
-#define WD_T110                 0x02    /* Temperature overheat sense */
-#define WD_HRTBT                0x04    /* Heartbeat sense */
-#define WD_RLY2                 0x08    /* External relay triggered */
-#define WD_SRLY2                0x80    /* Software external relay triggered */
+#define WD_WDRST                0x01    /* Previously reset state */
+#define WD_T110                 0x02    /* Temperature overheat sense */
+#define WD_HRTBT                0x04    /* Heartbeat sense */
+#define WD_RLY2                 0x08    /* External relay triggered */
+#define WD_SRLY2                0x80    /* Software external relay triggered */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision C. */
-#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
-#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
-#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
+#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
+#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_RL2A            0x08    /* Relay 2 activated by on-board processor */
+#define WD_REVC_RL1A            0x10    /* Relay 1 active */
+#define WD_REVC_R2DS            0x40    /* Relay 2 disable */
+#define WD_REVC_RLY2            0x80    /* Relay 2 activated? */
 /* Port 2 : Control Status #2 */
 #define WD_WDIS                 0x10    /* Watchdog Disabled */
 #define WD_ENTP                 0x20    /* Watchdog Enable Temperature Trip */
@@ -122,9 +124,14 @@
 #define CMD_ISA_VERSION_HUNDRETH        0x03
 #define CMD_ISA_VERSION_MINOR           0x04
 #define CMD_ISA_SWITCH_SETTINGS         0x05
+#define CMD_ISA_RESET_PC                0x06
+#define CMD_ISA_ARM_0                   0x07
+#define CMD_ISA_ARM_30                  0x08
+#define CMD_ISA_ARM_60                  0x09
 #define CMD_ISA_DELAY_TIME_2SECS        0x0A
 #define CMD_ISA_DELAY_TIME_4SECS        0x0B
 #define CMD_ISA_DELAY_TIME_8SECS        0x0C
+#define CMD_ISA_RESET_RELAYS            0x0D
 
 /*
  * We are using an kernel timer to do the pinging of the watchdog
@@ -142,6 +149,7 @@ static atomic_t open_allowed = ATOMIC_INIT(1);
 static char expect_close;
 static int temp_panic;
 static struct {                         /* this is private data for each ISA-PC watchdog card */
+        char fw_ver_str[6];             /* The cards firmware version */
         int revision;                   /* The card's revision */
         int supports_temp;              /* Wether or not the card has a temperature device */
         int command_mode;               /* Wether or not the card is in command mode */
@@ -153,6 +161,13 @@ static struct {				/* this is private data for each ISA-PC watchdog card */
 } pcwd_private;
 
 /* module parameters */
+#define QUIET   0       /* Default */
+#define VERBOSE 1       /* Verbose */
+#define DEBUG   2       /* print fancy stuff too */
+static int debug = QUIET;
+module_param(debug, int, 0);
+MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
+
 #define WATCHDOG_HEARTBEAT 60           /* 60 sec default heartbeat */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
@@ -172,6 +187,10 @@ static int send_isa_command(int cmd)
         int control_status;
         int port0, last_port0;  /* Double read for stabilising */
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "sending following data cmd=0x%02x\n",
+                        cmd);
+
         /* The WCMD bit must be 1 and the command is only 4 bits in size */
         control_status = (cmd & 0x0F) | WD_WCMD;
         outb_p(control_status, pcwd_private.io_addr + 2);
@@ -188,6 +207,10 @@ static int send_isa_command(int cmd)
                 udelay (250);
         }
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "received following data for cmd=0x%02x: port0=0x%02x last_port0=0x%02x\n",
+                        cmd, port0, last_port0);
+
         return port0;
 }
 
@@ -214,6 +237,10 @@ static int set_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
         pcwd_private.command_mode = found;
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
+
         return(found);
 }
 
@@ -226,6 +253,10 @@ static void unset_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
 
         pcwd_private.command_mode = 0;
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
 }
 
 static inline void pcwd_check_temperature_support(void)
@@ -234,27 +265,22 @@ static inline void pcwd_check_temperature_support(void)
                 pcwd_private.supports_temp = 1;
 }
 
-static inline char *get_firmware(void)
+static inline void pcwd_get_firmware(void)
 {
         int one, ten, hund, minor;
-        char *ret;
 
-        ret = kmalloc(6, GFP_KERNEL);
-        if(ret == NULL)
-                return NULL;
+        strcpy(pcwd_private.fw_ver_str, "ERROR");
 
         if (set_command_mode()) {
                 one = send_isa_command(CMD_ISA_VERSION_INTEGER);
                 ten = send_isa_command(CMD_ISA_VERSION_TENTH);
                 hund = send_isa_command(CMD_ISA_VERSION_HUNDRETH);
                 minor = send_isa_command(CMD_ISA_VERSION_MINOR);
-                sprintf(ret, "%c.%c%c%c", one, ten, hund, minor);
+                sprintf(pcwd_private.fw_ver_str, "%c.%c%c%c", one, ten, hund, minor);
         }
-        else
-                sprintf(ret, "ERROR");
-
         unset_command_mode();
-        return(ret);
+
+        return;
 }
 
 static inline int pcwd_get_option_switches(void)
@@ -272,17 +298,15 @@ static inline int pcwd_get_option_switches(void)
 
 static void pcwd_show_card_info(void)
 {
-        char *firmware;
         int option_switches;
 
         /* Get some extra info from the hardware (in command/debug/diag mode) */
         if (pcwd_private.revision == PCWD_REVISION_A)
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.A) detected at port 0x%04x\n", pcwd_private.io_addr);
         else if (pcwd_private.revision == PCWD_REVISION_C) {
-                firmware = get_firmware();
+                pcwd_get_firmware();
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.C) detected at port 0x%04x (Firmware version: %s)\n",
-                        pcwd_private.io_addr, firmware);
-                kfree(firmware);
+                        pcwd_private.io_addr, pcwd_private.fw_ver_str);
                 option_switches = pcwd_get_option_switches();
                 printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
                         option_switches,
@@ -362,6 +386,10 @@ static int pcwd_start(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog started\n");
+
         return 0;
 }
 
@@ -386,6 +414,10 @@ static int pcwd_stop(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog stopped\n");
+
         return 0;
 }
 
@@ -393,6 +425,10 @@ static int pcwd_keepalive(void)
 {
         /* user land ping */
         pcwd_private.next_heartbeat = jiffies + (heartbeat * HZ);
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "Watchdog keepalive signal send\n");
+
         return 0;
 }
 
@@ -402,12 +438,17 @@ static int pcwd_set_heartbeat(int t)
                 return -EINVAL;
 
         heartbeat = t;
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "New heartbeat: %d\n",
+                       heartbeat);
+
         return 0;
 }
 
 static int pcwd_get_status(int *status)
 {
-        int card_status;
+        int control_status;
 
         *status=0;
         spin_lock(&pcwd_private.io_lock);
@@ -415,37 +456,39 @@ static int pcwd_get_status(int *status)
                 /* Rev A cards return status information from
                  * the base register, which is used for the
                  * temperature in other cards. */
-                card_status = inb(pcwd_private.io_addr);
+                control_status = inb(pcwd_private.io_addr);
         else {
                 /* Rev C cards return card status in the base
                  * address + 1 register. And use different bits
                  * to indicate a card initiated reset, and an
                  * over-temperature condition. And the reboot
                  * status can be reset. */
-                card_status = inb(pcwd_private.io_addr + 1);
+                control_status = inb(pcwd_private.io_addr + 1);
         }
         spin_unlock(&pcwd_private.io_lock);
 
         if (pcwd_private.revision == PCWD_REVISION_A) {
-                if (card_status & WD_WDRST)
+                if (control_status & WD_WDRST)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_T110) {
+                if (control_status & WD_T110) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         } else {
-                if (card_status & WD_REVC_WTRP)
+                if (control_status & WD_REVC_WTRP)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_REVC_TTRP) {
+                if (control_status & WD_REVC_TTRP) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         }
@@ -455,9 +498,25 @@ static int pcwd_get_status(int *status)
 
 static int pcwd_clear_status(void)
 {
+        int control_status;
+
         if (pcwd_private.revision == PCWD_REVISION_C) {
                 spin_lock(&pcwd_private.io_lock);
-                outb_p(0x00, pcwd_private.io_addr + 1); /* clear reset status */
+
+                if (debug >= VERBOSE)
+                        printk(KERN_INFO PFX "clearing watchdog trip status\n");
+
+                control_status = inb_p(pcwd_private.io_addr + 1);
+
+                if (debug >= DEBUG) {
+                        printk(KERN_DEBUG PFX "status was: 0x%02x\n", control_status);
+                        printk(KERN_DEBUG PFX "sending: 0x%02x\n",
+                                (control_status & WD_REVC_R2DS));
+                }
+
+                /* clear reset status & Keep Relay 2 disable state as it is */
+                outb_p((control_status & WD_REVC_R2DS), pcwd_private.io_addr + 1);
+
                 spin_unlock(&pcwd_private.io_lock);
         }
         return 0;
@@ -481,6 +540,11 @@ static int pcwd_get_temperature(int *temperature)
         *temperature = ((inb(pcwd_private.io_addr)) * 9 / 5) + 32;
         spin_unlock(&pcwd_private.io_lock);
 
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "temperature is: %d F\n",
+                        *temperature);
+        }
+
         return 0;
 }
 
@@ -599,6 +663,8 @@ static ssize_t pcwd_write(struct file *file, const char __user *buf, size_t len,
 static int pcwd_open(struct inode *inode, struct file *file)
 {
         if (!atomic_dec_and_test(&open_allowed) ) {
+                if (debug >= VERBOSE)
+                        printk(KERN_ERR PFX "Attempt to open already opened device.\n");
                 atomic_inc( &open_allowed );
                 return -EBUSY;
         }
@@ -922,7 +988,8 @@ static void __exit pcwd_cleanup_module(void)
 {
         if (pcwd_private.io_addr)
                 pcwatchdog_exit();
-        return;
+
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(pcwd_init_module);
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 2700c5c45b8a..3fdfda9324fa 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -705,7 +705,8 @@ err_out_misc_deregister:
 err_out_unregister_reboot:
         unregister_reboot_notifier(&usb_pcwd_notifier);
 error:
-        usb_pcwd_delete (usb_pcwd);
+        if (usb_pcwd)
+                usb_pcwd_delete(usb_pcwd);
         usb_pcwd_device = NULL;
         return retval;
 }