68 files changed, 2648 insertions, 1777 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 889cad07774e..78d928f9d9f1 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -291,7 +291,7 @@ config SX
 
 config RIO
         tristate "Specialix RIO system support"
-        depends on SERIAL_NONSTANDARD && !64BIT
+        depends on SERIAL_NONSTANDARD
         help
           This is a driver for the Specialix RIO, a smart serial card which
           drives an outboard box that can support up to 128 ports.  Product
@@ -805,10 +805,6 @@ config S3C2410_RTC
           Samsung S3C2410. This can provide periodic interrupt rates
           from 1Hz to 64Hz for user programs, and wakeup from Alarm.
 
-config RTC_VR41XX
-        tristate "NEC VR4100 series Real Time Clock Support"
-        depends on CPU_VR41XX
-
 config COBALT_LCD
         bool "Support for Cobalt LCD"
         depends on MIPS_COBALT
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index a73cb4956928..fb919bfb2824 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -41,9 +41,9 @@ obj-$(CONFIG_N_HDLC)		+= n_hdlc.o
 obj-$(CONFIG_AMIGA_BUILTIN_SERIAL) += amiserial.o
 obj-$(CONFIG_SX)                += sx.o generic_serial.o
 obj-$(CONFIG_RIO)               += rio/ generic_serial.o
-obj-$(CONFIG_HVC_DRIVER)        += hvc_console.o
 obj-$(CONFIG_HVC_CONSOLE)       += hvc_vio.o hvsi.o
 obj-$(CONFIG_HVC_RTAS)          += hvc_rtas.o
+obj-$(CONFIG_HVC_DRIVER)        += hvc_console.o
 obj-$(CONFIG_RAW_DRIVER)        += raw.o
 obj-$(CONFIG_SGI_SNSC)          += snsc.o snsc_event.o
 obj-$(CONFIG_MMTIMER)           += mmtimer.o
@@ -67,7 +67,6 @@ obj-$(CONFIG_SGI_DS1286)	+= ds1286.o
 obj-$(CONFIG_SGI_IP27_RTC)      += ip27-rtc.o
 obj-$(CONFIG_DS1302)            += ds1302.o
 obj-$(CONFIG_S3C2410_RTC)       += s3c2410-rtc.o
-obj-$(CONFIG_RTC_VR41XX)        += vr41xx_rtc.o
 ifeq ($(CONFIG_GENERIC_NVRAM),y)
   obj-$(CONFIG_NVRAM)   += generic_nvram.o
 else
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 0b9cf9c59a21..7c88c060a9e6 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -86,7 +86,7 @@ config AGP_NVIDIA
 
 config AGP_SIS
         tristate "SiS chipset support"
-        depends on AGP && X86_32
+        depends on AGP
         help
           This option gives you AGP support for the GLX component of
           X on Silicon Integrated Systems [SiS] chipsets.
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 36517d4d1ad9..ac3c33a2e37d 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -617,6 +617,9 @@ static int agp_amd64_resume(struct pci_dev *pdev)
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
 
+        if (pdev->vendor == PCI_VENDOR_ID_NVIDIA)
+                nforce3_agp_init(pdev);
+
         return amd_8151_configure();
 }
 
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index fed0a87448d8..86a966b65236 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -64,6 +64,12 @@ static struct gatt_mask efficeon_generic_masks[] =
         {.mask = 0x00000001, .type = 0}
 };
 
+/* This function does the same thing as mask_memory() for this chipset... */
+static inline unsigned long efficeon_mask_memory(unsigned long addr)
+{
+        return addr | 0x00000001;
+}
+
 static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
 {
         {256, 65536, 0},
@@ -251,7 +257,7 @@ static int efficeon_insert_memory(struct agp_memory * mem, off_t pg_start, int t
         last_page = NULL;
         for (i = 0; i < count; i++) {
                 int index = pg_start + i;
-                unsigned long insert = mem->memory[i];
+                unsigned long insert = efficeon_mask_memory(mem->memory[i]);
 
                 page = (unsigned int *) efficeon_private.l1_table[index >> 10];
 
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 97b0a890ba7f..b8ec25d17478 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -345,6 +345,12 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata =
                 .chipset_name   = "PT880",
         },
 
+        /* PT880 Ultra */
+        {
+                .device_id      = PCI_DEVICE_ID_VIA_PT880ULTRA,
+                .chipset_name   = "PT880 Ultra",
+        },
+
         /* PT890 */
         {
                 .device_id      = PCI_DEVICE_ID_VIA_8783_0,
@@ -511,6 +517,7 @@ static struct pci_device_id agp_via_pci_table[] = {
         ID(PCI_DEVICE_ID_VIA_8763_0),
         ID(PCI_DEVICE_ID_VIA_8378_0),
         ID(PCI_DEVICE_ID_VIA_PT880),
+        ID(PCI_DEVICE_ID_VIA_PT880ULTRA),
         ID(PCI_DEVICE_ID_VIA_8783_0),
         ID(PCI_DEVICE_ID_VIA_PX8X0_0),
         ID(PCI_DEVICE_ID_VIA_3269_0),
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 927a5bbe112c..a370e7a0bad5 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -142,7 +142,7 @@ static int ac_register_board(unsigned long physloc, void __iomem *loc,
         if (!boardno)
                 boardno = readb(loc + NUMCARD_OWNER_TO_PC);
 
-        if (!boardno && boardno > MAX_BOARD) {
+        if (!boardno || boardno > MAX_BOARD) {
                 printk(KERN_WARNING "Board #%d (at 0x%lx) is out of range (1 <= x <= %d).\n",
                        boardno, physloc, MAX_BOARD);
                 return 0;
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 5d72f50de1ac..46d66037b917 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
         dev_t dev_id = MKDEV(major, 0);
+
+        cdev_del(&cs5535_gpio_cdev);
         unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-        if (gpio_base != 0)
-                release_region(gpio_base, CS5535_GPIO_SIZE);
+        release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(cs5535_gpio_init);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index edc72a6348a7..cb76e5ca9a23 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -815,8 +815,6 @@ extern int drm_mem_info(char *buf, char **start, off_t offset,
 extern void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area);
 extern void *drm_ioremap(unsigned long offset, unsigned long size,
                          drm_device_t * dev);
-extern void *drm_ioremap_nocache(unsigned long offset, unsigned long size,
-                                 drm_device_t * dev);
 extern void drm_ioremapfree(void *pt, unsigned long size, drm_device_t * dev);
 
 extern DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type);
@@ -891,7 +889,6 @@ extern int drm_lock_free(drm_device_t * dev,
                                 /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
-extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                       unsigned int size, drm_map_type_t type,
                       drm_map_flags_t flags, drm_local_map_t ** map_ptr);
@@ -1022,11 +1019,13 @@ static __inline__ void drm_core_ioremap(struct drm_map *map,
         map->handle = drm_ioremap(map->offset, map->size, dev);
 }
 
+#if 0
 static __inline__ void drm_core_ioremap_nocache(struct drm_map *map,
                                                 struct drm_device *dev)
 {
         map->handle = drm_ioremap_nocache(map->offset, map->size, dev);
 }
+#endif  /*  0  */
 
 static __inline__ void drm_core_ioremapfree(struct drm_map *map,
                                             struct drm_device *dev)
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index fabc930c67a2..40bfd9b01e39 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -503,8 +503,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start)
         return agp_bind_memory(handle, start);
 }
 
-EXPORT_SYMBOL(drm_agp_bind_memory);
-
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM * handle)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 8a9cf12e6183..006b06d29727 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -386,7 +386,6 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         return 0;
 }
-EXPORT_SYMBOL(drm_rmmap_locked);
 
 int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
@@ -398,7 +397,6 @@ int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 
         return ret;
 }
-EXPORT_SYMBOL(drm_rmmap);
 
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
  * the last close of the device, and this is necessary for cleanup when things
@@ -1053,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
         return 0;
 }
 
-int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
         drm_device_dma_t *dma = dev->dma;
         drm_buf_entry_t *entry;
@@ -1212,7 +1210,6 @@ int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
         atomic_dec(&dev->buf_alloc);
         return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_fb);
 
 
 /**
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index dc6bbe8a18dc..3c0b882a8e72 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -75,8 +75,8 @@ static drm_ioctl_desc_t drm_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = {drm_setsareactx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = {drm_getsareactx, DRM_AUTH},
 
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)] = {drm_modctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)] = {drm_getctx, DRM_AUTH},
         [DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)] = {drm_switchctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index dddf8de66143..7e3318e1d1c6 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -80,6 +80,71 @@ void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
 }
 
 #if __OS_HAS_AGP
+/*
+ * Find the drm_map that covers the range [offset, offset+size).
+ */
+static drm_map_t *drm_lookup_map(unsigned long offset,
+                                 unsigned long size, drm_device_t * dev)
+{
+        struct list_head *list;
+        drm_map_list_t *r_list;
+        drm_map_t *map;
+
+        list_for_each(list, &dev->maplist->head) {
+                r_list = (drm_map_list_t *) list;
+                map = r_list->map;
+                if (!map)
+                        continue;
+                if (map->offset <= offset
+                    && (offset + size) <= (map->offset + map->size))
+                        return map;
+        }
+        return NULL;
+}
+
+static void *agp_remap(unsigned long offset, unsigned long size,
+                       drm_device_t * dev)
+{
+        unsigned long *phys_addr_map, i, num_pages =
+            PAGE_ALIGN(size) / PAGE_SIZE;
+        struct drm_agp_mem *agpmem;
+        struct page **page_map;
+        void *addr;
+
+        size = PAGE_ALIGN(size);
+
+#ifdef __alpha__
+        offset -= dev->hose->mem_space->start;
+#endif
+
+        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
+                if (agpmem->bound <= offset
+                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
+                    (offset + size))
+                        break;
+        if (!agpmem)
+                return NULL;
+
+        /*
+         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
+         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
+         * page-table instead (that's probably faster anyhow...).
+         */
+        /* note: use vmalloc() because num_pages could be large... */
+        page_map = vmalloc(num_pages * sizeof(struct page *));
+        if (!page_map)
+                return NULL;
+
+        phys_addr_map =
+            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
+        for (i = 0; i < num_pages; ++i)
+                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
+        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
+        vfree(page_map);
+
+        return addr;
+}
+
 /** Wrapper around agp_allocate_memory() */
 DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type)
 {
@@ -103,5 +168,74 @@ int drm_unbind_agp(DRM_AGP_MEM * handle)
 {
         return drm_agp_unbind_memory(handle);
 }
+
+#else  /*  __OS_HAS_AGP  */
+
+static inline drm_map_t *drm_lookup_map(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        return NULL;
+}
+
+static inline void *agp_remap(unsigned long offset, unsigned long size,
+                              drm_device_t * dev)
+{
+        return NULL;
+}
+
 #endif                          /* agp */
+
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap(offset, size);
+}
+EXPORT_SYMBOL(drm_ioremap);
+
+#if 0
+void *drm_ioremap_nocache(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap_nocache(offset, size);
+}
+#endif  /*  0  */
+
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev)
+{
+        /*
+         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
+         * routines for handling mappings in the AGP space.  Hopefully this can be done in
+         * a future revision of the interface...
+         */
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
+            && ((unsigned long)pt >= VMALLOC_START
+                && (unsigned long)pt < VMALLOC_END)) {
+                unsigned long offset;
+                drm_map_t *map;
+
+                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
+                map = drm_lookup_map(offset, size, dev);
+                if (map && map->type == _DRM_AGP) {
+                        vunmap(pt);
+                        return;
+                }
+        }
+
+        iounmap(pt);
+}
+EXPORT_SYMBOL(drm_ioremapfree);
+
 #endif                          /* debug_memory */
diff --git a/drivers/char/drm/drm_memory.h b/drivers/char/drm/drm_memory.h
index 3732a61c3762..714d9aedcff5 100644
--- a/drivers/char/drm/drm_memory.h
+++ b/drivers/char/drm/drm_memory.h
@@ -57,71 +57,6 @@
 # endif
 #endif
 
-/*
- * Find the drm_map that covers the range [offset, offset+size).
- */
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        struct list_head *list;
-        drm_map_list_t *r_list;
-        drm_map_t *map;
-
-        list_for_each(list, &dev->maplist->head) {
-                r_list = (drm_map_list_t *) list;
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (map->offset <= offset
-                    && (offset + size) <= (map->offset + map->size))
-                        return map;
-        }
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        unsigned long *phys_addr_map, i, num_pages =
-            PAGE_ALIGN(size) / PAGE_SIZE;
-        struct drm_agp_mem *agpmem;
-        struct page **page_map;
-        void *addr;
-
-        size = PAGE_ALIGN(size);
-
-#ifdef __alpha__
-        offset -= dev->hose->mem_space->start;
-#endif
-
-        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
-                if (agpmem->bound <= offset
-                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
-                    (offset + size))
-                        break;
-        if (!agpmem)
-                return NULL;
-
-        /*
-         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
-         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
-         * page-table instead (that's probably faster anyhow...).
-         */
-        /* note: use vmalloc() because num_pages could be large... */
-        page_map = vmalloc(num_pages * sizeof(struct page *));
-        if (!page_map)
-                return NULL;
-
-        phys_addr_map =
-            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
-        for (i = 0; i < num_pages; ++i)
-                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
-        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
-        vfree(page_map);
-
-        return addr;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         pgd_t *pgd = pgd_offset_k((unsigned long)vaddr);
@@ -133,18 +68,6 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #else                           /* __OS_HAS_AGP */
 
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        return NULL;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         return 0;
@@ -152,51 +75,8 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #endif
 
-static inline void *drm_ioremap(unsigned long offset, unsigned long size,
-                                drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap(offset, size);
-}
-
-static inline void *drm_ioremap_nocache(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap_nocache(offset, size);
-}
-
-static inline void drm_ioremapfree(void *pt, unsigned long size,
-                                   drm_device_t * dev)
-{
-        /*
-         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
-         * routines for handling mappings in the AGP space.  Hopefully this can be done in
-         * a future revision of the interface...
-         */
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
-            && ((unsigned long)pt >= VMALLOC_START
-                && (unsigned long)pt < VMALLOC_END)) {
-                unsigned long offset;
-                drm_map_t *map;
-
-                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
-                map = drm_lookup_map(offset, size, dev);
-                if (map && map->type == _DRM_AGP) {
-                        vunmap(pt);
-                        return;
-                }
-        }
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev);
 
-        iounmap(pt);
-}
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev);
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index 7868341817da..6543b9a14c42 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -229,6 +229,7 @@ void *drm_ioremap (unsigned long offset, unsigned long size,
         return pt;
 }
 
+#if 0
 void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
                             drm_device_t * dev) {
         void *pt;
@@ -251,6 +252,7 @@ void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
         spin_unlock(&drm_mem_lock);
         return pt;
 }
+#endif  /*  0  */
 
 void drm_ioremapfree (void *pt, unsigned long size, drm_device_t * dev) {
         int alloc_count;
diff --git a/drivers/char/drm/drm_pci.c b/drivers/char/drm/drm_pci.c
index b28ca9cea8a2..86a0f1c22091 100644
--- a/drivers/char/drm/drm_pci.c
+++ b/drivers/char/drm/drm_pci.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include "drmP.h"
 
 /**********************************************************************/
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 68073e14fdec..9a842a36bb27 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -229,8 +229,6 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         return ret;
 }
 
-EXPORT_SYMBOL(drm_get_dev);
-
 /**
  * Put a device minor number.
  *
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index b108c7f913b2..26bdf2ca59d7 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -723,7 +723,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
         
         dev_priv->scratch_ages[header.scratch.reg]++;
         
-        ref_age_base = *(u32 **)cmdbuf->buf;
+        ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
         
         cmdbuf->buf += sizeof(u64);
         cmdbuf->bufsz -= sizeof(u64);
diff --git a/drivers/char/drm/via_irq.c b/drivers/char/drm/via_irq.c
index 6152415644e9..c33d068cde19 100644
--- a/drivers/char/drm/via_irq.c
+++ b/drivers/char/drm/via_irq.c
@@ -196,9 +196,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         unsigned int cur_irq_sequence;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int ret = 0;
-        maskarray_t *masks = dev_priv->irq_masks;
+        maskarray_t *masks;
         int real_irq;
 
         DRM_DEBUG("%s\n", __FUNCTION__);
@@ -221,8 +221,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
                           __FUNCTION__, irq);
                 return DRM_ERR(EINVAL);
         }
-        
-        cur_irq += real_irq;
+
+        masks = dev_priv->irq_masks;
+        cur_irq = dev_priv->via_irqs + real_irq;
 
         if (masks[real_irq][2] && !force_sequence) {
                 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
@@ -247,11 +248,12 @@ void via_driver_irq_preinstall(drm_device_t * dev)
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         u32 status;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int i;
 
         DRM_DEBUG("driver_irq_preinstall: dev_priv: %p\n", dev_priv);
         if (dev_priv) {
+                cur_irq = dev_priv->via_irqs;
 
                 dev_priv->irq_enable_mask = VIA_IRQ_VBLANK_ENABLE;
                 dev_priv->irq_pending_mask = VIA_IRQ_VBLANK_PENDING;
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index a229915ce1b2..87dcaa237f07 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -490,7 +490,7 @@ for (i = 0; i < 10; i++)			\
                 release_region(dtlk_portlist[i], DTLK_IO_EXTENT);
         }
 
-        printk(KERN_INFO "\nDoubleTalk PC - not found\n");
+        printk(KERN_INFO "DoubleTalk PC - not found\n");
         return -ENODEV;
 }
 
diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
index d3a2bc36129b..588fca542a98 100644
--- a/drivers/char/genrtc.c
+++ b/drivers/char/genrtc.c
@@ -200,13 +200,13 @@ static ssize_t gen_rtc_read(struct file *file, char __user *buf,
         /* first test allows optimizer to nuke this case for 32-bit machines */
         if (sizeof (int) != sizeof (long) && count == sizeof (unsigned int)) {
                 unsigned int uidata = data;
-                retval = put_user(uidata, (unsigned long __user *)buf);
+                retval = put_user(uidata, (unsigned int __user *)buf) ?:
+                        sizeof(unsigned int);
         }
         else {
-                retval = put_user(data, (unsigned long __user *)buf);
+                retval = put_user(data, (unsigned long __user *)buf) ?:
+                        sizeof(unsigned long);
         }
-        if (!retval)
-                retval = sizeof(unsigned long);
  out:
         current->state = TASK_RUNNING;
         remove_wait_queue(&gen_rtc_wait, &wait);
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 327b00c3c45e..8d97b3911293 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -904,7 +904,7 @@ static int hvcs_enable_device(struct hvcs_struct *hvcsd, uint32_t unit_address,
                  * It is possible the vty-server was removed after the irq was
                  * requested but before we have time to enable interrupts.
                  */
-                if (vio_enable_interrupts(vdev) == H_Success)
+                if (vio_enable_interrupts(vdev) == H_SUCCESS)
                         return 0;
                 else {
                         printk(KERN_ERR "HVCS: int enable failed for"
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 58dcdee1cd71..0030cd8e2e95 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct si_sm_data *bt,
 {
         unsigned int i;
 
-        if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+        if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
                return -1;
 
         if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 932feedda262..e1c95374984c 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -42,7 +42,7 @@
 #include <linux/slab.h>
 #include <linux/devfs_fs_kernel.h>
 #include <linux/ipmi.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/compat.h>
@@ -55,7 +55,7 @@ struct ipmi_file_private
         struct file          *file;
         struct fasync_struct *fasync_queue;
         wait_queue_head_t    wait;
-        struct semaphore     recv_sem;
+        struct mutex         recv_mutex;
         int                  default_retries;
         unsigned int         default_retry_time_ms;
 };
@@ -141,7 +141,7 @@ static int ipmi_open(struct inode *inode, struct file *file)
         INIT_LIST_HEAD(&(priv->recv_msgs));
         init_waitqueue_head(&priv->wait);
         priv->fasync_queue = NULL;
-        sema_init(&(priv->recv_sem), 1);
+        mutex_init(&priv->recv_mutex);
 
         /* Use the low-level defaults. */
         priv->default_retries = -1;
@@ -285,15 +285,15 @@ static int ipmi_ioctl(struct inode  *inode,
                         break;
                 }
 
-                /* We claim a semaphore because we don't want two
+                /* We claim a mutex because we don't want two
                    users getting something from the queue at a time.
                    Since we have to release the spinlock before we can
                    copy the data to the user, it's possible another
                    user will grab something from the queue, too.  Then
                    the messages might get out of order if something
                    fails and the message gets put back onto the
-                   queue.  This semaphore prevents that problem. */
-                down(&(priv->recv_sem));
+                   queue.  This mutex prevents that problem. */
+                mutex_lock(&priv->recv_mutex);
 
                 /* Grab the message off the list. */
                 spin_lock_irqsave(&(priv->recv_msg_lock), flags);
@@ -352,7 +352,7 @@ static int ipmi_ioctl(struct inode  *inode,
                         goto recv_putback_on_err;
                 }
 
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 ipmi_free_recv_msg(msg);
                 break;
 
@@ -362,11 +362,11 @@ static int ipmi_ioctl(struct inode  *inode,
                 spin_lock_irqsave(&(priv->recv_msg_lock), flags);
                 list_add(entry, &(priv->recv_msgs));
                 spin_unlock_irqrestore(&(priv->recv_msg_lock), flags);
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 break;
 
         recv_err:
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 break;
         }
 
diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
index da1554194d3d..2062675f9e99 100644
--- a/drivers/char/ipmi/ipmi_kcs_sm.c
+++ b/drivers/char/ipmi/ipmi_kcs_sm.c
@@ -227,7 +227,7 @@ static inline int check_ibf(struct si_sm_data *kcs, unsigned char status,
 static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
                             long time)
 {
-        if (! GET_STATUS_OBF(status)) {
+        if (!GET_STATUS_OBF(status)) {
                 kcs->obf_timeout -= time;
                 if (kcs->obf_timeout < 0) {
                     start_error_recovery(kcs, "OBF not ready in time");
@@ -407,7 +407,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                 }
 
                 if (state == KCS_READ_STATE) {
-                        if (! check_obf(kcs, status, time))
+                        if (!check_obf(kcs, status, time))
                                 return SI_SM_CALL_WITH_DELAY;
                         read_next_byte(kcs);
                 } else {
@@ -447,7 +447,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                                              "Not in read state for error2");
                         break;
                 }
-                if (! check_obf(kcs, status, time))
+                if (!check_obf(kcs, status, time))
                         return SI_SM_CALL_WITH_DELAY;
 
                 clear_obf(kcs, status);
@@ -462,7 +462,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                         break;
                 }
 
-                if (! check_obf(kcs, status, time))
+                if (!check_obf(kcs, status, time))
                         return SI_SM_CALL_WITH_DELAY;
 
                 clear_obf(kcs, status);
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 40eb005b9d77..9f2f8fdec69a 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -38,6 +38,7 @@
 #include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/slab.h>
 #include <linux/ipmi.h>
 #include <linux/ipmi_smi.h>
@@ -234,7 +235,7 @@ struct ipmi_smi
 
         /* The list of command receivers that are registered for commands
            on this interface. */
-        struct semaphore cmd_rcvrs_lock;
+        struct mutex     cmd_rcvrs_mutex;
         struct list_head cmd_rcvrs;
 
         /* Events that were queues because no one was there to receive
@@ -387,10 +388,10 @@ static void clean_up_interface_data(ipmi_smi_t intf)
 
         /* Wholesale remove all the entries from the list in the
          * interface and wait for RCU to know that none are in use. */
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         list_add_rcu(&list, &intf->cmd_rcvrs);
         list_del_rcu(&intf->cmd_rcvrs);
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         synchronize_rcu();
 
         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
@@ -557,7 +558,7 @@ unsigned int ipmi_addr_length(int addr_type)
 
 static void deliver_response(struct ipmi_recv_msg *msg)
 {
-        if (! msg->user) {
+        if (!msg->user) {
                 ipmi_smi_t    intf = msg->user_msg_data;
                 unsigned long flags;
 
@@ -598,11 +599,11 @@ static int intf_next_seq(ipmi_smi_t           intf,
              (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
              i = (i+1)%IPMI_IPMB_NUM_SEQ)
         {
-                if (! intf->seq_table[i].inuse)
+                if (!intf->seq_table[i].inuse)
                         break;
         }
 
-        if (! intf->seq_table[i].inuse) {
+        if (!intf->seq_table[i].inuse) {
                 intf->seq_table[i].recv_msg = recv_msg;
 
                 /* Start with the maximum timeout, when the send response
@@ -763,7 +764,7 @@ int ipmi_create_user(unsigned int          if_num,
         }
 
         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
-        if (! new_user)
+        if (!new_user)
                 return -ENOMEM;
 
         spin_lock_irqsave(&interfaces_lock, flags);
@@ -819,14 +820,13 @@ static void free_user(struct kref *ref)
 
 int ipmi_destroy_user(ipmi_user_t user)
 {
-        int              rv = -ENODEV;
         ipmi_smi_t       intf = user->intf;
         int              i;
         unsigned long    flags;
         struct cmd_rcvr  *rcvr;
         struct cmd_rcvr  *rcvrs = NULL;
 
-        user->valid = 1;
+        user->valid = 0;
 
         /* Remove the user from the interface's sequence table. */
         spin_lock_irqsave(&intf->seq_lock, flags);
@@ -847,7 +847,7 @@ int ipmi_destroy_user(ipmi_user_t user)
          * since other things may be using it till we do
          * synchronize_rcu()) then free everything in that list.
          */
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
                 if (rcvr->user == user) {
                         list_del_rcu(&rcvr->link);
@@ -855,7 +855,7 @@ int ipmi_destroy_user(ipmi_user_t user)
                         rcvrs = rcvr;
                 }
         }
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         synchronize_rcu();
         while (rcvrs) {
                 rcvr = rcvrs;
@@ -871,7 +871,7 @@ int ipmi_destroy_user(ipmi_user_t user)
 
         kref_put(&user->refcount, free_user);
 
-        return rv;
+        return 0;
 }
 
 void ipmi_get_version(ipmi_user_t   user,
@@ -936,10 +936,12 @@ int ipmi_set_gets_events(ipmi_user_t user, int val)
 
         if (val) {
                 /* Deliver any queued events. */
-                list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) {
+                list_for_each_entry_safe(msg, msg2, &intf->waiting_events,
+                                         link) {
                         list_del(&msg->link);
                         list_add_tail(&msg->link, &msgs);
                 }
+                intf->waiting_events_count = 0;
         }
 
         /* Hold the events lock while doing this to preserve order. */
@@ -978,13 +980,13 @@ int ipmi_register_for_cmd(ipmi_user_t   user,
 
 
         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
-        if (! rcvr)
+        if (!rcvr)
                 return -ENOMEM;
         rcvr->cmd = cmd;
         rcvr->netfn = netfn;
         rcvr->user = user;
 
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         /* Make sure the command/netfn is not already registered. */
         entry = find_cmd_rcvr(intf, netfn, cmd);
         if (entry) {
@@ -995,7 +997,7 @@ int ipmi_register_for_cmd(ipmi_user_t   user,
         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
 
  out_unlock:
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         if (rv)
                 kfree(rcvr);
 
@@ -1009,17 +1011,17 @@ int ipmi_unregister_for_cmd(ipmi_user_t   user,
         ipmi_smi_t      intf = user->intf;
         struct cmd_rcvr *rcvr;
 
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         /* Make sure the command/netfn is not already registered. */
         rcvr = find_cmd_rcvr(intf, netfn, cmd);
         if ((rcvr) && (rcvr->user == user)) {
                 list_del_rcu(&rcvr->link);
-                up(&intf->cmd_rcvrs_lock);
+                mutex_unlock(&intf->cmd_rcvrs_mutex);
                 synchronize_rcu();
                 kfree(rcvr);
                 return 0;
         } else {
-                up(&intf->cmd_rcvrs_lock);
+                mutex_unlock(&intf->cmd_rcvrs_mutex);
                 return -ENOENT;
         }
 }
@@ -1514,7 +1516,7 @@ int ipmi_request_settime(ipmi_user_t      user,
         unsigned char saddr, lun;
         int           rv;
 
-        if (! user)
+        if (!user)
                 return -EINVAL;
         rv = check_addr(user->intf, addr, &saddr, &lun);
         if (rv)
@@ -1545,7 +1547,7 @@ int ipmi_request_supply_msgs(ipmi_user_t          user,
         unsigned char saddr, lun;
         int           rv;
 
-        if (! user)
+        if (!user)
                 return -EINVAL;
         rv = check_addr(user->intf, addr, &saddr, &lun);
         if (rv)
@@ -1570,7 +1572,7 @@ static int ipmb_file_read_proc(char *page, char **start, off_t off,
         char       *out = (char *) page;
         ipmi_smi_t intf = data;
         int        i;
-        int        rv= 0;
+        int        rv = 0;
 
         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
@@ -1989,7 +1991,7 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
         } else {
                 bmc->dev = platform_device_alloc("ipmi_bmc",
                                                  bmc->id.device_id);
-                if (! bmc->dev) {
+                if (!bmc->dev) {
                         printk(KERN_ERR
                                "ipmi_msghandler:"
                                " Unable to allocate platform device\n");
@@ -2305,8 +2307,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                       void                     *send_info,
                       struct ipmi_device_id    *device_id,
                       struct device            *si_dev,
-                      unsigned char            slave_addr,
-                      ipmi_smi_t               *new_intf)
+                      unsigned char            slave_addr)
 {
         int              i, j;
         int              rv;
@@ -2366,7 +2367,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
         spin_lock_init(&intf->events_lock);
         INIT_LIST_HEAD(&intf->waiting_events);
         intf->waiting_events_count = 0;
-        init_MUTEX(&intf->cmd_rcvrs_lock);
+        mutex_init(&intf->cmd_rcvrs_mutex);
         INIT_LIST_HEAD(&intf->cmd_rcvrs);
         init_waitqueue_head(&intf->waitq);
 
@@ -2388,9 +2389,9 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
         if (rv)
                 goto out;
 
-        /* FIXME - this is an ugly kludge, this sets the intf for the
-           caller before sending any messages with it. */
-        *new_intf = intf;
+        rv = handlers->start_processing(send_info, intf);
+        if (rv)
+                goto out;
 
         get_guid(intf);
 
@@ -2622,7 +2623,7 @@ static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
                 spin_unlock_irqrestore(&intf->counter_lock, flags);
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -2777,7 +2778,7 @@ static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
                 spin_unlock_irqrestore(&intf->counter_lock, flags);
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -2869,13 +2870,14 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
            events. */
         rcu_read_lock();
         list_for_each_entry_rcu(user, &intf->users, link) {
-                if (! user->gets_events)
+                if (!user->gets_events)
                         continue;
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         rcu_read_unlock();
-                        list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
+                        list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
+                                                 link) {
                                 list_del(&recv_msg->link);
                                 ipmi_free_recv_msg(recv_msg);
                         }
@@ -2905,7 +2907,7 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
                 /* No one to receive the message, put it in queue if there's
                    not already too many things in the queue. */
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -2915,6 +2917,7 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
 
                 copy_event_into_recv_msg(recv_msg, msg);
                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
+                intf->waiting_events_count++;
         } else {
                 /* There's too many things in the queue, discard this
                    message. */
@@ -3190,7 +3193,7 @@ void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
 
         rcu_read_lock();
         list_for_each_entry_rcu(user, &intf->users, link) {
-                if (! user->handler->ipmi_watchdog_pretimeout)
+                if (!user->handler->ipmi_watchdog_pretimeout)
                         continue;
 
                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
@@ -3278,7 +3281,7 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
 
                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
                                             ent->seqid);
-                if (! smi_msg)
+                if (!smi_msg)
                         return;
 
                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
@@ -3314,8 +3317,9 @@ static void ipmi_timeout_handler(long timeout_period)
 
                 /* See if any waiting messages need to be processed. */
                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
-                list_for_each_entry_safe(smi_msg, smi_msg2, &intf->waiting_msgs, link) {
-                        if (! handle_new_recv_msg(intf, smi_msg)) {
+                list_for_each_entry_safe(smi_msg, smi_msg2,
+                                         &intf->waiting_msgs, link) {
+                        if (!handle_new_recv_msg(intf, smi_msg)) {
                                 list_del(&smi_msg->link);
                                 ipmi_free_smi_msg(smi_msg);
                         } else {
diff --git a/drivers/char/ipmi/ipmi_poweroff.c b/drivers/char/ipmi/ipmi_poweroff.c
index 786a2802ca34..d0b5c08e7b4e 100644
--- a/drivers/char/ipmi/ipmi_poweroff.c
+++ b/drivers/char/ipmi/ipmi_poweroff.c
@@ -346,7 +346,7 @@ static int ipmi_dell_chassis_detect (ipmi_user_t user)
 {
         const char ipmi_version_major = ipmi_version & 0xF;
         const char ipmi_version_minor = (ipmi_version >> 4) & 0xF;
-        const char mfr[3]=DELL_IANA_MFR_ID;
+        const char mfr[3] = DELL_IANA_MFR_ID;
         if (!memcmp(mfr, &mfg_id, sizeof(mfr)) &&
             ipmi_version_major <= 1 &&
             ipmi_version_minor < 5)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35fbd4d8ed4b..02a7dd7a8a55 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -803,7 +803,7 @@ static int ipmi_thread(void *data)
         set_user_nice(current, 19);
         while (!kthread_should_stop()) {
                 spin_lock_irqsave(&(smi_info->si_lock), flags);
-                smi_result=smi_event_handler(smi_info, 0);
+                smi_result = smi_event_handler(smi_info, 0);
                 spin_unlock_irqrestore(&(smi_info->si_lock), flags);
                 if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
                         /* do nothing */
@@ -972,10 +972,37 @@ static irqreturn_t si_bt_irq_handler(int irq, void *data, struct pt_regs *regs)
         return si_irq_handler(irq, data, regs);
 }
 
+static int smi_start_processing(void       *send_info,
+                                ipmi_smi_t intf)
+{
+        struct smi_info *new_smi = send_info;
+
+        new_smi->intf = intf;
+
+        /* Set up the timer that drives the interface. */
+        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
+        new_smi->last_timeout_jiffies = jiffies;
+        mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+
+        if (new_smi->si_type != SI_BT) {
+                new_smi->thread = kthread_run(ipmi_thread, new_smi,
+                                              "kipmi%d", new_smi->intf_num);
+                if (IS_ERR(new_smi->thread)) {
+                        printk(KERN_NOTICE "ipmi_si_intf: Could not start"
+                               " kernel thread due to error %ld, only using"
+                               " timers to drive the interface\n",
+                               PTR_ERR(new_smi->thread));
+                        new_smi->thread = NULL;
+                }
+        }
+
+        return 0;
+}
 
 static struct ipmi_smi_handlers handlers =
 {
         .owner                  = THIS_MODULE,
+        .start_processing       = smi_start_processing,
         .sender                 = sender,
         .request_events         = request_events,
         .set_run_to_completion  = set_run_to_completion,
@@ -987,7 +1014,7 @@ static struct ipmi_smi_handlers handlers =
 
 #define SI_MAX_PARMS 4
 static LIST_HEAD(smi_infos);
-static DECLARE_MUTEX(smi_infos_lock);
+static DEFINE_MUTEX(smi_infos_lock);
 static int smi_num; /* Used to sequence the SMIs */
 
 #define DEFAULT_REGSPACING      1
@@ -1157,20 +1184,20 @@ static void port_outl(struct si_sm_io *io, unsigned int offset,
 static void port_cleanup(struct smi_info *info)
 {
         unsigned int addr = info->io.addr_data;
-        int          mapsize;
+        int          idx;
 
         if (addr) {
-                mapsize = ((info->io_size * info->io.regspacing)
-                           - (info->io.regspacing - info->io.regsize));
-
-                release_region (addr, mapsize);
+                for (idx = 0; idx < info->io_size; idx++) {
+                        release_region(addr + idx * info->io.regspacing,
+                                       info->io.regsize);
+                }
         }
 }
 
 static int port_setup(struct smi_info *info)
 {
         unsigned int addr = info->io.addr_data;
-        int          mapsize;
+        int          idx;
 
         if (!addr)
                 return -ENODEV;
@@ -1198,16 +1225,22 @@ static int port_setup(struct smi_info *info)
                 return -EINVAL;
         }
 
-        /* Calculate the total amount of memory to claim.  This is an
-         * unusual looking calculation, but it avoids claiming any
-         * more memory than it has to.  It will claim everything
-         * between the first address to the end of the last full
-         * register. */
-        mapsize = ((info->io_size * info->io.regspacing)
-                   - (info->io.regspacing - info->io.regsize));
-
-        if (request_region(addr, mapsize, DEVICE_NAME) == NULL)
-                return -EIO;
+        /* Some BIOSes reserve disjoint I/O regions in their ACPI
+         * tables.  This causes problems when trying to register the
+         * entire I/O region.  Therefore we must register each I/O
+         * port separately.
+         */
+        for (idx = 0; idx < info->io_size; idx++) {
+                if (request_region(addr + idx * info->io.regspacing,
+                                   info->io.regsize, DEVICE_NAME) == NULL) {
+                        /* Undo allocations */
+                        while (idx--) {
+                                release_region(addr + idx * info->io.regspacing,
+                                               info->io.regsize);
+                        }
+                        return -EIO;
+                }
+        }
         return 0;
 }
 
@@ -2162,16 +2195,20 @@ static void setup_xaction_handlers(struct smi_info *smi_info)
 
 static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
 {
-        if (smi_info->thread != NULL && smi_info->thread != ERR_PTR(-ENOMEM))
-                kthread_stop(smi_info->thread);
-        del_timer_sync(&smi_info->si_timer);
+        if (smi_info->intf) {
+                /* The timer and thread are only running if the
+                   interface has been started up and registered. */
+                if (smi_info->thread != NULL)
+                        kthread_stop(smi_info->thread);
+                del_timer_sync(&smi_info->si_timer);
+        }
 }
 
-static struct ipmi_default_vals
+static __devinitdata struct ipmi_default_vals
 {
         int type;
         int port;
-} __devinit ipmi_defaults[] =
+} ipmi_defaults[] =
 {
         { .type = SI_KCS, .port = 0xca2 },
         { .type = SI_SMIC, .port = 0xca9 },
@@ -2245,7 +2282,7 @@ static int try_smi_init(struct smi_info *new_smi)
                        new_smi->slave_addr, new_smi->irq);
         }
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         if (!is_new_interface(new_smi)) {
                 printk(KERN_WARNING "ipmi_si: duplicate interface\n");
                 rv = -EBUSY;
@@ -2341,21 +2378,6 @@ static int try_smi_init(struct smi_info *new_smi)
         if (new_smi->irq)
                 new_smi->si_state = SI_CLEARING_FLAGS_THEN_SET_IRQ;
 
-        /* The ipmi_register_smi() code does some operations to
-           determine the channel information, so we must be ready to
-           handle operations before it is called.  This means we have
-           to stop the timer if we get an error after this point. */
-        init_timer(&(new_smi->si_timer));
-        new_smi->si_timer.data = (long) new_smi;
-        new_smi->si_timer.function = smi_timeout;
-        new_smi->last_timeout_jiffies = jiffies;
-        new_smi->si_timer.expires = jiffies + SI_TIMEOUT_JIFFIES;
-
-        add_timer(&(new_smi->si_timer));
-        if (new_smi->si_type != SI_BT)
-                new_smi->thread = kthread_run(ipmi_thread, new_smi,
-                                              "kipmi%d", new_smi->intf_num);
-
         if (!new_smi->dev) {
                 /* If we don't already have a device from something
                  * else (like PCI), then register a new one. */
@@ -2365,7 +2387,7 @@ static int try_smi_init(struct smi_info *new_smi)
                         printk(KERN_ERR
                                "ipmi_si_intf:"
                                " Unable to allocate platform device\n");
-                        goto out_err_stop_timer;
+                        goto out_err;
                 }
                 new_smi->dev = &new_smi->pdev->dev;
                 new_smi->dev->driver = &ipmi_driver;
@@ -2377,7 +2399,7 @@ static int try_smi_init(struct smi_info *new_smi)
                                " Unable to register system interface device:"
                                " %d\n",
                                rv);
-                        goto out_err_stop_timer;
+                        goto out_err;
                 }
                 new_smi->dev_registered = 1;
         }
@@ -2386,8 +2408,7 @@ static int try_smi_init(struct smi_info *new_smi)
                                new_smi,
                                &new_smi->device_id,
                                new_smi->dev,
-                               new_smi->slave_addr,
-                               &(new_smi->intf));
+                               new_smi->slave_addr);
         if (rv) {
                 printk(KERN_ERR
                        "ipmi_si: Unable to register device: error %d\n",
@@ -2417,7 +2438,7 @@ static int try_smi_init(struct smi_info *new_smi)
 
         list_add_tail(&new_smi->link, &smi_infos);
 
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         printk(" IPMI %s interface initialized\n",si_to_str[new_smi->si_type]);
 
@@ -2454,7 +2475,7 @@ static int try_smi_init(struct smi_info *new_smi)
 
         kfree(new_smi);
 
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         return rv;
 }
@@ -2512,26 +2533,26 @@ static __devinit int init_ipmi_si(void)
 #endif
 
         if (si_trydefaults) {
-                down(&smi_infos_lock);
+                mutex_lock(&smi_infos_lock);
                 if (list_empty(&smi_infos)) {
                         /* No BMC was found, try defaults. */
-                        up(&smi_infos_lock);
+                        mutex_unlock(&smi_infos_lock);
                         default_find_bmc();
                 } else {
-                        up(&smi_infos_lock);
+                        mutex_unlock(&smi_infos_lock);
                 }
         }
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         if (list_empty(&smi_infos)) {
-                up(&smi_infos_lock);
+                mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
                 printk("ipmi_si: Unable to find any System Interface(s)\n");
                 return -ENODEV;
         } else {
-                up(&smi_infos_lock);
+                mutex_unlock(&smi_infos_lock);
                 return 0;
         }
 }
@@ -2607,10 +2628,10 @@ static __exit void cleanup_ipmi_si(void)
         pci_unregister_driver(&ipmi_pci_driver);
 #endif
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
                 cleanup_one_si(e);
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         driver_unregister(&ipmi_driver);
 }
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 7ece9f3c8f70..2d11ddd99e55 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -39,6 +39,7 @@
 #include <linux/watchdog.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
+#include <linux/completion.h>
 #include <linux/rwsem.h>
 #include <linux/errno.h>
 #include <asm/uaccess.h>
@@ -303,21 +304,22 @@ static int ipmi_heartbeat(void);
 static void panic_halt_ipmi_heartbeat(void);
 
 
-/* We use a semaphore to make sure that only one thing can send a set
+/* We use a mutex to make sure that only one thing can send a set
    timeout at one time, because we only have one copy of the data.
-   The semaphore is claimed when the set_timeout is sent and freed
+   The mutex is claimed when the set_timeout is sent and freed
    when both messages are free. */
 static atomic_t set_timeout_tofree = ATOMIC_INIT(0);
-static DECLARE_MUTEX(set_timeout_lock);
+static DEFINE_MUTEX(set_timeout_lock);
+static DECLARE_COMPLETION(set_timeout_wait);
 static void set_timeout_free_smi(struct ipmi_smi_msg *msg)
 {
     if (atomic_dec_and_test(&set_timeout_tofree))
-            up(&set_timeout_lock);
+            complete(&set_timeout_wait);
 }
 static void set_timeout_free_recv(struct ipmi_recv_msg *msg)
 {
     if (atomic_dec_and_test(&set_timeout_tofree))
-            up(&set_timeout_lock);
+            complete(&set_timeout_wait);
 }
 static struct ipmi_smi_msg set_timeout_smi_msg =
 {
@@ -399,7 +401,7 @@ static int ipmi_set_timeout(int do_heartbeat)
 
 
         /* We can only send one of these at a time. */
-        down(&set_timeout_lock);
+        mutex_lock(&set_timeout_lock);
 
         atomic_set(&set_timeout_tofree, 2);
 
@@ -407,16 +409,21 @@ static int ipmi_set_timeout(int do_heartbeat)
                                 &set_timeout_recv_msg,
                                 &send_heartbeat_now);
         if (rv) {
-                up(&set_timeout_lock);
-        } else {
-                if ((do_heartbeat == IPMI_SET_TIMEOUT_FORCE_HB)
-                    || ((send_heartbeat_now)
-                        && (do_heartbeat == IPMI_SET_TIMEOUT_HB_IF_NECESSARY)))
-                {
-                        rv = ipmi_heartbeat();
-                }
+                mutex_unlock(&set_timeout_lock);
+                goto out;
         }
 
+        wait_for_completion(&set_timeout_wait);
+
+        if ((do_heartbeat == IPMI_SET_TIMEOUT_FORCE_HB)
+            || ((send_heartbeat_now)
+                && (do_heartbeat == IPMI_SET_TIMEOUT_HB_IF_NECESSARY)))
+        {
+                rv = ipmi_heartbeat();
+        }
+        mutex_unlock(&set_timeout_lock);
+
+out:
         return rv;
 }
 
@@ -458,17 +465,17 @@ static void panic_halt_ipmi_set_timeout(void)
    The semaphore is claimed when the set_timeout is sent and freed
    when both messages are free. */
 static atomic_t heartbeat_tofree = ATOMIC_INIT(0);
-static DECLARE_MUTEX(heartbeat_lock);
-static DECLARE_MUTEX_LOCKED(heartbeat_wait_lock);
+static DEFINE_MUTEX(heartbeat_lock);
+static DECLARE_COMPLETION(heartbeat_wait);
 static void heartbeat_free_smi(struct ipmi_smi_msg *msg)
 {
     if (atomic_dec_and_test(&heartbeat_tofree))
-            up(&heartbeat_wait_lock);
+            complete(&heartbeat_wait);
 }
 static void heartbeat_free_recv(struct ipmi_recv_msg *msg)
 {
     if (atomic_dec_and_test(&heartbeat_tofree))
-            up(&heartbeat_wait_lock);
+            complete(&heartbeat_wait);
 }
 static struct ipmi_smi_msg heartbeat_smi_msg =
 {
@@ -511,14 +518,14 @@ static int ipmi_heartbeat(void)
                 return ipmi_set_timeout(IPMI_SET_TIMEOUT_HB_IF_NECESSARY);
         }
 
-        down(&heartbeat_lock);
+        mutex_lock(&heartbeat_lock);
 
         atomic_set(&heartbeat_tofree, 2);
 
         /* Don't reset the timer if we have the timer turned off, that
            re-enables the watchdog. */
         if (ipmi_watchdog_state == WDOG_TIMEOUT_NONE) {
-                up(&heartbeat_lock);
+                mutex_unlock(&heartbeat_lock);
                 return 0;
         }
 
@@ -539,14 +546,14 @@ static int ipmi_heartbeat(void)
                                       &heartbeat_recv_msg,
                                       1);
         if (rv) {
-                up(&heartbeat_lock);
+                mutex_unlock(&heartbeat_lock);
                 printk(KERN_WARNING PFX "heartbeat failure: %d\n",
                        rv);
                 return rv;
         }
 
         /* Wait for the heartbeat to be sent. */
-        down(&heartbeat_wait_lock);
+        wait_for_completion(&heartbeat_wait);
 
         if (heartbeat_recv_msg.msg.data[0] != 0) {
             /* Got an error in the heartbeat response.  It was already
@@ -555,7 +562,7 @@ static int ipmi_heartbeat(void)
             rv = -EINVAL;
         }
 
-        up(&heartbeat_lock);
+        mutex_unlock(&heartbeat_lock);
 
         return rv;
 }
@@ -589,7 +596,7 @@ static void panic_halt_ipmi_heartbeat(void)
                                  1);
 }
 
-static struct watchdog_info ident=
+static struct watchdog_info ident =
 {
         .options        = 0,    /* WDIOF_SETTIMEOUT, */
         .firmware_version = 1,
@@ -790,13 +797,13 @@ static int ipmi_fasync(int fd, struct file *file, int on)
 
 static int ipmi_close(struct inode *ino, struct file *filep)
 {
-        if (iminor(ino)==WATCHDOG_MINOR)
-        {
+        if (iminor(ino) == WATCHDOG_MINOR) {
                 if (expect_close == 42) {
                         ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
                         ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
                 } else {
-                        printk(KERN_CRIT PFX "Unexpected close, not stopping watchdog!\n");
+                        printk(KERN_CRIT PFX
+                               "Unexpected close, not stopping watchdog!\n");
                         ipmi_heartbeat();
                 }
                 clear_bit(0, &ipmi_wdog_open);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index e5247f85a446..ef20c1fc9c4c 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -706,7 +706,6 @@ static int	stli_portcmdstats(stliport_t *portp);
 static int      stli_clrportstats(stliport_t *portp, comstats_t __user *cp);
 static int      stli_getportstruct(stliport_t __user *arg);
 static int      stli_getbrdstruct(stlibrd_t __user *arg);
-static void     *stli_memalloc(int len);
 static stlibrd_t *stli_allocbrd(void);
 
 static void     stli_ecpinit(stlibrd_t *brdp);
@@ -997,17 +996,6 @@ static int stli_parsebrd(stlconf_t *confp, char **argp)
 
 /*****************************************************************************/
 
-/*
- *      Local driver kernel malloc routine.
- */
-
-static void *stli_memalloc(int len)
-{
-        return((void *) kmalloc(len, GFP_KERNEL));
-}
-
-/*****************************************************************************/
-
 static int stli_open(struct tty_struct *tty, struct file *filp)
 {
         stlibrd_t       *brdp;
@@ -3227,13 +3215,12 @@ static int stli_initports(stlibrd_t *brdp)
 #endif
 
         for (i = 0, panelnr = 0, panelport = 0; (i < brdp->nrports); i++) {
-                portp = (stliport_t *) stli_memalloc(sizeof(stliport_t));
-                if (portp == (stliport_t *) NULL) {
+                portp = kzalloc(sizeof(stliport_t), GFP_KERNEL);
+                if (!portp) {
                         printk("STALLION: failed to allocate port structure\n");
                         continue;
                 }
 
-                memset(portp, 0, sizeof(stliport_t));
                 portp->magic = STLI_PORTMAGIC;
                 portp->portnr = i;
                 portp->brdnr = brdp->brdnr;
@@ -4610,14 +4597,13 @@ static stlibrd_t *stli_allocbrd(void)
 {
         stlibrd_t       *brdp;
 
-        brdp = (stlibrd_t *) stli_memalloc(sizeof(stlibrd_t));
-        if (brdp == (stlibrd_t *) NULL) {
+        brdp = kzalloc(sizeof(stlibrd_t), GFP_KERNEL);
+        if (!brdp) {
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlibrd_t));
-                return((stlibrd_t *) NULL);
+                return NULL;
         }
 
-        memset(brdp, 0, sizeof(stlibrd_t));
         brdp->magic = STLI_BOARDMAGIC;
         return(brdp);
 }
@@ -5210,12 +5196,12 @@ int __init stli_init(void)
 /*
  *      Allocate a temporary write buffer.
  */
-        stli_tmpwritebuf = (char *) stli_memalloc(STLI_TXBUFSIZE);
-        if (stli_tmpwritebuf == (char *) NULL)
+        stli_tmpwritebuf = kmalloc(STLI_TXBUFSIZE, GFP_KERNEL);
+        if (!stli_tmpwritebuf)
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", STLI_TXBUFSIZE);
-        stli_txcookbuf = stli_memalloc(STLI_TXBUFSIZE);
-        if (stli_txcookbuf == (char *) NULL)
+        stli_txcookbuf = kmalloc(STLI_TXBUFSIZE, GFP_KERNEL);
+        if (!stli_txcookbuf)
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", STLI_TXBUFSIZE);
 
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 8b603b2d1c42..5755b7e5f187 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -74,7 +74,7 @@ void compute_shiftstate(void);
         k_self,         k_fn,           k_spec,         k_pad,\
         k_dead,         k_cons,         k_cur,          k_shift,\
         k_meta,         k_ascii,        k_lock,         k_lowercase,\
-        k_slock,        k_dead2,        k_ignore,       k_ignore
+        k_slock,        k_dead2,        k_brl,          k_ignore
 
 typedef void (k_handler_fn)(struct vc_data *vc, unsigned char value,
                             char up_flag, struct pt_regs *regs);
@@ -100,7 +100,7 @@ static fn_handler_fn *fn_handler[] = { FN_HANDLERS };
 const int max_vals[] = {
         255, ARRAY_SIZE(func_table) - 1, ARRAY_SIZE(fn_handler) - 1, NR_PAD - 1,
         NR_DEAD - 1, 255, 3, NR_SHIFT - 1, 255, NR_ASCII - 1, NR_LOCK - 1,
-        255, NR_LOCK - 1, 255
+        255, NR_LOCK - 1, 255, NR_BRL - 1
 };
 
 const int NR_TYPES = ARRAY_SIZE(max_vals);
@@ -126,7 +126,7 @@ static unsigned long key_down[NBITS(KEY_MAX)];		/* keyboard key bitmap */
 static unsigned char shift_down[NR_SHIFT];              /* shift state counters.. */
 static int dead_key_next;
 static int npadch = -1;                                 /* -1 or number assembled on pad */
-static unsigned char diacr;
+static unsigned int diacr;
 static char rep;                                        /* flag telling character repeat */
 
 static unsigned char ledstate = 0xff;                   /* undefined */
@@ -394,22 +394,30 @@ void compute_shiftstate(void)
  * Otherwise, conclude that DIACR was not combining after all,
  * queue it and return CH.
  */
-static unsigned char handle_diacr(struct vc_data *vc, unsigned char ch)
+static unsigned int handle_diacr(struct vc_data *vc, unsigned int ch)
 {
-        int d = diacr;
+        unsigned int d = diacr;
         unsigned int i;
 
         diacr = 0;
 
-        for (i = 0; i < accent_table_size; i++) {
-                if (accent_table[i].diacr == d && accent_table[i].base == ch)
-                        return accent_table[i].result;
+        if ((d & ~0xff) == BRL_UC_ROW) {
+                if ((ch & ~0xff) == BRL_UC_ROW)
+                        return d | ch;
+        } else {
+                for (i = 0; i < accent_table_size; i++)
+                        if (accent_table[i].diacr == d && accent_table[i].base == ch)
+                                return accent_table[i].result;
         }
 
-        if (ch == ' ' || ch == d)
+        if (ch == ' ' || ch == (BRL_UC_ROW|0) || ch == d)
                 return d;
 
-        put_queue(vc, d);
+        if (kbd->kbdmode == VC_UNICODE)
+                to_utf8(vc, d);
+        else if (d < 0x100)
+                put_queue(vc, d);
+
         return ch;
 }
 
@@ -419,7 +427,10 @@ static unsigned char handle_diacr(struct vc_data *vc, unsigned char ch)
 static void fn_enter(struct vc_data *vc, struct pt_regs *regs)
 {
         if (diacr) {
-                put_queue(vc, diacr);
+                if (kbd->kbdmode == VC_UNICODE)
+                        to_utf8(vc, diacr);
+                else if (diacr < 0x100)
+                        put_queue(vc, diacr);
                 diacr = 0;
         }
         put_queue(vc, 13);
@@ -615,7 +626,7 @@ static void k_lowercase(struct vc_data *vc, unsigned char value, char up_flag, s
         printk(KERN_ERR "keyboard.c: k_lowercase was called - impossible\n");
 }
 
-static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+static void k_unicode(struct vc_data *vc, unsigned int value, char up_flag, struct pt_regs *regs)
 {
         if (up_flag)
                 return;         /* no action, if this is a key release */
@@ -628,7 +639,10 @@ static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct
                 diacr = value;
                 return;
         }
-        put_queue(vc, value);
+        if (kbd->kbdmode == VC_UNICODE)
+                to_utf8(vc, value);
+        else if (value < 0x100)
+                put_queue(vc, value);
 }
 
 /*
@@ -636,13 +650,23 @@ static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct
  * dead keys modifying the same character. Very useful
  * for Vietnamese.
  */
-static void k_dead2(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+static void k_deadunicode(struct vc_data *vc, unsigned int value, char up_flag, struct pt_regs *regs)
 {
         if (up_flag)
                 return;
         diacr = (diacr ? handle_diacr(vc, value) : value);
 }
 
+static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        k_unicode(vc, value, up_flag, regs);
+}
+
+static void k_dead2(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        k_deadunicode(vc, value, up_flag, regs);
+}
+
 /*
  * Obsolete - for backwards compatibility only
  */
@@ -650,7 +674,7 @@ static void k_dead(struct vc_data *vc, unsigned char value, char up_flag, struct
 {
         static unsigned char ret_diacr[NR_DEAD] = {'`', '\'', '^', '~', '"', ',' };
         value = ret_diacr[value];
-        k_dead2(vc, value, up_flag, regs);
+        k_deadunicode(vc, value, up_flag, regs);
 }
 
 static void k_cons(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
@@ -835,6 +859,80 @@ static void k_slock(struct vc_data *vc, unsigned char value, char up_flag, struc
         }
 }
 
+/* by default, 300ms interval for combination release */
+static unsigned brl_timeout = 300;
+MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for commit on first key release)");
+module_param(brl_timeout, uint, 0644);
+
+static unsigned brl_nbchords = 1;
+MODULE_PARM_DESC(brl_nbchords, "Number of chords that produce a braille pattern (0 for dead chords)");
+module_param(brl_nbchords, uint, 0644);
+
+static void k_brlcommit(struct vc_data *vc, unsigned int pattern, char up_flag, struct pt_regs *regs)
+{
+        static unsigned long chords;
+        static unsigned committed;
+
+        if (!brl_nbchords)
+                k_deadunicode(vc, BRL_UC_ROW | pattern, up_flag, regs);
+        else {
+                committed |= pattern;
+                chords++;
+                if (chords == brl_nbchords) {
+                        k_unicode(vc, BRL_UC_ROW | committed, up_flag, regs);
+                        chords = 0;
+                        committed = 0;
+                }
+        }
+}
+
+static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        static unsigned pressed,committing;
+        static unsigned long releasestart;
+
+        if (kbd->kbdmode != VC_UNICODE) {
+                if (!up_flag)
+                        printk("keyboard mode must be unicode for braille patterns\n");
+                return;
+        }
+
+        if (!value) {
+                k_unicode(vc, BRL_UC_ROW, up_flag, regs);
+                return;
+        }
+
+        if (value > 8)
+                return;
+
+        if (up_flag) {
+                if (brl_timeout) {
+                        if (!committing ||
+                            jiffies - releasestart > (brl_timeout * HZ) / 1000) {
+                                committing = pressed;
+                                releasestart = jiffies;
+                        }
+                        pressed &= ~(1 << (value - 1));
+                        if (!pressed) {
+                                if (committing) {
+                                        k_brlcommit(vc, committing, 0, regs);
+                                        committing = 0;
+                                }
+                        }
+                } else {
+                        if (committing) {
+                                k_brlcommit(vc, committing, 0, regs);
+                                committing = 0;
+                        }
+                        pressed &= ~(1 << (value - 1));
+                }
+        } else {
+                pressed |= 1 << (value - 1);
+                if (!brl_timeout)
+                        committing = pressed;
+        }
+}
+
 /*
  * The leds display either (i) the status of NumLock, CapsLock, ScrollLock,
  * or (ii) whatever pattern of lights people want to show using KDSETLED,
@@ -1125,9 +1223,13 @@ static void kbd_keycode(unsigned int keycode, int down,
         }
 
         if (keycode > NR_KEYS)
-                return;
+                if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
+                        keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
+                else
+                        return;
+        else
+                keysym = key_map[keycode];
 
-        keysym = key_map[keycode];
         type = KTYP(keysym);
 
         if (type < 0xf0) {
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 66719f9d294c..1fa9fa157c12 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,6 +27,7 @@
 #include <linux/crash_dump.h>
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -578,6 +579,18 @@ static ssize_t write_null(struct file * file, const char __user * buf,
         return count;
 }
 
+static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
+                        struct splice_desc *sd)
+{
+        return sd->len;
+}
+
+static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
+}
+
 #ifdef CONFIG_MMU
 /*
  * For fun, we are using the MMU for this.
@@ -785,6 +798,7 @@ static struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
+        .splice_write   = splice_write_null,
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index 8666171e187b..d3ba2f860ef0 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
         
-                        if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+                        if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {
                                 PRINTK_ERROR(KERN_ERR_MWAVE
                                                 "mwavedd::mwave_ioctl:"
                                                 " IOCTL_MW_REGISTER_IPC:"
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index ede365d05387..b9371d5bf790 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1384,8 +1384,10 @@ do_it_again:
                  * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
                  * we won't get any more characters.
                  */
-                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE)
+                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE) {
+                        n_tty_set_room(tty);
                         check_unthrottle(tty);
+                }
 
                 if (b - buf >= minimum)
                         break;
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 5fdf18515433..eab5394da666 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -46,7 +46,7 @@
 /* #define ATR_CSUM */
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -67,7 +67,7 @@ static char *version = "cm4000_cs.c v2.4.0gm6 - All bugs added by Harald Welte";
 #define T_100MSEC       msecs_to_jiffies(100)
 #define T_500MSEC       msecs_to_jiffies(500)
 
-static void cm4000_release(dev_link_t *link);
+static void cm4000_release(struct pcmcia_device *link);
 
 static int major;               /* major number we get from the kernel */
 
@@ -106,7 +106,7 @@ static int major;		/* major number we get from the kernel */
 #define REG_STOPBITS(x)         (x + 7)
 
 struct cm4000_dev {
-        dev_link_t link;                /* pcmcia link */
+        struct pcmcia_device *p_dev;
         dev_node_t node;                /* OS node (major,minor) */
 
         unsigned char atr[MAX_ATR];
@@ -149,14 +149,14 @@ struct cm4000_dev {
 #define ZERO_DEV(dev)                                           \
         memset(&dev->atr_csum,0,                                \
                 sizeof(struct cm4000_dev) -                     \
-                /*link*/ sizeof(dev_link_t) -                   \
+                /*link*/ sizeof(struct pcmcia_device *) -       \
                 /*node*/ sizeof(dev_node_t) -                   \
                 /*atr*/ MAX_ATR*sizeof(char) -                  \
                 /*rbuf*/ 512*sizeof(char) -                     \
                 /*sbuf*/ 512*sizeof(char) -                     \
                 /*queue*/ 4*sizeof(wait_queue_head_t))
 
-static dev_link_t *dev_table[CM4000_MAX_DEV];
+static struct pcmcia_device *dev_table[CM4000_MAX_DEV];
 static struct class *cmm_class;
 
 /* This table doesn't use spaces after the comma between fields and thus
@@ -454,7 +454,7 @@ static struct card_fixup card_fixups[] = {
 static void set_cardparameter(struct cm4000_dev *dev)
 {
         int i;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         u_int8_t stopbits = 0x02; /* ISO default */
 
         DEBUGP(3, dev, "-> set_cardparameter\n");
@@ -487,7 +487,7 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
         unsigned short num_bytes_read;
         unsigned char pts_reply[4];
         ssize_t rc;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
 
         rc = 0;
 
@@ -699,7 +699,7 @@ static void terminate_monitor(struct cm4000_dev *dev)
 static void monitor_card(unsigned long p)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) p;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         struct ptsreq ptsreq;
         int i, atrc;
@@ -962,7 +962,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
                         loff_t *ppos)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i, j, k;
 
@@ -971,7 +971,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
         if (count == 0)         /* according to manpage */
                 return 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1083,7 +1083,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         unsigned char tmp;
         unsigned char infolen;
@@ -1108,7 +1108,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
 
         sendT0 = dev->proto ? 0 : nr > 5 ? 0x08 : 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1440,8 +1440,8 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                      unsigned long arg)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
-        dev_link_t *link;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
+        struct pcmcia_device *link;
         int size;
         int rc;
         void __user *argp = (void __user *)arg;
@@ -1458,7 +1458,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                iminor(inode), ioctl_names[_IOC_NR(cmd)]);
 
         link = dev_table[iminor(inode)];
-        if (!(DEV_OK(link))) {
+        if (!pcmcia_dev_present(link)) {
                 DEBUGP(4, dev, "DEV_OK false\n");
                 return -ENODEV;
         }
@@ -1660,14 +1660,14 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
 static int cmm_open(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int rc, minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -1709,7 +1709,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
 static int cmm_close(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
@@ -1735,7 +1735,7 @@ static int cmm_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cmm_cm4000_release(dev_link_t * link)
+static void cmm_cm4000_release(struct pcmcia_device * link)
 {
         struct cm4000_dev *dev = link->priv;
 
@@ -1759,13 +1759,11 @@ static void cmm_cm4000_release(dev_link_t * link)
 
 /*==== Interface to PCMCIA Layer =======================================*/
 
-static void cm4000_config(dev_link_t * link, int devno)
+static int cm4000_config(struct pcmcia_device * link, int devno)
 {
-        client_handle_t handle = link->handle;
         struct cm4000_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
@@ -1777,41 +1775,34 @@ static void cm4000_config(dev_link_t * link, int devno)
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
         if ((fail_rc =
-             pcmcia_parse_tuple(handle, &tuple, &parse)) != CS_SUCCESS) {
+             pcmcia_parse_tuple(link, &tuple, &parse)) != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc =
-             pcmcia_get_configuration_info(handle, &conf)) != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
-             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(handle, &tuple)) {
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
+             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(link, &tuple)) {
 
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -1831,7 +1822,7 @@ static void cm4000_config(dev_link_t * link, int devno)
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                     & CISTPL_IO_LINES_MASK;
 
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
                 if (rc == CS_SUCCESS)
                         break;  /* we are done */
         }
@@ -1841,7 +1832,7 @@ static void cm4000_config(dev_link_t * link, int devno)
         link->conf.IntType = 00000002;
 
         if ((fail_rc =
-             pcmcia_request_configuration(handle, &link->conf)) != CS_SUCCESS) {
+             pcmcia_request_configuration(link, &link->conf)) != CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
                 goto cs_release;
         }
@@ -1851,63 +1842,48 @@ static void cm4000_config(dev_link_t * link, int devno)
         dev->node.major = major;
         dev->node.minor = devno;
         dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &dev->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         cm4000_release(link);
-
-        link->state &= ~DEV_CONFIG_PENDING;
+        return -ENODEV;
 }
 
-static int cm4000_suspend(struct pcmcia_device *p_dev)
+static int cm4000_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
         stop_monitor(dev);
 
         return 0;
 }
 
-static int cm4000_resume(struct pcmcia_device *p_dev)
+static int cm4000_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
         if (link->open)
                 start_monitor(dev);
 
         return 0;
 }
 
-static void cm4000_release(dev_link_t *link)
+static void cm4000_release(struct pcmcia_device *link)
 {
         cmm_cm4000_release(link->priv); /* delay release until device closed */
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int cm4000_attach(struct pcmcia_device *p_dev)
+static int cm4000_probe(struct pcmcia_device *link)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM4000_MAX_DEV; i++)
                 if (dev_table[i] == NULL)
@@ -1923,7 +1899,7 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         if (dev == NULL)
                 return -ENOMEM;
 
-        link = &dev->link;
+        dev->p_dev = link;
         link->priv = dev;
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -1933,11 +1909,9 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         init_waitqueue_head(&dev->atrq);
         init_waitqueue_head(&dev->readq);
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        cm4000_config(link, i);
+        ret = cm4000_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmm_class, NULL, MKDEV(major, i), NULL,
                             "cmm%d", i);
@@ -1945,9 +1919,8 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void cm4000_detach(struct pcmcia_device *p_dev)
+static void cm4000_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev = link->priv;
         int devno;
 
@@ -1958,11 +1931,9 @@ static void cm4000_detach(struct pcmcia_device *p_dev)
         if (devno == CM4000_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
         stop_monitor(dev);
 
-        if (link->state & DEV_CONFIG)
-                cm4000_release(link);
+        cm4000_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -1993,7 +1964,7 @@ static struct pcmcia_driver cm4000_driver = {
         .drv      = {
                 .name = "cm4000_cs",
                 },
-        .probe    = cm4000_attach,
+        .probe    = cm4000_probe,
         .remove   = cm4000_detach,
         .suspend  = cm4000_suspend,
         .resume   = cm4000_resume,
@@ -2010,10 +1981,6 @@ static int __init cmm_init(void)
         if (!cmm_class)
                 return -1;
 
-        rc = pcmcia_register_driver(&cm4000_driver);
-        if (rc < 0)
-                return rc;
-
         major = register_chrdev(0, DEVICE_NAME, &cm4000_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
@@ -2021,6 +1988,12 @@ static int __init cmm_init(void)
                 return -1;
         }
 
+        rc = pcmcia_register_driver(&cm4000_driver);
+        if (rc < 0) {
+                unregister_chrdev(major, DEVICE_NAME);
+                return rc;
+        }
+
         return 0;
 }
 
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 466e33bab029..47a8465bf95b 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -41,7 +41,7 @@
 
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -65,7 +65,7 @@ static char *version =
 /* how often to poll for fifo status change */
 #define POLL_PERIOD                             msecs_to_jiffies(10)
 
-static void reader_release(dev_link_t *link);
+static void reader_release(struct pcmcia_device *link);
 
 static int major;
 static struct class *cmx_class;
@@ -74,7 +74,7 @@ static struct class *cmx_class;
 #define         BS_WRITABLE     0x02
 
 struct reader_dev {
-        dev_link_t              link;
+        struct pcmcia_device    *p_dev;
         dev_node_t              node;
         wait_queue_head_t       devq;
         wait_queue_head_t       poll_wait;
@@ -87,7 +87,7 @@ struct reader_dev {
         struct timer_list       poll_timer;
 };
 
-static dev_link_t *dev_table[CM_MAX_DEV];
+static struct pcmcia_device *dev_table[CM_MAX_DEV];
 
 #ifndef PCMCIA_DEBUG
 #define xoutb   outb
@@ -116,7 +116,7 @@ static inline unsigned char xinb(unsigned short port)
 static void cm4040_do_poll(unsigned long dummy)
 {
         struct reader_dev *dev = (struct reader_dev *) dummy;
-        unsigned int obs = xinb(dev->link.io.BasePort1
+        unsigned int obs = xinb(dev->p_dev->io.BasePort1
                                 + REG_OFFSET_BUFFER_STATUS);
 
         if ((obs & BSR_BULK_IN_FULL)) {
@@ -147,7 +147,7 @@ static void cm4040_stop_poll(struct reader_dev *dev)
 static int wait_for_bulk_out_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -177,7 +177,7 @@ static int wait_for_bulk_out_ready(struct reader_dev *dev)
 /* Write to Sync Control Register */
 static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 {
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         int rc;
 
         rc = wait_for_bulk_out_ready(dev);
@@ -195,7 +195,7 @@ static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 static int wait_for_bulk_in_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -225,7 +225,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                         size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         size_t bytes_to_read;
         unsigned long i;
         size_t min_bytes_to_read;
@@ -246,7 +246,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT)==0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         for (i = 0; i < 5; i++) {
@@ -328,7 +328,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i;
         unsigned int bytes_to_write;
@@ -351,7 +351,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT) == 0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         bytes_to_write = count;
@@ -445,14 +445,14 @@ static unsigned int cm4040_poll(struct file *filp, poll_table *wait)
 static int cm4040_open(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -478,7 +478,7 @@ static int cm4040_open(struct inode *inode, struct file *filp)
 static int cm4040_close(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev = filp->private_data;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         DEBUGP(2, dev, "-> cm4040_close(maj/min=%d.%d)\n", imajor(inode),
@@ -500,7 +500,7 @@ static int cm4040_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cm4040_reader_release(dev_link_t *link)
+static void cm4040_reader_release(struct pcmcia_device *link)
 {
         struct reader_dev *dev = link->priv;
 
@@ -514,60 +514,49 @@ static void cm4040_reader_release(dev_link_t *link)
         return;
 }
 
-static void reader_config(dev_link_t *link, int devno)
+static int reader_config(struct pcmcia_device *link, int devno)
 {
-        client_handle_t handle;
         struct reader_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
 
-        handle = link->handle;
-
         tuple.DesiredTuple = CISTPL_CONFIG;
         tuple.Attributes = 0;
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_parse_tuple(handle, &tuple, &parse))
+        if ((fail_rc = pcmcia_parse_tuple(link, &tuple, &parse))
                                                         != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_configuration_info(handle, &conf))
-                                                        != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
              rc == CS_SUCCESS;
-             rc = pcmcia_get_next_tuple(handle, &tuple)) {
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+             rc = pcmcia_get_next_tuple(link, &tuple)) {
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -585,13 +574,13 @@ static void reader_config(dev_link_t *link, int devno)
                         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                                                 & CISTPL_IO_LINES_MASK;
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
 
-                dev_printk(KERN_INFO, &handle_to_dev(handle), "foo");
+                dev_printk(KERN_INFO, &handle_to_dev(link), "foo");
                 if (rc == CS_SUCCESS)
                         break;
                 else
-                        dev_printk(KERN_INFO, &handle_to_dev(handle),
+                        dev_printk(KERN_INFO, &handle_to_dev(link),
                                    "pcmcia_request_io failed 0x%x\n", rc);
         }
         if (rc != CS_SUCCESS)
@@ -599,10 +588,10 @@ static void reader_config(dev_link_t *link, int devno)
 
         link->conf.IntType = 00000002;
 
-        if ((fail_rc = pcmcia_request_configuration(handle,&link->conf))
+        if ((fail_rc = pcmcia_request_configuration(link,&link->conf))
                                                                 !=CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
-                dev_printk(KERN_INFO, &handle_to_dev(handle),
+                dev_printk(KERN_INFO, &handle_to_dev(link),
                            "pcmcia_request_configuration failed 0x%x\n",
                            fail_rc);
                 goto cs_release;
@@ -612,57 +601,31 @@ static void reader_config(dev_link_t *link, int devno)
         sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
         dev->node.major = major;
         dev->node.minor = devno;
-        dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        dev->node.next = &dev->node;
 
         DEBUGP(2, dev, "device " DEVICE_NAME "%d at 0x%.4x-0x%.4x\n", devno,
               link->io.BasePort1, link->io.BasePort1+link->io.NumPorts1);
         DEBUGP(2, dev, "<- reader_config (succ)\n");
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         reader_release(link);
-        link->state &= ~DEV_CONFIG_PENDING;
-}
-
-static int reader_suspend(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int reader_resume(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
+        return -ENODEV;
 }
 
-static void reader_release(dev_link_t *link)
+static void reader_release(struct pcmcia_device *link)
 {
         cm4040_reader_release(link->priv);
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int reader_attach(struct pcmcia_device *p_dev)
+static int reader_probe(struct pcmcia_device *link)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM_MAX_DEV; i++) {
                 if (dev_table[i] == NULL)
@@ -679,8 +642,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         dev->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
         dev->buffer_status = 0;
 
-        link = &dev->link;
         link->priv = dev;
+        dev->p_dev = link;
 
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -692,11 +655,9 @@ static int reader_attach(struct pcmcia_device *p_dev)
         init_timer(&dev->poll_timer);
         dev->poll_timer.function = &cm4040_do_poll;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        reader_config(link, i);
+        ret = reader_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
                             "cmx%d", i);
@@ -704,9 +665,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void reader_detach(struct pcmcia_device *p_dev)
+static void reader_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct reader_dev *dev = link->priv;
         int devno;
 
@@ -718,10 +678,7 @@ static void reader_detach(struct pcmcia_device *p_dev)
         if (devno == CM_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
-
-        if (link->state & DEV_CONFIG)
-                reader_release(link);
+        reader_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -753,10 +710,8 @@ static struct pcmcia_driver reader_driver = {
         .drv            = {
                 .name   = "cm4040_cs",
         },
-        .probe          = reader_attach,
+        .probe          = reader_probe,
         .remove         = reader_detach,
-        .suspend        = reader_suspend,
-        .resume         = reader_resume,
         .id_table       = cm4040_ids,
 };
 
@@ -769,16 +724,19 @@ static int __init cm4040_init(void)
         if (!cmx_class)
                 return -1;
 
-        rc = pcmcia_register_driver(&reader_driver);
-        if (rc < 0)
-                return rc;
-
         major = register_chrdev(0, DEVICE_NAME, &reader_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
                         ": could not get major number\n");
                 return -1;
         }
+
+        rc = pcmcia_register_driver(&reader_driver);
+        if (rc < 0) {
+                unregister_chrdev(major, DEVICE_NAME);
+                return rc;
+        }
+
         return 0;
 }
 
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index e6b714b6390d..07213454c458 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -228,7 +228,7 @@ typedef struct _mgslpc_info {
         struct  _input_signal_events    input_signal_events;
 
         /* PCMCIA support */
-        dev_link_t            link;
+        struct pcmcia_device    *p_dev;
         dev_node_t            node;
         int                   stop;
 
@@ -484,7 +484,7 @@ static void mgslpc_wait_until_sent(struct tty_struct *tty, int timeout);
 
 /* PCMCIA prototypes */
 
-static void mgslpc_config(dev_link_t *link);
+static int mgslpc_config(struct pcmcia_device *link);
 static void mgslpc_release(u_long arg);
 static void mgslpc_detach(struct pcmcia_device *p_dev);
 
@@ -533,14 +533,14 @@ static void ldisc_receive_buf(struct tty_struct *tty,
         }
 }
 
-static int mgslpc_attach(struct pcmcia_device *p_dev)
+static int mgslpc_probe(struct pcmcia_device *link)
 {
     MGSLPC_INFO *info;
-    dev_link_t *link;
-    
+    int ret;
+
     if (debug_level >= DEBUG_LEVEL_INFO)
             printk("mgslpc_attach\n");
-        
+
     info = (MGSLPC_INFO *)kmalloc(sizeof(MGSLPC_INFO), GFP_KERNEL);
     if (!info) {
             printk("Error can't allocate device instance data\n");
@@ -565,25 +565,22 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
     info->imrb_value = 0xffff;
     info->pim_value = 0xff;
 
-    link = &info->link;
+    info->p_dev = link;
     link->priv = info;
-    
-    /* Initialize the dev_link_t structure */
+
+    /* Initialize the struct pcmcia_device structure */
 
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1   = IRQ_LEVEL_ID;
     link->irq.Handler = NULL;
-    
+
     link->conf.Attributes = 0;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    mgslpc_config(link);
+    ret = mgslpc_config(link);
+    if (ret)
+            return ret;
 
     mgslpc_add_device(info);
 
@@ -596,15 +593,13 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void mgslpc_config(dev_link_t *link)
+static int mgslpc_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     MGSLPC_INFO *info = link->priv;
     tuple_t tuple;
     cisparse_t parse;
     int last_fn, last_ret;
     u_char buf[64];
-    config_info_t conf;
     cistpl_cftable_entry_t dflt = { 0 };
     cistpl_cftable_entry_t *cfg;
     
@@ -617,27 +612,20 @@ static void mgslpc_config(dev_link_t *link)
     tuple.TupleData = buf;
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
-    /* Look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
 
     /* get CIS configuration entry */
 
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
 
     cfg = &(parse.cftable_entry);
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
 
     if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
     if (cfg->index == 0)
@@ -658,11 +646,10 @@ static void mgslpc_config(dev_link_t *link)
             link->io.IOAddrLines = io->flags & CISTPL_IO_LINES_MASK;
             link->io.BasePort1 = io->win[0].base;
             link->io.NumPorts1 = io->win[0].len;
-            CS_CHECK(RequestIO, pcmcia_request_io(link->handle, &link->io));
+            CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
     }
 
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 8;
     link->conf.Present = PRESENT_OPTION;
@@ -670,9 +657,9 @@ static void mgslpc_config(dev_link_t *link)
     link->irq.Attributes |= IRQ_HANDLE_PRESENT;
     link->irq.Handler     = mgslpc_isr;
     link->irq.Instance    = info;
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     info->io_base = link->io.BasePort1;
     info->irq_level = link->irq.AssignedIRQ;
@@ -680,7 +667,7 @@ static void mgslpc_config(dev_link_t *link)
     /* add to linked list of devices */
     sprintf(info->node.dev_name, "mgslpc0");
     info->node.major = info->node.minor = 0;
-    link->dev = &info->node;
+    link->dev_node = &info->node;
 
     printk(KERN_INFO "%s: index 0x%02x:",
            info->node.dev_name, link->conf.ConfigIndex);
@@ -690,13 +677,12 @@ static void mgslpc_config(dev_link_t *link)
             printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                    link->io.BasePort1+link->io.NumPorts1-1);
     printk("\n");
-    
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     mgslpc_release((u_long)link);
+    return -ENODEV;
 }
 
 /* Card has been removed.
@@ -705,58 +691,38 @@ cs_failed:
  */
 static void mgslpc_release(u_long arg)
 {
-    dev_link_t *link = (dev_link_t *)arg;
+        struct pcmcia_device *link = (struct pcmcia_device *)arg;
 
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_release(0x%p)\n", link);
-
-    /* Unlink the device chain */
-    link->dev = NULL;
-    link->state &= ~DEV_CONFIG;
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_release(0x%p)\n", link);
 
-    pcmcia_release_configuration(link->handle);
-    if (link->io.NumPorts1)
-            pcmcia_release_io(link->handle, &link->io);
-    if (link->irq.AssignedIRQ)
-            pcmcia_release_irq(link->handle, &link->irq);
+        pcmcia_disable_device(link);
 }
 
-static void mgslpc_detach(struct pcmcia_device *p_dev)
+static void mgslpc_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_detach(0x%p)\n", link);
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG) {
-            ((MGSLPC_INFO *)link->priv)->stop = 1;
-            mgslpc_release((u_long)link);
-    }
+        ((MGSLPC_INFO *)link->priv)->stop = 1;
+        mgslpc_release((u_long)link);
 
-    mgslpc_remove_device((MGSLPC_INFO *)link->priv);
+        mgslpc_remove_device((MGSLPC_INFO *)link->priv);
 }
 
-static int mgslpc_suspend(struct pcmcia_device *dev)
+static int mgslpc_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state |= DEV_SUSPEND;
         info->stop = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int mgslpc_resume(struct pcmcia_device *dev)
+static int mgslpc_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         info->stop = 0;
 
         return 0;
@@ -1280,7 +1246,7 @@ static irqreturn_t mgslpc_isr(int irq, void *dev_id, struct pt_regs * regs)
         if (!info)
                 return IRQ_NONE;
                 
-        if (!(info->link.state & DEV_CONFIG))
+        if (!(info->p_dev->_locked))
                 return IRQ_HANDLED;
 
         spin_lock(&info->lock);
@@ -3033,7 +2999,7 @@ static struct pcmcia_driver mgslpc_driver = {
         .drv            = {
                 .name   = "synclink_cs",
         },
-        .probe          = mgslpc_attach,
+        .probe          = mgslpc_probe,
         .remove         = mgslpc_detach,
         .id_table       = mgslpc_ids,
         .suspend        = mgslpc_suspend,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 86be04b241e1..58f3512c52e1 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1584,7 +1584,6 @@ u32 secure_ipv6_port_ephemeral(const __u32 *saddr, const __u32 *daddr, __u16 dpo
 
         return twothirdsMD4Transform(daddr, hash);
 }
-EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
diff --git a/drivers/char/rio/host.h b/drivers/char/rio/host.h
index 3ec73d1a279a..179cdbea712b 100644
--- a/drivers/char/rio/host.h
+++ b/drivers/char/rio/host.h
@@ -33,12 +33,6 @@
 #ifndef __rio_host_h__
 #define __rio_host_h__
 
-#ifdef SCCS_LABELS
-#ifndef lint
-static char *_host_h_sccs_ = "@(#)host.h        1.2";
-#endif
-#endif
-
 /*
 ** the host structure - one per host card in the system.
 */
@@ -77,9 +71,6 @@ struct Host {
 #define RC_STARTUP            1
 #define RC_RUNNING            2
 #define RC_STUFFED            3
-#define RC_SOMETHING          4
-#define RC_SOMETHING_NEW      5
-#define RC_SOMETHING_ELSE     6
 #define RC_READY              7
 #define RUN_STATE             7
 /*
diff --git a/drivers/char/rio/rioboot.c b/drivers/char/rio/rioboot.c
index acda9326c2ef..290143addd34 100644
--- a/drivers/char/rio/rioboot.c
+++ b/drivers/char/rio/rioboot.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include <linux/termios.h>
 #include <linux/serial.h>
+#include <linux/vmalloc.h>
 #include <asm/semaphore.h>
 #include <linux/generic_serial.h>
 #include <linux/errno.h>
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index d31aba62bb7f..75b2557c37ec 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -1394,14 +1394,17 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
                 return RIO_FAIL;
         }
 
-        if (((int) ((char) PortP->InUse) == -1) || !(CmdBlkP = RIOGetCmdBlk())) {
-                rio_dprintk(RIO_DEBUG_CTRL, "Cannot allocate command block for command %d on port %d\n", Cmd, PortP->PortNum);
+        if ((PortP->InUse == (typeof(PortP->InUse))-1) ||
+                        !(CmdBlkP = RIOGetCmdBlk())) {
+                rio_dprintk(RIO_DEBUG_CTRL, "Cannot allocate command block "
+                        "for command %d on port %d\n", Cmd, PortP->PortNum);
                 return RIO_FAIL;
         }
 
-        rio_dprintk(RIO_DEBUG_CTRL, "Command blk %p - InUse now %d\n", CmdBlkP, PortP->InUse);
+        rio_dprintk(RIO_DEBUG_CTRL, "Command blk %p - InUse now %d\n",
+                        CmdBlkP, PortP->InUse);
 
-        PktCmdP = (struct PktCmd_M *) &CmdBlkP->Packet.data[0];
+        PktCmdP = (struct PktCmd_M *)&CmdBlkP->Packet.data[0];
 
         CmdBlkP->Packet.src_unit = 0;
         if (PortP->SecondBlock)
@@ -1425,38 +1428,46 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
 
         switch (Cmd) {
         case MEMDUMP:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MEMDUMP command blk %p (addr 0x%x)\n", CmdBlkP, (int) SubCmd.Addr);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MEMDUMP command blk %p "
+                                "(addr 0x%x)\n", CmdBlkP, (int) SubCmd.Addr);
                 PktCmdP->SubCommand = MEMDUMP;
                 PktCmdP->SubAddr = SubCmd.Addr;
                 break;
         case FCLOSE:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue FCLOSE command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue FCLOSE command blk %p\n",
+                                CmdBlkP);
                 break;
         case READ_REGISTER:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue READ_REGISTER (0x%x) command blk %p\n", (int) SubCmd.Addr, CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue READ_REGISTER (0x%x) "
+                                "command blk %p\n", (int) SubCmd.Addr, CmdBlkP);
                 PktCmdP->SubCommand = READ_REGISTER;
                 PktCmdP->SubAddr = SubCmd.Addr;
                 break;
         case RESUME:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue RESUME command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue RESUME command blk %p\n",
+                                CmdBlkP);
                 break;
         case RFLUSH:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue RFLUSH command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue RFLUSH command blk %p\n",
+                                CmdBlkP);
                 CmdBlkP->PostFuncP = RIORFlushEnable;
                 break;
         case SUSPEND:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue SUSPEND command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue SUSPEND command blk %p\n",
+                                CmdBlkP);
                 break;
 
         case MGET:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MGET command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MGET command blk %p\n",
+                                CmdBlkP);
                 break;
 
         case MSET:
         case MBIC:
         case MBIS:
                 CmdBlkP->Packet.data[4] = (char) PortP->ModemLines;
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MSET/MBIC/MBIS command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MSET/MBIC/MBIS command "
+                                "blk %p\n", CmdBlkP);
                 break;
 
         case WFLUSH:
@@ -1465,12 +1476,14 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
                  ** allowed then we should not bother sending any more to the
                  ** RTA.
                  */
-                if ((int) ((char) PortP->WflushFlag) == (int) -1) {
-                        rio_dprintk(RIO_DEBUG_CTRL, "Trashed WFLUSH, WflushFlag about to wrap!");
+                if (PortP->WflushFlag == (typeof(PortP->WflushFlag))-1) {
+                        rio_dprintk(RIO_DEBUG_CTRL, "Trashed WFLUSH, "
+                                        "WflushFlag about to wrap!");
                         RIOFreeCmdBlk(CmdBlkP);
                         return (RIO_FAIL);
                 } else {
-                        rio_dprintk(RIO_DEBUG_CTRL, "Queue WFLUSH command blk %p\n", CmdBlkP);
+                        rio_dprintk(RIO_DEBUG_CTRL, "Queue WFLUSH command "
+                                        "blk %p\n", CmdBlkP);
                         CmdBlkP->PostFuncP = RIOWFlushMark;
                 }
                 break;
diff --git a/drivers/char/rio/rioioctl.h b/drivers/char/rio/rioioctl.h
index 14b83fae75c8..e8af5b30519e 100644
--- a/drivers/char/rio/rioioctl.h
+++ b/drivers/char/rio/rioioctl.h
@@ -33,10 +33,6 @@
 #ifndef __rioioctl_h__
 #define __rioioctl_h__
 
-#ifdef SCCS_LABELS
-static char *_rioioctl_h_sccs_ = "@(#)rioioctl.h        1.2";
-#endif
-
 /*
 ** RIO device driver - user ioctls and associated structures.
 */
@@ -44,55 +40,13 @@ static char *_rioioctl_h_sccs_ = "@(#)rioioctl.h	1.2";
 struct portStats {
         int port;
         int gather;
-        ulong txchars;
-        ulong rxchars;
-        ulong opens;
-        ulong closes;
-        ulong ioctls;
+        unsigned long txchars;
+        unsigned long rxchars;
+        unsigned long opens;
+        unsigned long closes;
+        unsigned long ioctls;
 };
 
-
-#define rIOC    ('r'<<8)
-#define TCRIOSTATE      (rIOC | 1)
-#define TCRIOXPON       (rIOC | 2)
-#define TCRIOXPOFF      (rIOC | 3)
-#define TCRIOXPCPS      (rIOC | 4)
-#define TCRIOXPRINT     (rIOC | 5)
-#define TCRIOIXANYON    (rIOC | 6)
-#define TCRIOIXANYOFF   (rIOC | 7)
-#define TCRIOIXONON     (rIOC | 8)
-#define TCRIOIXONOFF    (rIOC | 9)
-#define TCRIOMBIS       (rIOC | 10)
-#define TCRIOMBIC       (rIOC | 11)
-#define TCRIOTRIAD      (rIOC | 12)
-#define TCRIOTSTATE     (rIOC | 13)
-
-/*
-** 15.10.1998 ARG - ESIL 0761 part fix
-** Add RIO ioctls for manipulating RTS and CTS flow control, (as LynxOS
-** appears to not support hardware flow control).
-*/
-#define TCRIOCTSFLOWEN  (rIOC | 14)     /* enable CTS flow control */
-#define TCRIOCTSFLOWDIS (rIOC | 15)     /* disable CTS flow control */
-#define TCRIORTSFLOWEN  (rIOC | 16)     /* enable RTS flow control */
-#define TCRIORTSFLOWDIS (rIOC | 17)     /* disable RTS flow control */
-
-/*
-** 09.12.1998 ARG - ESIL 0776 part fix
-** Definition for 'RIOC' also appears in daemon.h, so we'd better do a
-** #ifndef here first.
-** 'RIO_QUICK_CHECK' also #define'd here as this ioctl is now
-** allowed to be used by customers.
-**
-** 05.02.1999 ARG -
-** This is what I've decied to do with ioctls etc., which are intended to be
-** invoked from users applications :
-** Anything that needs to be defined here will be removed from daemon.h, that
-** way it won't end up having to be defined/maintained in two places. The only
-** consequence of this is that this file should now be #include'd by daemon.h
-**
-** 'stats' ioctls now #define'd here as they are to be used by customers.
-*/
 #define RIOC    ('R'<<8)|('i'<<16)|('o'<<24)
 
 #define RIO_QUICK_CHECK         (RIOC | 105)
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                         format_module_id(devnamep, geo_module(geoid),
                                          MODULE_FORMAT_BRIEF);
                         devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
 
                         /* allocate sysctl device data */
                         scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index f8dd8527c6aa..a90f5d97df35 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                           PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
         else
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
 
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 3f5d6077f39c..a9c5a7230f89 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -504,7 +504,6 @@ static int	stl_echmcaintr(stlbrd_t *brdp);
 static int      stl_echpciintr(stlbrd_t *brdp);
 static int      stl_echpci64intr(stlbrd_t *brdp);
 static void     stl_offintr(void *private);
-static void     *stl_memalloc(int len);
 static stlbrd_t *stl_allocbrd(void);
 static stlport_t *stl_getport(int brdnr, int panelnr, int portnr);
 
@@ -940,17 +939,6 @@ static int stl_parsebrd(stlconf_t *confp, char **argp)
 /*****************************************************************************/
 
 /*
- *      Local driver kernel memory allocation routine.
- */
-
-static void *stl_memalloc(int len)
-{
-        return (void *) kmalloc(len, GFP_KERNEL);
-}
-
-/*****************************************************************************/
-
-/*
  *      Allocate a new board structure. Fill out the basic info in it.
  */
 
@@ -958,14 +946,13 @@ static stlbrd_t *stl_allocbrd(void)
 {
         stlbrd_t        *brdp;
 
-        brdp = (stlbrd_t *) stl_memalloc(sizeof(stlbrd_t));
-        if (brdp == (stlbrd_t *) NULL) {
+        brdp = kzalloc(sizeof(stlbrd_t), GFP_KERNEL);
+        if (!brdp) {
                 printk("STALLION: failed to allocate memory (size=%d)\n",
                         sizeof(stlbrd_t));
-                return (stlbrd_t *) NULL;
+                return NULL;
         }
 
-        memset(brdp, 0, sizeof(stlbrd_t));
         brdp->magic = STL_BOARDMAGIC;
         return brdp;
 }
@@ -1017,9 +1004,9 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
         portp->refcount++;
 
         if ((portp->flags & ASYNC_INITIALIZED) == 0) {
-                if (portp->tx.buf == (char *) NULL) {
-                        portp->tx.buf = (char *) stl_memalloc(STL_TXBUFSIZE);
-                        if (portp->tx.buf == (char *) NULL)
+                if (!portp->tx.buf) {
+                        portp->tx.buf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
+                        if (!portp->tx.buf)
                                 return -ENOMEM;
                         portp->tx.head = portp->tx.buf;
                         portp->tx.tail = portp->tx.buf;
@@ -2178,13 +2165,12 @@ static int __init stl_initports(stlbrd_t *brdp, stlpanel_t *panelp)
  *      each ports data structures.
  */
         for (i = 0; (i < panelp->nrports); i++) {
-                portp = (stlport_t *) stl_memalloc(sizeof(stlport_t));
-                if (portp == (stlport_t *) NULL) {
+                portp = kzalloc(sizeof(stlport_t), GFP_KERNEL);
+                if (!portp) {
                         printk("STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlport_t));
                         break;
                 }
-                memset(portp, 0, sizeof(stlport_t));
 
                 portp->magic = STL_PORTMAGIC;
                 portp->portnr = i;
@@ -2315,13 +2301,12 @@ static inline int stl_initeio(stlbrd_t *brdp)
  *      can complete the setup.
  */
 
-        panelp = (stlpanel_t *) stl_memalloc(sizeof(stlpanel_t));
-        if (panelp == (stlpanel_t *) NULL) {
+        panelp = kzalloc(sizeof(stlpanel_t), GFP_KERNEL);
+        if (!panelp) {
                 printk(KERN_WARNING "STALLION: failed to allocate memory "
                         "(size=%d)\n", sizeof(stlpanel_t));
-                return(-ENOMEM);
+                return -ENOMEM;
         }
-        memset(panelp, 0, sizeof(stlpanel_t));
 
         panelp->magic = STL_PANELMAGIC;
         panelp->brdnr = brdp->brdnr;
@@ -2490,13 +2475,12 @@ static inline int stl_initech(stlbrd_t *brdp)
                 status = inb(ioaddr + ECH_PNLSTATUS);
                 if ((status & ECH_PNLIDMASK) != nxtid)
                         break;
-                panelp = (stlpanel_t *) stl_memalloc(sizeof(stlpanel_t));
-                if (panelp == (stlpanel_t *) NULL) {
+                panelp = kzalloc(sizeof(stlpanel_t), GFP_KERNEL);
+                if (!panelp) {
                         printk("STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlpanel_t));
                         break;
                 }
-                memset(panelp, 0, sizeof(stlpanel_t));
                 panelp->magic = STL_PANELMAGIC;
                 panelp->brdnr = brdp->brdnr;
                 panelp->panelnr = panelnr;
@@ -3074,8 +3058,8 @@ static int __init stl_init(void)
 /*
  *      Allocate a temporary write buffer.
  */
-        stl_tmpwritebuf = (char *) stl_memalloc(STL_TXBUFSIZE);
-        if (stl_tmpwritebuf == (char *) NULL)
+        stl_tmpwritebuf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
+        if (!stl_tmpwritebuf)
                 printk("STALLION: failed to allocate memory (size=%d)\n",
                         STL_TXBUFSIZE);
 
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index eb2eb3e12d6a..079db5a935a1 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -515,7 +515,7 @@ tipar_init_module(void)
                 err = PTR_ERR(tipar_class);
                 goto out_chrdev;
         }
-        if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+        if (parport_register_driver(&tipar_driver)) {
                 printk(KERN_ERR "tipar: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 2546637a55c0..f58ad7f68267 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -327,7 +327,7 @@ static ssize_t store_received_ref_clk3a(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3a);
 
 
@@ -349,7 +349,7 @@ static ssize_t store_received_ref_clk3b(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3b);
 
 
@@ -371,7 +371,7 @@ static ssize_t store_enable_clk3b_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3b_output);
 
 static ssize_t store_enable_clk3a_output(struct device *d,
@@ -392,7 +392,7 @@ static ssize_t store_enable_clk3a_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3a_output);
 
 static ssize_t store_enable_clkb1_output(struct device *d,
@@ -413,7 +413,7 @@ static ssize_t store_enable_clkb1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb1_output);
 
 
@@ -435,7 +435,7 @@ static ssize_t store_enable_clka1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka1_output);
 
 static ssize_t store_enable_clkb0_output(struct device *d,
@@ -456,7 +456,7 @@ static ssize_t store_enable_clkb0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb0_output);
 
 static ssize_t store_enable_clka0_output(struct device *d,
@@ -477,7 +477,7 @@ static ssize_t store_enable_clka0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka0_output);
 
 static ssize_t store_select_amcb2_transmit_clock(struct device *d,
@@ -519,7 +519,7 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
         store_select_amcb2_transmit_clock);
 
 static ssize_t store_select_amcb1_transmit_clock(struct device *d,
@@ -560,7 +560,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_amcb1_transmit_clock);
 
 static ssize_t store_select_redundant_clock(struct device *d,
@@ -581,7 +581,7 @@ static ssize_t store_select_redundant_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_redundant_clock);
 
 static ssize_t store_select_ref_frequency(struct device *d,
@@ -602,7 +602,7 @@ static ssize_t store_select_ref_frequency(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
+static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
                 store_select_ref_frequency);
 
 static ssize_t store_filter_select(struct device *d,
@@ -623,7 +623,7 @@ static ssize_t store_filter_select(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
+static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
 
 static ssize_t store_hardware_switching_mode(struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -643,7 +643,7 @@ static ssize_t store_hardware_switching_mode(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching_mode);
 
 static ssize_t store_hardware_switching(struct device *d,
@@ -664,7 +664,7 @@ static ssize_t store_hardware_switching(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching);
 
 static ssize_t store_refalign (struct device *d,
@@ -684,7 +684,7 @@ static ssize_t store_refalign (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
+static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
 
 static ssize_t store_mode_select (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -704,7 +704,7 @@ static ssize_t store_mode_select (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
+static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
 
 static ssize_t store_reset (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -724,7 +724,7 @@ static ssize_t store_reset (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
+static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
 
 static struct attribute *tlclk_sysfs_entries[] = {
         &dev_attr_current_ref.attr,
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..fe00c7dfb649 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
           Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
 
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM && PNPACPI
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
+
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from National Semicondutor 
           say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
         obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 2048,
         TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
 
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
         schedule_work(&chip->work);
 }
 
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
         struct tpm_chip *chip = ptr;
 
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+
+/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                             size_t bufsiz)
 {
         ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
         unsigned long stop;
 
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
-
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
                 return -ENODATA;
         if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 
         down(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
         }
 
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
         do {
-                u8 status = chip->vendor->status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                u8 status = chip->vendor.status(chip);
+                if ((status & chip->vendor.req_complete_mask) ==
+                    chip->vendor.req_complete_val)
                         goto out_recv;
-                }
 
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                         dev_err(chip->dev, "Operation Canceled\n");
                         rc = -ECANCELED;
                         goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 rmb();
         } while (time_before(jiffies, stop));
 
-
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         dev_err(chip->dev, "Operation Timed out\n");
         rc = -ETIME;
         goto out;
 
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
         if (rc < 0)
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
-static const u8 cap_pcr[] = {
+#define TPM_ERROR_SIZE 10
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+
+static const u8 tpm_cap[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 22,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 1
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
 
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
+
 static const u8 pcrread[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
+        ssize_t rc;
         int i, j, num_pcrs;
         __be32 index;
         char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
-            < CAP_PCR_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the number of PCRS");
+        if (rc)
                 return 0;
-        }
 
         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
-
         for (i = 0; i < num_pcrs; i++) {
                 memcpy(data, pcrread, sizeof(pcrread));
                 index = cpu_to_be32(i);
                 memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
-                    < READ_PCR_RESULT_SIZE){
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
+                rc = transmit_cmd(chip, data, sizeof(data),
+                                "attempting to read a PCR");
+                if (rc)
                         goto out;
-                }
                 str += sprintf(str, "PCR-%02d: ", i);
                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
                         str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                        char *buf)
 {
         u8 *data;
-        ssize_t len;
+        ssize_t err;
         int i, rc;
         char *str = buf;
 
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 
         memcpy(data, readpubek, sizeof(readpubek));
 
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
-            READ_PUBEK_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
+                        "attempting to read the PUBEK");
+        if (err)
                 goto out;
-        }
 
         /* 
            ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                 if ((i + 1) % 16 == 0)
                         str += sprintf(str, "\n");
         }
-        rc = str - buf;
 out:
+        rc = str - buf;
         kfree(data);
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 18,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
         0, 0, 0, 0
 };
 
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
-
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t rc;
         char *str = buf;
 
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_MANUFACTURER_RESULT_SIZE)
-                return len;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the manufacturer");
+        if (rc)
+                return 0;
 
         str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 
         memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_VER_RESULT_SIZE)
-                return len;
-
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
 
+out:
         return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
 
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return 0;
 
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
         spin_lock(&driver_lock);
 
         list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
                         break;
                 }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
 
         return in_size;
 }
-
 EXPORT_SYMBOL_GPL(tpm_write);
 
-ssize_t tpm_read(struct file * file, char __user *buf,
-                 size_t size, loff_t * off)
+ssize_t tpm_read(struct file *file, char __user *buf,
+                 size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
         spin_unlock(&driver_lock);
 
         dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
-        kfree(chip->vendor->miscdev.name);
+        misc_deregister(&chip->vendor.miscdev);
+        kfree(chip->vendor.miscdev.name);
 
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
+        clear_bit(chip->dev_num, dev_mask);
 
         kfree(chip);
 
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
 
         char *devname;
         struct tpm_chip *chip;
-        int i, j;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
 
         init_MUTEX(&chip->buffer_mutex);
         init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
         chip->user_read_timer.function = user_reader_timeout;
         chip->user_read_timer.data = (unsigned long) chip;
 
-        chip->vendor = entry;
-
-        chip->dev_num = -1;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
 
-dev_num_search_complete:
-        if (chip->dev_num < 0) {
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
                 kfree(chip);
-                return -ENODEV;
+                return NULL;
         } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
         else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+
+        set_bit(chip->dev_num, dev_mask);
 
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
 
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
         chip->dev = get_device(dev);
 
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                 dev_err(chip->dev,
                         "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.name,
+                        chip->vendor.miscdev.minor);
                 put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
-                dev_mask[i] &= !(1 << j);
-                return -ENODEV;
+                return NULL;
         }
 
         spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..050ced247f68 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
-        u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_complete_mask;
+        const u8 req_complete_val;
+        const u8 req_canceled;
         void __iomem *iobase;           /* ioremapped address */
         unsigned long base;             /* TPM base address */
 
+        int irq;
+
         int region_size;
         int have_region;
 
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
         u8 (*status) (struct tpm_chip *);
         struct miscdevice miscdev;
         struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
         struct work_struct work;
         struct semaphore tpm_mutex;     /* tpm is processing */
 
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
 
         struct dentry **bios_dir;
 
         struct list_head list;
 };
 
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
+
 static inline int tpm_read_index(int base, int index)
 {
         outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
         outb(value & 0xFF, base+1);
 }
 
-extern int tpm_register_hardware(struct device *,
-                                 struct tpm_vendor_specific *);
+extern void tpm_get_timeouts(struct tpm_chip *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
@@ -115,7 +140,7 @@ extern int tpm_pm_resume(struct device *);
 extern struct dentry ** tpm_bios_log_setup(char *);
 extern void tpm_bios_log_teardown(struct dentry **);
 #else
-static inline struct dentry* tpm_bios_log_setup(char *name)
+static inline struct dentry ** tpm_bios_log_setup(char *name)
 {
         return NULL;
 }
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 return -EIO;
 
         for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading header\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 dev_err(chip->dev,
                         "Recv size(%d) less than available space\n", size);
                 for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                         if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                 dev_err(chip->dev, "error reading data\n");
                                 return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         /* read all the data available */
         for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading data\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
 
         if (status & ATML_STATUS_DATA_AVAIL) {
                 dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
         dev_dbg(chip->dev, "tpm_atml_send:\n");
         for (i = 0; i < count; i++) {
                 dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
         }
 
         return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
 
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
         .recv = tpm_atml_recv,
         .send = tpm_atml_send,
         .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
         struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
 
         if (chip) {
-                if (chip->vendor->have_region)
-                        atmel_release_region(chip->vendor->base,
-                                             chip->vendor->region_size);
-                atmel_put_base_addr(chip->vendor);
+                if (chip->vendor.have_region)
+                        atmel_release_region(chip->vendor.base,
+                                             chip->vendor.region_size);
+                atmel_put_base_addr(chip->vendor.iobase);
                 tpm_remove_hardware(chip->dev);
                 platform_device_unregister(pdev);
         }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
         int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
 
         driver_register(&atml_drv);
 
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
                 goto err_unreg_drv;
         }
 
-        tpm_atmel.have_region =
+        have_region =
             (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
-              "tpm_atmel0") == NULL) ? 0 : 1;
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+
 
         if (IS_ERR
             (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                 goto err_rel_reg;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                 goto err_unreg_dev;
+        }
+
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
+
         return 0;
 
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
-        if (tpm_atmel.have_region)
-                atmel_release_region(tpm_atmel.base,
-                                     tpm_atmel.region_size);
+        atmel_put_base_addr(iobase);
+        if (have_region)
+                atmel_release_region(base,
+                                     region_size);
 err_unreg_drv:
         driver_unregister(&atml_drv);
         return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
 
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         struct device_node *dn;
         unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
         else
                 size = reg[naddrc];
 
-        vendor->base = address;
-        vendor->region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        *base = address;
+        *region_size = size;
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
         return 0;
 }
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
 }
 
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         int lo, hi;
 
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
         lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
         hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
 
-        vendor->base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *base = (hi << 8) | lo;
+        *region_size = 2;
 
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..a611972024e6 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
 
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
+
 struct tpm_bios_log {
         void *bios_event_log;
         void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 
 struct acpi_tcpa {
         struct acpi_table_header hdr;
-        u16 reserved;
-        u32 log_max_len __attribute__ ((packed));
-        u32 log_start_addr __attribute__ ((packed));
+        u16 platform_class;
+        union {
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 
 struct tcpa_event {
@@ -91,6 +105,12 @@ static const char* tcpa_event_type_strings[] = {
         "Non-Host Info"
 };
 
+struct tcpa_pc_event {
+        u32 event_id;
+        u32 event_size;
+        u8 event_data[0];
+};
+
 enum tcpa_pc_event_ids {
         SMBIOS = 1,
         BIS_CERT,
@@ -100,14 +120,15 @@ enum tcpa_pc_event_ids {
         NVRAM,
         OPTION_ROM_EXEC,
         OPTION_ROM_CONFIG,
-        OPTION_ROM_MICROCODE,
+        OPTION_ROM_MICROCODE = 10,
         S_CRTM_VERSION,
         S_CRTM_CONTENTS,
         POST_CONTENTS,
+        HOST_TABLE_OF_DEVICES,
 };
 
 static const char* tcpa_pc_event_id_strings[] = {
-        ""
+        "",
         "SMBIOS",
         "BIS Certificate",
         "POST BIOS ",
@@ -116,10 +137,12 @@ static const char* tcpa_pc_event_id_strings[] = {
         "NVRAM",
         "Option ROM",
         "Option ROM config",
-        "Option ROM microcode",
+        "",
+        "Option ROM microcode ",
         "S-CRTM Version",
-        "S-CRTM Contents",
-        "S-CRTM POST Contents",
+        "S-CRTM Contents ",
+        "POST Contents ",
+        "Table of Devices",
 };
 
 /* returns pointer to start of pos. entry of tcg log */
@@ -191,7 +214,7 @@ static int get_event_name(char *dest, struct tcpa_event *event,
         const char *name = "";
         char data[40] = "";
         int i, n_len = 0, d_len = 0;
-        u32 event_id;
+        struct tcpa_pc_event *pc_event;
 
         switch(event->event_type) {
         case PREBOOT:
@@ -220,31 +243,32 @@ static int get_event_name(char *dest, struct tcpa_event *event,
                 }
                 break;
         case EVENT_TAG:
-                event_id = be32_to_cpu(*((u32 *)event_entry));
+                pc_event = (struct tcpa_pc_event *)event_entry;
 
                 /* ToDo Row data -> Base64 */
 
-                switch (event_id) {
+                switch (pc_event->event_id) {
                 case SMBIOS:
                 case BIS_CERT:
                 case CMOS:
                 case NVRAM:
                 case OPTION_ROM_EXEC:
                 case OPTION_ROM_CONFIG:
-                case OPTION_ROM_MICROCODE:
                 case S_CRTM_VERSION:
-                case S_CRTM_CONTENTS:
-                case POST_CONTENTS:
-                        name = tcpa_pc_event_id_strings[event_id];
+                        name = tcpa_pc_event_id_strings[pc_event->event_id];
                         n_len = strlen(name);
                         break;
+                /* hash data */
                 case POST_BIOS_ROM:
                 case ESCD:
-                        name = tcpa_pc_event_id_strings[event_id];
+                case OPTION_ROM_MICROCODE:
+                case S_CRTM_CONTENTS:
+                case POST_CONTENTS:
+                        name = tcpa_pc_event_id_strings[pc_event->event_id];
                         n_len = strlen(name);
                         for (i = 0; i < 20; i++)
-                                d_len += sprintf(data, "%02x",
-                                                event_entry[8 + i]);
+                                d_len += sprintf(&data[2*i], "%02x",
+                                                pc_event->event_data[i]);
                         break;
                 default:
                         break;
@@ -260,52 +284,13 @@ static int get_event_name(char *dest, struct tcpa_event *event,
 
 static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
 {
+        struct tcpa_event *event = v;
+        char *data = v;
+        int i;
 
-        char *eventname;
-        char data[4];
-        u32 help;
-        int i, len;
-        struct tcpa_event *event = (struct tcpa_event *) v;
-        unsigned char *event_entry =
-            (unsigned char *) (v + sizeof(struct tcpa_event));
-
-        eventname = kmalloc(MAX_TEXT_EVENT, GFP_KERNEL);
-        if (!eventname) {
-                printk(KERN_ERR "%s: ERROR - No Memory for event name\n ",
-                       __func__);
-                return -ENOMEM;
-        }
-
-        /* 1st: PCR used is in little-endian format (4 bytes) */
-        help = le32_to_cpu(event->pcr_index);
-        memcpy(data, &help, 4);
-        for (i = 0; i < 4; i++)
-                seq_putc(m, data[i]);
-
-        /* 2nd: SHA1 (20 bytes) */
-        for (i = 0; i < 20; i++)
-                seq_putc(m, event->pcr_value[i]);
-
-        /* 3rd: event type identifier (4 bytes) */
-        help = le32_to_cpu(event->event_type);
-        memcpy(data, &help, 4);
-        for (i = 0; i < 4; i++)
+        for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
                 seq_putc(m, data[i]);
 
-        len = 0;
-
-        len += get_event_name(eventname, event, event_entry);
-
-        /* 4th:  filename <= 255 + \'0' delimiter */
-        if (len > TCG_EVENT_NAME_LEN_MAX)
-                len = TCG_EVENT_NAME_LEN_MAX;
-
-        for (i = 0; i < len; i++)
-                seq_putc(m, eventname[i]);
-
-        /* 5th: delimiter */
-        seq_putc(m, '\0');
-
         return 0;
 }
 
@@ -353,6 +338,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
         /* 4th: eventname <= max + \'0' delimiter */
         seq_printf(m, " %s\n", eventname);
 
+        kfree(eventname);
         return 0;
 }
 
@@ -376,6 +362,7 @@ static int read_log(struct tpm_bios_log *log)
         struct acpi_tcpa *buff;
         acpi_status status;
         struct acpi_table_header *virt;
+        u64 len, start;
 
         if (log->bios_event_log != NULL) {
                 printk(KERN_ERR
@@ -396,27 +383,37 @@ static int read_log(struct tpm_bios_log *log)
                 return -EIO;
         }
 
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                 printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                 return -EIO;
         }
 
         /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
         if (!log->bios_event_log) {
-                printk
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                     __func__);
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
                 return -ENOMEM;
         }
 
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
 
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
 
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
         return 0;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
  * License.
  */
 
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
 
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
 
         if (clear_wrfifo) {
                 for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                         if (status == 0xff) {
                                 if (check == 5)
                                         break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
          */
         i = 0;
         do {
-                status = inb(chip->vendor->base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + RDFIFO);
+                status = inb(chip->vendor.base + STAT);
                 i++;
                 if (i == TPM_MAX_TRIES)
                         return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
         int status;
         int i;
         for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
         wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
 
     /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                 ret = wait(chip, STAT_RDA);
                 if (ret)
                         return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
         }
 
         if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
 
                 for (i = 0; i < size; i++) {
                         wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                 }
 
                 if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
         u8 count_high, count_low, count_4, count_3, count_2, count_1;
 
         /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
 
         ret = empty_fifo(chip, 1);
         if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
         .release = tpm_release,
 };
 
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
         .recv = tpm_inf_recv,
         .send = tpm_inf_send,
         .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         int version[2];
         int productid[2];
         char chipname[20];
+        struct tpm_chip *chip;
 
         /* read IO-ports through PnP */
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
                 /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                 if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
-                                "tpm_infineon0") == NULL) {
+                if (request_region
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 /* configure TPM with IO-ports */
                 outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                 outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
 
                 /* control if IO-ports are set correctly */
                 outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(IOLIML, TPM_INF_ADDR);
                 iol = inb(TPM_INF_DATA);
 
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                         dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
-                                tpm_inf.base);
+                                "Could not set IO-ports to 0x%x\n",
+                                TPM_INF_BASE);
                         rc = -EIO;
                         goto err_release_region;
                 }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&dev->dev, "TPM found: "
                          "config base 0x%x, "
                          "io base 0x%x, "
-                         "chip version %02x%02x, "
-                         "vendor id %x%x (Infineon), "
-                         "product id %02x%02x"
+                         "chip version 0x%02x%02x, "
+                         "vendor id 0x%x%x (Infineon), "
+                         "product id 0x%02x%02x"
                          "%s\n",
                          TPM_INF_ADDR,
                          TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
 
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
-                if (rc < 0) {
-                        rc = -ENODEV;
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
                         goto err_release_region;
                 }
+                chip->vendor.base = TPM_INF_BASE;
                 return 0;
         } else {
                 rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         }
 
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
         release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
         struct tpm_chip *chip = pnp_get_drvdata(dev);
 
         if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
         },
         .id_table = tpm_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         unsigned long stop;
 
         /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
         if ((*data & mask) == val)
                 return 0;
 
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         stop = jiffies + 10 * HZ;
         do {
                 msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                 if ((*data & mask) == val)
                         return 0;
         }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         unsigned long stop;
 
         /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
         if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
         if (status & NSC_STATUS_RDY)
                 return 0;
 
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         stop = jiffies + 100;
         do {
                 msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                 if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                 if (status & NSC_STATUS_RDY)
                         return 0;
         }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
         if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                 dev_err(chip->dev, "not in normal mode (0x%x)\n",
                         data);
                 return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 }
                 if (data & NSC_STATUS_F0)
                         break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
         }
 
         if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 dev_err(chip->dev, "F0 not set\n");
                 return -EIO;
         }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                 dev_err(chip->dev,
                         "expected end of command(0x%x)\n", data);
                 return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
          * fix it. Not sure why this is needed, we followed the flow
          * chart in the manual to the letter.
          */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 
         if (nsc_wait_for_ready(chip) != 0)
                 return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
 
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
         if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                 dev_err(chip->dev, "IBR timeout\n");
                 return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                 "IBF timeout (while writing data)\n");
                         return -EIO;
                 }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
         }
 
         if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                 dev_err(chip->dev, "IBF timeout\n");
                 return -EIO;
         }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
 
         return count;
 }
 
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
 
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
         .recv = tpm_nsc_recv,
         .send = tpm_nsc_send,
         .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
         int rc = 0;
         int lo, hi;
         int nscAddrBase = TPM_ADDR;
-
+        struct tpm_chip *chip;
+        unsigned long base;
 
         /* verify that it is a National part (SID) */
         if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
 
         /* enable the DPM module */
         tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
         if ((rc = platform_device_register(pdev)) < 0)
                 goto err_free_dev;
 
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                 rc = -EBUSY;
                 goto err_unreg_dev;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                 goto err_rel_reg;
+        }
 
         dev_dbg(&pdev->dev, "NSC TPM detected\n");
         dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                  "NSC TPM revision %d\n",
                  tpm_read_index(nscAddrBase, 0x27) & 0x1F);
 
+        chip->vendor.base = base;
+
         return 0;
 
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..8ea70625f7ea
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,665 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+
+#define TPM_HEADER_SIZE 10
+
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED40000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+
+        return -1;
+}
+
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+
+        if (check_locality(chip, l) >= 0)
+                return l;
+
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        chip->vendor.irq = irq;
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 0bfd1b63662e..a88b94a82b14 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -351,10 +351,10 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
         spin_unlock_irqrestore(&tty->buf.lock, flags);
         return size;
 }
-
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
 
-int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, size_t size)
+int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
+                                size_t size)
 {
         int copied = 0;
         do {
@@ -368,17 +368,16 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, s
                 tb->used += space;
                 copied += space;
                 chars += space;
-/*              printk("Flip insert %d.\n", space); */
         }
         /* There is a small chance that we need to split the data over
            several buffers. If this is the case we must loop */
         while (unlikely(size > copied));
         return copied;
 }
+EXPORT_SYMBOL(tty_insert_flip_string);
 
-EXPORT_SYMBOL_GPL(tty_insert_flip_string);
-
-int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size)
+int tty_insert_flip_string_flags(struct tty_struct *tty,
+                const unsigned char *chars, const char *flags, size_t size)
 {
         int copied = 0;
         do {
@@ -399,9 +398,20 @@ int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *ch
         while (unlikely(size > copied));
         return copied;
 }
+EXPORT_SYMBOL(tty_insert_flip_string_flags);
 
-EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
-
+void tty_schedule_flip(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        if (tty->buf.tail != NULL) {
+                tty->buf.tail->active = 0;
+                tty->buf.tail->commit = tty->buf.tail->used;
+        }
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        schedule_delayed_work(&tty->buf.work, 1);
+}
+EXPORT_SYMBOL(tty_schedule_flip);
 
 /*
  *      Prepare a block of space in the buffer for data. Returns the length
@@ -1730,7 +1740,7 @@ static void release_dev(struct file * filp)
 {
         struct tty_struct *tty, *o_tty;
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
-        int     devpts_master, devpts;
+        int     devpts;
         int     idx;
         char    buf[64];
         unsigned long flags;
@@ -1747,7 +1757,6 @@ static void release_dev(struct file * filp)
         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                       tty->driver->subtype == PTY_TYPE_MASTER);
         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
-        devpts_master = pty_master && devpts;
         o_tty = tty->link;
 
 #ifdef TTY_PARANOIA_CHECK
@@ -2185,6 +2194,7 @@ static int ptmx_open(struct inode * inode, struct file * filp)
                 return 0;
 out1:
         release_dev(filp);
+        return retval;
 out:
         down(&allocated_ptys_lock);
         idr_remove(&allocated_ptys, index);
@@ -2713,7 +2723,11 @@ static void __do_SAK(void *arg)
                 }
                 task_lock(p);
                 if (p->files) {
-                        rcu_read_lock();
+                        /*
+                         * We don't take a ref to the file, so we must
+                         * hold ->file_lock instead.
+                         */
+                        spin_lock(&p->files->file_lock);
                         fdt = files_fdtable(p->files);
                         for (i=0; i < fdt->max_fds; i++) {
                                 filp = fcheck_files(p->files, i);
@@ -2724,11 +2738,11 @@ static void __do_SAK(void *arg)
                                         printk(KERN_NOTICE "SAK: killed process %d"
                                             " (%s): fd#%d opened to the tty\n",
                                             p->pid, p->comm, i);
-                                        send_sig(SIGKILL, p, 1);
+                                        force_sig(SIGKILL, p);
                                         break;
                                 }
                         }
-                        rcu_read_unlock();
+                        spin_unlock(&p->files->file_lock);
                 }
                 task_unlock(p);
         } while_each_thread(g, p);
diff --git a/drivers/char/vr41xx_rtc.c b/drivers/char/vr41xx_rtc.c
deleted file mode 100644
index b109d9a502d6..000000000000
--- a/drivers/char/vr41xx_rtc.c
+++ /dev/null
@@ -1,717 +0,0 @@
-/*
- *  Driver for NEC VR4100 series  Real Time Clock unit.
- *
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#include <linux/platform_device.h>
-#include <linux/fs.h>
-#include <linux/init.h>
-#include <linux/ioport.h>
-#include <linux/irq.h>
-#include <linux/mc146818rtc.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/poll.h>
-#include <linux/rtc.h>
-#include <linux/spinlock.h>
-#include <linux/types.h>
-#include <linux/wait.h>
-
-#include <asm/div64.h>
-#include <asm/io.h>
-#include <asm/time.h>
-#include <asm/uaccess.h>
-#include <asm/vr41xx/vr41xx.h>
-
-MODULE_AUTHOR("Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>");
-MODULE_DESCRIPTION("NEC VR4100 series RTC driver");
-MODULE_LICENSE("GPL");
-
-#define RTC1_TYPE1_START        0x0b0000c0UL
-#define RTC1_TYPE1_END          0x0b0000dfUL
-#define RTC2_TYPE1_START        0x0b0001c0UL
-#define RTC2_TYPE1_END          0x0b0001dfUL
-
-#define RTC1_TYPE2_START        0x0f000100UL
-#define RTC1_TYPE2_END          0x0f00011fUL
-#define RTC2_TYPE2_START        0x0f000120UL
-#define RTC2_TYPE2_END          0x0f00013fUL
-
-#define RTC1_SIZE               0x20
-#define RTC2_SIZE               0x20
-
-/* RTC 1 registers */
-#define ETIMELREG               0x00
-#define ETIMEMREG               0x02
-#define ETIMEHREG               0x04
-/* RFU */
-#define ECMPLREG                0x08
-#define ECMPMREG                0x0a
-#define ECMPHREG                0x0c
-/* RFU */
-#define RTCL1LREG               0x10
-#define RTCL1HREG               0x12
-#define RTCL1CNTLREG            0x14
-#define RTCL1CNTHREG            0x16
-#define RTCL2LREG               0x18
-#define RTCL2HREG               0x1a
-#define RTCL2CNTLREG            0x1c
-#define RTCL2CNTHREG            0x1e
-
-/* RTC 2 registers */
-#define TCLKLREG                0x00
-#define TCLKHREG                0x02
-#define TCLKCNTLREG             0x04
-#define TCLKCNTHREG             0x06
-/* RFU */
-#define RTCINTREG               0x1e
- #define TCLOCK_INT             0x08
- #define RTCLONG2_INT           0x04
- #define RTCLONG1_INT           0x02
- #define ELAPSEDTIME_INT        0x01
-
-#define RTC_FREQUENCY           32768
-#define MAX_PERIODIC_RATE       6553
-#define MAX_USER_PERIODIC_RATE  64
-
-static void __iomem *rtc1_base;
-static void __iomem *rtc2_base;
-
-#define rtc1_read(offset)               readw(rtc1_base + (offset))
-#define rtc1_write(offset, value)       writew((value), rtc1_base + (offset))
-
-#define rtc2_read(offset)               readw(rtc2_base + (offset))
-#define rtc2_write(offset, value)       writew((value), rtc2_base + (offset))
-
-static unsigned long epoch = 1970;      /* Jan 1 1970 00:00:00 */
-
-static spinlock_t rtc_task_lock;
-static wait_queue_head_t rtc_wait;
-static unsigned long rtc_irq_data;
-static struct fasync_struct *rtc_async_queue;
-static rtc_task_t *rtc_callback;
-static char rtc_name[] = "RTC";
-static unsigned long periodic_frequency;
-static unsigned long periodic_count;
-
-typedef enum {
-        RTC_RELEASE,
-        RTC_OPEN,
-} rtc_status_t;
-
-static rtc_status_t rtc_status;
-
-typedef enum {
-        FUNCTION_RTC_IOCTL,
-        FUNCTION_RTC_CONTROL,
-} rtc_callfrom_t;
-
-struct resource rtc_resource[2] = {
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-};
-
-static inline unsigned long read_elapsed_second(void)
-{
-        unsigned long first_low, first_mid, first_high;
-        unsigned long second_low, second_mid, second_high;
-
-        do {
-                first_low = rtc1_read(ETIMELREG);
-                first_mid = rtc1_read(ETIMEMREG);
-                first_high = rtc1_read(ETIMEHREG);
-                second_low = rtc1_read(ETIMELREG);
-                second_mid = rtc1_read(ETIMEMREG);
-                second_high = rtc1_read(ETIMEHREG);
-        } while (first_low != second_low || first_mid != second_mid ||
-                 first_high != second_high);
-
-        return (first_high << 17) | (first_mid << 1) | (first_low >> 15);
-}
-
-static inline void write_elapsed_second(unsigned long sec)
-{
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ETIMELREG, (uint16_t)(sec << 15));
-        rtc1_write(ETIMEMREG, (uint16_t)(sec >> 1));
-        rtc1_write(ETIMEHREG, (uint16_t)(sec >> 17));
-
-        spin_unlock_irq(&rtc_lock);
-}
-
-static void set_alarm(struct rtc_time *time)
-{
-        unsigned long alarm_sec;
-
-        alarm_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
-                           time->tm_hour, time->tm_min, time->tm_sec);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, (uint16_t)(alarm_sec << 15));
-        rtc1_write(ECMPMREG, (uint16_t)(alarm_sec >> 1));
-        rtc1_write(ECMPHREG, (uint16_t)(alarm_sec >> 17));
-
-        spin_unlock_irq(&rtc_lock);
-}
-
-static void read_alarm(struct rtc_time *time)
-{
-        unsigned long low, mid, high;
-
-        spin_lock_irq(&rtc_lock);
-
-        low = rtc1_read(ECMPLREG);
-        mid = rtc1_read(ECMPMREG);
-        high = rtc1_read(ECMPHREG);
-
-        spin_unlock_irq(&rtc_lock);
-
-        to_tm((high << 17) | (mid << 1) | (low >> 15), time);
-        time->tm_year -= 1900;
-}
-
-static void read_time(struct rtc_time *time)
-{
-        unsigned long epoch_sec, elapsed_sec;
-
-        epoch_sec = mktime(epoch, 1, 1, 0, 0, 0);
-        elapsed_sec = read_elapsed_second();
-
-        to_tm(epoch_sec + elapsed_sec, time);
-        time->tm_year -= 1900;
-}
-
-static void set_time(struct rtc_time *time)
-{
-        unsigned long epoch_sec, current_sec;
-
-        epoch_sec = mktime(epoch, 1, 1, 0, 0, 0);
-        current_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
-                             time->tm_hour, time->tm_min, time->tm_sec);
-
-        write_elapsed_second(current_sec - epoch_sec);
-}
-
-static ssize_t rtc_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        unsigned long irq_data;
-        int retval = 0;
-
-        if (count != sizeof(unsigned int) && count != sizeof(unsigned long))
-                return -EINVAL;
-
-        add_wait_queue(&rtc_wait, &wait);
-
-        do {
-                __set_current_state(TASK_INTERRUPTIBLE);
-
-                spin_lock_irq(&rtc_lock);
-                irq_data = rtc_irq_data;
-                rtc_irq_data = 0;
-                spin_unlock_irq(&rtc_lock);
-
-                if (irq_data != 0)
-                        break;
-
-                if (file->f_flags & O_NONBLOCK) {
-                        retval = -EAGAIN;
-                        break;
-                }
-
-                if (signal_pending(current)) {
-                        retval = -ERESTARTSYS;
-                        break;
-                }
-        } while (1);
-
-        if (retval == 0) {
-                if (count == sizeof(unsigned int)) {
-                        retval = put_user(irq_data, (unsigned int __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned int);
-                } else {
-                        retval = put_user(irq_data, (unsigned long __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned long);
-                }
-
-        }
-
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&rtc_wait, &wait);
-
-        return retval;
-}
-
-static unsigned int rtc_poll(struct file *file, struct poll_table_struct *table)
-{
-        poll_wait(file, &rtc_wait, table);
-
-        if (rtc_irq_data != 0)
-                return POLLIN | POLLRDNORM;
-
-        return 0;
-}
-
-static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from)
-{
-        struct rtc_time time;
-        unsigned long count;
-
-        switch (cmd) {
-        case RTC_AIE_ON:
-                enable_irq(ELAPSEDTIME_IRQ);
-                break;
-        case RTC_AIE_OFF:
-                disable_irq(ELAPSEDTIME_IRQ);
-                break;
-        case RTC_PIE_ON:
-                enable_irq(RTCLONG1_IRQ);
-                break;
-        case RTC_PIE_OFF:
-                disable_irq(RTCLONG1_IRQ);
-                break;
-        case RTC_ALM_SET:
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_alarm(&time);
-                break;
-        case RTC_ALM_READ:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_alarm(&time);
-                break;
-        case RTC_RD_TIME:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_time(&time);
-                if (copy_to_user((void __user *)arg, &time, sizeof(struct rtc_time)))
-                        return -EFAULT;
-                break;
-        case RTC_SET_TIME:
-                if (capable(CAP_SYS_TIME) == 0)
-                        return -EACCES;
-
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_time(&time);
-                break;
-        case RTC_IRQP_READ:
-                return put_user(periodic_frequency, (unsigned long __user *)arg);
-                break;
-        case RTC_IRQP_SET:
-                if (arg > MAX_PERIODIC_RATE)
-                        return -EINVAL;
-
-                if (from == FUNCTION_RTC_IOCTL && arg > MAX_USER_PERIODIC_RATE &&
-                    capable(CAP_SYS_RESOURCE) == 0)
-                        return -EACCES;
-
-                periodic_frequency = arg;
-
-                count = RTC_FREQUENCY;
-                do_div(count, arg);
-
-                periodic_count = count;
-
-                spin_lock_irq(&rtc_lock);
-
-                rtc1_write(RTCL1LREG, count);
-                rtc1_write(RTCL1HREG, count >> 16);
-
-                spin_unlock_irq(&rtc_lock);
-                break;
-        case RTC_EPOCH_READ:
-                return put_user(epoch, (unsigned long __user *)arg);
-        case RTC_EPOCH_SET:
-                /* Doesn't support before 1900 */
-                if (arg < 1900)
-                        return -EINVAL;
-
-                if (capable(CAP_SYS_TIME) == 0)
-                        return -EACCES;
-
-                epoch = arg;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-                     unsigned long arg)
-{
-        return rtc_do_ioctl(cmd, arg, FUNCTION_RTC_IOCTL);
-}
-
-static int rtc_open(struct inode *inode, struct file *file)
-{
-        spin_lock_irq(&rtc_lock);
-
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        rtc_status = RTC_OPEN;
-        rtc_irq_data = 0;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-static int rtc_release(struct inode *inode, struct file *file)
-{
-        if (file->f_flags & FASYNC)
-                (void)fasync_helper(-1, file, 0, &rtc_async_queue);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock_irq(&rtc_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-static int rtc_fasync(int fd, struct file *file, int on)
-{
-        return fasync_helper(fd, file, on, &rtc_async_queue);
-}
-
-static struct file_operations rtc_fops = {
-        .owner          = THIS_MODULE,
-        .llseek         = no_llseek,
-        .read           = rtc_read,
-        .poll           = rtc_poll,
-        .ioctl          = rtc_ioctl,
-        .open           = rtc_open,
-        .release        = rtc_release,
-        .fasync         = rtc_fasync,
-};
-
-static irqreturn_t elapsedtime_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-        spin_lock(&rtc_lock);
-        rtc2_write(RTCINTREG, ELAPSEDTIME_INT);
-
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_AF;
-        spin_unlock(&rtc_lock);
-
-        spin_lock(&rtc_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_lock);
-
-        wake_up_interruptible(&rtc_wait);
-
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
-
-        return IRQ_HANDLED;
-}
-
-static irqreturn_t rtclong1_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-        unsigned long count = periodic_count;
-
-        spin_lock(&rtc_lock);
-        rtc2_write(RTCINTREG, RTCLONG1_INT);
-
-        rtc1_write(RTCL1LREG, count);
-        rtc1_write(RTCL1HREG, count >> 16);
-
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_PF;
-        spin_unlock(&rtc_lock);
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_task_lock);
-
-        wake_up_interruptible(&rtc_wait);
-
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
-
-        return IRQ_HANDLED;
-}
-
-int rtc_register(rtc_task_t *task)
-{
-        if (task == NULL || task->func == NULL)
-                return -EINVAL;
-
-        spin_lock_irq(&rtc_lock);
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback != NULL) {
-                spin_unlock(&rtc_task_lock);
-                spin_unlock_irq(&rtc_task_lock);
-                return -EBUSY;
-        }
-
-        rtc_callback = task;
-        spin_unlock(&rtc_task_lock);
-
-        rtc_status = RTC_OPEN;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_register);
-
-int rtc_unregister(rtc_task_t *task)
-{
-        spin_lock_irq(&rtc_task_lock);
-        if (task == NULL || rtc_callback != task) {
-                spin_unlock_irq(&rtc_task_lock);
-                return -ENXIO;
-        }
-
-        spin_lock(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock(&rtc_lock);
-
-        rtc_callback = NULL;
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_unregister);
-
-int rtc_control(rtc_task_t *task, unsigned int cmd, unsigned long arg)
-{
-        int retval = 0;
-
-        spin_lock_irq(&rtc_task_lock);
-
-        if (rtc_callback != task)
-                retval = -ENXIO;
-        else
-                rtc_do_ioctl(cmd, arg, FUNCTION_RTC_CONTROL);
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        return retval;
-}
-
-EXPORT_SYMBOL_GPL(rtc_control);
-
-static struct miscdevice rtc_miscdevice = {
-        .minor  = RTC_MINOR,
-        .name   = rtc_name,
-        .fops   = &rtc_fops,
-};
-
-static int __devinit rtc_probe(struct platform_device *pdev)
-{
-        unsigned int irq;
-        int retval;
-
-        if (pdev->num_resources != 2)
-                return -EBUSY;
-
-        rtc1_base = ioremap(pdev->resource[0].start, RTC1_SIZE);
-        if (rtc1_base == NULL)
-                return -EBUSY;
-
-        rtc2_base = ioremap(pdev->resource[1].start, RTC2_SIZE);
-        if (rtc2_base == NULL) {
-                iounmap(rtc1_base);
-                rtc1_base = NULL;
-                return -EBUSY;
-        }
-
-        retval = misc_register(&rtc_miscdevice);
-        if (retval < 0) {
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return retval;
-        }
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-        rtc_irq_data = 0;
-
-        spin_unlock_irq(&rtc_lock);
-
-        init_waitqueue_head(&rtc_wait);
-
-        irq = ELAPSEDTIME_IRQ;
-        retval = request_irq(irq, elapsedtime_interrupt, SA_INTERRUPT,
-                             "elapsed_time", NULL);
-        if (retval == 0) {
-                irq = RTCLONG1_IRQ;
-                retval = request_irq(irq, rtclong1_interrupt, SA_INTERRUPT,
-                                     "rtclong1", NULL);
-        }
-
-        if (retval < 0) {
-                printk(KERN_ERR "rtc: IRQ%d is busy\n", irq);
-                if (irq == RTCLONG1_IRQ)
-                        free_irq(ELAPSEDTIME_IRQ, NULL);
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return retval;
-        }
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        spin_lock_init(&rtc_task_lock);
-
-        printk(KERN_INFO "rtc: Real Time Clock of NEC VR4100 series\n");
-
-        return 0;
-}
-
-static int __devexit rtc_remove(struct platform_device *dev)
-{
-        int retval;
-
-        retval = misc_deregister(&rtc_miscdevice);
-        if (retval < 0)
-                return retval;
-
-        free_irq(ELAPSEDTIME_IRQ, NULL);
-        free_irq(RTCLONG1_IRQ, NULL);
-        if (rtc1_base != NULL)
-                iounmap(rtc1_base);
-        if (rtc2_base != NULL)
-                iounmap(rtc2_base);
-
-        return 0;
-}
-
-static struct platform_device *rtc_platform_device;
-
-static struct platform_driver rtc_device_driver = {
-        .probe          = rtc_probe,
-        .remove         = __devexit_p(rtc_remove),
-        .driver         = {
-                .name   = rtc_name,
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init vr41xx_rtc_init(void)
-{
-        int retval;
-
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                rtc_resource[0].start = RTC1_TYPE1_START;
-                rtc_resource[0].end = RTC1_TYPE1_END;
-                rtc_resource[1].start = RTC2_TYPE1_START;
-                rtc_resource[1].end = RTC2_TYPE1_END;
-                break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                rtc_resource[0].start = RTC1_TYPE2_START;
-                rtc_resource[0].end = RTC1_TYPE2_END;
-                rtc_resource[1].start = RTC2_TYPE2_START;
-                rtc_resource[1].end = RTC2_TYPE2_END;
-                break;
-        default:
-                return -ENODEV;
-                break;
-        }
-
-        rtc_platform_device = platform_device_alloc("RTC", -1);
-        if (!rtc_platform_device)
-                return -ENOMEM;
-
-        retval = platform_device_add_resources(rtc_platform_device,
-                                rtc_resource, ARRAY_SIZE(rtc_resource));
-
-        if (retval == 0)
-                retval = platform_device_add(rtc_platform_device);
-
-        if (retval < 0) {
-                platform_device_put(rtc_platform_device);
-                return retval;
-        }
-
-        retval = platform_driver_register(&rtc_device_driver);
-        if (retval < 0)
-                platform_device_unregister(rtc_platform_device);
-
-        return retval;
-}
-
-static void __exit vr41xx_rtc_exit(void)
-{
-        platform_driver_unregister(&rtc_device_driver);
-        platform_device_unregister(rtc_platform_device);
-}
-
-module_init(vr41xx_rtc_init);
-module_exit(vr41xx_rtc_exit);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index ca4844c527da..6c94879e0b99 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2328,6 +2328,10 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                 case TIOCL_SETVESABLANK:
                         set_vesa_blanking(p);
                         break;
+                case TIOCL_GETKMSGREDIRECT:
+                        data = kmsg_redirect;
+                        ret = __put_user(data, p);
+                        break;
                 case TIOCL_SETKMSGREDIRECT:
                         if (!capable(CAP_SYS_ADMIN)) {
                                 ret = -EPERM;
@@ -3234,14 +3238,6 @@ void vcs_scr_writew(struct vc_data *vc, u16 val, u16 *org)
         }
 }
 
-int is_console_suspend_safe(void)
-{
-        /* It is unsafe to suspend devices while X has control of the
-         * hardware. Make sure we are running on a kernel-controlled console.
-         */
-        return vc_cons[fg_console].d->vc_mode == KD_TEXT;
-}
-
 /*
  *      Visible symbols for modules
  */
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index 16e99db2e12d..d53f664a4dd8 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -60,6 +60,13 @@ config SOFT_WATCHDOG
 
 # ARM Architecture
 
+config AT91_WATCHDOG
+        tristate "AT91RM9200 watchdog"
+        depends on WATCHDOG && ARCH_AT91RM9200
+        help
+          Watchdog timer embedded into AT91RM9200 chips. This will reboot your
+          system when the timeout is reached.
+
 config 21285_WATCHDOG
         tristate "DC21285 watchdog"
         depends on WATCHDOG && FOOTBRIDGE
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index d6f27fde9905..6ab77b61a643 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_WDTPCI) += wdt_pci.o
 obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 
 # ARM Architecture
+obj-$(CONFIG_AT91_WATCHDOG) += at91_wdt.o
 obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
 obj-$(CONFIG_977_WATCHDOG) += wdt977.o
 obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
diff --git a/drivers/char/watchdog/at91_wdt.c b/drivers/char/watchdog/at91_wdt.c
new file mode 100644
index 000000000000..ac83bc4b019a
--- /dev/null
+++ b/drivers/char/watchdog/at91_wdt.c
@@ -0,0 +1,228 @@
+/*
+ * Watchdog driver for Atmel AT91RM9200 (Thunder)
+ *
+ *  Copyright (C) 2003 SAN People (Pty) Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+#include <asm/bitops.h>
+#include <asm/uaccess.h>
+
+
+#define WDT_DEFAULT_TIME        5       /* 5 seconds */
+#define WDT_MAX_TIME            256     /* 256 seconds */
+
+static int wdt_time = WDT_DEFAULT_TIME;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_time, int, 0);
+MODULE_PARM_DESC(wdt_time, "Watchdog time in seconds. (default="__MODULE_STRING(WDT_DEFAULT_TIME) ")");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+
+static unsigned long at91wdt_busy;
+
+/* ......................................................................... */
+
+/*
+ * Disable the watchdog.
+ */
+static void inline at91_wdt_stop(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN);
+}
+
+/*
+ * Enable and reset the watchdog.
+ */
+static void inline at91_wdt_start(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN | AT91_ST_RSTEN | (((65536 * wdt_time) >> 8) & AT91_ST_WDV));
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/*
+ * Reload the watchdog timer.  (ie, pat the watchdog)
+ */
+static void inline at91_wdt_reload(void)
+{
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/* ......................................................................... */
+
+/*
+ * Watchdog device is opened, and watchdog starts running.
+ */
+static int at91_wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(0, &at91wdt_busy))
+                return -EBUSY;
+
+        at91_wdt_start();
+        return nonseekable_open(inode, file);
+}
+
+/*
+ * Close the watchdog device.
+ * If CONFIG_WATCHDOG_NOWAYOUT is NOT defined then the watchdog is also
+ *  disabled.
+ */
+static int at91_wdt_close(struct inode *inode, struct file *file)
+{
+        if (!nowayout)
+                at91_wdt_stop();        /* Disable the watchdog when file is closed */
+
+        clear_bit(0, &at91wdt_busy);
+        return 0;
+}
+
+/*
+ * Change the watchdog time interval.
+ */
+static int at91_wdt_settimeout(int new_time)
+{
+        /*
+         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         *
+         * Since WDV is a 16-bit counter, the maximum period is
+         * 65536 / 0.256 = 256 seconds.
+         */
+        if ((new_time <= 0) || (new_time > WDT_MAX_TIME))
+                return -EINVAL;
+
+        /* Set new watchdog time. It will be used when at91_wdt_start() is called. */
+        wdt_time = new_time;
+        return 0;
+}
+
+static struct watchdog_info at91_wdt_info = {
+        .identity       = "at91 watchdog",
+        .options        = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+};
+
+/*
+ * Handle commands from user-space.
+ */
+static int at91_wdt_ioctl(struct inode *inode, struct file *file,
+                unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int new_value;
+
+        switch(cmd) {
+                case WDIOC_KEEPALIVE:
+                        at91_wdt_reload();      /* pat the watchdog */
+                        return 0;
+
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &at91_wdt_info, sizeof(at91_wdt_info)) ? -EFAULT : 0;
+
+                case WDIOC_SETTIMEOUT:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+                                
+                        if (at91_wdt_settimeout(new_value))
+                                return -EINVAL;
+
+                        /* Enable new time value */
+                        at91_wdt_start();
+
+                        /* Return current value */
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETTIMEOUT:
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETSTATUS:
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, p);
+
+                case WDIOC_SETOPTIONS:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+
+                        if (new_value & WDIOS_DISABLECARD)
+                                at91_wdt_stop();
+                        if (new_value & WDIOS_ENABLECARD)
+                                at91_wdt_start();
+                        return 0;
+
+                default:
+                        return -ENOIOCTLCMD;
+        }
+}
+
+/*
+ * Pat the watchdog whenever device is written to.
+ */
+static ssize_t at91_wdt_write(struct file *file, const char *data, size_t len, loff_t *ppos)
+{
+        at91_wdt_reload();              /* pat the watchdog */
+        return len;
+}
+
+/* ......................................................................... */
+
+static struct file_operations at91wdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .ioctl          = at91_wdt_ioctl,
+        .open           = at91_wdt_open,
+        .release        = at91_wdt_close,
+        .write          = at91_wdt_write,
+};
+
+static struct miscdevice at91wdt_miscdev = {
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &at91wdt_fops,
+};
+
+static int __init at91_wdt_init(void)
+{
+        int res;
+
+        /* Check that the heartbeat value is within range; if not reset to the default */
+        if (at91_wdt_settimeout(wdt_time)) {
+                at91_wdt_settimeout(WDT_DEFAULT_TIME);
+                printk(KERN_INFO "at91_wdt: wdt_time value must be 1 <= wdt_time <= 256, using %d\n", wdt_time);
+        }
+
+        res = misc_register(&at91wdt_miscdev);
+        if (res)
+                return res;
+
+        printk("AT91 Watchdog Timer enabled (%d seconds, nowayout=%d)\n", wdt_time, nowayout);
+        return 0;
+}
+
+static void __exit at91_wdt_exit(void)
+{
+        misc_deregister(&at91wdt_miscdev);
+}
+
+module_init(at91_wdt_init);
+module_exit(at91_wdt_exit);
+
+MODULE_AUTHOR("Andrew Victor");
+MODULE_DESCRIPTION("Watchdog driver for Atmel AT91RM9200");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index a13395e2c372..fa2ba9ebe42a 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -33,11 +33,6 @@
  *      82801E   (C-ICH)  : document number 273599-001, 273645-002,
  *      82801EB  (ICH5)   : document number 252516-001, 252517-003,
  *      82801ER  (ICH5R)  : document number 252516-001, 252517-003,
- *      82801FB  (ICH6)   : document number 301473-002, 301474-007,
- *      82801FR  (ICH6R)  : document number 301473-002, 301474-007,
- *      82801FBM (ICH6-M) : document number 301473-002, 301474-007,
- *      82801FW  (ICH6W)  : document number 301473-001, 301474-007,
- *      82801FRW (ICH6RW) : document number 301473-001, 301474-007
  *
  *  20000710 Nils Faerber
  *      Initial Version 0.01
@@ -66,6 +61,10 @@
  *  20050807 Wim Van Sebroeck <wim@iguana.be>
  *      0.08 Make sure that the watchdog is only "armed" when started.
  *           (Kernel Bug 4251)
+ *  20060416 Wim Van Sebroeck <wim@iguana.be>
+ *      0.09 Remove support for the ICH6, ICH6R, ICH6-M, ICH6W and ICH6RW and
+ *           ICH7 chipsets. (See Kernel Bug 6031 - other code will support these
+ *           chipsets)
  */
 
 /*
@@ -90,7 +89,7 @@
 #include "i8xx_tco.h"
 
 /* Module and version information */
-#define TCO_VERSION "0.08"
+#define TCO_VERSION "0.09"
 #define TCO_MODULE_NAME "i8xx TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 #define PFX TCO_MODULE_NAME ": "
@@ -391,11 +390,6 @@ static struct pci_device_id i8xx_tco_pci_tbl[] = {
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_12,  PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801E_0,    PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801EB_0,   PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_0,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_2,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_0,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_1,      PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_1,       PCI_ANY_ID, PCI_ANY_ID, },
         { 0, },                 /* End of list */
 };
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 8d6b249ad66b..6d44ca68312d 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -66,15 +66,13 @@
 #include <linux/fs.h>           /* For file operations */
 #include <linux/ioport.h>       /* For io-port access */
 #include <linux/spinlock.h>     /* For spin_lock/spin_unlock/... */
-#include <linux/sched.h>        /* TASK_INTERRUPTIBLE, set_current_state() and friends */
-#include <linux/slab.h>         /* For kmalloc */
 
 #include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.16"
-#define WATCHDOG_DATE "03 Jan 2006"
+#define WATCHDOG_VERSION "1.17"
+#define WATCHDOG_DATE "12 Feb 2006"
 #define WATCHDOG_DRIVER_NAME "ISA-PC Watchdog"
 #define WATCHDOG_NAME "pcwd"
 #define PFX WATCHDOG_NAME ": "
@@ -96,15 +94,19 @@
  * PCI-PC Watchdog card.
 */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision A. */
-#define WD_WDRST                0x01    /* Previously reset state */
-#define WD_T110                 0x02    /* Temperature overheat sense */
-#define WD_HRTBT                0x04    /* Heartbeat sense */
-#define WD_RLY2                 0x08    /* External relay triggered */
-#define WD_SRLY2                0x80    /* Software external relay triggered */
+#define WD_WDRST                0x01    /* Previously reset state */
+#define WD_T110                 0x02    /* Temperature overheat sense */
+#define WD_HRTBT                0x04    /* Heartbeat sense */
+#define WD_RLY2                 0x08    /* External relay triggered */
+#define WD_SRLY2                0x80    /* Software external relay triggered */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision C. */
-#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
-#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
-#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
+#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
+#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_RL2A            0x08    /* Relay 2 activated by on-board processor */
+#define WD_REVC_RL1A            0x10    /* Relay 1 active */
+#define WD_REVC_R2DS            0x40    /* Relay 2 disable */
+#define WD_REVC_RLY2            0x80    /* Relay 2 activated? */
 /* Port 2 : Control Status #2 */
 #define WD_WDIS                 0x10    /* Watchdog Disabled */
 #define WD_ENTP                 0x20    /* Watchdog Enable Temperature Trip */
@@ -122,9 +124,14 @@
 #define CMD_ISA_VERSION_HUNDRETH        0x03
 #define CMD_ISA_VERSION_MINOR           0x04
 #define CMD_ISA_SWITCH_SETTINGS         0x05
+#define CMD_ISA_RESET_PC                0x06
+#define CMD_ISA_ARM_0                   0x07
+#define CMD_ISA_ARM_30                  0x08
+#define CMD_ISA_ARM_60                  0x09
 #define CMD_ISA_DELAY_TIME_2SECS        0x0A
 #define CMD_ISA_DELAY_TIME_4SECS        0x0B
 #define CMD_ISA_DELAY_TIME_8SECS        0x0C
+#define CMD_ISA_RESET_RELAYS            0x0D
 
 /*
  * We are using an kernel timer to do the pinging of the watchdog
@@ -142,6 +149,7 @@ static atomic_t open_allowed = ATOMIC_INIT(1);
 static char expect_close;
 static int temp_panic;
 static struct {                         /* this is private data for each ISA-PC watchdog card */
+        char fw_ver_str[6];             /* The cards firmware version */
         int revision;                   /* The card's revision */
         int supports_temp;              /* Wether or not the card has a temperature device */
         int command_mode;               /* Wether or not the card is in command mode */
@@ -153,6 +161,13 @@ static struct {				/* this is private data for each ISA-PC watchdog card */
 } pcwd_private;
 
 /* module parameters */
+#define QUIET   0       /* Default */
+#define VERBOSE 1       /* Verbose */
+#define DEBUG   2       /* print fancy stuff too */
+static int debug = QUIET;
+module_param(debug, int, 0);
+MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
+
 #define WATCHDOG_HEARTBEAT 60           /* 60 sec default heartbeat */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
@@ -172,6 +187,10 @@ static int send_isa_command(int cmd)
         int control_status;
         int port0, last_port0;  /* Double read for stabilising */
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "sending following data cmd=0x%02x\n",
+                        cmd);
+
         /* The WCMD bit must be 1 and the command is only 4 bits in size */
         control_status = (cmd & 0x0F) | WD_WCMD;
         outb_p(control_status, pcwd_private.io_addr + 2);
@@ -188,6 +207,10 @@ static int send_isa_command(int cmd)
                 udelay (250);
         }
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "received following data for cmd=0x%02x: port0=0x%02x last_port0=0x%02x\n",
+                        cmd, port0, last_port0);
+
         return port0;
 }
 
@@ -214,6 +237,10 @@ static int set_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
         pcwd_private.command_mode = found;
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
+
         return(found);
 }
 
@@ -226,6 +253,10 @@ static void unset_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
 
         pcwd_private.command_mode = 0;
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
 }
 
 static inline void pcwd_check_temperature_support(void)
@@ -234,27 +265,22 @@ static inline void pcwd_check_temperature_support(void)
                 pcwd_private.supports_temp = 1;
 }
 
-static inline char *get_firmware(void)
+static inline void pcwd_get_firmware(void)
 {
         int one, ten, hund, minor;
-        char *ret;
 
-        ret = kmalloc(6, GFP_KERNEL);
-        if(ret == NULL)
-                return NULL;
+        strcpy(pcwd_private.fw_ver_str, "ERROR");
 
         if (set_command_mode()) {
                 one = send_isa_command(CMD_ISA_VERSION_INTEGER);
                 ten = send_isa_command(CMD_ISA_VERSION_TENTH);
                 hund = send_isa_command(CMD_ISA_VERSION_HUNDRETH);
                 minor = send_isa_command(CMD_ISA_VERSION_MINOR);
-                sprintf(ret, "%c.%c%c%c", one, ten, hund, minor);
+                sprintf(pcwd_private.fw_ver_str, "%c.%c%c%c", one, ten, hund, minor);
         }
-        else
-                sprintf(ret, "ERROR");
-
         unset_command_mode();
-        return(ret);
+
+        return;
 }
 
 static inline int pcwd_get_option_switches(void)
@@ -272,17 +298,15 @@ static inline int pcwd_get_option_switches(void)
 
 static void pcwd_show_card_info(void)
 {
-        char *firmware;
         int option_switches;
 
         /* Get some extra info from the hardware (in command/debug/diag mode) */
         if (pcwd_private.revision == PCWD_REVISION_A)
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.A) detected at port 0x%04x\n", pcwd_private.io_addr);
         else if (pcwd_private.revision == PCWD_REVISION_C) {
-                firmware = get_firmware();
+                pcwd_get_firmware();
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.C) detected at port 0x%04x (Firmware version: %s)\n",
-                        pcwd_private.io_addr, firmware);
-                kfree(firmware);
+                        pcwd_private.io_addr, pcwd_private.fw_ver_str);
                 option_switches = pcwd_get_option_switches();
                 printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
                         option_switches,
@@ -362,6 +386,10 @@ static int pcwd_start(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog started\n");
+
         return 0;
 }
 
@@ -386,6 +414,10 @@ static int pcwd_stop(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog stopped\n");
+
         return 0;
 }
 
@@ -393,6 +425,10 @@ static int pcwd_keepalive(void)
 {
         /* user land ping */
         pcwd_private.next_heartbeat = jiffies + (heartbeat * HZ);
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "Watchdog keepalive signal send\n");
+
         return 0;
 }
 
@@ -402,12 +438,17 @@ static int pcwd_set_heartbeat(int t)
                 return -EINVAL;
 
         heartbeat = t;
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "New heartbeat: %d\n",
+                       heartbeat);
+
         return 0;
 }
 
 static int pcwd_get_status(int *status)
 {
-        int card_status;
+        int control_status;
 
         *status=0;
         spin_lock(&pcwd_private.io_lock);
@@ -415,37 +456,39 @@ static int pcwd_get_status(int *status)
                 /* Rev A cards return status information from
                  * the base register, which is used for the
                  * temperature in other cards. */
-                card_status = inb(pcwd_private.io_addr);
+                control_status = inb(pcwd_private.io_addr);
         else {
                 /* Rev C cards return card status in the base
                  * address + 1 register. And use different bits
                  * to indicate a card initiated reset, and an
                  * over-temperature condition. And the reboot
                  * status can be reset. */
-                card_status = inb(pcwd_private.io_addr + 1);
+                control_status = inb(pcwd_private.io_addr + 1);
         }
         spin_unlock(&pcwd_private.io_lock);
 
         if (pcwd_private.revision == PCWD_REVISION_A) {
-                if (card_status & WD_WDRST)
+                if (control_status & WD_WDRST)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_T110) {
+                if (control_status & WD_T110) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         } else {
-                if (card_status & WD_REVC_WTRP)
+                if (control_status & WD_REVC_WTRP)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_REVC_TTRP) {
+                if (control_status & WD_REVC_TTRP) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         }
@@ -455,9 +498,25 @@ static int pcwd_get_status(int *status)
 
 static int pcwd_clear_status(void)
 {
+        int control_status;
+
         if (pcwd_private.revision == PCWD_REVISION_C) {
                 spin_lock(&pcwd_private.io_lock);
-                outb_p(0x00, pcwd_private.io_addr + 1); /* clear reset status */
+
+                if (debug >= VERBOSE)
+                        printk(KERN_INFO PFX "clearing watchdog trip status\n");
+
+                control_status = inb_p(pcwd_private.io_addr + 1);
+
+                if (debug >= DEBUG) {
+                        printk(KERN_DEBUG PFX "status was: 0x%02x\n", control_status);
+                        printk(KERN_DEBUG PFX "sending: 0x%02x\n",
+                                (control_status & WD_REVC_R2DS));
+                }
+
+                /* clear reset status & Keep Relay 2 disable state as it is */
+                outb_p((control_status & WD_REVC_R2DS), pcwd_private.io_addr + 1);
+
                 spin_unlock(&pcwd_private.io_lock);
         }
         return 0;
@@ -481,6 +540,11 @@ static int pcwd_get_temperature(int *temperature)
         *temperature = ((inb(pcwd_private.io_addr)) * 9 / 5) + 32;
         spin_unlock(&pcwd_private.io_lock);
 
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "temperature is: %d F\n",
+                        *temperature);
+        }
+
         return 0;
 }
 
@@ -599,6 +663,8 @@ static ssize_t pcwd_write(struct file *file, const char __user *buf, size_t len,
 static int pcwd_open(struct inode *inode, struct file *file)
 {
         if (!atomic_dec_and_test(&open_allowed) ) {
+                if (debug >= VERBOSE)
+                        printk(KERN_ERR PFX "Attempt to open already opened device.\n");
                 atomic_inc( &open_allowed );
                 return -EBUSY;
         }
@@ -922,7 +988,8 @@ static void __exit pcwd_cleanup_module(void)
 {
         if (pcwd_private.io_addr)
                 pcwatchdog_exit();
-        return;
+
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(pcwd_init_module);
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 2700c5c45b8a..3fdfda9324fa 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -705,7 +705,8 @@ err_out_misc_deregister:
 err_out_unregister_reboot:
         unregister_reboot_notifier(&usb_pcwd_notifier);
 error:
-        usb_pcwd_delete (usb_pcwd);
+        if (usb_pcwd)
+                usb_pcwd_delete(usb_pcwd);
         usb_pcwd_device = NULL;
         return retval;
 }
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 9dc54736e4eb..1ea04e9b2b0b 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -423,6 +423,12 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         if (tmr_atboot && started == 0) {
                 printk(KERN_INFO PFX "Starting Watchdog Timer\n");
                 s3c2410wdt_start();
+        } else if (!tmr_atboot) {
+                /* if we're not enabling the watchdog, then ensure it is
+                 * disabled if it has been left running from the bootloader
+                 * or other source */
+
+                s3c2410wdt_stop();
         }
 
         return 0;
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index 515ce7572049..20b88f9b7be2 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -377,7 +377,7 @@ static int __init sc1200wdt_init(void)
 {
         int ret;
 
-        printk(banner);
+        printk("%s\n", banner);
 
         spin_lock_init(&sc1200wdt_lock);
         sema_init(&open_sem, 1);