12 files changed, 70 insertions, 42 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 700ff9679457..122254155ae1 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -1043,15 +1043,6 @@ config HPET
           open selects one of the timers supported by the HPET.  The timers are
           non-periodic and/or periodic.
 
-config HPET_RTC_IRQ
-        bool
-        default HPET_EMULATE_RTC
-        depends on RTC && HPET
-        help
-          If you say Y here, you will disable RTC_IRQ in drivers/char/rtc.c. It
-          is assumed the platform called hpet_alloc with the RTC IRQ values for
-          the HPET timers.
-
 config HPET_MMAP
         bool "Allow mmap of HPET"
         default y
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index b899d9182c7d..05674febb0c6 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -478,7 +478,7 @@ static int do_ac_read(int IndexCard, char __user *buf,
                 struct st_ram_io *st_loc, struct mailbox *mailbox)
 {
         void __iomem *from = apbs[IndexCard].RamIO + RAM_TO_PC;
-        unsigned char *to = (unsigned char *)&mailbox;
+        unsigned char *to = (unsigned char *)mailbox;
 #ifdef DEBUG
         int c;
 #endif
diff --git a/drivers/char/ds1286.c b/drivers/char/ds1286.c
index fb584938c9c3..5329d482b582 100644
--- a/drivers/char/ds1286.c
+++ b/drivers/char/ds1286.c
@@ -443,7 +443,6 @@ static void ds1286_get_time(struct rtc_time *rtc_tm)
 {
         unsigned char save_control;
         unsigned long flags;
-        unsigned long uip_watchdog = jiffies;
 
         /*
          * read RTC once any update in progress is done. The update
@@ -456,8 +455,7 @@ static void ds1286_get_time(struct rtc_time *rtc_tm)
          */
 
         if (ds1286_is_updating() != 0)
-                while (time_before(jiffies, uip_watchdog + 2*HZ/100))
-                        barrier();
+                msleep(20);
 
         /*
          * Only the values that we read from the RTC are set. We leave
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index ec7aded0a2df..bf70450a49cc 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -367,13 +367,13 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
         spin_lock_irqsave(&hp->lock, flags);
 
         if (--hp->count == 0) {
-                if (hp->ops->notifier_del)
-                        hp->ops->notifier_del(hp, hp->data);
-
                 /* We are done with the tty pointer now. */
                 hp->tty = NULL;
                 spin_unlock_irqrestore(&hp->lock, flags);
 
+                if (hp->ops->notifier_del)
+                        hp->ops->notifier_del(hp, hp->data);
+
                 /*
                  * Chain calls chars_in_buffer() and returns immediately if
                  * there is no buffered data otherwise sleeps on a wait queue
@@ -416,11 +416,11 @@ static void hvc_hangup(struct tty_struct *tty)
         hp->n_outbuf = 0;
         hp->tty = NULL;
 
+        spin_unlock_irqrestore(&hp->lock, flags);
+
         if (hp->ops->notifier_del)
                         hp->ops->notifier_del(hp, hp->data);
 
-        spin_unlock_irqrestore(&hp->lock, flags);
-
         while(temp_open_count) {
                 --temp_open_count;
                 kref_put(&hp->kref, destroy_hvc_struct);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 8e8afb6141f9..3123bf57ad91 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2695,7 +2695,7 @@ static __devinit void default_find_bmc(void)
         for (i = 0; ; i++) {
                 if (!ipmi_defaults[i].port)
                         break;
-#ifdef CONFIG_PPC_MERGE
+#ifdef CONFIG_PPC
                 if (check_legacy_ioport(ipmi_defaults[i].port))
                         continue;
 #endif
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 5df4003ad873..12d327a2c9ba 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -513,7 +513,7 @@ static int moxa_real_load_code(struct moxa_board_conf *brd, const void *ptr,
                 size_t len)
 {
         void __iomem *baseAddr = brd->basemem;
-        const u16 *uptr = ptr;
+        const __le16 *uptr = ptr;
         size_t wlen, len2, j;
         unsigned long key, loadbuf, loadlen, checksum, checksum_ok;
         unsigned int i, retry;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 6af435b89867..c8752eaad483 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1205,7 +1205,7 @@ static int proc_do_uuid(ctl_table *table, int write, struct file *filp,
         return proc_dostring(&fake_table, write, filp, buffer, lenp, ppos);
 }
 
-static int uuid_strategy(ctl_table *table, int __user *name, int nlen,
+static int uuid_strategy(ctl_table *table,
                          void __user *oldval, size_t __user *oldlenp,
                          void __user *newval, size_t newlen)
 {
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index b47710c17885..17683de95717 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -96,7 +96,7 @@ static unsigned long rtc_port;
 static int rtc_irq;
 #endif
 
-#ifdef  CONFIG_HPET_RTC_IRQ
+#ifdef  CONFIG_HPET_EMULATE_RTC
 #undef  RTC_IRQ
 #endif
 
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 8fdfe9c871e3..dce4cc0e6953 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -23,6 +23,7 @@
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
 #include <linux/kbd_kern.h>
+#include <linux/proc_fs.h>
 #include <linux/quotaops.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -326,6 +327,7 @@ static struct sysrq_key_op sysrq_moom_op = {
         .handler        = sysrq_handle_moom,
         .help_msg       = "Full",
         .action_msg     = "Manual OOM execution",
+        .enable_mask    = SYSRQ_ENABLE_SIGNAL,
 };
 
 static void sysrq_handle_kill(int key, struct tty_struct *tty)
@@ -533,3 +535,32 @@ int unregister_sysrq_key(int key, struct sysrq_key_op *op_p)
         return __sysrq_swap_key_ops(key, NULL, op_p);
 }
 EXPORT_SYMBOL(unregister_sysrq_key);
+
+#ifdef CONFIG_PROC_FS
+/*
+ * writing 'C' to /proc/sysrq-trigger is like sysrq-C
+ */
+static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        if (count) {
+                char c;
+
+                if (get_user(c, buf))
+                        return -EFAULT;
+                __handle_sysrq(c, NULL, 0);
+        }
+        return count;
+}
+
+static const struct file_operations proc_sysrq_trigger_operations = {
+        .write          = write_sysrq_trigger,
+};
+
+static int __init sysrq_init(void)
+{
+        proc_create("sysrq-trigger", S_IWUSR, NULL, &proc_sysrq_trigger_operations);
+        return 0;
+}
+module_init(sysrq_init);
+#endif
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 1fee7034a386..e70d13defde4 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -525,19 +525,19 @@ void tpm_get_timeouts(struct tpm_chip *chip)
         timeout =
             be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
         if (timeout)
-                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+                chip->vendor.timeout_a = usecs_to_jiffies(timeout);
         timeout =
             be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
         if (timeout)
-                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+                chip->vendor.timeout_b = usecs_to_jiffies(timeout);
         timeout =
             be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
         if (timeout)
-                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+                chip->vendor.timeout_c = usecs_to_jiffies(timeout);
         timeout =
             be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
         if (timeout)
-                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+                chip->vendor.timeout_d = usecs_to_jiffies(timeout);
 
 duration:
         memcpy(data, tpm_cap, sizeof(tpm_cap));
@@ -554,15 +554,22 @@ duration:
                 return;
 
         chip->vendor.duration[TPM_SHORT] =
-            msecs_to_jiffies(be32_to_cpu
+            usecs_to_jiffies(be32_to_cpu
                              (*((__be32 *) (data +
                                             TPM_GET_CAP_RET_UINT32_1_IDX))));
+        /* The Broadcom BCM0102 chipset in a Dell Latitude D820 gets the above
+         * value wrong and apparently reports msecs rather than usecs. So we
+         * fix up the resulting too-small TPM_SHORT value to make things work.
+         */
+        if (chip->vendor.duration[TPM_SHORT] < (HZ/100))
+                chip->vendor.duration[TPM_SHORT] = HZ;
+
         chip->vendor.duration[TPM_MEDIUM] =
-            msecs_to_jiffies(be32_to_cpu
+            usecs_to_jiffies(be32_to_cpu
                              (*((__be32 *) (data +
                                             TPM_GET_CAP_RET_UINT32_2_IDX))));
         chip->vendor.duration[TPM_LONG] =
-            msecs_to_jiffies(be32_to_cpu
+            usecs_to_jiffies(be32_to_cpu
                              (*((__be32 *) (data +
                                             TPM_GET_CAP_RET_UINT32_3_IDX))));
 }
@@ -1180,11 +1187,8 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
 
-        if (chip == NULL || devname == NULL) {
-                kfree(chip);
-                kfree(devname);
-                return NULL;
-        }
+        if (chip == NULL || devname == NULL)
+                goto out_free;
 
         mutex_init(&chip->buffer_mutex);
         mutex_init(&chip->tpm_mutex);
@@ -1201,8 +1205,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
 
         if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
-                kfree(chip);
-                return NULL;
+                goto out_free;
         } else if (chip->dev_num == 0)
                 chip->vendor.miscdev.minor = TPM_MINOR;
         else
@@ -1243,6 +1246,11 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
         spin_unlock(&driver_lock);
 
         return chip;
+
+out_free:
+        kfree(chip);
+        kfree(devname);
+        return NULL;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 7053d6333692..3f48d88cffc0 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -3032,11 +3032,12 @@ EXPORT_SYMBOL(tty_devnum);
 
 void proc_clear_tty(struct task_struct *p)
 {
+        unsigned long flags;
         struct tty_struct *tty;
-        spin_lock_irq(&p->sighand->siglock);
+        spin_lock_irqsave(&p->sighand->siglock, flags);
         tty = p->signal->tty;
         p->signal->tty = NULL;
-        spin_unlock_irq(&p->sighand->siglock);
+        spin_unlock_irqrestore(&p->sighand->siglock, flags);
         tty_kref_put(tty);
 }
 
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 57029fefd64a..d8f83e26e4a4 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -59,7 +59,7 @@
  * by Martin Mares <mj@atrey.karlin.mff.cuni.cz>, July 1998
  *
  * Removed old-style timers, introduced console_timer, made timer
- * deletion SMP-safe.  17Jun00, Andrew Morton <andrewm@uow.edu.au>
+ * deletion SMP-safe.  17Jun00, Andrew Morton
  *
  * Removed console_lock, enabled interrupts across all console operations
  * 13 March 2001, Andrew Morton
@@ -301,7 +301,7 @@ static void scrup(struct vc_data *vc, unsigned int t, unsigned int b, int nr)
         d = (unsigned short *)(vc->vc_origin + vc->vc_size_row * t);
         s = (unsigned short *)(vc->vc_origin + vc->vc_size_row * (t + nr));
         scr_memmovew(d, s, (b - t - nr) * vc->vc_size_row);
-        scr_memsetw(d + (b - t - nr) * vc->vc_cols, vc->vc_scrl_erase_char,
+        scr_memsetw(d + (b - t - nr) * vc->vc_cols, vc->vc_video_erase_char,
                     vc->vc_size_row * nr);
 }
 
@@ -319,7 +319,7 @@ static void scrdown(struct vc_data *vc, unsigned int t, unsigned int b, int nr)
         s = (unsigned short *)(vc->vc_origin + vc->vc_size_row * t);
         step = vc->vc_cols * nr;
         scr_memmovew(s + step, s, (b - t - nr) * vc->vc_size_row);
-        scr_memsetw(s, vc->vc_scrl_erase_char, 2 * step);
+        scr_memsetw(s, vc->vc_video_erase_char, 2 * step);
 }
 
 static void do_update_region(struct vc_data *vc, unsigned long start, int count)
@@ -434,7 +434,6 @@ static void update_attr(struct vc_data *vc)
                       vc->vc_blink, vc->vc_underline,
                       vc->vc_reverse ^ vc->vc_decscnm, vc->vc_italic);
         vc->vc_video_erase_char = (build_attr(vc, vc->vc_color, 1, vc->vc_blink, 0, vc->vc_decscnm, 0) << 8) | ' ';
-        vc->vc_scrl_erase_char = (build_attr(vc, vc->vc_def_color, 1, false, false, vc->vc_decscnm, false) << 8) | ' ';
 }
 
 /* Note: inverting the screen twice should revert to the original state */