68 files changed, 2332 insertions, 893 deletions
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 5d72f50de1ac..46d66037b917 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
        dev_t dev_id = MKDEV(major, 0);
+        cdev_del(&cs5535_gpio_cdev);
        unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-        if (gpio_base != 0)
+        release_region(gpio_base, CS5535_GPIO_SIZE);
-                release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 module_init(cs5535_gpio_init);
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 58dcdee1cd71..0030cd8e2e95 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct si_sm_data *bt,
 {
        unsigned int i;
-        if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+        if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
               return -1;
        if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index a86c0f29953e..b36eef0e9d19 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2198,11 +2198,11 @@ static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
        }
 }
-static struct ipmi_default_vals
+static __devinitdata struct ipmi_default_vals
 {
        int type;
        int port;
-} __devinit ipmi_defaults[] =
+} ipmi_defaults[] =
 {
        { .type = SI_KCS, .port = 0xca2 },
        { .type = SI_SMIC, .port = 0xca9 },
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                        format_module_id(devnamep, geo_module(geoid),
                                         MODULE_FORMAT_BRIEF);
                        devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
                        /* allocate sysctl device data */
                        scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index f8dd8527c6aa..a90f5d97df35 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct platform_device *dev)
        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                          PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
        else
                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..1efde3b27619 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
          Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
          and CONFIG_PNPACPI.
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
 config TCG_NSC
        tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
        ---help---
          If you have a TPM security chip from National Semicondutor 
          say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
        obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
        TPM_MINOR = 224,        /* officially assigned */
        TPM_BUFSIZE = 2048,
        TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
        schedule_work(&chip->work);
 }
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
        struct tpm_chip *chip = ptr;
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+/*
 * Internal kernel interface to transmit TPM commands
 */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                            size_t bufsiz)
 {
        ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
        unsigned long stop;
        count = be32_to_cpu(*((__be32 *) (buf + 2)));
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
        if (count == 0)
                return -ENODATA;
        if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
        down(&chip->tpm_mutex);
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                dev_err(chip->dev,
                        "tpm_transmit: tpm_send: error %zd\n", rc);
                goto out;
        }
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
        do {
-                u8 status = chip->vendor->status(chip);
+                u8 status = chip->vendor.status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
+                if ((status & chip->vendor.req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                    chip->vendor.req_complete_val)
                        goto out_recv;
-                }
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                        dev_err(chip->dev, "Operation Canceled\n");
                        rc = -ECANCELED;
                        goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                rmb();
        } while (time_before(jiffies, stop));
+        chip->vendor.cancel(chip);
-        chip->vendor->cancel(chip);
        dev_err(chip->dev, "Operation Timed out\n");
        rc = -ETIME;
        goto out;
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
        if (rc < 0)
                dev_err(chip->dev,
                        "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
+#define TPM_ERROR_SIZE 10
-static const u8 cap_pcr[] = {
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+static const u8 tpm_cap[] = {
        0, 193,                 /* TPM_TAG_RQU_COMMAND */
        0, 0, 0, 22,            /* length */
        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
-        0, 0, 0, 4,
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
-        0, 0, 1, 1
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
 static const u8 pcrread[] = {
        0, 193,                 /* TPM_TAG_RQU_COMMAND */
        0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                      char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
-        ssize_t len;
+        ssize_t rc;
        int i, j, num_pcrs;
        __be32 index;
        char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
        if (chip == NULL)
                return -ENODEV;
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
-            < CAP_PCR_RESULT_SIZE) {
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
+        rc = transmit_cmd(chip, data, sizeof(data),
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+                        "attempting to determine the number of PCRS");
+        if (rc)
                return 0;
-        }
        num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
        for (i = 0; i < num_pcrs; i++) {
                memcpy(data, pcrread, sizeof(pcrread));
                index = cpu_to_be32(i);
                memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
+                rc = transmit_cmd(chip, data, sizeof(data),
-                    < READ_PCR_RESULT_SIZE){
+                                "attempting to read a PCR");
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
+                if (rc)
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
                        goto out;
-                }
                str += sprintf(str, "PCR-%02d: ", i);
                for (j = 0; j < TPM_DIGEST_SIZE; j++)
                        str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
        u8 *data;
-        ssize_t len;
+        ssize_t err;
        int i, rc;
        char *str = buf;
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
        memcpy(data, readpubek, sizeof(readpubek));
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
-            READ_PUBEK_RESULT_SIZE) {
+                        "attempting to read the PUBEK");
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+        if (err)
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
                goto out;
-        }
        /* 
           ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                if ((i + 1) % 16 == 0)
                        str += sprintf(str, "\n");
        }
-        rc = str - buf;
 out:
+        rc = str - buf;
        kfree(data);
        return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
        0, 193,                 /* TPM_TAG_RQU_COMMAND */
        0, 0, 0, 18,            /* length */
        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
        0, 0, 0, 0
 };
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                      char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
-        ssize_t len;
+        ssize_t rc;
        char *str = buf;
        struct tpm_chip *chip = dev_get_drvdata(dev);
        if (chip == NULL)
                return -ENODEV;
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
+        rc = transmit_cmd(chip, data, sizeof(data),
-            CAP_MANUFACTURER_RESULT_SIZE)
+                        "attempting to determine the manufacturer");
-                return len;
+        if (rc)
+                return 0;
        str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
+        str += sprintf(str,
-            CAP_VER_RESULT_SIZE)
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                return len;
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+out:
        return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                        const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
        if (chip == NULL)
                return 0;
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
        return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
        spin_lock(&driver_lock);
        list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                        chip = pos;
                        break;
                }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
        struct tpm_chip *chip = file->private_data;
        int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
        return in_size;
 }
 EXPORT_SYMBOL_GPL(tpm_write);
-ssize_t tpm_read(struct file * file, char __user *buf,
+ssize_t tpm_read(struct file *file, char __user *buf,
-                 size_t size, loff_t * off)
+                 size_t size, loff_t *off)
 {
        struct tpm_chip *chip = file->private_data;
        int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
        spin_unlock(&driver_lock);
        dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
+        misc_deregister(&chip->vendor.miscdev);
-        kfree(chip->vendor->miscdev.name);
+        kfree(chip->vendor.miscdev.name);
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
        tpm_bios_log_teardown(chip->bios_dir);
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
+        clear_bit(chip->dev_num, dev_mask);
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
        kfree(chip);
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
 * upon errant exit from this function specific probe function should call
 * pci_disable_device
 */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
        char *devname;
        struct tpm_chip *chip;
-        int i, j;
        /* Driver specific per-device data */
        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
        if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
        init_MUTEX(&chip->buffer_mutex);
        init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
        chip->user_read_timer.function = user_reader_timeout;
        chip->user_read_timer.data = (unsigned long) chip;
-        chip->vendor = entry;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
-        chip->dev_num = -1;
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
-dev_num_search_complete:
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
-        if (chip->dev_num < 0) {
                dev_err(dev, "No available tpm device numbers\n");
                kfree(chip);
-                return -ENODEV;
+                return NULL;
        } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
        else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+        set_bit(chip->dev_num, dev_mask);
        devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
        scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
        chip->dev = get_device(dev);
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                dev_err(chip->dev,
                        "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
+                        chip->vendor.miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.minor);
                put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                kfree(chip);
-                dev_mask[i] &= !(1 << j);
+                return NULL;
-                return -ENODEV;
        }
        spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
        spin_unlock(&driver_lock);
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
        chip->bios_dir = tpm_bios_log_setup(devname);
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..54a4c804e25f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 struct tpm_chip;
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
+        const u8 req_complete_mask;
-        u8 req_complete_val;
+        const u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_canceled;
        void __iomem *iobase;           /* ioremapped address */
        unsigned long base;             /* TPM base address */
+        int irq;
        int region_size;
        int have_region;
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
        u8 (*status) (struct tpm_chip *);
        struct miscdevice miscdev;
        struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
        struct work_struct work;
        struct semaphore tpm_mutex;     /* tpm is processing */
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
        struct dentry **bios_dir;
        struct list_head list;
 };
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
 static inline int tpm_read_index(int base, int index)
 {
        outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
        outb(value & 0xFF, base+1);
 }
-extern int tpm_register_hardware(struct device *,
+extern void tpm_get_timeouts(struct tpm_chip *);
-                                 struct tpm_vendor_specific *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                return -EIO;
        for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                        dev_err(chip->dev, "error reading header\n");
                        return -EIO;
                }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
        }
        /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                dev_err(chip->dev,
                        "Recv size(%d) less than available space\n", size);
                for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                        if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                dev_err(chip->dev, "error reading data\n");
                                return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
        /* read all the data available */
        for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                        dev_err(chip->dev, "error reading data\n");
                        return -EIO;
                }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
        }
        /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
        if (status & ATML_STATUS_DATA_AVAIL) {
                dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
        dev_dbg(chip->dev, "tpm_atml_send:\n");
        for (i = 0; i < count; i++) {
                dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
        }
        return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
        .recv = tpm_atml_recv,
        .send = tpm_atml_send,
        .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
        struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
        if (chip) {
-                if (chip->vendor->have_region)
+                if (chip->vendor.have_region)
-                        atmel_release_region(chip->vendor->base,
+                        atmel_release_region(chip->vendor.base,
-                                             chip->vendor->region_size);
+                                             chip->vendor.region_size);
-                atmel_put_base_addr(chip->vendor);
+                atmel_put_base_addr(chip->vendor.iobase);
                tpm_remove_hardware(chip->dev);
                platform_device_unregister(pdev);
        }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
        int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
        driver_register(&atml_drv);
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                rc = -ENODEV;
                goto err_unreg_drv;
        }
-        tpm_atmel.have_region =
+        have_region =
            (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
-              "tpm_atmel0") == NULL) ? 0 : 1;
        if (IS_ERR
            (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                goto err_rel_reg;
        }
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                goto err_unreg_dev;
+        }
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
        return 0;
 err_unreg_dev:
        platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
+        atmel_put_base_addr(iobase);
-        if (tpm_atmel.have_region)
+        if (have_region)
-                atmel_release_region(tpm_atmel.base,
+                atmel_release_region(base,
-                                     tpm_atmel.region_size);
+                                     region_size);
 err_unreg_drv:
        driver_unregister(&atml_drv);
        return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
+static inline void atmel_put_base_addr(void __iomem *iobase)
-                                         *vendor)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
        struct device_node *dn;
        unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
        else
                size = reg[naddrc];
-        vendor->base = address;
+        *base = address;
-        vendor->region_size = size;
+        *region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
        return 0;
 }
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
+static inline void atmel_put_base_addr(void __iomem *iobase)
-                                         *vendor)
 {
 }
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
-                                         *vendor)
 {
        int lo, hi;
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
        lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
        hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
-        vendor->base = (hi << 8) | lo;
+        *base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *region_size = 2;
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..e45f0d3d12de 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
 struct tpm_bios_log {
        void *bios_event_log;
        void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 struct acpi_tcpa {
        struct acpi_table_header hdr;
-        u16 reserved;
+        u16 platform_class;
-        u32 log_max_len __attribute__ ((packed));
+        union {
-        u32 log_start_addr __attribute__ ((packed));
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 struct tcpa_event {
@@ -120,6 +134,7 @@ static const char* tcpa_pc_event_id_strings[] = {
        "S-CRTM Version",
        "S-CRTM Contents",
        "S-CRTM POST Contents",
+        "POST Contents",
 };
 /* returns pointer to start of pos. entry of tcg log */
@@ -306,6 +321,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
        /* 5th: delimiter */
        seq_putc(m, '\0');
+        kfree(eventname);
        return 0;
 }
@@ -353,6 +369,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
        /* 4th: eventname <= max + \'0' delimiter */
        seq_printf(m, " %s\n", eventname);
+        kfree(eventname);
        return 0;
 }
@@ -376,6 +393,7 @@ static int read_log(struct tpm_bios_log *log)
        struct acpi_tcpa *buff;
        acpi_status status;
        struct acpi_table_header *virt;
+        u64 len, start;
        if (log->bios_event_log != NULL) {
                printk(KERN_ERR
@@ -396,27 +414,37 @@ static int read_log(struct tpm_bios_log *log)
                return -EIO;
        }
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                return -EIO;
        }
        /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
        if (!log->bios_event_log) {
-                printk
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
-                     __func__);
                return -ENOMEM;
        }
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
        return 0;
 }
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
 * License.
 */
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
        if (clear_wrfifo) {
                for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                        if (status == 0xff) {
                                if (check == 5)
                                        break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
         */
        i = 0;
        do {
-                status = inb(chip->vendor->base + RDFIFO);
+                status = inb(chip->vendor.base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                i++;
                if (i == TPM_MAX_TRIES)
                        return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
        int status;
        int i;
        for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                /* check the status-register if wait_for_bit is set */
                if (status & 1 << wait_for_bit)
                        break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
        wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
    /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                ret = wait(chip, STAT_RDA);
                if (ret)
                        return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
        }
        if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
                for (i = 0; i < size; i++) {
                        wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                }
                if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
        u8 count_high, count_low, count_4, count_3, count_2, count_1;
        /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
        ret = empty_fifo(chip, 1);
        if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
        .release = tpm_release,
 };
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
        .recv = tpm_inf_recv,
        .send = tpm_inf_send,
        .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
        int version[2];
        int productid[2];
        char chipname[20];
+        struct tpm_chip *chip;
        /* read IO-ports through PnP */
        if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                        goto err_last;
                }
                /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                        rc = -EINVAL;
                        goto err_last;
                }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
+                if (request_region
-                                "tpm_infineon0") == NULL) {
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                        rc = -EINVAL;
                        goto err_last;
                }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                /* configure TPM with IO-ports */
                outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
                /* control if IO-ports are set correctly */
                outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                outb(IOLIML, TPM_INF_ADDR);
                iol = inb(TPM_INF_DATA);
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                        dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
+                                "Could not set IO-ports to 0x%x\n",
-                                tpm_inf.base);
+                                TPM_INF_BASE);
                        rc = -EIO;
                        goto err_release_region;
                }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
                /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
                /* Finally, we're done, print some infos */
                dev_info(&dev->dev, "TPM found: "
                         "config base 0x%x, "
                         "io base 0x%x, "
-                         "chip version %02x%02x, "
+                         "chip version 0x%02x%02x, "
-                         "vendor id %x%x (Infineon), "
+                         "vendor id 0x%x%x (Infineon), "
-                         "product id %02x%02x"
+                         "product id 0x%02x%02x"
                         "%s\n",
                         TPM_INF_ADDR,
                         TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         vendorid[0], vendorid[1],
                         productid[0], productid[1], chipname);
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
-                if (rc < 0) {
-                        rc = -ENODEV;
                        goto err_release_region;
                }
+                chip->vendor.base = TPM_INF_BASE;
                return 0;
        } else {
                rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
        }
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
        release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
        struct tpm_chip *chip = pnp_get_drvdata(dev);
        if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                tpm_remove_hardware(chip->dev);
        }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
        },
        .id_table = tpm_pnp_tbl,
        .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
        unsigned long stop;
        /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
        if ((*data & mask) == val)
                return 0;
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
        stop = jiffies + 10 * HZ;
        do {
                msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                if ((*data & mask) == val)
                        return 0;
        }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
        unsigned long stop;
        /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
        if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
        if (status & NSC_STATUS_RDY)
                return 0;
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
        stop = jiffies + 100;
        do {
                msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                if (status & NSC_STATUS_RDY)
                        return 0;
        }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                return -EIO;
        }
        if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                dev_err(chip->dev, "not in normal mode (0x%x)\n",
                        data);
                return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                }
                if (data & NSC_STATUS_F0)
                        break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
        }
        if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                dev_err(chip->dev, "F0 not set\n");
                return -EIO;
        }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                dev_err(chip->dev,
                        "expected end of command(0x%x)\n", data);
                return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
         * fix it. Not sure why this is needed, we followed the flow
         * chart in the manual to the letter.
         */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
        if (nsc_wait_for_ready(chip) != 0)
                return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                return -EIO;
        }
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
        if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                dev_err(chip->dev, "IBR timeout\n");
                return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                "IBF timeout (while writing data)\n");
                        return -EIO;
                }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
        }
        if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                dev_err(chip->dev, "IBF timeout\n");
                return -EIO;
        }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
        return count;
 }
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
        .recv = tpm_nsc_recv,
        .send = tpm_nsc_send,
        .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
        struct tpm_chip *chip = dev_get_drvdata(dev);
        if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                tpm_remove_hardware(chip->dev);
        }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
        int rc = 0;
        int lo, hi;
        int nscAddrBase = TPM_ADDR;
+        struct tpm_chip *chip;
+        unsigned long base;
        /* verify that it is a National part (SID) */
        if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
        hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
        lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
        /* enable the DPM module */
        tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
        if ((rc = platform_device_register(pdev)) < 0)
                goto err_free_dev;
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                rc = -EBUSY;
                goto err_unreg_dev;
        }
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                goto err_rel_reg;
+        }
        dev_dbg(&pdev->dev, "NSC TPM detected\n");
        dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                 "NSC TPM revision %d\n",
                 tpm_read_index(nscAddrBase, 0x27) & 0x1F);
+        chip->vendor.base = base;
        return 0;
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
        platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..b9cae9a238bb
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+#define TPM_HEADER_SIZE 10
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+        return -1;
+}
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+        if (check_locality(chip, l) >= 0)
+                return l;
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+        if (interrupt == 0)
+                return IRQ_NONE;
+        chip->vendor.irq = irq;
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+        if (interrupt == 0)
+                return IRQ_NONE;
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+        if ((vendor & 0xFFFF) == 0xFFFF) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 841f0bd3eaaf..f07637a8f88f 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2723,7 +2723,11 @@ static void __do_SAK(void *arg)
                }
                task_lock(p);
                if (p->files) {
-                        rcu_read_lock();
+                        /*
+                         * We don't take a ref to the file, so we must
+                         * hold ->file_lock instead.
+                         */
+                        spin_lock(&p->files->file_lock);
                        fdt = files_fdtable(p->files);
                        for (i=0; i < fdt->max_fds; i++) {
                                filp = fcheck_files(p->files, i);
@@ -2738,7 +2742,7 @@ static void __do_SAK(void *arg)
                                        break;
                                }
                        }
-                        rcu_read_unlock();
+                        spin_unlock(&p->files->file_lock);
                }
                task_unlock(p);
        } while_each_thread(g, p);
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 8e0f3158215f..dfca74933625 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapter * adap, u16 addr,
                ret = i801_transaction();
        }
+        /* Some BIOSes don't like it when PEC is enabled at reboot or resume
+           time, so we forcibly disable it after every transaction. */
+        if (hwpec)
+                outb_p(0, SMBAUXCTL);
        if(block)
                return ret;
        if(ret)
diff --git a/drivers/i2c/chips/m41t00.c b/drivers/i2c/chips/m41t00.c
index 27fc9ff2961a..99ab4ec34390 100644
--- a/drivers/i2c/chips/m41t00.c
+++ b/drivers/i2c/chips/m41t00.c
@@ -131,13 +131,13 @@ m41t00_set(void *arg)
        if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
                || (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
                        < 0)
-                || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
                        < 0)
-                || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
                        < 0)
-                || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
                        < 0)
-                || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
                        < 0))
                dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
index cf84350efc55..8b24b4f2a839 100644
--- a/drivers/ide/pci/alim15x3.c
+++ b/drivers/ide/pci/alim15x3.c
@@ -731,6 +731,8 @@ static unsigned int __devinit ata66_ali15x3 (ide_hwif_t *hwif)
        
        if(m5229_revision <= 0x20)
                tmpbyte = (tmpbyte & (~0x02)) | 0x01;
+        else if (m5229_revision == 0xc7)
+                tmpbyte |= 0x03;
        else
                tmpbyte |= 0x01;
diff --git a/drivers/ide/pci/atiixp.c b/drivers/ide/pci/atiixp.c
index df9ee9a78435..900efd1da587 100644
--- a/drivers/ide/pci/atiixp.c
+++ b/drivers/ide/pci/atiixp.c
@@ -348,6 +348,7 @@ static struct pci_device_id atiixp_pci_tbl[] = {
        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP200_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP300_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
        { 0, },
 };
 MODULE_DEVICE_TABLE(pci, atiixp_pci_tbl);
diff --git a/drivers/ide/pci/pdc202xx_old.c b/drivers/ide/pci/pdc202xx_old.c
index 6f8f8645b02c..7ce5bf783688 100644
--- a/drivers/ide/pci/pdc202xx_old.c
+++ b/drivers/ide/pci/pdc202xx_old.c
@@ -798,7 +798,6 @@ static ide_pci_device_t pdc202xx_chipsets[] __devinitdata = {
                .autodma        = AUTODMA,
                .bootable       = OFF_BOARD,
                .extra          = 48,
-                .flags          = IDEPCI_FLAG_FORCE_PDC,
        },{     /* 2 */
                .name           = "PDC20263",
                .init_setup     = init_setup_pdc202ata4,
@@ -819,7 +818,6 @@ static ide_pci_device_t pdc202xx_chipsets[] __devinitdata = {
                .autodma        = AUTODMA,
                .bootable       = OFF_BOARD,
                .extra          = 48,
-                .flags          = IDEPCI_FLAG_FORCE_PDC,
        },{     /* 4 */
                .name           = "PDC20267",
                .init_setup     = init_setup_pdc202xx,
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 7ebf992e8c2f..462ed3006c30 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -580,7 +580,6 @@ void ide_pci_setup_ports(struct pci_dev *dev, ide_pci_device_t *d, int pciirq, a
        int port;
        int at_least_one_hwif_enabled = 0;
        ide_hwif_t *hwif, *mate = NULL;
-        static int secondpdc = 0;
        u8 tmp;
        index->all = 0xf0f0;
@@ -592,21 +591,9 @@ void ide_pci_setup_ports(struct pci_dev *dev, ide_pci_device_t *d, int pciirq, a
        for (port = 0; port <= 1; ++port) {
                ide_pci_enablebit_t *e = &(d->enablebits[port]);
        
-                /* 
-                 * If this is a Promise FakeRaid controller,
-                 * the 2nd controller will be marked as 
-                 * disabled while it is actually there and enabled
-                 * by the bios for raid purposes. 
-                 * Skip the normal "is it enabled" test for those.
-                 */
-                if ((d->flags & IDEPCI_FLAG_FORCE_PDC) &&
-                    (secondpdc++==1) && (port==1))
-                        goto controller_ok;
-                        
                if (e->reg && (pci_read_config_byte(dev, e->reg, &tmp) ||
                    (tmp & e->mask) != e->val))
                        continue;       /* port not enabled */
-controller_ok:
                if (d->channels <= port)
                        break;
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 3a702da83e41..469b6923a2e2 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -228,10 +228,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                                goto error1;
                }
                /* Make sure class supplied is consistent with RMPP */
-                if (ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
+                if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
-                        if (!rmpp_version)
-                                goto error1;
-                } else {
                        if (rmpp_version)
                                goto error1;
                }
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index cd533cf951c2..7d3fb6996b41 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -365,15 +365,3 @@ static ssize_t ipath_diag_write(struct file *fp, const char __user *data,
 bail:
        return ret;
 }
-void ipath_diag_bringup_link(struct ipath_devdata *dd)
-{
-        if (diag_set_link || (dd->ipath_flags & IPATH_LINKACTIVE))
-                return;
-        diag_set_link = 1;
-        ipath_cdbg(VERBOSE, "Trying to set to set link active for "
-                   "diag pkt\n");
-        ipath_layer_set_linkstate(dd, IPATH_IB_LINKARM);
-        ipath_layer_set_linkstate(dd, IPATH_IB_LINKACTIVE);
-}
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 58a94efb0070..e7617c3982ea 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -1729,7 +1729,7 @@ void ipath_free_pddata(struct ipath_devdata *dd, u32 port, int freehdrq)
        }
 }
-int __init infinipath_init(void)
+static int __init infinipath_init(void)
 {
        int ret;
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index 60f5f4108069..0bcb428041f3 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -172,8 +172,8 @@ static void handle_e_ibstatuschanged(struct ipath_devdata *dd,
                                   "was %s\n", dd->ipath_unit,
                                   ib_linkstate(lstate),
                                   ib_linkstate((unsigned)
-                                                dd->ipath_lastibcstat
+                                                dd->ipath_lastibcstat
-                                                & IPATH_IBSTATE_MASK));
+                                                & IPATH_IBSTATE_MASK));
        }
        else {
                lstate = dd->ipath_lastibcstat & IPATH_IBSTATE_MASK;
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 159d0aed31a5..0ce5f19c9d62 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -528,7 +528,6 @@ extern spinlock_t ipath_devs_lock;
 extern struct ipath_devdata *ipath_lookup(int unit);
 extern u16 ipath_layer_rcv_opcode;
-extern int ipath_verbs_registered;
 extern int __ipath_layer_intr(struct ipath_devdata *, u32);
 extern int ipath_layer_intr(struct ipath_devdata *, u32);
 extern int __ipath_layer_rcv(struct ipath_devdata *, void *,
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c
index 2cabf6340572..69ed1100701a 100644
--- a/drivers/infiniband/hw/ipath/ipath_layer.c
+++ b/drivers/infiniband/hw/ipath/ipath_layer.c
@@ -52,7 +52,7 @@ static int (*layer_rcv)(void *, void *, struct sk_buff *);
 static int (*layer_rcv_lid)(void *, void *);
 static int (*verbs_piobufavail)(void *);
 static void (*verbs_rcv)(void *, void *, void *, u32);
-int ipath_verbs_registered;
+static int ipath_verbs_registered;
 static void *(*layer_add_one)(int, struct ipath_devdata *);
 static void (*layer_remove_one)(void *);
diff --git a/drivers/infiniband/hw/ipath/ipath_pe800.c b/drivers/infiniband/hw/ipath/ipath_pe800.c
index e693a7a82667..e1dc4f757062 100644
--- a/drivers/infiniband/hw/ipath/ipath_pe800.c
+++ b/drivers/infiniband/hw/ipath/ipath_pe800.c
@@ -305,8 +305,8 @@ static const struct ipath_cregs ipath_pe_cregs = {
 * we'll print them and continue.  We reuse the same message buffer as
 * ipath_handle_errors() to avoid excessive stack usage.
 */
-void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
+static void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
-        size_t msgl)
+                                     size_t msgl)
 {
        ipath_err_t hwerrs;
        u32 bits, ctrl;
@@ -552,7 +552,7 @@ static int ipath_pe_boardname(struct ipath_devdata *dd, char *name,
 * freeze mode), and enable hardware errors as errors (along with
 * everything else) in errormask
 */
-void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
+static void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
 {
        ipath_err_t val;
        u64 extsval;
@@ -577,7 +577,7 @@ void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
 * ipath_pe_bringup_serdes - bring up the serdes
 * @dd: the infinipath device
 */
-int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
+static int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
 {
        u64 val, tmp, config1;
        int ret = 0, change = 0;
@@ -694,7 +694,7 @@ int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
 * @dd: the infinipath device
 * Called when driver is being unloaded
 */
-void ipath_pe_quiet_serdes(struct ipath_devdata *dd)
+static void ipath_pe_quiet_serdes(struct ipath_devdata *dd)
 {
        u64 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index 6058d70d7577..18890716db1e 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -188,8 +188,8 @@ static void free_qpn(struct ipath_qp_table *qpt, u32 qpn)
 * Allocate the next available QPN and put the QP into the hash table.
 * The hash table holds a reference to the QP.
 */
-int ipath_alloc_qpn(struct ipath_qp_table *qpt, struct ipath_qp *qp,
+static int ipath_alloc_qpn(struct ipath_qp_table *qpt, struct ipath_qp *qp,
-                    enum ib_qp_type type)
+                           enum ib_qp_type type)
 {
        unsigned long flags;
        u32 qpn;
@@ -232,7 +232,7 @@ bail:
 * Remove the QP from the table so it can't be found asynchronously by
 * the receive interrupt routine.
 */
-void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
+static void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
 {
        struct ipath_qp *q, **qpp;
        unsigned long flags;
@@ -358,6 +358,65 @@ static void ipath_reset_qp(struct ipath_qp *qp)
 }
 /**
+ * ipath_error_qp - put a QP into an error state
+ * @qp: the QP to put into an error state
+ *
+ * Flushes both send and receive work queues.
+ * QP r_rq.lock and s_lock should be held.
+ */
+static void ipath_error_qp(struct ipath_qp *qp)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ib_wc wc;
+        _VERBS_INFO("QP%d/%d in error state\n",
+                    qp->ibqp.qp_num, qp->remote_qpn);
+        spin_lock(&dev->pending_lock);
+        /* XXX What if its already removed by the timeout code? */
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        if (qp->piowait.next != LIST_POISON1)
+                list_del(&qp->piowait);
+        spin_unlock(&dev->pending_lock);
+        wc.status = IB_WC_WR_FLUSH_ERR;
+        wc.vendor_err = 0;
+        wc.byte_len = 0;
+        wc.imm_data = 0;
+        wc.qp_num = qp->ibqp.qp_num;
+        wc.src_qp = 0;
+        wc.wc_flags = 0;
+        wc.pkey_index = 0;
+        wc.slid = 0;
+        wc.sl = 0;
+        wc.dlid_path_bits = 0;
+        wc.port_num = 0;
+        while (qp->s_last != qp->s_head) {
+                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
+                wc.wr_id = wqe->wr.wr_id;
+                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                if (++qp->s_last >= qp->s_size)
+                        qp->s_last = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
+        }
+        qp->s_cur = qp->s_tail = qp->s_head;
+        qp->s_hdrwords = 0;
+        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
+        wc.opcode = IB_WC_RECV;
+        while (qp->r_rq.tail != qp->r_rq.head) {
+                wc.wr_id = get_rwqe_ptr(&qp->r_rq, qp->r_rq.tail)->wr_id;
+                if (++qp->r_rq.tail >= qp->r_rq.size)
+                        qp->r_rq.tail = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
+        }
+}
+/**
 * ipath_modify_qp - modify the attributes of a queue pair
 * @ibqp: the queue pair who's attributes we're modifying
 * @attr: the new attributes
@@ -821,65 +880,6 @@ void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc)
 }
 /**
- * ipath_error_qp - put a QP into an error state
- * @qp: the QP to put into an error state
- *
- * Flushes both send and receive work queues.
- * QP r_rq.lock and s_lock should be held.
- */
-void ipath_error_qp(struct ipath_qp *qp)
-{
-        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
-        struct ib_wc wc;
-        _VERBS_INFO("QP%d/%d in error state\n",
-                    qp->ibqp.qp_num, qp->remote_qpn);
-        spin_lock(&dev->pending_lock);
-        /* XXX What if its already removed by the timeout code? */
-        if (qp->timerwait.next != LIST_POISON1)
-                list_del(&qp->timerwait);
-        if (qp->piowait.next != LIST_POISON1)
-                list_del(&qp->piowait);
-        spin_unlock(&dev->pending_lock);
-        wc.status = IB_WC_WR_FLUSH_ERR;
-        wc.vendor_err = 0;
-        wc.byte_len = 0;
-        wc.imm_data = 0;
-        wc.qp_num = qp->ibqp.qp_num;
-        wc.src_qp = 0;
-        wc.wc_flags = 0;
-        wc.pkey_index = 0;
-        wc.slid = 0;
-        wc.sl = 0;
-        wc.dlid_path_bits = 0;
-        wc.port_num = 0;
-        while (qp->s_last != qp->s_head) {
-                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
-                wc.wr_id = wqe->wr.wr_id;
-                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                if (++qp->s_last >= qp->s_size)
-                        qp->s_last = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
-        }
-        qp->s_cur = qp->s_tail = qp->s_head;
-        qp->s_hdrwords = 0;
-        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
-        wc.opcode = IB_WC_RECV;
-        while (qp->r_rq.tail != qp->r_rq.head) {
-                wc.wr_id = get_rwqe_ptr(&qp->r_rq, qp->r_rq.tail)->wr_id;
-                if (++qp->r_rq.tail >= qp->r_rq.size)
-                        qp->r_rq.tail = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
-        }
-}
-/**
 * ipath_get_credit - flush the send work queue of a QP
 * @qp: the qp who's send work queue to flush
 * @aeth: the Acknowledge Extended Transport Header
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 5ff3de6128b2..01cfb30ee160 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -46,8 +46,8 @@
 * This is called from ipath_post_ud_send() to forward a WQE addressed
 * to the same HCA.
 */
-void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
+static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
-                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc)
+                              u32 length, struct ib_send_wr *wr, struct ib_wc *wc)
 {
        struct ipath_ibdev *dev = to_idev(sqp->ibqp.device);
        struct ipath_qp *qp;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 9f27fd35cdbb..8d2558a01f35 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -41,7 +41,7 @@
 /* Not static, because we don't want the compiler removing it */
 const char ipath_verbs_version[] = "ipath_verbs " IPATH_IDSTR;
-unsigned int ib_ipath_qp_table_size = 251;
+static unsigned int ib_ipath_qp_table_size = 251;
 module_param_named(qp_table_size, ib_ipath_qp_table_size, uint, S_IRUGO);
 MODULE_PARM_DESC(qp_table_size, "QP table size");
@@ -87,7 +87,7 @@ const enum ib_wc_opcode ib_ipath_wc_opcode[] = {
 /*
 * System image GUID.
 */
-__be64 sys_image_guid;
+static __be64 sys_image_guid;
 /**
 * ipath_copy_sge - copy data to SGE memory
@@ -1110,7 +1110,7 @@ static void ipath_unregister_ib_device(void *arg)
        ib_dealloc_device(ibdev);
 }
-int __init ipath_verbs_init(void)
+static int __init ipath_verbs_init(void)
 {
        return ipath_verbs_register(ipath_register_ib_device,
                                    ipath_unregister_ib_device,
@@ -1118,33 +1118,33 @@ int __init ipath_verbs_init(void)
                                    ipath_ib_timer);
 }
-void __exit ipath_verbs_cleanup(void)
+static void __exit ipath_verbs_cleanup(void)
 {
        ipath_verbs_unregister();
 }
 static ssize_t show_rev(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
+        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int vendor, boardrev, majrev, minrev;
+        int vendor, boardrev, majrev, minrev;
-        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
+        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
-                                 &majrev, &minrev);
+                                 &majrev, &minrev);
-        return sprintf(buf, "%d.%d\n", majrev, minrev);
+        return sprintf(buf, "%d.%d\n", majrev, minrev);
 }
 static ssize_t show_hca(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
+        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int ret;
+        int ret;
-        ret = ipath_layer_get_boardname(dev->dd, buf, 128);
+        ret = ipath_layer_get_boardname(dev->dd, buf, 128);
-        if (ret < 0)
+        if (ret < 0)
-                goto bail;
+                goto bail;
-        strcat(buf, "\n");
+        strcat(buf, "\n");
-        ret = strlen(buf);
+        ret = strlen(buf);
 bail:
        return ret;
@@ -1152,40 +1152,40 @@ bail:
 static ssize_t show_stats(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
+        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int i;
+        int i;
-        int len;
+        int len;
-        len = sprintf(buf,
+        len = sprintf(buf,
-                      "RC resends  %d\n"
+                      "RC resends  %d\n"
-                      "RC QACKs    %d\n"
+                      "RC QACKs    %d\n"
-                      "RC ACKs     %d\n"
+                      "RC ACKs     %d\n"
-                      "RC SEQ NAKs %d\n"
+                      "RC SEQ NAKs %d\n"
-                      "RC RDMA seq %d\n"
+                      "RC RDMA seq %d\n"
-                      "RC RNR NAKs %d\n"
+                      "RC RNR NAKs %d\n"
-                      "RC OTH NAKs %d\n"
+                      "RC OTH NAKs %d\n"
-                      "RC timeouts %d\n"
+                      "RC timeouts %d\n"
-                      "RC RDMA dup %d\n"
+                      "RC RDMA dup %d\n"
-                      "piobuf wait %d\n"
+                      "piobuf wait %d\n"
-                      "no piobuf   %d\n"
+                      "no piobuf   %d\n"
-                      "PKT drops   %d\n"
+                      "PKT drops   %d\n"
-                      "WQE errs    %d\n",
+                      "WQE errs    %d\n",
-                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
+                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
-                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
+                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
-                      dev->n_other_naks, dev->n_timeouts,
+                      dev->n_other_naks, dev->n_timeouts,
-                      dev->n_rdma_dup_busy, dev->n_piowait,
+                      dev->n_rdma_dup_busy, dev->n_piowait,
-                      dev->n_no_piobuf, dev->n_pkt_drops, dev->n_wqe_errs);
+                      dev->n_no_piobuf, dev->n_pkt_drops, dev->n_wqe_errs);
-        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
+        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
                const struct ipath_opcode_stats *si = &dev->opstats[i];
-                if (!si->n_packets && !si->n_bytes)
+                if (!si->n_packets && !si->n_bytes)
-                        continue;
+                        continue;
-                len += sprintf(buf + len, "%02x %llu/%llu\n", i,
+                len += sprintf(buf + len, "%02x %llu/%llu\n", i,
                               (unsigned long long) si->n_packets,
-                               (unsigned long long) si->n_bytes);
+                               (unsigned long long) si->n_bytes);
-        }
+        }
-        return len;
+        return len;
 }
 static CLASS_DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
@@ -1194,25 +1194,25 @@ static CLASS_DEVICE_ATTR(board_id, S_IRUGO, show_hca, NULL);
 static CLASS_DEVICE_ATTR(stats, S_IRUGO, show_stats, NULL);
 static struct class_device_attribute *ipath_class_attributes[] = {
-        &class_device_attr_hw_rev,
+        &class_device_attr_hw_rev,
-        &class_device_attr_hca_type,
+        &class_device_attr_hca_type,
-        &class_device_attr_board_id,
+        &class_device_attr_board_id,
-        &class_device_attr_stats
+        &class_device_attr_stats
 };
 static int ipath_verbs_register_sysfs(struct ib_device *dev)
 {
-        int i;
+        int i;
        int ret;
-        for (i = 0; i < ARRAY_SIZE(ipath_class_attributes); ++i)
+        for (i = 0; i < ARRAY_SIZE(ipath_class_attributes); ++i)
-                if (class_device_create_file(&dev->class_dev,
+                if (class_device_create_file(&dev->class_dev,
-                                             ipath_class_attributes[i])) {
+                                             ipath_class_attributes[i])) {
-                        ret = 1;
+                        ret = 1;
                        goto bail;
                }
-        ret = 0;
+        ret = 0;
 bail:
        return ret;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
index b824632b2a8c..fcafbc7c9e71 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.h
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -577,8 +577,6 @@ int ipath_init_qp_table(struct ipath_ibdev *idev, int size);
 void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc);
-void ipath_error_qp(struct ipath_qp *qp);
 void ipath_get_credit(struct ipath_qp *qp, u32 aeth);
 void ipath_do_rc_send(unsigned long data);
@@ -607,9 +605,6 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
 void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc);
-void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
-                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc);
 int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr);
 void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index f235c7ea42f0..4730863ece9a 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -49,7 +49,7 @@ enum {
        MTHCA_VENDOR_CLASS2 = 0xa
 };
-int mthca_update_rate(struct mthca_dev *dev, u8 port_num)
+static int mthca_update_rate(struct mthca_dev *dev, u8 port_num)
 {
        struct ib_port_attr *tprops = NULL;
        int                  ret;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 5f2b3f6e4c47..5bb55742ada6 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -617,6 +617,14 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
                     scmnd->sc_data_direction);
 }
+static void srp_remove_req(struct srp_target_port *target, struct srp_request *req,
+                           int index)
+{
+        list_del(&req->list);
+        req->next = target->req_head;
+        target->req_head = index;
+}
 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
 {
        struct srp_request *req;
@@ -664,9 +672,7 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                        scmnd->host_scribble = (void *) -1L;
                        scmnd->scsi_done(scmnd);
-                        list_del(&req->list);
+                        srp_remove_req(target, req, rsp->tag & ~SRP_TAG_TSK_MGMT);
-                        req->next = target->req_head;
-                        target->req_head = rsp->tag & ~SRP_TAG_TSK_MGMT;
                } else
                        req->cmd_done = 1;
        }
@@ -1188,12 +1194,10 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
        spin_lock_irq(target->scsi_host->host_lock);
        if (req->cmd_done) {
-                list_del(&req->list);
+                srp_remove_req(target, req, req_index);
-                req->next = target->req_head;
-                target->req_head = req_index;
                scmnd->scsi_done(scmnd);
        } else if (!req->tsk_status) {
+                srp_remove_req(target, req, req_index);
                scmnd->result = DID_ABORT << 16;
                ret = SUCCESS;
        }
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index f86ed6af3aa2..eb41aba3ddef 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -5,8 +5,6 @@
 *                       Tilman Schmidt <tilman@imap.cc>,
 *                       Stefan Eilers.
 *
- * Based on usb-gigaset.c.
- *
 * =====================================================================
 *      This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License as
@@ -46,19 +44,20 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define GIGASET_DEVFSNAME  "gig/bas/"
 #define GIGASET_DEVNAME    "ttyGB"
-#define IF_WRITEBUF 256 //FIXME
+/* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
+#define IF_WRITEBUF 264
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
-#define USB_GIGA_PRODUCT_ID     0x0001
+#define USB_3070_PRODUCT_ID     0x0001
-#define USB_4175_PRODUCT_ID     0x0002
+#define USB_3075_PRODUCT_ID     0x0002
 #define USB_SX303_PRODUCT_ID    0x0021
 #define USB_SX353_PRODUCT_ID    0x0022
 /* table of devices that work with this driver */
 static struct usb_device_id gigaset_table [] = {
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_GIGA_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_4175_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX353_PRODUCT_ID) },
        { } /* Terminating entry */
@@ -77,6 +76,10 @@ static int gigaset_probe(struct usb_interface *interface,
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
+static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static void stopurbs(struct bas_bc_state *);
+static int atwrite_submit(struct cardstate *, unsigned char *, int);
+static int start_cbsend(struct cardstate *);
 /*==============================================================================*/
@@ -111,12 +114,14 @@ struct bas_cardstate {
 };
 /* status of direct USB connection to 307x base (bits in basstate) */
-#define BS_ATOPEN       0x001
+#define BS_ATOPEN       0x001   /* AT channel open */
-#define BS_B1OPEN       0x002
+#define BS_B1OPEN       0x002   /* B channel 1 open */
-#define BS_B2OPEN       0x004
+#define BS_B2OPEN       0x004   /* B channel 2 open */
-#define BS_ATREADY      0x008
+#define BS_ATREADY      0x008   /* base ready for AT command */
-#define BS_INIT         0x010
+#define BS_INIT         0x010   /* base has signalled INIT_OK */
-#define BS_ATTIMER      0x020
+#define BS_ATTIMER      0x020   /* waiting for HD_READY_SEND_ATDATA */
+#define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
+#define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 static struct gigaset_driver *driver = NULL;
@@ -130,6 +135,47 @@ static struct usb_driver gigaset_usb_driver = {
        .id_table =     gigaset_table,
 };
+/* get message text for usb_submit_urb return code
+ */
+static char *get_usb_rcmsg(int rc)
+{
+        static char unkmsg[28];
+        switch (rc) {
+        case 0:
+                return "success";
+        case -ENOMEM:
+                return "out of memory";
+        case -ENODEV:
+                return "device not present";
+        case -ENOENT:
+                return "endpoint not present";
+        case -ENXIO:
+                return "URB type not supported";
+        case -EINVAL:
+                return "invalid argument";
+        case -EAGAIN:
+                return "start frame too early or too much scheduled";
+        case -EFBIG:
+                return "too many isochronous frames requested";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -EMSGSIZE:
+                return "invalid packet size";
+        case -ENOSPC:
+                return "would overcommit USB bandwidth";
+        case -ESHUTDOWN:
+                return "device shut down";
+        case -EPERM:
+                return "reject flag set";
+        case -EHOSTUNREACH:
+                return "device suspended";
+        default:
+                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", rc);
+                return unkmsg;
+        }
+}
 /* get message text for USB status code
 */
 static char *get_usb_statmsg(int status)
@@ -140,43 +186,37 @@ static char *get_usb_statmsg(int status)
        case 0:
                return "success";
        case -ENOENT:
-                return "canceled";
+                return "unlinked (sync)";
-        case -ECONNRESET:
-                return "canceled (async)";
        case -EINPROGRESS:
                return "pending";
        case -EPROTO:
-                return "bit stuffing or unknown USB error";
+                return "bit stuffing error, timeout, or unknown USB error";
        case -EILSEQ:
-                return "Illegal byte sequence (CRC mismatch)";
+                return "CRC mismatch, timeout, or unknown USB error";
-        case -EPIPE:
-                return "babble detect or endpoint stalled";
-        case -ENOSR:
-                return "buffer error";
        case -ETIMEDOUT:
                return "timed out";
-        case -ENODEV:
+        case -EPIPE:
-                return "device not present";
+                return "endpoint stalled";
+        case -ECOMM:
+                return "IN buffer overrun";
+        case -ENOSR:
+                return "OUT buffer underrun";
+        case -EOVERFLOW:
+                return "too much data";
        case -EREMOTEIO:
                return "short packet detected";
+        case -ENODEV:
+                return "device removed";
        case -EXDEV:
                return "partial isochronous transfer";
        case -EINVAL:
                return "invalid argument";
-        case -ENXIO:
+        case -ECONNRESET:
-                return "URB already queued";
+                return "unlinked (async)";
-        case -EAGAIN:
-                return "isochronous start frame too early or too much scheduled";
-        case -EFBIG:
-                return "too many isochronous frames requested";
-        case -EMSGSIZE:
-                return "endpoint message size zero";
        case -ESHUTDOWN:
-                return "endpoint shutdown";
+                return "device shut down";
-        case -EBUSY:
-                return "another request pending";
        default:
-                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", status);
+                snprintf(unkmsg, sizeof(unkmsg), "unknown status %d", status);
                return unkmsg;
        }
 }
@@ -277,18 +317,17 @@ static inline void error_hangup(struct bc_state *bcs)
        gig_dbg(DEBUG_ANY, "%s: scheduling HUP for channel %d",
                __func__, bcs->channel);
-        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
+        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL))
-                //FIXME what should we do?
+                dev_err(cs->dev, "event queue full\n");
-                return;
-        }
        gigaset_schedule_event(cs);
 }
 /* error_reset
 * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context and takes care of scheduling
+ * This function may be called from any context, and should take care of
- * the necessary actions for execution outside of interrupt context.
+ * scheduling the necessary actions for execution outside of interrupt context.
+ * Right now, it just generates a kernel message calling for help.
 * argument:
 *      controller state structure
 */
@@ -364,36 +403,38 @@ static void cmd_in_timeout(unsigned long data)
 {
        struct cardstate *cs = (struct cardstate *) data;
        struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                gig_dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
        if (!ucs->rcvbuf_size) {
                gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                return;
        }
-        spin_unlock_irqrestore(&cs->lock, flags);
        dev_err(cs->dev, "timeout reading AT response\n");
        error_reset(cs);        //FIXME retry?
 }
+/* set/clear bits in base connection state, return previous state
+ */
+inline static int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = atomic_read(&ucs->basstate);
+        atomic_set(&ucs->basstate, (state & ~clear) | set);
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
 /* atread_submit
- * submit an HD_READ_ATMESSAGE command URB
+ * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
 * parameters:
 *      cs      controller state structure
 *      timeout timeout in 1/10 sec., 0: none
 * return value:
 *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
 *      -EBUSY if another request is pending
 *      any URB submission error code
 */
@@ -405,7 +446,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
        gig_dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)",
                ucs->rcvbuf_size);
-        if (ucs->urb_cmd_in->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATRDPEND, 0) & BS_ATRDPEND) {
                dev_err(cs->dev,
                        "could not submit HD_READ_ATMESSAGE: URB busy\n");
                return -EBUSY;
@@ -423,6 +464,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
                             read_ctrl_callback, cs->inbuf);
        if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
+                update_basstate(ucs, 0, BS_ATRDPEND);
                dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
                        get_usb_statmsg(ret));
                return ret;
@@ -438,26 +480,6 @@ static int atread_submit(struct cardstate *cs, int timeout)
        return 0;
 }
-static void stopurbs(struct bas_bc_state *);
-static int start_cbsend(struct cardstate *);
-/* set/clear bits in base connection state
- */
-inline static void update_basstate(struct bas_cardstate *ucs,
-                                   int set, int clear)
-{
-        unsigned long flags;
-        int state;
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = atomic_read(&ucs->basstate);
-        state &= ~clear;
-        state |= set;
-        atomic_set(&ucs->basstate, state);
-        spin_unlock_irqrestore(&ucs->lock, flags);
-}
 /* read_int_callback
 * USB completion handler for interrupt pipe input
 * called by the USB subsystem in interrupt context
@@ -471,20 +493,25 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
        struct bas_cardstate *ucs = cs->hw.bas;
        struct bc_state *bcs;
        unsigned long flags;
-        int status;
+        int rc;
        unsigned l;
        int channel;
        switch (urb->status) {
        case 0:                 /* success */
                break;
-        case -ENOENT:                   /* canceled */
+        case -ENOENT:                   /* cancelled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ECONNRESET:               /* cancelled (async) */
        case -EINPROGRESS:              /* pending */
                /* ignore silently */
                gig_dbg(DEBUG_USBREQ, "%s: %s",
                        __func__, get_usb_statmsg(urb->status));
                return;
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                //FIXME use this as disconnect indicator?
+                gig_dbg(DEBUG_USBREQ, "%s: device disconnected", __func__);
+                return;
        default:                /* severe trouble */
                dev_warn(cs->dev, "interrupt read: %s\n",
                         get_usb_statmsg(urb->status));
@@ -492,6 +519,13 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                goto resubmit;
        }
+        /* drop incomplete packets even if the missing bytes wouldn't matter */
+        if (unlikely(urb->actual_length < 3)) {
+                dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
+                         urb->actual_length);
+                goto resubmit;
+        }
        l = (unsigned) ucs->int_in_buf[1] +
            (((unsigned) ucs->int_in_buf[2]) << 8);
@@ -558,25 +592,28 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                }
                spin_lock_irqsave(&cs->lock, flags);
                if (ucs->rcvbuf_size) {
-                        spin_unlock_irqrestore(&cs->lock, flags);
+                        /* throw away previous buffer - we have no queue */
                        dev_err(cs->dev,
-                                "receive AT data overrun, %d bytes lost\n", l);
+                                "receive AT data overrun, %d bytes lost\n",
-                        error_reset(cs);        //FIXME reschedule
+                                ucs->rcvbuf_size);
-                        break;
+                        kfree(ucs->rcvbuf);
+                        ucs->rcvbuf_size = 0;
                }
                if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
                        spin_unlock_irqrestore(&cs->lock, flags);
-                        dev_err(cs->dev, "out of memory, %d bytes lost\n", l);
+                        dev_err(cs->dev, "out of memory receiving AT data\n");
-                        error_reset(cs);        //FIXME reschedule
+                        error_reset(cs);
                        break;
                }
                ucs->rcvbuf_size = l;
                ucs->retry_cmd_in = 0;
-                if ((status = atread_submit(cs, BAS_TIMEOUT)) < 0) {
+                if ((rc = atread_submit(cs, BAS_TIMEOUT)) < 0) {
                        kfree(ucs->rcvbuf);
                        ucs->rcvbuf = NULL;
                        ucs->rcvbuf_size = 0;
-                        error_reset(cs);        //FIXME reschedule
+                        if (rc != -ENODEV)
+                                //FIXME corrective action?
+                                error_reset(cs);
                }
                spin_unlock_irqrestore(&cs->lock, flags);
                break;
@@ -598,12 +635,10 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
        check_pending(ucs);
 resubmit:
-        spin_lock_irqsave(&cs->lock, flags);
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
-        status = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+        if (unlikely(rc != 0 && rc != -ENODEV)) {
-        spin_unlock_irqrestore(&cs->lock, flags);
-        if (unlikely(status)) {
                dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
-                        get_usb_statmsg(status));
+                        get_usb_rcmsg(rc));
                error_reset(cs);
        }
 }
@@ -622,18 +657,12 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
        struct bas_cardstate *ucs = cs->hw.bas;
        int have_data = 0;
        unsigned numbytes;
-        unsigned long flags;
+        int rc;
-        spin_lock_irqsave(&cs->lock, flags);
+        update_basstate(ucs, 0, BS_ATRDPEND);
-        if (unlikely(!cs->connected)) {
-                warn("%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
        if (!ucs->rcvbuf_size) {
                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                return;
        }
@@ -666,9 +695,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                }
                break;
-        case -ENOENT:                   /* canceled */
+        case -ENOENT:                   /* cancelled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ECONNRESET:               /* cancelled (async) */
        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                /* no action necessary */
                gig_dbg(DEBUG_USBREQ, "%s: %s",
                        __func__, get_usb_statmsg(urb->status));
@@ -681,11 +712,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                if (ucs->retry_cmd_in++ < BAS_RETRY) {
                        dev_notice(cs->dev, "control read: retry %d\n",
                                   ucs->retry_cmd_in);
-                        if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
+                        rc = atread_submit(cs, BAS_TIMEOUT);
-                                /* resubmitted - bypass regular exit block */
+                        if (rc >= 0 || rc == -ENODEV)
-                                spin_unlock_irqrestore(&cs->lock, flags);
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
                                return;
-                        }
                } else {
                        dev_err(cs->dev,
                                "control read: giving up after %d tries\n",
@@ -697,7 +728,6 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
        kfree(ucs->rcvbuf);
        ucs->rcvbuf = NULL;
        ucs->rcvbuf_size = 0;
-        spin_unlock_irqrestore(&cs->lock, flags);
        if (have_data) {
                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                gigaset_schedule_event(cs);
@@ -719,8 +749,11 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
        int i, rc;
        /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
+        if (unlikely(urb->status == -ENOENT ||
-                     urb->status == -EINPROGRESS)) {
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                gig_dbg(DEBUG_ISO, "%s: %s",
                        __func__, get_usb_statmsg(urb->status));
                return;
@@ -740,9 +773,9 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                for (i = 0; i < BAS_NUMFRAMES; i++) {
                        ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
                        if (unlikely(urb->iso_frame_desc[i].status != 0 &&
-                                     urb->iso_frame_desc[i].status != -EINPROGRESS)) {
+                                     urb->iso_frame_desc[i].status !=
+                                                                -EINPROGRESS))
                                ubc->loststatus = urb->iso_frame_desc[i].status;
-                        }
                        urb->iso_frame_desc[i].status = 0;
                        urb->iso_frame_desc[i].actual_length = 0;
                }
@@ -754,10 +787,10 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                        gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
                                __func__);
                        rc = usb_submit_urb(urb, SLAB_ATOMIC);
-                        if (unlikely(rc != 0)) {
+                        if (unlikely(rc != 0 && rc != -ENODEV)) {
                                dev_err(bcs->cs->dev,
                                        "could not resubmit isochronous read "
-                                        "URB: %s\n", get_usb_statmsg(rc));
+                                        "URB: %s\n", get_usb_rcmsg(rc));
                                dump_urb(DEBUG_ISO, "isoc read", urb);
                                error_hangup(bcs);
                        }
@@ -780,8 +813,11 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
        unsigned long flags;
        /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
+        if (unlikely(urb->status == -ENOENT ||
-                     urb->status == -EINPROGRESS)) {
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                gig_dbg(DEBUG_ISO, "%s: %s",
                        __func__, get_usb_statmsg(urb->status));
                return;
@@ -822,7 +858,6 @@ static int starturbs(struct bc_state *bcs)
        for (k = 0; k < BAS_INURBS; k++) {
                urb = ubc->isoinurbs[k];
                if (!urb) {
-                        dev_err(bcs->cs->dev, "isoinurbs[%d]==NULL\n", k);
                        rc = -EFAULT;
                        goto error;
                }
@@ -844,12 +879,8 @@ static int starturbs(struct bc_state *bcs)
                }
                dump_urb(DEBUG_ISO, "Initial isoc read", urb);
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
+                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0)
-                        dev_err(bcs->cs->dev,
-                               "could not submit isochronous read URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
                        goto error;
-                }
        }
        /* initialize L2 transmission */
@@ -859,7 +890,6 @@ static int starturbs(struct bc_state *bcs)
        for (k = 0; k < BAS_OUTURBS; ++k) {
                urb = ubc->isoouturbs[k].urb;
                if (!urb) {
-                        dev_err(bcs->cs->dev, "isoouturbs[%d].urb==NULL\n", k);
                        rc = -EFAULT;
                        goto error;
                }
@@ -885,12 +915,8 @@ static int starturbs(struct bc_state *bcs)
        for (k = 0; k < 2; ++k) {
                dump_urb(DEBUG_ISO, "Initial isoc write", urb);
                rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
-                if (rc != 0) {
+                if (rc != 0)
-                        dev_err(bcs->cs->dev,
-                              "could not submit isochronous write URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
                        goto error;
-                }
        }
        dump_urb(DEBUG_ISO, "Initial isoc write (free)", urb);
        ubc->isooutfree = &ubc->isoouturbs[2];
@@ -916,15 +942,15 @@ static void stopurbs(struct bas_bc_state *ubc)
        for (k = 0; k < BAS_INURBS; ++k) {
                rc = usb_unlink_urb(ubc->isoinurbs[k]);
                gig_dbg(DEBUG_ISO,
-                        "%s: isoc input URB %d unlinked, result = %d",
+                        "%s: isoc input URB %d unlinked, result = %s",
-                        __func__, k, rc);
+                        __func__, k, get_usb_rcmsg(rc));
        }
        for (k = 0; k < BAS_OUTURBS; ++k) {
                rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
                gig_dbg(DEBUG_ISO,
-                        "%s: isoc output URB %d unlinked, result = %d",
+                        "%s: isoc output URB %d unlinked, result = %s",
-                        __func__, k, rc);
+                        __func__, k, get_usb_rcmsg(rc));
        }
 }
@@ -934,7 +960,7 @@ static void stopurbs(struct bas_bc_state *ubc)
 /* submit_iso_write_urb
 * fill and submit the next isochronous write URB
 * parameters:
- *      bcs     B channel state structure
+ *      ucx     context structure containing URB
 * return value:
 *      number of frames submitted in URB
 *      0 if URB not submitted because no data available (isooutbuf busy)
@@ -946,7 +972,6 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
        struct bas_bc_state *ubc = ucx->bcs->hw.bas;
        struct usb_iso_packet_descriptor *ifd;
        int corrbytes, nframe, rc;
-        unsigned long flags;
        /* urb->dev is clobbered by USB subsystem */
        urb->dev = ucx->bcs->cs->hw.bas->udev;
@@ -992,20 +1017,22 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                ifd->status = 0;
                ifd->actual_length = 0;
        }
-        if ((urb->number_of_packets = nframe) > 0) {
+        if (unlikely(nframe == 0))
-                spin_lock_irqsave(&ucx->bcs->cs->lock, flags);
+                return 0;       /* no data to send */
-                rc = ucx->bcs->cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+        urb->number_of_packets = nframe;
-                spin_unlock_irqrestore(&ucx->bcs->cs->lock, flags);
-                if (rc) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                if (rc == -ENODEV)
+                        /* device removed - give up silently */
+                        gig_dbg(DEBUG_ISO, "%s: disconnected", __func__);
+                else
                        dev_err(ucx->bcs->cs->dev,
                                "could not submit isochronous write URB: %s\n",
-                                get_usb_statmsg(rc));
+                                get_usb_rcmsg(rc));
-                        dump_urb(DEBUG_ISO, "isoc write", urb);
+                return rc;
-                        return rc;
-                }
-                ++ubc->numsub;
        }
+        ++ubc->numsub;
        return nframe;
 }
@@ -1028,6 +1055,7 @@ static void write_iso_tasklet(unsigned long data)
        int i;
        struct sk_buff *skb;
        int len;
+        int rc;
        /* loop while completed URBs arrive in time */
        for (;;) {
@@ -1057,7 +1085,8 @@ static void write_iso_tasklet(unsigned long data)
                ubc->isooutfree = NULL;
                spin_unlock_irqrestore(&ubc->isooutlock, flags);
                if (next) {
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                /* could not submit URB, put it back */
                                spin_lock_irqsave(&ubc->isooutlock, flags);
                                if (ubc->isooutfree == NULL) {
@@ -1077,17 +1106,18 @@ static void write_iso_tasklet(unsigned long data)
                /* process completed URB */
                urb = done->urb;
                switch (urb->status) {
+                case -EXDEV:                    /* partial completion */
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
+                        /* fall through - what's the difference anyway? */
                case 0:                         /* normal completion */
-                        break;
+                        /* inspect individual frames
-                case -EXDEV:                    /* inspect individual frames */
+                         * assumptions (for lack of documentation):
-                        /* assumptions (for lack of documentation):
+                         * - actual_length bytes of first frame in error are
-                         * - actual_length bytes of the frame in error are
                         *   successfully sent
                         * - all following frames are not sent at all
                         */
-                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                        offset = done->limit;   /* default (no error) */
-                                __func__);
-                        offset = done->limit;   /* just in case */
                        for (i = 0; i < BAS_NUMFRAMES; i++) {
                                ifd = &urb->iso_frame_desc[i];
                                if (ifd->status ||
@@ -1122,7 +1152,7 @@ static void write_iso_tasklet(unsigned long data)
                        }
 #endif
                        break;
-                case -EPIPE:            //FIXME is this the code for "underrun"?
+                case -EPIPE:                    /* stall - probably underrun */
                        dev_err(cs->dev, "isochronous write stalled\n");
                        error_hangup(bcs);
                        break;
@@ -1142,7 +1172,8 @@ static void write_iso_tasklet(unsigned long data)
                spin_unlock_irqrestore(&ubc->isooutlock, flags);
                if (next) {
                        /* only one URB still active - resubmit one */
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                /* couldn't submit */
                                error_hangup(bcs);
                        }
@@ -1222,10 +1253,9 @@ static void read_iso_tasklet(unsigned long data)
                        break;
                case -ENOENT:
                case -ECONNRESET:
-                        gig_dbg(DEBUG_ISO, "%s: URB canceled", __func__);
+                case -EINPROGRESS:
-                        continue;               /* -> skip */
+                        gig_dbg(DEBUG_ISO, "%s: %s",
-                case -EINPROGRESS:              /* huh? */
+                                __func__, get_usb_statmsg(urb->status));
-                        gig_dbg(DEBUG_ISO, "%s: URB still pending", __func__);
                        continue;               /* -> skip */
                case -EPIPE:
                        dev_err(cs->dev, "isochronous read stalled\n");
@@ -1290,13 +1320,11 @@ static void read_iso_tasklet(unsigned long data)
                urb->dev = bcs->cs->hw.bas->udev;
                urb->transfer_flags = URB_ISO_ASAP;
                urb->number_of_packets = BAS_NUMFRAMES;
-                spin_lock_irqsave(&cs->lock, flags);
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
-                rc = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+                if (unlikely(rc != 0 && rc != -ENODEV)) {
-                spin_unlock_irqrestore(&cs->lock, flags);
-                if (rc) {
                        dev_err(cs->dev,
                                "could not resubmit isochronous read URB: %s\n",
-                                get_usb_statmsg(rc));
+                                get_usb_rcmsg(rc));
                        dump_urb(DEBUG_ISO, "resubmit iso read", urb);
                        error_hangup(bcs);
                }
@@ -1397,7 +1425,6 @@ static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
 *      timeout timeout in seconds (0: no timeout)
 * return value:
 *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
 *      -EBUSY if another request is pending
 *      any URB submission error code
 */
@@ -1418,12 +1445,6 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                        req, ucs->pending);
                return -EBUSY;
        }
-        if (ucs->urb_ctrl->status == -EINPROGRESS) {
-                spin_unlock_irqrestore(&ucs->lock, flags);
-                dev_err(bcs->cs->dev,
-                        "could not submit request 0x%02x: URB busy\n", req);
-                return -EBUSY;
-        }
        ucs->dr_ctrl.bRequestType = OUT_VENDOR_REQ;
        ucs->dr_ctrl.bRequest = req;
@@ -1465,22 +1486,36 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 static int gigaset_init_bchannel(struct bc_state *bcs)
 {
        int req, ret;
+        unsigned long flags;
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
        if ((ret = starturbs(bcs)) < 0) {
                dev_err(bcs->cs->dev,
-                        "could not start isochronous I/O for channel %d\n",
+                        "could not start isochronous I/O for channel B%d: %s\n",
-                        bcs->channel + 1);
+                        bcs->channel + 1,
-                error_hangup(bcs);
+                        ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                return ret;
        }
        req = bcs->channel ? HD_OPEN_B2CHANNEL : HD_OPEN_B1CHANNEL;
        if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0) {
-                dev_err(bcs->cs->dev, "could not open channel %d: %s\n",
+                dev_err(bcs->cs->dev, "could not open channel B%d\n",
-                        bcs->channel + 1, get_usb_statmsg(ret));
+                        bcs->channel + 1);
                stopurbs(bcs->hw.bas);
-                error_hangup(bcs);
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
        }
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
        return ret;
 }
@@ -1497,19 +1532,30 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 static int gigaset_close_bchannel(struct bc_state *bcs)
 {
        int req, ret;
+        unsigned long flags;
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
        if (!(atomic_read(&bcs->cs->hw.bas->basstate) &
              (bcs->channel ? BS_B2OPEN : BS_B1OPEN))) {
                /* channel not running: just signal common.c */
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                gigaset_bchannel_down(bcs);
                return 0;
        }
+        /* channel running: tell device to close it */
        req = bcs->channel ? HD_CLOSE_B2CHANNEL : HD_CLOSE_B1CHANNEL;
        if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0)
-                dev_err(bcs->cs->dev,
+                dev_err(bcs->cs->dev, "closing channel B%d failed\n",
-                        "could not submit HD_CLOSE_BxCHANNEL request: %s\n",
+                        bcs->channel + 1);
-                        get_usb_statmsg(ret));
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
        return ret;
 }
@@ -1545,8 +1591,6 @@ static void complete_cb(struct cardstate *cs)
        kfree(cb);
 }
-static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len);
 /* write_command_callback
 * USB completion handler for AT command transmission
 * called by the USB subsystem in interrupt context
@@ -1560,13 +1604,17 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
        struct bas_cardstate *ucs = cs->hw.bas;
        unsigned long flags;
+        update_basstate(ucs, 0, BS_ATWRPEND);
        /* check status */
        switch (urb->status) {
        case 0:                                 /* normal completion */
                break;
-        case -ENOENT:                   /* canceled */
+        case -ENOENT:                   /* cancelled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ECONNRESET:               /* cancelled (async) */
        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                /* ignore silently */
                gig_dbg(DEBUG_USBREQ, "%s: %s",
                        __func__, get_usb_statmsg(urb->status));
@@ -1627,19 +1675,17 @@ static void atrdy_timeout(unsigned long data)
 *      len     length of command to send
 * return value:
 *      0 on success
- *      -EFAULT if a NULL pointer is encountered somewhere
 *      -EBUSY if another request is pending
 *      any URB submission error code
 */
 static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 {
        struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
+        int rc;
-        int ret;
        gig_dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
-        if (ucs->urb_cmd_out->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATWRPEND, 0) & BS_ATWRPEND) {
                dev_err(cs->dev,
                        "could not submit HD_WRITE_ATMESSAGE: URB busy\n");
                return -EBUSY;
@@ -1654,29 +1700,22 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
                             usb_sndctrlpipe(ucs->udev, 0),
                             (unsigned char*) &ucs->dr_cmd_out, buf, len,
                             write_command_callback, cs);
+        rc = usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC);
-        spin_lock_irqsave(&cs->lock, flags);
+        if (unlikely(rc)) {
-        ret = cs->connected ? usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC) : -ENODEV;
+                update_basstate(ucs, 0, BS_ATWRPEND);
-        spin_unlock_irqrestore(&cs->lock, flags);
-        if (ret) {
                dev_err(cs->dev, "could not submit HD_WRITE_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(rc));
-                return ret;
+                return rc;
        }
-        /* submitted successfully */
+        /* submitted successfully, start timeout if necessary */
-        update_basstate(ucs, 0, BS_ATREADY);
+        if (!(update_basstate(ucs, BS_ATTIMER, BS_ATREADY) & BS_ATTIMER)) {
-        /* start timeout if necessary */
-        if (!(atomic_read(&ucs->basstate) & BS_ATTIMER)) {
                gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
                        ATRDY_TIMEOUT);
                ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
                ucs->timer_atrdy.data = (unsigned long) cs;
                ucs->timer_atrdy.function = atrdy_timeout;
                add_timer(&ucs->timer_atrdy);
-                update_basstate(ucs, BS_ATTIMER, 0);
        }
        return 0;
 }
@@ -1702,7 +1741,6 @@ static int start_cbsend(struct cardstate *cs)
                gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD, "AT channel not open");
                rc = req_submit(cs->bcs, HD_OPEN_ATCHANNEL, 0, BAS_TIMEOUT);
                if (rc < 0) {
-                        dev_err(cs->dev, "could not open AT channel\n");
                        /* flush command queue */
                        spin_lock_irqsave(&cs->cmdlock, flags);
                        while (cs->cmdbuf != NULL)
@@ -1786,8 +1824,14 @@ static int gigaset_write_cmd(struct cardstate *cs,
        cs->lastcmdbuf = cb;
        spin_unlock_irqrestore(&cs->cmdlock, flags);
+        spin_lock_irqsave(&cs->lock, flags);
+        if (unlikely(!cs->connected)) {
+                spin_unlock_irqrestore(&cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
        status = start_cbsend(cs);
+        spin_unlock_irqrestore(&cs->lock, flags);
        return status < 0 ? status : len;
 }
@@ -1849,12 +1893,32 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
 */
 static int gigaset_freebcshw(struct bc_state *bcs)
 {
-        if (!bcs->hw.bas)
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        int i;
+        if (!ubc)
                return 0;
-        if (bcs->hw.bas->isooutbuf)
+        /* kill URBs and tasklets before freeing - better safe than sorry */
-                kfree(bcs->hw.bas->isooutbuf);
+        atomic_set(&ubc->running, 0);
-        kfree(bcs->hw.bas);
+        for (i = 0; i < BAS_OUTURBS; ++i)
+                if (ubc->isoouturbs[i].urb) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso out URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoouturbs[i].urb);
+                        usb_free_urb(ubc->isoouturbs[i].urb);
+                }
+        for (i = 0; i < BAS_INURBS; ++i)
+                if (ubc->isoinurbs[i]) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso in URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoinurbs[i]);
+                        usb_free_urb(ubc->isoinurbs[i]);
+                }
+        tasklet_kill(&ubc->sent_tasklet);
+        tasklet_kill(&ubc->rcvd_tasklet);
+        kfree(ubc->isooutbuf);
+        kfree(ubc);
        bcs->hw.bas = NULL;
        return 1;
 }
@@ -1931,13 +1995,9 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 static void gigaset_freecshw(struct cardstate *cs)
 {
-        struct bas_cardstate *ucs = cs->hw.bas;
+        /* timers, URBs and rcvbuf are disposed of in disconnect */
-        del_timer(&ucs->timer_ctrl);
-        del_timer(&ucs->timer_atrdy);
-        del_timer(&ucs->timer_cmd_in);
        kfree(cs->hw.bas);
+        cs->hw.bas = NULL;
 }
 static int gigaset_initcshw(struct cardstate *cs)
@@ -2041,23 +2101,13 @@ static int gigaset_probe(struct usb_interface *interface,
        struct bas_bc_state *ubc;
        struct usb_endpoint_descriptor *endpoint;
        int i, j;
-        int ret;
+        int rc;
        gig_dbg(DEBUG_ANY,
                "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
                __func__, le16_to_cpu(udev->descriptor.idVendor),
                le16_to_cpu(udev->descriptor.idProduct));
-        /* See if the device offered us matches what we can accept */
-        if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_GIGA_VENDOR_ID) ||
-            (le16_to_cpu(udev->descriptor.idProduct) != USB_GIGA_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_4175_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX303_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX353_PRODUCT_ID)) {
-                gig_dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
-                return -ENODEV;
-        }
        /* set required alternate setting */
        hostif = interface->cur_altsetting;
        if (hostif->desc.bAlternateSetting != 3) {
@@ -2105,45 +2155,22 @@ static int gigaset_probe(struct usb_interface *interface,
         * - three for the different uses of the default control pipe
         * - three for each isochronous pipe
         */
-        ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL);
+        if (!(ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
-        if (!ucs->urb_int_in) {
+            !(ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
-                dev_err(cs->dev, "no free urbs available\n");
+            !(ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL)) ||
-                goto error;
+            !(ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL)))
-        }
+                goto allocerr;
-        ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_out) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_ctrl) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
        for (j = 0; j < 2; ++j) {
                ubc = cs->bcs[j].hw.bas;
-                for (i = 0; i < BAS_OUTURBS; ++i) {
+                for (i = 0; i < BAS_OUTURBS; ++i)
-                        ubc->isoouturbs[i].urb =
+                        if (!(ubc->isoouturbs[i].urb =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
-                        if (!ubc->isoouturbs[i].urb) {
+                                goto allocerr;
-                                dev_err(cs->dev, "no free urbs available\n");
+                for (i = 0; i < BAS_INURBS; ++i)
-                                goto error;
+                        if (!(ubc->isoinurbs[i] =
-                        }
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
-                }
+                                goto allocerr;
-                for (i = 0; i < BAS_INURBS; ++i) {
-                        ubc->isoinurbs[i] =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoinurbs[i]) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
        }
        ucs->rcvbuf = NULL;
@@ -2156,15 +2183,14 @@ static int gigaset_probe(struct usb_interface *interface,
                                        (endpoint->bEndpointAddress) & 0x0f),
                         ucs->int_in_buf, 3, read_int_callback, cs,
                         endpoint->bInterval);
-        ret = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL);
+        if ((rc = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL)) != 0) {
-        if (ret) {
                dev_err(cs->dev, "could not submit interrupt URB: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(rc));
                goto error;
        }
        /* tell the device that the driver is ready */
-        if ((ret = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
+        if ((rc = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
                goto error;
        /* tell common part that the device is ready */
@@ -2179,6 +2205,8 @@ static int gigaset_probe(struct usb_interface *interface,
        return 0;
+allocerr:
+        dev_err(cs->dev, "could not allocate URBs\n");
 error:
        freeurbs(cs);
        usb_set_intfdata(interface, NULL);
@@ -2193,19 +2221,34 @@ static void gigaset_disconnect(struct usb_interface *interface)
 {
        struct cardstate *cs;
        struct bas_cardstate *ucs;
+        int j;
        cs = usb_get_intfdata(interface);
        ucs = cs->hw.bas;
        dev_info(cs->dev, "disconnecting Gigaset base\n");
+        /* mark base as not ready, all channels disconnected */
+        atomic_set(&ucs->basstate, 0);
+        /* tell LL all channels are down */
+        //FIXME shouldn't gigaset_stop() do this?
+        for (j = 0; j < 2; ++j)
+                gigaset_bchannel_down(cs->bcs + j);
+        /* stop driver (common part) */
        gigaset_stop(cs);
+        /* stop timers and URBs, free ressources */
+        del_timer_sync(&ucs->timer_ctrl);
+        del_timer_sync(&ucs->timer_atrdy);
+        del_timer_sync(&ucs->timer_cmd_in);
        freeurbs(cs);
        usb_set_intfdata(interface, NULL);
        kfree(ucs->rcvbuf);
        ucs->rcvbuf = NULL;
        ucs->rcvbuf_size = 0;
-        atomic_set(&ucs->basstate, 0);
        usb_put_dev(ucs->udev);
        ucs->interface = NULL;
        ucs->udev = NULL;
@@ -2277,6 +2320,8 @@ error:	if (cardstate)
 */
 static void __exit bas_gigaset_exit(void)
 {
+        struct bas_cardstate *ucs = cardstate->hw.bas;
        gigaset_blockdriver(driver); /* => probe will fail
                                      * => no gigaset_start any more
                                      */
@@ -2284,14 +2329,26 @@ static void __exit bas_gigaset_exit(void)
        gigaset_shutdown(cardstate);
        /* from now on, no isdn callback should be possible */
-        if (atomic_read(&cardstate->hw.bas->basstate) & BS_ATOPEN) {
+        /* close all still open channels */
-                gig_dbg(DEBUG_ANY, "closing AT channel");
+        if (atomic_read(&ucs->basstate) & BS_B1OPEN) {
-                if (req_submit(cardstate->bcs,
+                gig_dbg(DEBUG_INIT, "closing B1 channel");
-                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
-                        /* successfully submitted */
+                                HD_CLOSE_B1CHANNEL, OUT_VENDOR_REQ, 0, 0,
-                        //FIXME wait for completion?
+                                NULL, 0, BAS_TIMEOUT);
-                }
+        }
+        if (atomic_read(&ucs->basstate) & BS_B2OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B2 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B2CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_ATOPEN) {
+                gig_dbg(DEBUG_INIT, "closing AT channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_ATCHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
        }
+        atomic_set(&ucs->basstate, 0);
        /* deregister this driver with the USB subsystem */
        usb_deregister(&gigaset_usb_driver);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 749b3da1236e..e55767b2ccd3 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -781,8 +781,7 @@ error:	if (cs)
 }
 EXPORT_SYMBOL_GPL(gigaset_initcs);
-/* ReInitialize the b-channel structure */
+/* ReInitialize the b-channel structure on hangup */
-/* e.g. called on hangup, disconnect */
 void gigaset_bcs_reinit(struct bc_state *bcs)
 {
        struct sk_buff *skb;
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 1ba3424a286b..18e05c09b71c 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -373,6 +373,9 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
        {EV_TIMEOUT,  750,750, -1,                  0, 0, {ACT_CONNTIMEOUT}},
+        /* B channel closed (general case) */
+        {EV_BC_CLOSED, -1, -1, -1,                 -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
        /* misc. */
        {EV_PROTO_L2,  -1, -1, -1,                 -1,-1, {ACT_PROTO_L2}}, //FIXME
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 9d21ba8757b0..22b9693f7c0a 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -75,7 +75,7 @@ extern int gigaset_debuglevel;	/* "needs" cast to (enum debuglevel) */
 * e.g. 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and
 * DEBUG_INTR.
 */
-enum debuglevel { /* up to 24 bits (atomic_t) */
+enum debuglevel {
        DEBUG_REG         = 0x0002, /* serial port I/O register operations */
        DEBUG_OPEN        = 0x0004, /* open/close serial port */
        DEBUG_INTR        = 0x0008, /* interrupt processing */
@@ -141,7 +141,7 @@ enum debuglevel { /* up to 24 bits (atomic_t) */
                        printk(KERN_DEBUG KBUILD_MODNAME ": " format "\n", \
                               ## arg); \
        } while (0)
-#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
+#define DEBUG_DEFAULT (DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
 #else
@@ -627,8 +627,7 @@ struct gigaset_ops {
        /* Called by gigaset_freecs() for freeing bcs->hw.xxx */
        int (*freebcshw)(struct bc_state *bcs);
-        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting
+        /* Called by gigaset_bchannel_down() for resetting bcs->hw.xxx */
-           bcs->hw.xxx */
        void (*reinitbcshw)(struct bc_state *bcs);
        /* Called by gigaset_initcs() for setting up cs->hw.xxx */
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 0815dbfb8291..1654fa413575 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -73,7 +73,7 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
        /* pass to device-specific module */
-        return cs->ops->send_skb(bcs, skb); //FIXME cs->ops->send_skb() must handle !cs->connected correctly
+        return cs->ops->send_skb(bcs, skb);
 }
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 45f017ed6e8c..8667daaa1a82 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -992,14 +992,18 @@ int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
        int len = skb->len;
        unsigned long flags;
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (!bcs->cs->connected) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
        skb_queue_tail(&bcs->squeue, skb);
        gig_dbg(DEBUG_ISO, "%s: skb queued, qlen=%d",
                __func__, skb_queue_len(&bcs->squeue));
        /* tasklet submits URB if necessary */
-        spin_lock_irqsave(&bcs->cs->lock, flags);
+        tasklet_schedule(&bcs->hw.bas->sent_tasklet);
-        if (bcs->cs->connected)
-                tasklet_schedule(&bcs->hw.bas->sent_tasklet);
        spin_unlock_irqrestore(&bcs->cs->lock, flags);
        return len;     /* ok so far */
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 5ebfd1d138da..5282fec17075 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -627,8 +627,8 @@ thermostat_init(void)
        if(therm_type == ADT7460)
                device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
-#ifndef CONFIG_I2C_KEYWEST
+#ifndef CONFIG_I2C_POWERMAC
-        request_module("i2c-keywest");
+        request_module("i2c-powermac");
 #endif
        return i2c_add_driver(&thermostat_driver);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 434ca39d19c1..d7316b829a62 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -279,11 +279,6 @@ static inline int mddev_lock(mddev_t * mddev)
        return mutex_lock_interruptible(&mddev->reconfig_mutex);
 }
-static inline void mddev_lock_uninterruptible(mddev_t * mddev)
-{
-        mutex_lock(&mddev->reconfig_mutex);
-}
 static inline int mddev_trylock(mddev_t * mddev)
 {
        return mutex_trylock(&mddev->reconfig_mutex);
@@ -2458,9 +2453,11 @@ md_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
        if (!entry->show)
                return -EIO;
-        mddev_lock(mddev);
+        rv = mddev_lock(mddev);
-        rv = entry->show(mddev, page);
+        if (!rv) {
-        mddev_unlock(mddev);
+                rv = entry->show(mddev, page);
+                mddev_unlock(mddev);
+        }
        return rv;
 }
@@ -2474,9 +2471,11 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
        if (!entry->store)
                return -EIO;
-        mddev_lock(mddev);
+        rv = mddev_lock(mddev);
-        rv = entry->store(mddev, page, length);
+        if (!rv) {
-        mddev_unlock(mddev);
+                rv = entry->store(mddev, page, length);
+                mddev_unlock(mddev);
+        }
        return rv;
 }
@@ -4341,8 +4340,9 @@ static int md_seq_show(struct seq_file *seq, void *v)
                return 0;
        }
-        if (mddev_lock(mddev)!=0) 
+        if (mddev_lock(mddev) < 0)
                return -EINTR;
        if (mddev->pers || mddev->raid_disks || !list_empty(&mddev->disks)) {
                seq_printf(seq, "%s : %sactive", mdname(mddev),
                                                mddev->pers ? "" : "in");
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index 08b218c5bfbc..93c494bcd18d 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -226,7 +226,7 @@ struct net_device * __init ne_probe(int unit)
        netdev_boot_setup_check(dev);
 #ifdef CONFIG_TOSHIBA_RBTX4938
-        dev->base_addr = 0x07f20280;
+        dev->base_addr = RBTX4938_RTL_8019_BASE;
        dev->irq = RBTX4938_RTL_8019_IRQ;
 #endif
        err = do_ne_probe(dev);
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index cb0aba95d4e3..046371ee5bbe 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -275,7 +275,7 @@ static int bcm5411_init(struct mii_phy* phy)
        return 0;
 }
-static int bcm5411_suspend(struct mii_phy* phy)
+static int generic_suspend(struct mii_phy* phy)
 {
        phy_write(phy, MII_BMCR, BMCR_PDOWN);
@@ -738,7 +738,7 @@ static struct mii_phy_def bcm5401_phy_def = {
 /* Broadcom BCM 5411 */
 static struct mii_phy_ops bcm5411_phy_ops = {
        .init           = bcm5411_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
        .setup_aneg     = bcm54xx_setup_aneg,
        .setup_forced   = bcm54xx_setup_forced,
        .poll_link      = genmii_poll_link,
@@ -757,7 +757,7 @@ static struct mii_phy_def bcm5411_phy_def = {
 /* Broadcom BCM 5421 */
 static struct mii_phy_ops bcm5421_phy_ops = {
        .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
        .setup_aneg     = bcm54xx_setup_aneg,
        .setup_forced   = bcm54xx_setup_forced,
        .poll_link      = genmii_poll_link,
@@ -776,7 +776,7 @@ static struct mii_phy_def bcm5421_phy_def = {
 /* Broadcom BCM 5421 built-in K2 */
 static struct mii_phy_ops bcm5421k2_phy_ops = {
        .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
        .setup_aneg     = bcm54xx_setup_aneg,
        .setup_forced   = bcm54xx_setup_forced,
        .poll_link      = genmii_poll_link,
@@ -795,7 +795,7 @@ static struct mii_phy_def bcm5421k2_phy_def = {
 /* Broadcom BCM 5462 built-in Vesta */
 static struct mii_phy_ops bcm5462V_phy_ops = {
        .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
        .setup_aneg     = bcm54xx_setup_aneg,
        .setup_forced   = bcm54xx_setup_forced,
        .poll_link      = genmii_poll_link,
@@ -816,6 +816,7 @@ static struct mii_phy_def bcm5462V_phy_def = {
 * would be useful here) --BenH.
 */
 static struct mii_phy_ops marvell_phy_ops = {
+        .suspend        = generic_suspend,
        .setup_aneg     = marvell_setup_aneg,
        .setup_forced   = marvell_setup_forced,
        .poll_link      = genmii_poll_link,
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index bad09ebdb50b..e0874cbfefea 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -6,7 +6,7 @@ menu "Wireless LAN (non-hamradio)"
        depends on NETDEVICES
 config NET_RADIO
-        bool "Wireless LAN drivers (non-hamradio)"
+        bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
        select WIRELESS_EXT
        ---help---
          Support for wireless LANs and everything having to do with radio,
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 108d9fed8f07..00764ddd74d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -3139,6 +3139,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                }
                if ( status & EV_LINK ) {
                        union iwreq_data        wrqu;
+                        int scan_forceloss = 0;
                        /* The link status has changed, if you want to put a
                           monitor hook in, do it here.  (Remember that
                           interrupts are still disabled!)
@@ -3157,7 +3158,8 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                          code) */
 #define AUTHFAIL 0x0300 /* Authentication failure (low byte is reason
                           code) */
-#define ASSOCIATED 0x0400 /* Assocatied */
+#define ASSOCIATED 0x0400 /* Associated */
+#define REASSOCIATED 0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
 #define RC_RESERVED 0 /* Reserved return code */
 #define RC_NOREASON 1 /* Unspecified reason */
 #define RC_AUTHINV 2 /* Previous authentication invalid */
@@ -3174,44 +3176,30 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                          leaving BSS */
 #define RC_NOAUTH 9 /* Station requesting (Re)Association is not
                       Authenticated with the responding station */
-                        if (newStatus != ASSOCIATED) {
+                        if (newStatus == FORCELOSS && apriv->scan_timeout > 0)
-                                if (auto_wep && !apriv->expires) {
+                                scan_forceloss = 1;
-                                        apriv->expires = RUN_AT(3*HZ);
+                        if(newStatus == ASSOCIATED || newStatus == REASSOCIATED) {
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-                        } else {
-                                struct task_struct *task = apriv->task;
                                if (auto_wep)
                                        apriv->expires = 0;
-                                if (task)
+                                if (apriv->task)
-                                        wake_up_process (task);
+                                        wake_up_process (apriv->task);
                                set_bit(FLAG_UPDATE_UNI, &apriv->flags);
                                set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
-                        }
-                        /* Question : is ASSOCIATED the only status
-                         * that is valid ? We want to catch handover
-                         * and reassociations as valid status
-                         * Jean II */
-                        if(newStatus == ASSOCIATED) {
-#if 0
-                                /* FIXME: Grabbing scan results here
-                                 * seems to be too early???  Just wait for
-                                 * timeout instead. */
-                                if (apriv->scan_timeout > 0) {
-                                        set_bit(JOB_SCAN_RESULTS, &apriv->flags);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-#endif
                                if (down_trylock(&apriv->sem) != 0) {
                                        set_bit(JOB_EVENT, &apriv->flags);
                                        wake_up_interruptible(&apriv->thr_wait);
                                } else
                                        airo_send_event(dev);
-                        } else {
+                        } else if (!scan_forceloss) {
-                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+                                if (auto_wep && !apriv->expires) {
-                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                                        apriv->expires = RUN_AT(3*HZ);
+                                        wake_up_interruptible(&apriv->thr_wait);
+                                }
                                /* Send event to user space */
+                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
                                wireless_send_event(dev, SIOCGIWAP, &wrqu,NULL);
                        }
                }
@@ -7136,10 +7124,10 @@ static int airo_set_scan(struct net_device *dev,
                goto out;
        /* Initiate a scan command */
+        ai->scan_timeout = RUN_AT(3*HZ);
        memset(&cmd, 0, sizeof(cmd));
        cmd.cmd=CMD_LISTBSS;
        issuecommand(ai, &cmd, &rsp);
-        ai->scan_timeout = RUN_AT(3*HZ);
        wake = 1;
 out:
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 87afa6878f26..8606c88886fc 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -3463,6 +3463,7 @@ static void atmel_command_irq(struct atmel_private *priv)
        u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
        u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
        int fast_scan;
+        union iwreq_data wrqu;
        if (status == CMD_STATUS_IDLE ||
            status == CMD_STATUS_IN_PROGRESS)
@@ -3487,6 +3488,7 @@ static void atmel_command_irq(struct atmel_private *priv)
                        atmel_scan(priv, 1);
                } else {
                        int bss_index = retrieve_bss(priv);
+                        int notify_scan_complete = 1;
                        if (bss_index != -1) {
                                atmel_join_bss(priv, bss_index);
                        } else if (priv->operating_mode == IW_MODE_ADHOC &&
@@ -3495,8 +3497,14 @@ static void atmel_command_irq(struct atmel_private *priv)
                        } else {
                                priv->fast_scan = !fast_scan;
                                atmel_scan(priv, 1);
+                                notify_scan_complete = 0;
                        }
                        priv->site_survey_state = SITE_SURVEY_COMPLETED;
+                        if (notify_scan_complete) {
+                                wrqu.data.length = 0;
+                                wrqu.data.flags = 0;
+                                wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
+                        }
                }
                break;
@@ -3509,6 +3517,9 @@ static void atmel_command_irq(struct atmel_private *priv)
                priv->site_survey_state = SITE_SURVEY_COMPLETED;
                if (priv->station_is_associated) {
                        atmel_enter_state(priv, STATION_STATE_READY);
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
                } else {
                        atmel_scan(priv, 1);
                }
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 418465600a77..25ea4748f0b9 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -17,8 +17,11 @@ config BCM43XX_DEBUG
 config BCM43XX_DMA
        bool
+        depends on BCM43XX
 config BCM43XX_PIO
        bool
+        depends on BCM43XX
 choice
        prompt "BCM43xx data transfer mode"
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index dcadd295de4f..2e83083935e1 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -15,7 +15,6 @@
 #include "bcm43xx_debugfs.h"
 #include "bcm43xx_leds.h"
-#include "bcm43xx_sysfs.h"
 #define PFX                             KBUILD_MODNAME ": "
@@ -638,8 +637,6 @@ struct bcm43xx_key {
 };
 struct bcm43xx_private {
-        struct bcm43xx_sysfs sysfs;
        struct ieee80211_device *ieee;
        struct ieee80211softmac_device *softmac;
@@ -772,6 +769,20 @@ struct bcm43xx_private * bcm43xx_priv(struct net_device *dev)
        return ieee80211softmac_priv(dev);
 }
+struct device;
+static inline
+struct bcm43xx_private * dev_to_bcm(struct device *dev)
+{
+        struct net_device *net_dev;
+        struct bcm43xx_private *bcm;
+        net_dev = dev_get_drvdata(dev);
+        bcm = bcm43xx_priv(net_dev);
+        return bcm;
+}
 /* Helper function, which returns a boolean.
 * TRUE, if PIO is used; FALSE, if DMA is used.
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index d2c3401e9b70..35a4fcb6d923 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -452,12 +452,12 @@ void bcm43xx_printk_dump(const char *data,
        size_t i;
        char c;
-        printk(KERN_INFO PFX "Data dump (%s, %u bytes):",
+        printk(KERN_INFO PFX "Data dump (%s, %zd bytes):",
               description, size);
        for (i = 0; i < size; i++) {
                c = data[i];
                if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  0x%02x, ", i, c & 0xff);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  0x%02x, ", i, c & 0xff);
                else
                        printk("0x%02x, ", c & 0xff);
        }
@@ -472,12 +472,12 @@ void bcm43xx_printk_bitdump(const unsigned char *data,
        int j;
        const unsigned char *d;
-        printk(KERN_INFO PFX "*** Bitdump (%s, %u bytes, %s) ***",
+        printk(KERN_INFO PFX "*** Bitdump (%s, %zd bytes, %s) ***",
               description, bytes, msb_to_lsb ? "MSB to LSB" : "LSB to MSB");
        for (i = 0; i < bytes; i++) {
                d = data + i;
                if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  ", i);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  ", i);
                if (msb_to_lsb) {
                        for (j = 7; j >= 0; j--) {
                                if (*d & (1 << j))
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index c3681b8f09b4..bbecba02e697 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -196,8 +196,9 @@ static int alloc_ringmemory(struct bcm43xx_dmaring *ring)
        }
        if (ring->dmabase + BCM43xx_DMA_RINGMEMSIZE > BCM43xx_DMA_BUSADDRMAX) {
                printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RINGMEMORY >1G "
-                                    "(0x%08x, len: %lu)\n",
+                                    "(0x%llx, len: %lu)\n",
-                       ring->dmabase, BCM43xx_DMA_RINGMEMSIZE);
+                                (unsigned long long)ring->dmabase,
+                                BCM43xx_DMA_RINGMEMSIZE);
                dma_free_coherent(dev, BCM43xx_DMA_RINGMEMSIZE,
                                  ring->vbase, ring->dmabase);
                return -ENOMEM;
@@ -307,8 +308,8 @@ static int setup_rx_descbuffer(struct bcm43xx_dmaring *ring,
                unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
                dev_kfree_skb_any(skb);
                printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
+                                    "(0x%llx, len: %u)\n",
-                       dmaaddr, ring->rx_buffersize);
+                        (unsigned long long)dmaaddr, ring->rx_buffersize);
                return -ENOMEM;
        }
        meta->skb = skb;
@@ -729,8 +730,8 @@ static int dma_tx_fragment(struct bcm43xx_dmaring *ring,
        if (unlikely(meta->dmaaddr + skb->len > BCM43xx_DMA_BUSADDRMAX)) {
                return_slot(ring, slot);
                printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA TX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
+                                    "(0x%llx, len: %u)\n",
-                       meta->dmaaddr, skb->len);
+                        (unsigned long long)meta->dmaaddr, skb->len);
                return -ENOMEM;
        }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index c37371fc9e01..9a06e61df0a2 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -52,6 +52,7 @@
 #include "bcm43xx_wx.h"
 #include "bcm43xx_ethtool.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_sysfs.h"
 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
@@ -3522,6 +3523,7 @@ static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
                err = bcm43xx_pio_tx(bcm, txb);
        else
                err = bcm43xx_dma_tx(bcm, txb);
+        bcm->net_dev->trans_start = jiffies;
        return err;
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 0a66f43ca0c0..33137165727f 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -2151,6 +2151,7 @@ int bcm43xx_phy_init_tssi2dbm_table(struct bcm43xx_private *bcm)
                                phy->tssi2dbm = NULL;
                                printk(KERN_ERR PFX "Could not generate "
                                                    "tssi2dBm table\n");
+                                kfree(dyn_tssi2dbm);
                                return -ENODEV;
                        }
                phy->tssi2dbm = dyn_tssi2dbm;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.c b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
index 3c92b62807c5..6569da3a7a39 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
@@ -35,77 +35,101 @@
 #include "bcm43xx_main.h"
+/* Get the Slow Clock Source */
+static int bcm43xx_pctl_get_slowclksrc(struct bcm43xx_private *bcm)
+{
+        u32 tmp;
+        int err;
+        assert(bcm->current_core == &bcm->core_chipcommon);
+        if (bcm->current_core->rev < 6) {
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCMCIA ||
+                    bcm->bustype == BCM43xx_BUSTYPE_SB)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCI) {
+                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
+                        assert(!err);
+                        if (tmp & 0x10)
+                                return BCM43xx_PCTL_CLKSRC_PCI;
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                }
+        }
+        if (bcm->current_core->rev < 10) {
+                tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
+                tmp &= 0x7;
+                if (tmp == 0)
+                        return BCM43xx_PCTL_CLKSRC_LOPWROS;
+                if (tmp == 1)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (tmp == 2)
+                        return BCM43xx_PCTL_CLKSRC_PCI;
+        }
+        return BCM43xx_PCTL_CLKSRC_XTALOS;
+}
 /* Get max/min slowclock frequency
 * as described in http://bcm-specs.sipsolutions.net/PowerControl
 */
 static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                                       int get_max)
 {
-        int limit = 0;
+        int limit;
+        int clocksrc;
        int divisor;
-        int selection;
-        int err;
        u32 tmp;
-        struct bcm43xx_coreinfo *old_core;
-        if (!(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL))
+        assert(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL);
-                goto out;
+        assert(bcm->current_core == &bcm->core_chipcommon);
-        old_core = bcm->current_core;
-        err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
-        if (err)
-                goto out;
+        clocksrc = bcm43xx_pctl_get_slowclksrc(bcm);
        if (bcm->current_core->rev < 6) {
-                if ((bcm->bustype == BCM43xx_BUSTYPE_PCMCIA) ||
+                switch (clocksrc) {
-                        (bcm->bustype == BCM43xx_BUSTYPE_SB)) {
+                case BCM43xx_PCTL_CLKSRC_PCI:
-                        selection = 1;
+                        divisor = 64;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
                        divisor = 32;
-                } else {
+                        break;
-                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
+                default:
-                        if (err) {
+                        assert(0);
-                                printk(KERN_ERR PFX "clockfreqlimit pcicfg read failure\n");
+                        divisor = 1;
-                                goto out_switchback;
-                        }
-                        if (tmp & 0x10) {
-                                /* PCI */
-                                selection = 2;
-                                divisor = 64;
-                        } else {
-                                /* XTAL */
-                                selection = 1;
-                                divisor = 32;
-                        }
                }
        } else if (bcm->current_core->rev < 10) {
-                selection = (tmp & 0x07);
+                switch (clocksrc) {
-                if (selection) {
+                case BCM43xx_PCTL_CLKSRC_LOPWROS:
+                        divisor = 1;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
+                case BCM43xx_PCTL_CLKSRC_PCI:
                        tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
-                        divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
+                        divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
-                } else
+                        divisor *= 4;
+                        break;
+                default:
+                        assert(0);
                        divisor = 1;
+                }
        } else {
                tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL);
-                divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
+                divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
-                selection = 1;
+                divisor *= 4;
        }
-        
-        switch (selection) {
+        switch (clocksrc) {
-        case 0:
+        case BCM43xx_PCTL_CLKSRC_LOPWROS:
-                /* LPO */
                if (get_max)
                        limit = 43000;
                else
                        limit = 25000;
                break;
-        case 1:
+        case BCM43xx_PCTL_CLKSRC_XTALOS:
-                /* XTAL */
                if (get_max)
                        limit = 20200000;
                else
                        limit = 19800000;
                break;
-        case 2:
+        case BCM43xx_PCTL_CLKSRC_PCI:
-                /* PCI */
                if (get_max)
                        limit = 34000000;
                else
@@ -113,17 +137,14 @@ static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                break;
        default:
                assert(0);
+                limit = 0;
        }
        limit /= divisor;
-out_switchback:
-        err = bcm43xx_switch_core(bcm, old_core);
-        assert(err == 0);
-out:
        return limit;
 }
 /* init power control
 * as described in http://bcm-specs.sipsolutions.net/PowerControl
 */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.h b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
index 5f63640810bd..c966ab3a5a8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
@@ -33,6 +33,15 @@
 #include <linux/types.h>
+/* Clock sources */
+enum {
+        /* PCI clock */
+        BCM43xx_PCTL_CLKSRC_PCI,
+        /* Crystal slow clock oscillator */
+        BCM43xx_PCTL_CLKSRC_XTALOS,
+        /* Low power oscillator */
+        BCM43xx_PCTL_CLKSRC_LOPWROS,
+};
 struct bcm43xx_private;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
index c44d890b949b..b438f48e891d 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
@@ -71,14 +71,46 @@ static int get_boolean(const char *buf, size_t count)
        return -EINVAL;
 }
+static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len)
+{
+        int i, pos = 0;
+        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+                pos += snprintf(buf + pos, buf_len - pos - 1,
+                                "%04X", swab16(sprom[i]) & 0xFFFF);
+        }
+        pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
+        return pos + 1;
+}
+static int hex2sprom(u16 *sprom, const char *dump, size_t len)
+{
+        char tmp[5] = { 0 };
+        int cnt = 0;
+        unsigned long parsed;
+        if (len < BCM43xx_SPROM_SIZE * sizeof(u16) * 2)
+                return -EINVAL;
+        while (cnt < BCM43xx_SPROM_SIZE) {
+                memcpy(tmp, dump, 4);
+                dump += 4;
+                parsed = simple_strtoul(tmp, NULL, 16);
+                sprom[cnt++] = swab16((u16)parsed);
+        }
+        return 0;
+}
 static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
                                       struct device_attribute *attr,
                                       char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        u16 *sprom;
        unsigned long flags;
-        int i, err;
+        int err;
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;
@@ -91,55 +123,53 @@ static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
        bcm43xx_lock_mmio(bcm, flags);
        assert(bcm->initialized);
        err = bcm43xx_sprom_read(bcm, sprom);
-        if (!err) {
+        if (!err)
-                for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+                err = sprom2hex(sprom, buf, PAGE_SIZE);
-                        buf[i * 2] = sprom[i] & 0x00FF;
-                        buf[i * 2 + 1] = (sprom[i] & 0xFF00) >> 8;
-                }
-        }
        bcm43xx_unlock_mmio(bcm, flags);
        kfree(sprom);
-        return err ? err : BCM43xx_SPROM_SIZE * sizeof(u16);
+        return err;
 }
 static ssize_t bcm43xx_attr_sprom_store(struct device *dev,
                                        struct device_attribute *attr,
                                        const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        u16 *sprom;
        unsigned long flags;
-        int i, err;
+        int err;
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;
-        if (count != BCM43xx_SPROM_SIZE * sizeof(u16))
-                return -EINVAL;
        sprom = kmalloc(BCM43xx_SPROM_SIZE * sizeof(*sprom),
                        GFP_KERNEL);
        if (!sprom)
                return -ENOMEM;
-        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+        err = hex2sprom(sprom, buf, count);
-                sprom[i] = buf[i * 2] & 0xFF;
+        if (err)
-                sprom[i] |= ((u16)(buf[i * 2 + 1] & 0xFF)) << 8;
+                goto out_kfree;
-        }
        bcm43xx_lock_mmio(bcm, flags);
        assert(bcm->initialized);
        err = bcm43xx_sprom_write(bcm, sprom);
        bcm43xx_unlock_mmio(bcm, flags);
+out_kfree:
        kfree(sprom);
        return err ? err : count;
 }
+static DEVICE_ATTR(sprom, 0600,
+                   bcm43xx_attr_sprom_show,
+                   bcm43xx_attr_sprom_store);
 static ssize_t bcm43xx_attr_interfmode_show(struct device *dev,
                                            struct device_attribute *attr,
                                            char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        unsigned long flags;
        int err;
        ssize_t count = 0;
@@ -175,7 +205,7 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
                                             struct device_attribute *attr,
                                             const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        unsigned long flags;
        int err;
        int mode;
@@ -215,11 +245,15 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
        return err ? err : count;
 }
+static DEVICE_ATTR(interference, 0644,
+                   bcm43xx_attr_interfmode_show,
+                   bcm43xx_attr_interfmode_store);
 static ssize_t bcm43xx_attr_preamble_show(struct device *dev,
                                          struct device_attribute *attr,
                                          char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        unsigned long flags;
        int err;
        ssize_t count;
@@ -245,7 +279,7 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
                                           struct device_attribute *attr,
                                           const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
        unsigned long flags;
        int err;
        int value;
@@ -267,56 +301,41 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
        return err ? err : count;
 }
+static DEVICE_ATTR(shortpreamble, 0644,
+                   bcm43xx_attr_preamble_show,
+                   bcm43xx_attr_preamble_store);
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm)
 {
        struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
        int err;
        assert(bcm->initialized);
-        sysfs->attr_sprom.attr.name = "sprom";
+        err = device_create_file(dev, &dev_attr_sprom);
-        sysfs->attr_sprom.attr.owner = THIS_MODULE;
-        sysfs->attr_sprom.attr.mode = 0600;
-        sysfs->attr_sprom.show = bcm43xx_attr_sprom_show;
-        sysfs->attr_sprom.store = bcm43xx_attr_sprom_store;
-        err = device_create_file(dev, &sysfs->attr_sprom);
        if (err)
                goto out;
+        err = device_create_file(dev, &dev_attr_interference);
-        sysfs->attr_interfmode.attr.name = "interference";
-        sysfs->attr_interfmode.attr.owner = THIS_MODULE;
-        sysfs->attr_interfmode.attr.mode = 0600;
-        sysfs->attr_interfmode.show = bcm43xx_attr_interfmode_show;
-        sysfs->attr_interfmode.store = bcm43xx_attr_interfmode_store;
-        err = device_create_file(dev, &sysfs->attr_interfmode);
        if (err)
                goto err_remove_sprom;
+        err = device_create_file(dev, &dev_attr_shortpreamble);
-        sysfs->attr_preamble.attr.name = "shortpreamble";
-        sysfs->attr_preamble.attr.owner = THIS_MODULE;
-        sysfs->attr_preamble.attr.mode = 0600;
-        sysfs->attr_preamble.show = bcm43xx_attr_preamble_show;
-        sysfs->attr_preamble.store = bcm43xx_attr_preamble_store;
-        err = device_create_file(dev, &sysfs->attr_preamble);
        if (err)
                goto err_remove_interfmode;
 out:
        return err;
 err_remove_interfmode:
-        device_remove_file(dev, &sysfs->attr_interfmode);
+        device_remove_file(dev, &dev_attr_interference);
 err_remove_sprom:
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_sprom);
        goto out;
 }
 void bcm43xx_sysfs_unregister(struct bcm43xx_private *bcm)
 {
        struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
-        device_remove_file(dev, &sysfs->attr_preamble);
+        device_remove_file(dev, &dev_attr_shortpreamble);
-        device_remove_file(dev, &sysfs->attr_interfmode);
+        device_remove_file(dev, &dev_attr_interference);
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_sprom);
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
index 57f14514e3e0..cc701df71e2a 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
@@ -1,22 +1,6 @@
 #ifndef BCM43xx_SYSFS_H_
 #define BCM43xx_SYSFS_H_
-#include <linux/device.h>
-struct bcm43xx_sysfs {
-        struct device_attribute attr_sprom;
-        struct device_attribute attr_interfmode;
-        struct device_attribute attr_preamble;
-};
-#define devattr_to_bcm(attr, attr_name) ({                              \
-        struct bcm43xx_sysfs *__s; struct bcm43xx_private *__p;         \
-        __s = container_of((attr), struct bcm43xx_sysfs, attr_name);    \
-        __p = container_of(__s, struct bcm43xx_private, sysfs);         \
-        __p;                                                            \
-                                        })
 struct bcm43xx_private;
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 3daee828ef4b..3edbb481a0a0 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -962,22 +962,22 @@ static const struct iw_priv_args bcm43xx_priv_wx_args[] = {
        {
                .cmd            = PRIV_WX_SET_SHORTPREAMBLE,
                .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_shortpreambl",
+                .name           = "set_shortpreamb",
        },
        {
                .cmd            = PRIV_WX_GET_SHORTPREAMBLE,
                .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_shortpreambl",
+                .name           = "get_shortpreamb",
        },
        {
                .cmd            = PRIV_WX_SET_SWENCRYPTION,
                .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_swencryption",
+                .name           = "set_swencrypt",
        },
        {
                .cmd            = PRIV_WX_GET_SWENCRYPTION,
                .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_swencryption",
+                .name           = "get_swencrypt",
        },
        {
                .cmd            = PRIV_WX_SPROM_WRITE,
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 8dfdfbd5966c..06523e2a8471 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -390,7 +390,7 @@ static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
                }
        } else {
                struct {
-                        __le16 qual, signal, noise;
+                        __le16 qual, signal, noise, unused;
                } __attribute__ ((packed)) cq;
                err = HERMES_READ_RECORD(hw, USER_BAP,
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index d5890027f8af..48bbf32fd980 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -97,7 +97,7 @@ static struct superio_struct {	/* For Super-IO chips autodetection */
        int io;
        int irq;
        int dma;
-} superios[NR_SUPERIOS] __devinitdata = { {0,},};
+} superios[NR_SUPERIOS] = { {0,},};
 static int user_specified;
 #if defined(CONFIG_PARPORT_PC_SUPERIO) || \
@@ -1557,7 +1557,7 @@ static int __devinit get_superio_dma (struct parport *p)
        return PARPORT_DMA_NONE;
 }
-static int __devinit get_superio_irq (struct parport *p)
+static int get_superio_irq (struct parport *p)
 {
        int i=0;
        while( (superios[i].io != p->base) && (i<NR_SUPERIOS))
@@ -1579,7 +1579,7 @@ static int __devinit get_superio_irq (struct parport *p)
 *                         this shall always be the case!)
 *
 */
-static int __devinit parport_SPP_supported(struct parport *pb)
+static int parport_SPP_supported(struct parport *pb)
 {
        unsigned char r, w;
@@ -1660,7 +1660,7 @@ static int __devinit parport_SPP_supported(struct parport *pb)
 * two bits of ECR aren't writable, so we check by writing ECR and
 * reading it back to see if it's what we expect.
 */
-static int __devinit parport_ECR_present(struct parport *pb)
+static int parport_ECR_present(struct parport *pb)
 {
        struct parport_pc_private *priv = pb->private_data;
        unsigned char r = 0xc;
@@ -1712,7 +1712,7 @@ static int __devinit parport_ECR_present(struct parport *pb)
 * be misdetected here is rather academic. 
 */
-static int __devinit parport_PS2_supported(struct parport *pb)
+static int parport_PS2_supported(struct parport *pb)
 {
        int ok = 0;
  
@@ -1868,7 +1868,7 @@ static int __devinit parport_ECP_supported(struct parport *pb)
 }
 #endif
-static int __devinit parport_ECPPS2_supported(struct parport *pb)
+static int parport_ECPPS2_supported(struct parport *pb)
 {
        const struct parport_pc_private *priv = pb->private_data;
        int result;
@@ -1886,7 +1886,7 @@ static int __devinit parport_ECPPS2_supported(struct parport *pb)
 /* EPP mode detection  */
-static int __devinit parport_EPP_supported(struct parport *pb)
+static int parport_EPP_supported(struct parport *pb)
 {
        const struct parport_pc_private *priv = pb->private_data;
@@ -1931,7 +1931,7 @@ static int __devinit parport_EPP_supported(struct parport *pb)
        return 1;
 }
-static int __devinit parport_ECPEPP_supported(struct parport *pb)
+static int parport_ECPEPP_supported(struct parport *pb)
 {
        struct parport_pc_private *priv = pb->private_data;
        int result;
@@ -2073,7 +2073,7 @@ static int __devinit irq_probe_SPP(struct parport *pb)
 * When ECP is available we can autoprobe for IRQs.
 * NOTE: If we can autoprobe it, we can register the IRQ.
 */
-static int __devinit parport_irq_probe(struct parport *pb)
+static int parport_irq_probe(struct parport *pb)
 {
        struct parport_pc_private *priv = pb->private_data;
@@ -2779,7 +2779,7 @@ static struct parport_pc_pci {
        /* If set, this is called after probing for ports.  If 'failed'
         * is non-zero we couldn't use any of the ports. */
        void (*postinit_hook) (struct pci_dev *pdev, int failed);
-} cards[] __devinitdata = {
+} cards[] = {
        /* siig_1p_10x */               { 1, { { 2, 3 }, } },
        /* siig_2p_10x */               { 2, { { 2, 3 }, { 4, 5 }, } },
        /* siig_1p_20x */               { 1, { { 0, 1 }, } },
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 827550d25c9e..c42ae2cf8d64 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -865,6 +865,35 @@ static void __init quirk_eisa_bridge(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82375,      quirk_eisa_bridge );
 /*
+ * On the MSI-K8T-Neo2Fir Board, the internal Soundcard is disabled
+ * when a PCI-Soundcard is added. The BIOS only gives Options
+ * "Disabled" and "AUTO". This Quirk Sets the corresponding
+ * Register-Value to enable the Soundcard.
+ */
+static void __init k8t_sound_hostbridge(struct pci_dev *dev)
+{
+        unsigned char val;
+        printk(KERN_INFO "PCI: Quirk-MSI-K8T Soundcard On\n");
+        pci_read_config_byte(dev, 0x50, &val);
+        if (val == 0x88 || val == 0xc8) {
+                pci_write_config_byte(dev, 0x50, val & (~0x40));
+                /* Verify the Change for Status output */
+                pci_read_config_byte(dev, 0x50, &val);
+                if (val & 0x40)
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard still off\n");
+                else
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard on\n");
+        } else {
+                printk(KERN_INFO "PCI: Unexpected Value in PCI-Register: "
+                                        "no Change!\n");
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_hostbridge);
+/*
 * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
 * is not activated. The myth is that Asus said that they do not want the
 * users to be irritated by just another PCI Device in the Win98 device
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index c4256aa32bcb..6fff109bdab6 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -479,7 +479,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
 int pnp_start_dev(struct pnp_dev *dev)
 {
        if (!pnp_can_write(dev)) {
-                pnp_info("Device %s does not supported activation.", dev->dev.bus_id);
+                pnp_info("Device %s does not support activation.", dev->dev.bus_id);
                return -EINVAL;
        }
@@ -503,7 +503,7 @@ int pnp_start_dev(struct pnp_dev *dev)
 int pnp_stop_dev(struct pnp_dev *dev)
 {
        if (!pnp_can_disable(dev)) {
-                pnp_info("Device %s does not supported disabling.", dev->dev.bus_id);
+                pnp_info("Device %s does not support disabling.", dev->dev.bus_id);
                return -EINVAL;
        }
        if (dev->protocol->disable(dev)<0) {
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index e9c10c0a30fc..321a40f33b50 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -1057,7 +1057,6 @@ static void m32r_sio_console_write(struct console *co, const char *s,
 {
        struct uart_sio_port *up = &m32r_sio_ports[co->index];
        unsigned int ier;
-        int i;
        /*
         *      First save the UER then disable the interrupts
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 9a6b5b39b88e..387a18a47ac2 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -2265,7 +2265,7 @@ static struct bin_attribute edid2_attr = {
 };
-static int radeonfb_pci_register (struct pci_dev *pdev,
+static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
                                  const struct pci_device_id *ent)
 {
        struct fb_info *info;
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 8d8eadb64853..372aa1776827 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -674,13 +674,19 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                total_size = info->fix.smem_len;
        if (p > total_size)
-                return 0;
+                return -EFBIG;
-        if (count >= total_size)
+        if (count > total_size) {
+                err = -EFBIG;
                count = total_size;
+        }
+        if (count + p > total_size) {
+                if (!err)
+                        err = -ENOSPC;
-        if (count + p > total_size)
                count = total_size - p;
+        }
        buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
                         GFP_KERNEL);
@@ -722,7 +728,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
        kfree(buffer);
-        return (err) ? err : cnt;
+        return (cnt) ? cnt : err;
 }
 #ifdef CONFIG_KMOD
diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c
index 5fe197943deb..4e963930b50a 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/pm2fb.c
@@ -73,8 +73,8 @@ static char *mode __devinitdata = NULL;
 * these flags allow the user to specify that requests for +ve sync
 * should be silently turned in -ve sync.
 */
-static int lowhsync __devinitdata = 0;
+static int lowhsync;
-static int lowvsync __devinitdata = 0;
+static int lowvsync;
 /*
 * The hardware state of the graphics card that isn't part of the
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 10e6b3aab9ea..0da624e6524f 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -73,7 +73,7 @@
 /* --------------------------------------------------------------------- */
-static char *mode_option __initdata = NULL;
+static char *mode_option __devinitdata = NULL;
 #ifdef MODULE
@@ -1545,7 +1545,7 @@ static int __devinit savage_map_mmio (struct fb_info *info)
        return 0;
 }
-static void __devinit savage_unmap_mmio (struct fb_info *info)
+static void savage_unmap_mmio (struct fb_info *info)
 {
        struct savagefb_par *par = info->par;
        DBG ("savage_unmap_mmio");
@@ -1597,7 +1597,7 @@ static int __devinit savage_map_video (struct fb_info *info,
        return 0;
 }
-static void __devinit savage_unmap_video (struct fb_info *info)
+static void savage_unmap_video (struct fb_info *info)
 {
        struct savagefb_par *par = info->par;
@@ -1614,7 +1614,7 @@ static void __devinit savage_unmap_video (struct fb_info *info)
        }
 }
-static int __devinit savage_init_hw (struct savagefb_par *par)
+static int savage_init_hw (struct savagefb_par *par)
 {
        unsigned char config1, m, n, n1, n2, sr8, cr3f, cr66 = 0, tmp;