17 files changed, 149 insertions, 88 deletions

diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 710af89b176d..cd18493c9527 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -12,6 +12,7 @@
 #include <asm/smp.h>
 #include "agp.h"
 #include "intel-agp.h"
+#include <linux/intel-gtt.h>
 
 #include "intel-gtt.c"
 
@@ -805,6 +806,8 @@ static const struct intel_driver_description {
             "G45/G43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
             "B43", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
+            "B43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
             "G41", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
@@ -815,11 +818,19 @@ static const struct intel_driver_description {
             "HD Graphics", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
             "HD Graphics", NULL, &intel_i965_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_IG,
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG,
+            "Sandybridge", NULL, &intel_gen6_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG,
+            "Sandybridge", NULL, &intel_gen6_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG,
+            "Sandybridge", NULL, &intel_gen6_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG,
+            "Sandybridge", NULL, &intel_gen6_driver },
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG,
             "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_IG,
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG,
             "Sandybridge", NULL, &intel_gen6_driver },
-        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_D0_IG,
+        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB, PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG,
             "Sandybridge", NULL, &intel_gen6_driver },
         { 0, 0, NULL, NULL, NULL }
 };
@@ -1044,6 +1055,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
         ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB),
         ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB),
+        ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB),
         { }
 };
 
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index 08d47532e605..d09b1ab7e8ab 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -1,6 +1,8 @@
 /*
  * Common Intel AGPGART and GTT definitions.
  */
+#ifndef _INTEL_AGP_H
+#define _INTEL_AGP_H
 
 /* Intel registers */
 #define INTEL_APSIZE    0xb4
@@ -184,6 +186,8 @@
 #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
 #define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
 #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
+#define PCI_DEVICE_ID_INTEL_B43_1_HB        0x2E90
+#define PCI_DEVICE_ID_INTEL_B43_1_IG        0x2E92
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
 #define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
@@ -200,11 +204,16 @@
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB          0x0062
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB    0x006a
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG           0x0046
-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB  0x0100
-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_IG  0x0102
-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB  0x0104
-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_IG  0x0106
-#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_D0_IG  0x0126
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB              0x0100  /* Desktop */
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG          0x0102
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG          0x0112
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG     0x0122
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB            0x0104  /* Mobile */
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG        0x0106
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG        0x0116
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG   0x0126
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB            0x0108  /* Server */
+#define PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG            0x010A
 
 /* cover 915 and 945 variants */
 #define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
@@ -231,7 +240,8 @@
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
 
 #define IS_SNB (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB)
 
 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
@@ -244,3 +254,5 @@
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB || \
                 IS_SNB)
+
+#endif
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index d22ffb811bf2..75e0a3497888 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -49,6 +49,26 @@ static struct gatt_mask intel_i810_masks[] =
          .type = INTEL_AGP_CACHED_MEMORY}
 };
 
+#define INTEL_AGP_UNCACHED_MEMORY              0
+#define INTEL_AGP_CACHED_MEMORY_LLC            1
+#define INTEL_AGP_CACHED_MEMORY_LLC_GFDT       2
+#define INTEL_AGP_CACHED_MEMORY_LLC_MLC        3
+#define INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT   4
+
+static struct gatt_mask intel_gen6_masks[] =
+{
+        {.mask = I810_PTE_VALID | GEN6_PTE_UNCACHED,
+         .type = INTEL_AGP_UNCACHED_MEMORY },
+        {.mask = I810_PTE_VALID | GEN6_PTE_LLC,
+         .type = INTEL_AGP_CACHED_MEMORY_LLC },
+        {.mask = I810_PTE_VALID | GEN6_PTE_LLC | GEN6_PTE_GFDT,
+         .type = INTEL_AGP_CACHED_MEMORY_LLC_GFDT },
+        {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC,
+         .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC },
+        {.mask = I810_PTE_VALID | GEN6_PTE_LLC_MLC | GEN6_PTE_GFDT,
+         .type = INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT },
+};
+
 static struct _intel_private {
         struct pci_dev *pcidev; /* device one */
         u8 __iomem *registers;
@@ -178,13 +198,6 @@ static void intel_agp_insert_sg_entries(struct agp_memory *mem,
                                         off_t pg_start, int mask_type)
 {
         int i, j;
-        u32 cache_bits = 0;
-
-        if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB ||
-            agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
-        {
-                cache_bits = GEN6_PTE_LLC_MLC;
-        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
@@ -317,6 +330,23 @@ static int intel_i830_type_to_mask_type(struct agp_bridge_data *bridge,
                 return 0;
 }
 
+static int intel_gen6_type_to_mask_type(struct agp_bridge_data *bridge,
+                                        int type)
+{
+        unsigned int type_mask = type & ~AGP_USER_CACHED_MEMORY_GFDT;
+        unsigned int gfdt = type & AGP_USER_CACHED_MEMORY_GFDT;
+
+        if (type_mask == AGP_USER_UNCACHED_MEMORY)
+                return INTEL_AGP_UNCACHED_MEMORY;
+        else if (type_mask == AGP_USER_CACHED_MEMORY_LLC_MLC)
+                return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT :
+                              INTEL_AGP_CACHED_MEMORY_LLC_MLC;
+        else /* set 'normal'/'cached' to LLC by default */
+                return gfdt ? INTEL_AGP_CACHED_MEMORY_LLC_GFDT :
+                              INTEL_AGP_CACHED_MEMORY_LLC;
+}
+
+
 static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
                                 int type)
 {
@@ -588,8 +618,7 @@ static void intel_i830_init_gtt_entries(void)
                         gtt_entries = 0;
                         break;
                 }
-        } else if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB ||
-                   agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB) {
+        } else if (IS_SNB) {
                 /*
                  * SandyBridge has new memory control reg at 0x50.w
                  */
@@ -1068,11 +1097,11 @@ static void intel_i9xx_setup_flush(void)
                 intel_i915_setup_chipset_flush();
         }
 
-        if (intel_private.ifp_resource.start) {
+        if (intel_private.ifp_resource.start)
                 intel_private.i9xx_flush_page = ioremap_nocache(intel_private.ifp_resource.start, PAGE_SIZE);
-                if (!intel_private.i9xx_flush_page)
-                        dev_info(&intel_private.pcidev->dev, "can't ioremap flush page - no chipset flushing");
-        }
+        if (!intel_private.i9xx_flush_page)
+                dev_err(&intel_private.pcidev->dev,
+                        "can't ioremap flush page - no chipset flushing\n");
 }
 
 static int intel_i9xx_configure(void)
@@ -1163,7 +1192,7 @@ static int intel_i915_insert_entries(struct agp_memory *mem, off_t pg_start,
 
         mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
 
-        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
+        if (!IS_SNB && mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
             mask_type != INTEL_AGP_CACHED_MEMORY)
                 goto out_err;
 
@@ -1333,8 +1362,8 @@ static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
 static unsigned long intel_gen6_mask_memory(struct agp_bridge_data *bridge,
                                             dma_addr_t addr, int type)
 {
-        /* Shift high bits down */
-        addr |= (addr >> 28) & 0xff;
+        /* gen6 has bit11-4 for physical addr bit39-32 */
+        addr |= (addr >> 28) & 0xff0;
 
         /* Type checking must be done elsewhere */
         return addr | bridge->driver->masks[type].mask;
@@ -1359,6 +1388,7 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
                 break;
         case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB:
         case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB:
+        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB:
                 *gtt_offset = MB(2);
 
                 pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
@@ -1563,7 +1593,7 @@ static const struct agp_bridge_driver intel_gen6_driver = {
         .fetch_size             = intel_i9xx_fetch_size,
         .cleanup                = intel_i915_cleanup,
         .mask_memory            = intel_gen6_mask_memory,
-        .masks                  = intel_i810_masks,
+        .masks                  = intel_gen6_masks,
         .agp_enable             = intel_i810_agp_enable,
         .cache_flush            = global_cache_flush,
         .create_gatt_table      = intel_i965_create_gatt_table,
@@ -1576,7 +1606,7 @@ static const struct agp_bridge_driver intel_gen6_driver = {
         .agp_alloc_pages        = agp_generic_alloc_pages,
         .agp_destroy_page       = agp_generic_destroy_page,
         .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
+        .agp_type_to_mask_type  = intel_gen6_type_to_mask_type,
         .chipset_flush          = intel_i915_chipset_flush,
 #ifdef USE_PCI_DMA_API
         .agp_map_page           = intel_agp_map_page,
diff --git a/drivers/char/hangcheck-timer.c b/drivers/char/hangcheck-timer.c
index e0249722d25f..f953c96efc86 100644
--- a/drivers/char/hangcheck-timer.c
+++ b/drivers/char/hangcheck-timer.c
@@ -159,7 +159,7 @@ static void hangcheck_fire(unsigned long data)
                 if (hangcheck_dump_tasks) {
                         printk(KERN_CRIT "Hangcheck: Task state:\n");
 #ifdef CONFIG_MAGIC_SYSRQ
-                        handle_sysrq('t', NULL);
+                        handle_sysrq('t');
 #endif  /* CONFIG_MAGIC_SYSRQ */
                 }
                 if (hangcheck_reboot) {
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index fa27d1676ee5..3afd62e856eb 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -651,7 +651,7 @@ int hvc_poll(struct hvc_struct *hp)
                                         if (sysrq_pressed)
                                                 continue;
                                 } else if (sysrq_pressed) {
-                                        handle_sysrq(buf[i], tty);
+                                        handle_sysrq(buf[i]);
                                         sysrq_pressed = 0;
                                         continue;
                                 }
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 1f4b6de65a2d..a2bc885ce60a 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -403,7 +403,7 @@ static void hvsi_insert_chars(struct hvsi_struct *hp, const char *buf, int len)
                         hp->sysrq = 1;
                         continue;
                 } else if (hp->sysrq) {
-                        handle_sysrq(c, hp->tty);
+                        handle_sysrq(c);
                         hp->sysrq = 0;
                         continue;
                 }
diff --git a/drivers/char/hw_random/n2-drv.c b/drivers/char/hw_random/n2-drv.c
index 1acdb2509511..a3f5e381e746 100644
--- a/drivers/char/hw_random/n2-drv.c
+++ b/drivers/char/hw_random/n2-drv.c
@@ -387,7 +387,7 @@ static int n2rng_init_control(struct n2rng *np)
 
 static int n2rng_data_read(struct hwrng *rng, u32 *data)
 {
-        struct n2rng *np = rng->priv;
+        struct n2rng *np = (struct n2rng *) rng->priv;
         unsigned long ra = __pa(&np->test_data);
         int len;
 
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 07f3ea38b582..d4b71e8d0d23 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -1650,7 +1650,7 @@ ip2_close( PTTY tty, struct file *pFile )
         /* disable DSS reporting */
         i2QueueCommands(PTYPE_INLINE, pCh, 100, 4,
                                 CMD_DCD_NREP, CMD_CTS_NREP, CMD_DSR_NREP, CMD_RI_NREP);
-        if ( !tty || (tty->termios->c_cflag & HUPCL) ) {
+        if (tty->termios->c_cflag & HUPCL) {
                 i2QueueCommands(PTYPE_INLINE, pCh, 100, 2, CMD_RTSDN, CMD_DTRDN);
                 pCh->dataSetOut &= ~(I2_DTR | I2_RTS);
                 i2QueueCommands( PTYPE_INLINE, pCh, 100, 1, CMD_PAUSE(25));
@@ -2930,6 +2930,8 @@ ip2_ipl_ioctl (struct file *pFile, UINT cmd, ULONG arg )
                                 if ( pCh )
                                 {
                                         rc = copy_to_user(argp, pCh, sizeof(i2ChanStr));
+                                        if (rc)
+                                                rc = -EFAULT;
                                 } else {
                                         rc = -ENODEV;
                                 }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 3822b4f49c84..7bd7c45b53ef 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -305,6 +305,9 @@ static int num_force_kipmid;
 #ifdef CONFIG_PCI
 static int pci_registered;
 #endif
+#ifdef CONFIG_ACPI
+static int pnp_registered;
+#endif
 #ifdef CONFIG_PPC_OF
 static int of_registered;
 #endif
@@ -2126,7 +2129,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
 {
         struct acpi_device *acpi_dev;
         struct smi_info *info;
-        struct resource *res;
+        struct resource *res, *res_second;
         acpi_handle handle;
         acpi_status status;
         unsigned long long tmp;
@@ -2182,13 +2185,13 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         info->io.addr_data = res->start;
 
         info->io.regspacing = DEFAULT_REGSPACING;
-        res = pnp_get_resource(dev,
+        res_second = pnp_get_resource(dev,
                                (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
                                         IORESOURCE_IO : IORESOURCE_MEM,
                                1);
-        if (res) {
-                if (res->start > info->io.addr_data)
-                        info->io.regspacing = res->start - info->io.addr_data;
+        if (res_second) {
+                if (res_second->start > info->io.addr_data)
+                        info->io.regspacing = res_second->start - info->io.addr_data;
         }
         info->io.regsize = DEFAULT_REGSPACING;
         info->io.regshift = 0;
@@ -3359,6 +3362,7 @@ static __devinit int init_ipmi_si(void)
 
 #ifdef CONFIG_ACPI
         pnp_register_driver(&ipmi_pnp_driver);
+        pnp_registered = 1;
 #endif
 
 #ifdef CONFIG_DMI
@@ -3526,7 +3530,8 @@ static __exit void cleanup_ipmi_si(void)
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
-        pnp_unregister_driver(&ipmi_pnp_driver);
+        if (pnp_registered)
+                pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index a398ecdbd758..1f528fad3516 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -788,10 +788,11 @@ static const struct file_operations zero_fops = {
 /*
  * capabilities for /dev/zero
  * - permits private mappings, "copies" are taken of the source of zeros
+ * - no writeback happens
  */
 static struct backing_dev_info zero_bdi = {
         .name           = "char/mem",
-        .capabilities   = BDI_CAP_MAP_COPY,
+        .capabilities   = BDI_CAP_MAP_COPY | BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 
 static const struct file_operations full_fops = {
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 79c3bc69165a..7c79d243acc9 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -1244,6 +1244,7 @@ static int set_config(struct tty_struct *tty, struct r_port *info,
                 }
                 info->flags = ((info->flags & ~ROCKET_USR_MASK) | (new_serial.flags & ROCKET_USR_MASK));
                 configure_r_port(tty, info, NULL);
+                mutex_unlock(&info->port.mutex);
                 return 0;
         }
 
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index fef80cfcab5c..e63b830c86cc 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -691,8 +691,10 @@ static int open(struct tty_struct *tty, struct file *filp)
         if (info->port.count == 1) {
                 /* 1st open on this device, init hardware */
                 retval = startup(info);
-                if (retval < 0)
+                if (retval < 0) {
+                        mutex_unlock(&info->port.mutex);
                         goto cleanup;
+                }
         }
         mutex_unlock(&info->port.mutex);
         retval = block_til_ready(tty, filp, info);
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 878ac0c2cc68..ef31bb81e843 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -18,7 +18,6 @@
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
-#include <linux/tty.h>
 #include <linux/mount.h>
 #include <linux/kdev_t.h>
 #include <linux/major.h>
@@ -76,7 +75,7 @@ static int __init sysrq_always_enabled_setup(char *str)
 __setup("sysrq_always_enabled", sysrq_always_enabled_setup);
 
 
-static void sysrq_handle_loglevel(int key, struct tty_struct *tty)
+static void sysrq_handle_loglevel(int key)
 {
         int i;
 
@@ -93,7 +92,7 @@ static struct sysrq_key_op sysrq_loglevel_op = {
 };
 
 #ifdef CONFIG_VT
-static void sysrq_handle_SAK(int key, struct tty_struct *tty)
+static void sysrq_handle_SAK(int key)
 {
         struct work_struct *SAK_work = &vc_cons[fg_console].SAK_work;
         schedule_work(SAK_work);
@@ -109,7 +108,7 @@ static struct sysrq_key_op sysrq_SAK_op = {
 #endif
 
 #ifdef CONFIG_VT
-static void sysrq_handle_unraw(int key, struct tty_struct *tty)
+static void sysrq_handle_unraw(int key)
 {
         struct kbd_struct *kbd = &kbd_table[fg_console];
 
@@ -126,7 +125,7 @@ static struct sysrq_key_op sysrq_unraw_op = {
 #define sysrq_unraw_op (*(struct sysrq_key_op *)NULL)
 #endif /* CONFIG_VT */
 
-static void sysrq_handle_crash(int key, struct tty_struct *tty)
+static void sysrq_handle_crash(int key)
 {
         char *killer = NULL;
 
@@ -141,7 +140,7 @@ static struct sysrq_key_op sysrq_crash_op = {
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
 
-static void sysrq_handle_reboot(int key, struct tty_struct *tty)
+static void sysrq_handle_reboot(int key)
 {
         lockdep_off();
         local_irq_enable();
@@ -154,7 +153,7 @@ static struct sysrq_key_op sysrq_reboot_op = {
         .enable_mask    = SYSRQ_ENABLE_BOOT,
 };
 
-static void sysrq_handle_sync(int key, struct tty_struct *tty)
+static void sysrq_handle_sync(int key)
 {
         emergency_sync();
 }
@@ -165,7 +164,7 @@ static struct sysrq_key_op sysrq_sync_op = {
         .enable_mask    = SYSRQ_ENABLE_SYNC,
 };
 
-static void sysrq_handle_show_timers(int key, struct tty_struct *tty)
+static void sysrq_handle_show_timers(int key)
 {
         sysrq_timer_list_show();
 }
@@ -176,7 +175,7 @@ static struct sysrq_key_op sysrq_show_timers_op = {
         .action_msg     = "Show clockevent devices & pending hrtimers (no others)",
 };
 
-static void sysrq_handle_mountro(int key, struct tty_struct *tty)
+static void sysrq_handle_mountro(int key)
 {
         emergency_remount();
 }
@@ -188,7 +187,7 @@ static struct sysrq_key_op sysrq_mountro_op = {
 };
 
 #ifdef CONFIG_LOCKDEP
-static void sysrq_handle_showlocks(int key, struct tty_struct *tty)
+static void sysrq_handle_showlocks(int key)
 {
         debug_show_all_locks();
 }
@@ -226,7 +225,7 @@ static void sysrq_showregs_othercpus(struct work_struct *dummy)
 
 static DECLARE_WORK(sysrq_showallcpus, sysrq_showregs_othercpus);
 
-static void sysrq_handle_showallcpus(int key, struct tty_struct *tty)
+static void sysrq_handle_showallcpus(int key)
 {
         /*
          * Fall back to the workqueue based printing if the
@@ -252,7 +251,7 @@ static struct sysrq_key_op sysrq_showallcpus_op = {
 };
 #endif
 
-static void sysrq_handle_showregs(int key, struct tty_struct *tty)
+static void sysrq_handle_showregs(int key)
 {
         struct pt_regs *regs = get_irq_regs();
         if (regs)
@@ -266,7 +265,7 @@ static struct sysrq_key_op sysrq_showregs_op = {
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
 
-static void sysrq_handle_showstate(int key, struct tty_struct *tty)
+static void sysrq_handle_showstate(int key)
 {
         show_state();
 }
@@ -277,7 +276,7 @@ static struct sysrq_key_op sysrq_showstate_op = {
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
 
-static void sysrq_handle_showstate_blocked(int key, struct tty_struct *tty)
+static void sysrq_handle_showstate_blocked(int key)
 {
         show_state_filter(TASK_UNINTERRUPTIBLE);
 }
@@ -291,7 +290,7 @@ static struct sysrq_key_op sysrq_showstate_blocked_op = {
 #ifdef CONFIG_TRACING
 #include <linux/ftrace.h>
 
-static void sysrq_ftrace_dump(int key, struct tty_struct *tty)
+static void sysrq_ftrace_dump(int key)
 {
         ftrace_dump(DUMP_ALL);
 }
@@ -305,7 +304,7 @@ static struct sysrq_key_op sysrq_ftrace_dump_op = {
 #define sysrq_ftrace_dump_op (*(struct sysrq_key_op *)NULL)
 #endif
 
-static void sysrq_handle_showmem(int key, struct tty_struct *tty)
+static void sysrq_handle_showmem(int key)
 {
         show_mem();
 }
@@ -330,7 +329,7 @@ static void send_sig_all(int sig)
         }
 }
 
-static void sysrq_handle_term(int key, struct tty_struct *tty)
+static void sysrq_handle_term(int key)
 {
         send_sig_all(SIGTERM);
         console_loglevel = 8;
@@ -349,7 +348,7 @@ static void moom_callback(struct work_struct *ignored)
 
 static DECLARE_WORK(moom_work, moom_callback);
 
-static void sysrq_handle_moom(int key, struct tty_struct *tty)
+static void sysrq_handle_moom(int key)
 {
         schedule_work(&moom_work);
 }
@@ -361,7 +360,7 @@ static struct sysrq_key_op sysrq_moom_op = {
 };
 
 #ifdef CONFIG_BLOCK
-static void sysrq_handle_thaw(int key, struct tty_struct *tty)
+static void sysrq_handle_thaw(int key)
 {
         emergency_thaw_all();
 }
@@ -373,7 +372,7 @@ static struct sysrq_key_op sysrq_thaw_op = {
 };
 #endif
 
-static void sysrq_handle_kill(int key, struct tty_struct *tty)
+static void sysrq_handle_kill(int key)
 {
         send_sig_all(SIGKILL);
         console_loglevel = 8;
@@ -385,7 +384,7 @@ static struct sysrq_key_op sysrq_kill_op = {
         .enable_mask    = SYSRQ_ENABLE_SIGNAL,
 };
 
-static void sysrq_handle_unrt(int key, struct tty_struct *tty)
+static void sysrq_handle_unrt(int key)
 {
         normalize_rt_tasks();
 }
@@ -493,7 +492,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p)
                 sysrq_key_table[i] = op_p;
 }
 
-void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
+void __handle_sysrq(int key, bool check_mask)
 {
         struct sysrq_key_op *op_p;
         int orig_log_level;
@@ -520,7 +519,7 @@ void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
                 if (!check_mask || sysrq_on_mask(op_p->enable_mask)) {
                         printk("%s\n", op_p->action_msg);
                         console_loglevel = orig_log_level;
-                        op_p->handler(key, tty);
+                        op_p->handler(key);
                 } else {
                         printk("This sysrq operation is disabled.\n");
                 }
@@ -545,10 +544,10 @@ void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
         spin_unlock_irqrestore(&sysrq_key_table_lock, flags);
 }
 
-void handle_sysrq(int key, struct tty_struct *tty)
+void handle_sysrq(int key)
 {
         if (sysrq_on())
-                __handle_sysrq(key, tty, 1);
+                __handle_sysrq(key, true);
 }
 EXPORT_SYMBOL(handle_sysrq);
 
@@ -597,7 +596,7 @@ static bool sysrq_filter(struct input_handle *handle, unsigned int type,
 
         default:
                 if (sysrq_down && value && value != 2)
-                        __handle_sysrq(sysrq_xlate[code], NULL, 1);
+                        __handle_sysrq(sysrq_xlate[code], true);
                 break;
         }
 
@@ -765,7 +764,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
 
                 if (get_user(c, buf))
                         return -EFAULT;
-                __handle_sysrq(c, NULL, 0);
+                __handle_sysrq(c, false);
         }
 
         return count;
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 949067a0bd47..613c852ee0fe 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -355,7 +355,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
                 if (*stp == '\0')
                         stp = NULL;
 
-                if (tty_line >= 0 && tty_line <= p->num && p->ops &&
+                if (tty_line >= 0 && tty_line < p->num && p->ops &&
                     p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
                         res = tty_driver_kref_get(p);
                         *line = tty_line;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 942a9826bd23..c810481a5bc2 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
         ssize_t ret;
         bool nonblock;
 
+        /* Userspace could be out to fool us */
+        if (!count)
+                return 0;
+
         port = filp->private_data;
 
         nonblock = filp->f_flags & O_NONBLOCK;
@@ -642,7 +646,7 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
         poll_wait(filp, &port->waitqueue, wait);
 
         ret = 0;
-        if (port->inbuf)
+        if (!will_read_block(port))
                 ret |= POLLIN | POLLRDNORM;
         if (!will_write_block(port))
                 ret |= POLLOUT;
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 50590c7f2c01..281aada7b4a1 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -906,22 +906,16 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
                          * bottom of buffer
                          */
                         old_origin += (old_rows - new_rows) * old_row_size;
-                        end = vc->vc_scr_end;
                 } else {
                         /*
                          * Cursor is in no man's land, copy 1/2 screenful
                          * from the top and bottom of cursor position
                          */
                         old_origin += (vc->vc_y - new_rows/2) * old_row_size;
-                        end = old_origin + (old_row_size * new_rows);
                 }
-        } else
-                /*
-                 * Cursor near the top, copy contents from the top of buffer
-                 */
-                end = (old_rows > new_rows) ? old_origin +
-                        (old_row_size * new_rows) :
-                        vc->vc_scr_end;
+        }
+
+        end = old_origin + old_row_size * min(old_rows, new_rows);
 
         update_attr(vc);
 
@@ -3075,8 +3069,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
 
                 old_was_color = vc->vc_can_do_color;
                 vc->vc_sw->con_deinit(vc);
-                if (!vc->vc_origin)
-                        vc->vc_origin = (unsigned long)vc->vc_screenbuf;
+                vc->vc_origin = (unsigned long)vc->vc_screenbuf;
                 visual_init(vc, i, 0);
                 set_origin(vc);
                 update_attr(vc);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 2bbeaaea46e9..38df8c19e74c 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -533,11 +533,14 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;
-                /* FIXME: This is an old broken API but we need to keep it
-                   supported and somehow separate the historic advertised
-                   tick rate from any real one */
+                /*
+                 * The use of PIT_TICK_RATE is historic, it used to be
+                 * the platform-dependent CLOCK_TICK_RATE between 2.6.12
+                 * and 2.6.36, which was a minor but unfortunate ABI
+                 * change.
+                 */
                 if (arg)
-                        arg = CLOCK_TICK_RATE / arg;
+                        arg = PIT_TICK_RATE / arg;
                 kd_mksound(arg, 0);
                 break;
 
@@ -553,11 +556,8 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                  */
                 ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
                 count = ticks ? (arg & 0xffff) : 0;
-                /* FIXME: This is an old broken API but we need to keep it
-                   supported and somehow separate the historic advertised
-                   tick rate from any real one */
                 if (count)
-                        count = CLOCK_TICK_RATE / count;
+                        count = PIT_TICK_RATE / count;
                 kd_mksound(count, ticks);
                 break;
         }