Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

The SmartMedia FTL code depends on new kfifo bits from 2.6.33

18 files changed, 320 insertions, 129 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 6f31c9472100..e023682be2c4 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -502,7 +502,7 @@ config BRIQ_PANEL
 
 config BFIN_OTP
         tristate "Blackfin On-Chip OTP Memory Support"
-        depends on BLACKFIN && (BF52x || BF54x)
+        depends on BLACKFIN && (BF51x || BF52x || BF54x)
         default y
         help
           If you say Y here, you will get support for a character device
@@ -669,7 +669,7 @@ config VIRTIO_CONSOLE
 
 config HVCS
         tristate "IBM Hypervisor Virtual Console Server support"
-        depends on PPC_PSERIES
+        depends on PPC_PSERIES && HVC_CONSOLE
         help
           Partitionable IBM Power5 ppc64 machines allow hosting of
           firmware virtual consoles from one Linux partition by
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 2fb2e6cc322a..fd50ead59c79 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -728,6 +728,7 @@ int __init agp_amd64_init(void)
 
         if (agp_off)
                 return -EINVAL;
+
         err = pci_register_driver(&agp_amd64_pci_driver);
         if (err < 0)
                 return err;
@@ -764,19 +765,28 @@ int __init agp_amd64_init(void)
         return err;
 }
 
+static int __init agp_amd64_mod_init(void)
+{
+#ifndef MODULE
+        if (gart_iommu_aperture)
+                return agp_bridges_found ? 0 : -ENODEV;
+#endif
+        return agp_amd64_init();
+}
+
 static void __exit agp_amd64_cleanup(void)
 {
+#ifndef MODULE
+        if (gart_iommu_aperture)
+                return;
+#endif
         if (aperture_resource)
                 release_resource(aperture_resource);
         pci_unregister_driver(&agp_amd64_pci_driver);
 }
 
-/* On AMD64 the PCI driver needs to initialize this driver early
-   for the IOMMU, so it has to be called via a backdoor. */
-#ifndef CONFIG_GART_IOMMU
-module_init(agp_amd64_init);
+module_init(agp_amd64_mod_init);
 module_exit(agp_amd64_cleanup);
-#endif
 
 MODULE_AUTHOR("Dave Jones <davej@redhat.com>, Andi Kleen");
 module_param(agp_try_unsupported, bool, 0);
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index a56ca080e108..c3ab46da51a3 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -285,18 +285,22 @@ int agp_add_bridge(struct agp_bridge_data *bridge)
 {
         int error;
 
-        if (agp_off)
-                return -ENODEV;
+        if (agp_off) {
+                error = -ENODEV;
+                goto err_put_bridge;
+        }
 
         if (!bridge->dev) {
                 printk (KERN_DEBUG PFX "Erk, registering with no pci_dev!\n");
-                return -EINVAL;
+                error = -EINVAL;
+                goto err_put_bridge;
         }
 
         /* Grab reference on the chipset driver. */
         if (!try_module_get(bridge->driver->owner)) {
                 dev_info(&bridge->dev->dev, "can't lock chipset driver\n");
-                return -EINVAL;
+                error = -EINVAL;
+                goto err_put_bridge;
         }
 
         error = agp_backend_initialize(bridge);
@@ -326,6 +330,7 @@ frontend_err:
         agp_backend_cleanup(bridge);
 err_out:
         module_put(bridge->driver->owner);
+err_put_bridge:
         agp_put_bridge(bridge);
         return error;
 }
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 9047b2714653..58752b70efea 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -488,9 +488,8 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
         handle = obj;
         do {
                 status = acpi_get_object_info(handle, &info);
-                if (ACPI_SUCCESS(status)) {
+                if (ACPI_SUCCESS(status) && (info->valid & ACPI_VALID_HID)) {
                         /* TBD check _CID also */
-                        info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
                         match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
                         kfree(info);
                         if (match) {
@@ -509,6 +508,9 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
                 handle = parent;
         } while (ACPI_SUCCESS(status));
 
+        if (ACPI_FAILURE(status))
+                return AE_OK;   /* found no enclosing IOC */
+
         if (hp_zx1_setup(sba_hpa + HP_ZX1_IOC_OFFSET, lba_hpa))
                 return AE_OK;
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 30c36ac2cd00..3999a5f25f38 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -2460,10 +2460,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                                 &bridge->mode);
         }
 
-        if (bridge->driver->mask_memory == intel_i965_mask_memory)
+        if (bridge->driver->mask_memory == intel_i965_mask_memory) {
                 if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(36)))
                         dev_err(&intel_private.pcidev->dev,
                                 "set gfx device dma mask 36bit failed!\n");
+                else
+                        pci_set_consistent_dma_mask(intel_private.pcidev,
+                                                    DMA_BIT_MASK(36));
+        }
 
         pci_set_drvdata(pdev, bridge);
         return agp_add_bridge(bridge);
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index e989f67bb61f..3d9c61e5acbf 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -158,10 +158,11 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
                         goto out;
                 }
         }
-out_unlock:
-        mutex_unlock(&rng_mutex);
 out:
         return ret ? : err;
+out_unlock:
+        mutex_unlock(&rng_mutex);
+        goto out;
 }
 
 
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index bdaef8e94021..64fe0a793efd 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -114,7 +114,7 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
-static struct virtio_driver virtio_rng = {
+static struct virtio_driver virtio_rng_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
@@ -124,12 +124,12 @@ static struct virtio_driver virtio_rng = {
 
 static int __init init(void)
 {
-        return register_virtio_driver(&virtio_rng);
+        return register_virtio_driver(&virtio_rng_driver);
 }
 
 static void __exit fini(void)
 {
-        unregister_virtio_driver(&virtio_rng);
+        unregister_virtio_driver(&virtio_rng_driver);
 }
 module_init(init);
 module_exit(fini);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index d2e698096ace..176f1751237f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -64,6 +64,7 @@
 #include <linux/dmi.h>
 #include <linux/string.h>
 #include <linux/ctype.h>
+#include <linux/pnp.h>
 
 #ifdef CONFIG_PPC_OF
 #include <linux/of_device.h>
@@ -1919,7 +1920,7 @@ struct SPMITable {
         s8      spmi_id[1]; /* A '\0' terminated array starts here. */
 };
 
-static __devinit int try_init_acpi(struct SPMITable *spmi)
+static __devinit int try_init_spmi(struct SPMITable *spmi)
 {
         struct smi_info  *info;
         u8               addr_space;
@@ -1940,7 +1941,7 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
                 return -ENOMEM;
         }
 
-        info->addr_source = "ACPI";
+        info->addr_source = "SPMI";
 
         /* Figure out the interface type. */
         switch (spmi->InterfaceType) {
@@ -2002,7 +2003,7 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
         return 0;
 }
 
-static __devinit void acpi_find_bmc(void)
+static __devinit void spmi_find_bmc(void)
 {
         acpi_status      status;
         struct SPMITable *spmi;
@@ -2020,9 +2021,106 @@ static __devinit void acpi_find_bmc(void)
                 if (status != AE_OK)
                         return;
 
-                try_init_acpi(spmi);
+                try_init_spmi(spmi);
         }
 }
+
+static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
+                                    const struct pnp_device_id *dev_id)
+{
+        struct acpi_device *acpi_dev;
+        struct smi_info *info;
+        acpi_handle handle;
+        acpi_status status;
+        unsigned long long tmp;
+
+        acpi_dev = pnp_acpi_device(dev);
+        if (!acpi_dev)
+                return -ENODEV;
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        info->addr_source = "ACPI";
+
+        handle = acpi_dev->handle;
+
+        /* _IFT tells us the interface type: KCS, BT, etc */
+        status = acpi_evaluate_integer(handle, "_IFT", NULL, &tmp);
+        if (ACPI_FAILURE(status))
+                goto err_free;
+
+        switch (tmp) {
+        case 1:
+                info->si_type = SI_KCS;
+                break;
+        case 2:
+                info->si_type = SI_SMIC;
+                break;
+        case 3:
+                info->si_type = SI_BT;
+                break;
+        default:
+                dev_info(&dev->dev, "unknown interface type %lld\n", tmp);
+                goto err_free;
+        }
+
+        if (pnp_port_valid(dev, 0)) {
+                info->io_setup = port_setup;
+                info->io.addr_type = IPMI_IO_ADDR_SPACE;
+                info->io.addr_data = pnp_port_start(dev, 0);
+        } else if (pnp_mem_valid(dev, 0)) {
+                info->io_setup = mem_setup;
+                info->io.addr_type = IPMI_MEM_ADDR_SPACE;
+                info->io.addr_data = pnp_mem_start(dev, 0);
+        } else {
+                dev_err(&dev->dev, "no I/O or memory address\n");
+                goto err_free;
+        }
+
+        info->io.regspacing = DEFAULT_REGSPACING;
+        info->io.regsize = DEFAULT_REGSPACING;
+        info->io.regshift = 0;
+
+        /* If _GPE exists, use it; otherwise use standard interrupts */
+        status = acpi_evaluate_integer(handle, "_GPE", NULL, &tmp);
+        if (ACPI_SUCCESS(status)) {
+                info->irq = tmp;
+                info->irq_setup = acpi_gpe_irq_setup;
+        } else if (pnp_irq_valid(dev, 0)) {
+                info->irq = pnp_irq(dev, 0);
+                info->irq_setup = std_irq_setup;
+        }
+
+        info->dev = &acpi_dev->dev;
+        pnp_set_drvdata(dev, info);
+
+        return try_smi_init(info);
+
+err_free:
+        kfree(info);
+        return -EINVAL;
+}
+
+static void __devexit ipmi_pnp_remove(struct pnp_dev *dev)
+{
+        struct smi_info *info = pnp_get_drvdata(dev);
+
+        cleanup_one_si(info);
+}
+
+static const struct pnp_device_id pnp_dev_table[] = {
+        {"IPI0001", 0},
+        {"", 0},
+};
+
+static struct pnp_driver ipmi_pnp_driver = {
+        .name           = DEVICE_NAME,
+        .probe          = ipmi_pnp_probe,
+        .remove         = __devexit_p(ipmi_pnp_remove),
+        .id_table       = pnp_dev_table,
+};
 #endif
 
 #ifdef CONFIG_DMI
@@ -2202,7 +2300,6 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         int rv;
         int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
         struct smi_info *info;
-        int first_reg_offset = 0;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
@@ -2241,9 +2338,6 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         info->addr_source_cleanup = ipmi_pci_cleanup;
         info->addr_source_data = pdev;
 
-        if (pdev->subsystem_vendor == PCI_HP_VENDOR_ID)
-                first_reg_offset = 1;
-
         if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
                 info->io_setup = port_setup;
                 info->io.addr_type = IPMI_IO_ADDR_SPACE;
@@ -3108,7 +3202,10 @@ static __devinit int init_ipmi_si(void)
 #endif
 
 #ifdef CONFIG_ACPI
-        acpi_find_bmc();
+        spmi_find_bmc();
+#endif
+#ifdef CONFIG_ACPI
+        pnp_register_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PCI
@@ -3233,6 +3330,9 @@ static __exit void cleanup_ipmi_si(void)
 #ifdef CONFIG_PCI
         pci_unregister_driver(&ipmi_pci_driver);
 #endif
+#ifdef CONFIG_ACPI
+        pnp_unregister_driver(&ipmi_pnp_driver);
+#endif
 
 #ifdef CONFIG_PPC_OF
         of_unregister_platform_driver(&ipmi_of_platform_driver);
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 5619007e7e05..f706b1dffdb3 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -233,7 +233,8 @@ int setkeycode(unsigned int scancode, unsigned int keycode)
 }
 
 /*
- * Making beeps and bells.
+ * Making beeps and bells. Note that we prefer beeps to bells, but when
+ * shutting the sound off we do both.
  */
 
 static int kd_sound_helper(struct input_handle *handle, void *data)
@@ -242,9 +243,12 @@ static int kd_sound_helper(struct input_handle *handle, void *data)
         struct input_dev *dev = handle->dev;
 
         if (test_bit(EV_SND, dev->evbit)) {
-                if (test_bit(SND_TONE, dev->sndbit))
+                if (test_bit(SND_TONE, dev->sndbit)) {
                         input_inject_event(handle, EV_SND, SND_TONE, *hz);
-                if (test_bit(SND_BELL, handle->dev->sndbit))
+                        if (*hz)
+                                return 0;
+                }
+                if (test_bit(SND_BELL, dev->sndbit))
                         input_inject_event(handle, EV_SND, SND_BELL, *hz ? 1 : 0);
         }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index be832b6f8279..48788db4e280 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -395,6 +395,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
         unsigned long p = *ppos;
         ssize_t low_count, read, sz;
         char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
+        int err = 0;
 
         read = 0;
         if (p < (unsigned long) high_memory) {
@@ -441,12 +442,16 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                         return -ENOMEM;
                 while (count > 0) {
                         sz = size_inside_page(p, count);
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         sz = vread(kbuf, (char *)p, sz);
                         if (!sz)
                                 break;
                         if (copy_to_user(buf, kbuf, sz)) {
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
                         count -= sz;
                         buf += sz;
@@ -455,8 +460,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                 }
                 free_page((unsigned long)kbuf);
         }
-        *ppos = p;
-        return read;
+        *ppos = p;
+        return read ? read : err;
 }
 
 
@@ -520,6 +525,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
         ssize_t wrote = 0;
         ssize_t virtr = 0;
         char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+        int err = 0;
 
         if (p < (unsigned long) high_memory) {
                 unsigned long to_write = min_t(unsigned long, count,
@@ -540,14 +546,16 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                         unsigned long sz = size_inside_page(p, count);
                         unsigned long n;
 
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         n = copy_from_user(kbuf, buf, sz);
                         if (n) {
-                                if (wrote + virtr)
-                                        break;
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
-                        sz = vwrite(kbuf, (char *)p, sz);
+                        vwrite(kbuf, (char *)p, sz);
                         count -= sz;
                         buf += sz;
                         virtr += sz;
@@ -556,8 +564,8 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                 free_page((unsigned long)kbuf);
         }
 
-        *ppos = p;
-        return virtr + wrote;
+        *ppos = p;
+        return virtr + wrote ? : err;
 }
 #endif
 
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index d3400b20444f..2ad7d37afbd0 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -358,7 +358,7 @@ struct port {
         u8 update_flow_control;
         struct ctrl_ul ctrl_ul;
         struct ctrl_dl ctrl_dl;
-        struct kfifo *fifo_ul;
+        struct kfifo fifo_ul;
         void __iomem *dl_addr[2];
         u32 dl_size[2];
         u8 toggle_dl;
@@ -685,8 +685,6 @@ static int nozomi_read_config_table(struct nozomi *dc)
                 dump_table(dc);
 
                 for (i = PORT_MDM; i < MAX_PORT; i++) {
-                        dc->port[i].fifo_ul =
-                            kfifo_alloc(FIFO_BUFFER_SIZE_UL, GFP_ATOMIC, NULL);
                         memset(&dc->port[i].ctrl_dl, 0, sizeof(struct ctrl_dl));
                         memset(&dc->port[i].ctrl_ul, 0, sizeof(struct ctrl_ul));
                 }
@@ -798,7 +796,7 @@ static int send_data(enum port_type index, struct nozomi *dc)
         struct tty_struct *tty = tty_port_tty_get(&port->port);
 
         /* Get data from tty and place in buf for now */
-        size = __kfifo_get(port->fifo_ul, dc->send_buf,
+        size = kfifo_out(&port->fifo_ul, dc->send_buf,
                            ul_size < SEND_BUF_MAX ? ul_size : SEND_BUF_MAX);
 
         if (size == 0) {
@@ -988,11 +986,11 @@ static int receive_flow_control(struct nozomi *dc)
 
         } else if (old_ctrl.CTS == 0 && ctrl_dl.CTS == 1) {
 
-                if (__kfifo_len(dc->port[port].fifo_ul)) {
+                if (kfifo_len(&dc->port[port].fifo_ul)) {
                         DBG1("Enable interrupt (0x%04X) on port: %d",
                                 enable_ier, port);
                         DBG1("Data in buffer [%d], enable transmit! ",
-                                __kfifo_len(dc->port[port].fifo_ul));
+                                kfifo_len(&dc->port[port].fifo_ul));
                         enable_transmit_ul(port, dc);
                 } else {
                         DBG1("No data in buffer...");
@@ -1433,6 +1431,16 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
                 goto err_free_sbuf;
         }
 
+        for (i = PORT_MDM; i < MAX_PORT; i++) {
+                if (kfifo_alloc(&dc->port[i].fifo_ul,
+                      FIFO_BUFFER_SIZE_UL, GFP_ATOMIC)) {
+                        dev_err(&pdev->dev,
+                                        "Could not allocate kfifo buffer\n");
+                        ret = -ENOMEM;
+                        goto err_free_kfifo;
+                }
+        }
+
         spin_lock_init(&dc->spin_mutex);
 
         nozomi_setup_private_data(dc);
@@ -1445,7 +1453,7 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
                         NOZOMI_NAME, dc);
         if (unlikely(ret)) {
                 dev_err(&pdev->dev, "can't request irq %d\n", pdev->irq);
-                goto err_free_sbuf;
+                goto err_free_kfifo;
         }
 
         DBG1("base_addr: %p", dc->base_addr);
@@ -1464,13 +1472,28 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
         dc->state = NOZOMI_STATE_ENABLED;
 
         for (i = 0; i < MAX_PORT; i++) {
+                struct device *tty_dev;
+
                 mutex_init(&dc->port[i].tty_sem);
                 tty_port_init(&dc->port[i].port);
-                tty_register_device(ntty_driver, dc->index_start + i,
+                tty_dev = tty_register_device(ntty_driver, dc->index_start + i,
                                                         &pdev->dev);
+
+                if (IS_ERR(tty_dev)) {
+                        ret = PTR_ERR(tty_dev);
+                        dev_err(&pdev->dev, "Could not allocate tty?\n");
+                        goto err_free_tty;
+                }
         }
+
         return 0;
 
+err_free_tty:
+        for (i = dc->index_start; i < dc->index_start + MAX_PORT; ++i)
+                tty_unregister_device(ntty_driver, i);
+err_free_kfifo:
+        for (i = 0; i < MAX_PORT; i++)
+                kfifo_free(&dc->port[i].fifo_ul);
 err_free_sbuf:
         kfree(dc->send_buf);
         iounmap(dc->base_addr);
@@ -1536,8 +1559,7 @@ static void __devexit nozomi_card_exit(struct pci_dev *pdev)
         free_irq(pdev->irq, dc);
 
         for (i = 0; i < MAX_PORT; i++)
-                if (dc->port[i].fifo_ul)
-                        kfifo_free(dc->port[i].fifo_ul);
+                kfifo_free(&dc->port[i].fifo_ul);
 
         kfree(dc->send_buf);
 
@@ -1629,10 +1651,10 @@ static void ntty_close(struct tty_struct *tty, struct file *file)
 
         dc->open_ttys--;
         port->count--;
-        tty_port_tty_set(port, NULL);
 
         if (port->count == 0) {
                 DBG1("close: %d", nport->token_dl);
+                tty_port_tty_set(port, NULL);
                 spin_lock_irqsave(&dc->spin_mutex, flags);
                 dc->last_ier &= ~(nport->token_dl);
                 writew(dc->last_ier, dc->reg_ier);
@@ -1673,7 +1695,7 @@ static int ntty_write(struct tty_struct *tty, const unsigned char *buffer,
                 goto exit;
         }
 
-        rval = __kfifo_put(port->fifo_ul, (unsigned char *)buffer, count);
+        rval = kfifo_in(&port->fifo_ul, (unsigned char *)buffer, count);
 
         /* notify card */
         if (unlikely(dc == NULL)) {
@@ -1721,7 +1743,7 @@ static int ntty_write_room(struct tty_struct *tty)
         if (!port->port.count)
                 goto exit;
 
-        room = port->fifo_ul->size - __kfifo_len(port->fifo_ul);
+        room = port->fifo_ul.size - kfifo_len(&port->fifo_ul);
 
 exit:
         mutex_unlock(&port->tty_sem);
@@ -1878,7 +1900,7 @@ static s32 ntty_chars_in_buffer(struct tty_struct *tty)
                 goto exit_in_buffer;
         }
 
-        rval = __kfifo_len(port->fifo_ul);
+        rval = kfifo_len(&port->fifo_ul);
 
 exit_in_buffer:
         return rval;
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 8c7df5ba088f..f80810901db6 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/smp_lock.h>
 #include <linux/mutex.h>
+#include <linux/jiffies.h>
 
 #include <asm/hardware/dec21285.h>
 #include <asm/io.h>
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 8258982b49ec..2849713d2231 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1051,12 +1051,6 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
                                 /* like a named pipe */
         }
 
-        /*
-         * If we gave the user some bytes, update the access time.
-         */
-        if (count)
-                file_accessed(file);
-
         return (count ? count : retval);
 }
 
@@ -1107,7 +1101,6 @@ static ssize_t random_write(struct file *file, const char __user *buffer,
                             size_t count, loff_t *ppos)
 {
         size_t ret;
-        struct inode *inode = file->f_path.dentry->d_inode;
 
         ret = write_pool(&blocking_pool, buffer, count);
         if (ret)
@@ -1116,8 +1109,6 @@ static ssize_t random_write(struct file *file, const char __user *buffer,
         if (ret)
                 return ret;
 
-        inode->i_mtime = current_fs_time(inode->i_sb);
-        mark_inode_dirty(inode);
         return (ssize_t)count;
 }
 
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 8c262aaf7c26..bba727c3807e 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -50,7 +50,6 @@
 #include <linux/err.h>
 #include <linux/kfifo.h>
 #include <linux/platform_device.h>
-#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -487,7 +486,7 @@ static struct sonypi_device {
         int camera_power;
         int bluetooth_power;
         struct mutex lock;
-        struct kfifo *fifo;
+        struct kfifo fifo;
         spinlock_t fifo_lock;
         wait_queue_head_t fifo_proc_list;
         struct fasync_struct *fifo_async;
@@ -496,7 +495,7 @@ static struct sonypi_device {
         struct input_dev *input_jog_dev;
         struct input_dev *input_key_dev;
         struct work_struct input_work;
-        struct kfifo *input_fifo;
+        struct kfifo input_fifo;
         spinlock_t input_fifo_lock;
 } sonypi_device;
 
@@ -777,8 +776,9 @@ static void input_keyrelease(struct work_struct *work)
 {
         struct sonypi_keypress kp;
 
-        while (kfifo_get(sonypi_device.input_fifo, (unsigned char *)&kp,
-                         sizeof(kp)) == sizeof(kp)) {
+        while (kfifo_out_locked(&sonypi_device.input_fifo, (unsigned char *)&kp,
+                         sizeof(kp), &sonypi_device.input_fifo_lock)
+                        == sizeof(kp)) {
                 msleep(10);
                 input_report_key(kp.dev, kp.key, 0);
                 input_sync(kp.dev);
@@ -827,8 +827,9 @@ static void sonypi_report_input_event(u8 event)
         if (kp.dev) {
                 input_report_key(kp.dev, kp.key, 1);
                 input_sync(kp.dev);
-                kfifo_put(sonypi_device.input_fifo,
-                          (unsigned char *)&kp, sizeof(kp));
+                kfifo_in_locked(&sonypi_device.input_fifo,
+                        (unsigned char *)&kp, sizeof(kp),
+                        &sonypi_device.input_fifo_lock);
                 schedule_work(&sonypi_device.input_work);
         }
 }
@@ -880,7 +881,8 @@ found:
                 acpi_bus_generate_proc_event(sonypi_acpi_device, 1, event);
 #endif
 
-        kfifo_put(sonypi_device.fifo, (unsigned char *)&event, sizeof(event));
+        kfifo_in_locked(&sonypi_device.fifo, (unsigned char *)&event,
+                        sizeof(event), &sonypi_device.fifo_lock);
         kill_fasync(&sonypi_device.fifo_async, SIGIO, POLL_IN);
         wake_up_interruptible(&sonypi_device.fifo_proc_list);
 
@@ -902,14 +904,13 @@ static int sonypi_misc_release(struct inode *inode, struct file *file)
 
 static int sonypi_misc_open(struct inode *inode, struct file *file)
 {
-        lock_kernel();
         mutex_lock(&sonypi_device.lock);
         /* Flush input queue on first open */
         if (!sonypi_device.open_count)
-                kfifo_reset(sonypi_device.fifo);
+                kfifo_reset(&sonypi_device.fifo);
         sonypi_device.open_count++;
         mutex_unlock(&sonypi_device.lock);
-        unlock_kernel();
+
         return 0;
 }
 
@@ -919,17 +920,18 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
         ssize_t ret;
         unsigned char c;
 
-        if ((kfifo_len(sonypi_device.fifo) == 0) &&
+        if ((kfifo_len(&sonypi_device.fifo) == 0) &&
             (file->f_flags & O_NONBLOCK))
                 return -EAGAIN;
 
         ret = wait_event_interruptible(sonypi_device.fifo_proc_list,
-                                       kfifo_len(sonypi_device.fifo) != 0);
+                                       kfifo_len(&sonypi_device.fifo) != 0);
         if (ret)
                 return ret;
 
         while (ret < count &&
-               (kfifo_get(sonypi_device.fifo, &c, sizeof(c)) == sizeof(c))) {
+               (kfifo_out_locked(&sonypi_device.fifo, &c, sizeof(c),
+                                 &sonypi_device.fifo_lock) == sizeof(c))) {
                 if (put_user(c, buf++))
                         return -EFAULT;
                 ret++;
@@ -946,15 +948,15 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
 static unsigned int sonypi_misc_poll(struct file *file, poll_table *wait)
 {
         poll_wait(file, &sonypi_device.fifo_proc_list, wait);
-        if (kfifo_len(sonypi_device.fifo))
+        if (kfifo_len(&sonypi_device.fifo))
                 return POLLIN | POLLRDNORM;
         return 0;
 }
 
-static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
+static long sonypi_misc_ioctl(struct file *fp,
                              unsigned int cmd, unsigned long arg)
 {
-        int ret = 0;
+        long ret = 0;
         void __user *argp = (void __user *)arg;
         u8 val8;
         u16 val16;
@@ -1070,7 +1072,8 @@ static const struct file_operations sonypi_misc_fops = {
         .open           = sonypi_misc_open,
         .release        = sonypi_misc_release,
         .fasync         = sonypi_misc_fasync,
-        .ioctl          = sonypi_misc_ioctl,
+        .unlocked_ioctl = sonypi_misc_ioctl,
+        .llseek         = no_llseek,
 };
 
 static struct miscdevice sonypi_misc_device = {
@@ -1313,11 +1316,10 @@ static int __devinit sonypi_probe(struct platform_device *dev)
                         "http://www.linux.it/~malattia/wiki/index.php/Sony_drivers\n");
 
         spin_lock_init(&sonypi_device.fifo_lock);
-        sonypi_device.fifo = kfifo_alloc(SONYPI_BUF_SIZE, GFP_KERNEL,
-                                         &sonypi_device.fifo_lock);
-        if (IS_ERR(sonypi_device.fifo)) {
+        error = kfifo_alloc(&sonypi_device.fifo, SONYPI_BUF_SIZE, GFP_KERNEL);
+        if (error) {
                 printk(KERN_ERR "sonypi: kfifo_alloc failed\n");
-                return PTR_ERR(sonypi_device.fifo);
+                return error;
         }
 
         init_waitqueue_head(&sonypi_device.fifo_proc_list);
@@ -1393,12 +1395,10 @@ static int __devinit sonypi_probe(struct platform_device *dev)
                 }
 
                 spin_lock_init(&sonypi_device.input_fifo_lock);
-                sonypi_device.input_fifo =
-                        kfifo_alloc(SONYPI_BUF_SIZE, GFP_KERNEL,
-                                    &sonypi_device.input_fifo_lock);
-                if (IS_ERR(sonypi_device.input_fifo)) {
+                error = kfifo_alloc(&sonypi_device.input_fifo, SONYPI_BUF_SIZE,
+                                GFP_KERNEL);
+                if (error) {
                         printk(KERN_ERR "sonypi: kfifo_alloc failed\n");
-                        error = PTR_ERR(sonypi_device.input_fifo);
                         goto err_inpdev_unregister;
                 }
 
@@ -1423,7 +1423,7 @@ static int __devinit sonypi_probe(struct platform_device *dev)
                 pci_disable_device(pcidev);
  err_put_pcidev:
         pci_dev_put(pcidev);
-        kfifo_free(sonypi_device.fifo);
+        kfifo_free(&sonypi_device.fifo);
 
         return error;
 }
@@ -1438,7 +1438,7 @@ static int __devexit sonypi_remove(struct platform_device *dev)
         if (useinput) {
                 input_unregister_device(sonypi_device.input_key_dev);
                 input_unregister_device(sonypi_device.input_jog_dev);
-                kfifo_free(sonypi_device.input_fifo);
+                kfifo_free(&sonypi_device.input_fifo);
         }
 
         misc_deregister(&sonypi_misc_device);
@@ -1451,7 +1451,7 @@ static int __devexit sonypi_remove(struct platform_device *dev)
                 pci_dev_put(sonypi_device.dev);
         }
 
-        kfifo_free(sonypi_device.fifo);
+        kfifo_free(&sonypi_device.fifo);
 
         return 0;
 }
diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index 663cd15d7c78..f8bc79f6de34 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -68,7 +68,7 @@
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-
+#include <linux/smp_lock.h>
 #include <linux/toshiba.h>
 
 #define TOSH_MINOR_DEV 181
@@ -88,13 +88,13 @@ static int tosh_date;
 static int tosh_sci;
 static int tosh_fan;
 
-static int tosh_ioctl(struct inode *, struct file *, unsigned int,
+static long tosh_ioctl(struct file *, unsigned int,
         unsigned long);
 
 
 static const struct file_operations tosh_fops = {
         .owner          = THIS_MODULE,
-        .ioctl          = tosh_ioctl,
+        .unlocked_ioctl = tosh_ioctl,
 };
 
 static struct miscdevice tosh_device = {
@@ -252,8 +252,7 @@ int tosh_smm(SMMRegisters *regs)
 EXPORT_SYMBOL(tosh_smm);
 
 
-static int tosh_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
-        unsigned long arg)
+static long tosh_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
         SMMRegisters regs;
         SMMRegisters __user *argp = (SMMRegisters __user *)arg;
@@ -275,13 +274,16 @@ static int tosh_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
                                 return -EINVAL;
 
                         /* do we need to emulate the fan ? */
+                        lock_kernel();
                         if (tosh_fan==1) {
                                 if (((ax==0xf300) || (ax==0xf400)) && (bx==0x0004)) {
                                         err = tosh_emulate_fan(&regs);
+                                        unlock_kernel();
                                         break;
                                 }
                         }
                         err = tosh_smm(&regs);
+                        unlock_kernel();
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ecba4942fc8e..f58440791e65 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -39,12 +39,12 @@
 struct tpm_inf_dev {
         int iotype;
 
-        void __iomem *mem_base;         /* MMIO ioremap'd addr */
-        unsigned long map_base;         /* phys MMIO base */
-        unsigned long map_size;         /* MMIO region size */
-        unsigned int index_off;         /* index register offset */
+        void __iomem *mem_base; /* MMIO ioremap'd addr */
+        unsigned long map_base; /* phys MMIO base */
+        unsigned long map_size; /* MMIO region size */
+        unsigned int index_off; /* index register offset */
 
-        unsigned int data_regs;         /* Data registers */
+        unsigned int data_regs; /* Data registers */
         unsigned int data_size;
 
         unsigned int config_port;       /* IO Port config index reg */
@@ -406,14 +406,14 @@ static const struct tpm_vendor_specific tpm_inf = {
         .miscdev = {.fops = &inf_ops,},
 };
 
-static const struct pnp_device_id tpm_pnp_tbl[] = {
+static const struct pnp_device_id tpm_inf_pnp_tbl[] = {
         /* Infineon TPMs */
         {"IFX0101", 0},
         {"IFX0102", 0},
         {"", 0}
 };
 
-MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
+MODULE_DEVICE_TABLE(pnp, tpm_inf_pnp_tbl);
 
 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                                        const struct pnp_device_id *dev_id)
@@ -430,7 +430,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
             !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
 
-                tpm_dev.iotype = TPM_INF_IO_PORT;
+                tpm_dev.iotype = TPM_INF_IO_PORT;
 
                 tpm_dev.config_port = pnp_port_start(dev, 0);
                 tpm_dev.config_size = pnp_port_len(dev, 0);
@@ -459,9 +459,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
         } else if (pnp_mem_valid(dev, 0) &&
-                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
+                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
 
-                tpm_dev.iotype = TPM_INF_IO_MEM;
+                tpm_dev.iotype = TPM_INF_IO_MEM;
 
                 tpm_dev.map_base = pnp_mem_start(dev, 0);
                 tpm_dev.map_size = pnp_mem_len(dev, 0);
@@ -563,11 +563,11 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          "product id 0x%02x%02x"
                          "%s\n",
                          tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.config_port :
-                                tpm_dev.map_base + tpm_dev.index_off,
+                         tpm_dev.config_port :
+                         tpm_dev.map_base + tpm_dev.index_off,
                          tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.data_regs :
-                                tpm_dev.map_base + tpm_dev.data_regs,
+                         tpm_dev.data_regs :
+                         tpm_dev.map_base + tpm_dev.data_regs,
                          version[0], version[1],
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
@@ -607,20 +607,55 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
                         iounmap(tpm_dev.mem_base);
                         release_mem_region(tpm_dev.map_base, tpm_dev.map_size);
                 }
+                tpm_dev_vendor_release(chip);
                 tpm_remove_hardware(chip->dev);
         }
 }
 
+static int tpm_inf_pnp_suspend(struct pnp_dev *dev, pm_message_t pm_state)
+{
+        struct tpm_chip *chip = pnp_get_drvdata(dev);
+        int rc;
+        if (chip) {
+                u8 savestate[] = {
+                        0, 193, /* TPM_TAG_RQU_COMMAND */
+                        0, 0, 0, 10,    /* blob length (in bytes) */
+                        0, 0, 0, 152    /* TPM_ORD_SaveState */
+                };
+                dev_info(&dev->dev, "saving TPM state\n");
+                rc = tpm_inf_send(chip, savestate, sizeof(savestate));
+                if (rc < 0) {
+                        dev_err(&dev->dev, "error while saving TPM state\n");
+                        return rc;
+                }
+        }
+        return 0;
+}
+
+static int tpm_inf_pnp_resume(struct pnp_dev *dev)
+{
+        /* Re-configure TPM after suspending */
+        tpm_config_out(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        tpm_config_out(IOLIMH, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs >> 8) & 0xff, TPM_INF_DATA);
+        tpm_config_out(IOLIML, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs & 0xff), TPM_INF_DATA);
+        /* activate register */
+        tpm_config_out(TPM_DAR, TPM_INF_ADDR);
+        tpm_config_out(0x01, TPM_INF_DATA);
+        tpm_config_out(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        /* disable RESET, LP and IRQC */
+        tpm_data_out(RESET_LP_IRQC_DISABLE, CMD);
+        return tpm_pm_resume(&dev->dev);
+}
+
 static struct pnp_driver tpm_inf_pnp_driver = {
         .name = "tpm_inf_pnp",
-        .driver = {
-                .owner = THIS_MODULE,
-                .suspend = tpm_pm_suspend,
-                .resume = tpm_pm_resume,
-        },
-        .id_table = tpm_pnp_tbl,
+        .id_table = tpm_inf_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = __devexit_p(tpm_inf_pnp_remove),
+        .suspend = tpm_inf_pnp_suspend,
+        .resume = tpm_inf_pnp_resume,
+        .remove = __devexit_p(tpm_inf_pnp_remove)
 };
 
 static int __init init_inf(void)
@@ -638,5 +673,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.9");
+MODULE_VERSION("1.9.2");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index f15df40bc318..dcb9083ecde0 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
                         pid = task_pid(current);
                         type = PIDTYPE_PID;
                 }
+                get_pid(pid);
                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
                 retval = __f_setown(filp, pid, type, 0);
+                put_pid(pid);
                 if (retval)
                         goto out;
         } else {
diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index 867b67be9f0a..c7072ba14f48 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -89,13 +89,17 @@ static long uv_mmtimer_ioctl(struct file *file, unsigned int cmd,
         switch (cmd) {
         case MMTIMER_GETOFFSET: /* offset of the counter */
                 /*
-                 * UV RTC register is on its own page
+                 * Starting with HUB rev 2.0, the UV RTC register is
+                 * replicated across all cachelines of it's own page.
+                 * This allows faster simultaneous reads from a given socket.
+                 *
+                 * The offset returned is in 64 bit units.
                  */
-                if (PAGE_SIZE <= (1 << 16))
-                        ret = ((UV_LOCAL_MMR_BASE | UVH_RTC) & (PAGE_SIZE-1))
-                                / 8;
+                if (uv_get_min_hub_revision_id() == 1)
+                        ret = 0;
                 else
-                        ret = -ENOSYS;
+                        ret = ((uv_blade_processor_id() * L1_CACHE_BYTES) %
+                                        PAGE_SIZE) / 8;
                 break;
 
         case MMTIMER_GETRES: /* resolution of the clock in 10^-15 s */
@@ -115,8 +119,8 @@ static long uv_mmtimer_ioctl(struct file *file, unsigned int cmd,
                 ret = hweight64(UVH_RTC_REAL_TIME_CLOCK_MASK);
                 break;
 
-        case MMTIMER_MMAPAVAIL: /* can we mmap the clock into userspace? */
-                ret = (PAGE_SIZE <= (1 << 16)) ? 1 : 0;
+        case MMTIMER_MMAPAVAIL:
+                ret = 1;
                 break;
 
         case MMTIMER_GETCOUNTER: