76 files changed, 412 insertions, 981 deletions
diff --git a/drivers/char/ChangeLog b/drivers/char/ChangeLog
deleted file mode 100644
index 56b8a2e76ab1..000000000000
--- a/drivers/char/ChangeLog
+++ /dev/null
@@ -1,775 +0,0 @@
-2001-08-11  Tim Waugh  <twaugh@redhat.com>
-        * serial.c (get_pci_port): Deal with awkward Titan cards.
-1998-08-26  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (rs_open): Correctly decrement the module in-use count
-                on errors.
-Thu Feb 19 14:24:08 1998  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * tty_io.c (tty_name): Remove the non-reentrant (and non-SMP safe)
-                version of tty_name, and rename the reentrant _tty_name
-                function to be tty_name.
-                (tty_open): Add a warning message stating callout devices
-                are deprecated.
-Mon Dec  1 08:24:15 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * tty_io.c (tty_get_baud_rate): Print a warning syslog if the
-                tty->alt_speed kludge is used; this means the system is
-                using the deprecated SPD_HI ioctls.
-Mon Nov 24 10:37:49 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c, esp.c, rocket.c: Change drivers to take advantage of
-                tty_get_baud_rate().
-        
-        * tty_io.c (tty_get_baud_rate): New function which computes the
-                correct baud rate for the tty.  More factoring out of
-                common code out of the serial driver to the high-level tty
-                functions....
-Sat Nov 22 07:53:36 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c, esp.c, rocket.c: Add tty->driver.break() routine, and
-                allow high-level tty code to handle the break and soft
-                carrier ioctls.
-        
-        * tty_ioctl.c (n_tty_ioctl): Support TIOCGSOFTCAR and
-                TIOCSSOFTCAR, so that device drivers don't have to support
-                it.
-        * serial.c (autoconfig): Change 16750 test to hopefully eliminate
-                false results by people with strange 16550As being
-                detected as 16750s.  Hopefully 16750s will still be
-                detected as 16750, and other weird UARTs won't get poorly
-                autodetected.  If this doesn't work, I'll have to disable
-                the auto identification for the 16750.
-        * tty_io.c (tty_hangup): Now actually do the tty hangup
-                processing during the timer processing, and disable
-                interrupts while doing the hangup processing.  This avoids
-                several nasty race conditions which happened when the
-                hangup processing was done asynchronously.
-                (tty_ioctl): Do break handling in the tty driver if
-                driver's break function is supported.  
-                (tty_flip_buffer_push): New exported function which should
-                be used by drivers to push characters in the flip buffer
-                to the tty handler.  This may either be done using a task
-                queue function for better CPU efficiency, or directly for
-                low latency operation.
-        * serial.c (rs_set_termios): Fix bug rs_set_termios when
-                transitioning away from B0, submitted by Stanislav
-                Voronyi. 
-Thu Jun 19 20:05:58 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (begin_break, end_break, rs_ioctl): Applied patch
-                to support BSD ioctls to set and clear the break
-                condition explicitly.
-        * console.c (scrup, scrdown, insert_line, delete_line): Applied
-                fix suggested by Aaron Tiensivu to speed up block scrolls
-                up and down.
-        * n_tty.c (opost_block, write_chan): Added a modified "fast
-                console" patch which processes a block of text via
-                "cooking" efficiently.
-Wed Jun 18 15:25:50 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * tty_io.c (init_dev, release_dev): Applied fix suggested by Bill
-                Hawes to prevent race conditions in the tty code.
-        * n_tty.c (n_tty_chars_in_buffer): Applied fix suggested by Bill
-                Hawes so that n_tty_chars_in_buffer returns the correct
-                value in the case when the tty is in cannonical mode.  (To
-                avoid a pty deadlock with telnetd.)
-Thu Feb 27 01:53:08 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (change_speed): Add support for the termios flag
-                CMSPAR, which allows the user to select stick parity.
-                (i.e, if PARODD is set, the parity bit is always 1; if
-                PARRODD is not set, then the parity bit is always 0).
-Wed Feb 26 19:03:10 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (cleanup_module): Fix memory leak when using the serial
-                driver as a module; make sure tmp_buf gets freed!
-Tue Feb 25 11:01:59 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (set_modem_info): Add support for setting and clearing
-                the OUT1 and OUT2 bits.  (For special case UART's, usually
-                for half-duplex.)
-                (autoconfig, change_speed): Fix TI 16750 support.
-Sun Feb 16 00:14:43 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * tty_io.c (release_dev): Add sanity check to make sure there are
-                no waiters on tty->read_wait or tty->write_wait.
-        * serial.c (rs_init): Don't autoconfig a device if the I/O region
-                is already reserved.
-        * serial.c (serial_proc_info): Add support for /proc/serial.
-Thu Feb 13 00:49:10 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (receive_chars): When the UART repotrs an overrun
-                condition, it does so with a valid character.  Changed to
-                not throw away the valid character, but instead report the
-                overrun after the valid character.
-        * serial.c: Added new #ifdef's for some of the advanced serial
-                driver features.  A minimal driver that only supports COM
-                1/2/3/4 without sharing serial interrupts only takes 17k;
-                the full driver takes 32k.
-                
-Wed Feb 12 14:50:44 1997  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * vt.c:
-        * pty.c: 
-        * tty_ioctl.c: 
-        * serial.c: Update routines to use the new 2.1 memory access
-                routines.
-Wed Dec  4 07:51:52 1996  Theodore Ts'o  <tytso@localhost.mit.edu>
-        * serial.c (change_speed): Use save_flags(); cli() and
-                restore_flags() in order to ensure we don't accidentally
-                turn on interrupts when starting up the port.
-                (startup): Move the insertion of serial structure into the
-                IRQ chain earlier into the startup processing.  Interrupts
-                should be off this whole time, but we eventually will want
-                to reduce this window.
-Thu Nov 21 10:05:22 1996  Theodore Ts'o  <tytso@localhost.mit.edu>
-        * tty_ioctl.c (tty_wait_until_sent): Always check the driver
-                wait_until_ready routine, even if there are no characters
-                in the xmit buffer.  (There may be charactes in the device
-                FIFO.)
-                (n_tty_ioctl): Add new flag tty->flow_stopped which
-                indicates whether the tty is stopped due to a request by
-                the TCXONC ioctl (used by tcflow).  If so, don't let an
-                incoming XOFF character restart the tty.  The tty can only
-                be restarted by another TCXONC request.
-        * tty_io.c (start_tty): Don't allow the tty to be restarted if
-                tty->flow_stopped is true.
-        * n_tty.c (n_tty_receive_char): If tty->flow_stopped is true, and
-                IXANY is set, don't eat a character trying to restart the
-                tty.
-        * serial.c (startup): Remove need for MCR_noint from the
-                async_struct structure.  Only turn on DTR and RTS if the
-                baud rate is not zero.
-                (change_speed): More accurately calculate the timeout
-                value based on the word size.  Move responsibility of
-                hangup when speed becomes B0 to rs_set_termios()
-                (set_serial_info): When changing the UART type set the
-                current xmit_fifo_size as well as the permanent
-                xmit_fifo_size.
-                (rs_ioctl): Fix TCSBRK (used by tcdrain) and TCSBRKP
-                ioctls to return EINTR if interrupted by a signal.
-                (rs_set_termios): If the baud rate changes to or from B0,
-                this function is now responsible for setting or clearing
-                DTR and RTS.  DTR and RTS are only be changed on the
-                transition to or from the B0 state.
-                (rs_close): Wait for the characters to drain based on
-                info->timeout.  At low baud rates (50 bps), it may take a
-                long time for the FIFO to completely drain out!
-                (rs_wait_until_sent): Fixed timeout handling.  Now
-                releases control to the scheduler, but checks frequently
-                enough so that the function is sensitive enough to pass
-                the timing requirements of the NIST-PCTS.
-                (block_til_ready): When opening the device, don't turn on
-                DTR and RTS if the baud rate is B0.
-Thu Nov 14 00:06:09 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c (autoconfig): Fix autoconfiguration problems;
-                info->flags wasn't getting initialized from the state
-                structure.  Put in more paranoid test for the 16750.
-Fri Nov  8 20:19:50 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * n_tty.c (n_tty_flush_buffer): Only call driver->unthrottle() if
-                the tty was previous throttled.
-                (n_tty_set_termios, write_chan): Add changes suggested by
-                        Simon P. Allen to allow hardware cooking.
-        * tty_ioctl.c (set_termios): If we get a signal while waiting for
-                the tty to drain, return -EINTR.
-        
-        * serial.c (change_speed): Add support for CREAD, as required by
-                POSIX.
-Sat Nov  2 20:43:10 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * serial.c: Wholesale changes.  Added support for the Startech
-                16650 and 16650V2 chips.  (WARNING: the new startech
-                16650A may or may not work!)  Added support for the
-                TI16750 (not yet tested).  Split async_struct into a
-                transient part (async_struct) and a permanent part
-                (serial_state) which contains the configuration
-                information for the ports.  Added new driver routines
-                wait_until_sent() and send_xchar() to help with POSIX
-                compliance.  Added support for radio clocks which waggle
-                the carrier detect line (CONFIG_HARD_PPS).
-        
-        * tty_ioctl.c (tty_wait_until_sent): Added call to new driver
-                function tty->driver.wait_until_sent(), which returns when
-                the tty's device xmit buffers are drained.  Needed for
-                full POSIX compliance.
-                (send_prio_char): New function, called by the ioctl's
-                TCIOFF and TCION; uses the new driver call send_xchar(),
-                which will send the XON or XOFF character at high priority
-                (and even if tty output is stopped).
-Wed Jun  5 18:52:04 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * pty.c (pty_close): When closing a pty, make sure packet mode is
-                cleared.
-Sun May 26 09:33:52 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * vesa_blank.c (set_vesa_blanking): Add missing verify_area() call.
-        * selection.c (set_selection): Add missing verify_area() call.
-        * tty_io.c (tty_ioctl): Add missing verify_area() calls.
-        * serial.c (rs_ioctl): Add missing verify_area() calls.
-                (rs_init): Allow initialization of serial driver
-                configuration from a module.
-        * random.c (extract_entropy): Add missing verify_area call.
-                Don't limit number of characters returned to
-                32,768. Extract entropy is now no longer a inlined
-                function.
-                (random_read): Check return value in case extract_entropy
-                returns an error.
-                (secure_tcp_sequence_number): New function which returns a
-                secure TCP sequence number.  This is needed to prevent some
-                nasty TCP hijacking attacks.
-        
-                (init_std_data): Initialize using gettimeofday() instead of
-                struct timeval xtime.
-                (fast_add_entropy_word, add_entropy_word): Rename the
-                inline function add_entropy_word() to
-                fast_add_entropy_word().  Make add_entropy_word() be the
-                non-inlined function which is used in non-timing critical
-                places, in order to save space.
-                (initialize_benchmark, begin_benchmark, end_benchmark): New
-                functions defined when RANDOM_BENCHMARK is defined.  They
-                allow us to benchmark the speed of the
-                add_timer_randomness() call.
-                (int_ln, rotate_left): Add two new inline functions with
-                i386 optimized asm instructions.  This speeds up the
-                critical add_entropy_word() and add_timer_randomness()
-                functions, which are called from interrupt handlers.
-Tue May  7 22:51:11 1996    <tytso@rsts-11.mit.edu>
-        * random.c (add_timer_randomness): Limit the amount randomness
-                that we estimate to 12 bits.  (An arbitrary amount).
-                (extract_entropy): To make it harder to analyze the hash
-                function, fold the hash function in half using XOR, and
-                use the folded result as the value to emit to the user.
-                Also, add timer randomness each pass through the
-                exact_entropy call, to increase the amount of unknown
-                values during the extraction process.
-                (random_ioctl): Use IOR/IOW definitions to define the
-                ioctl values used by the /dev/random driver.  Allow the
-                old ioctl values to be used for backwards compatibility
-                (for a limited amount of time).
-Wed Apr 24 14:02:04 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
-        * random.c (add_timer_randomness): Use 2nd derivative as well to
-                better estimate entropy.
-                (rand_initialize): Explicitly initialize all the pointers
-                to NULL.  (Clearing pointers using memset isn't portable.)
-                Initialize the random pool with OS-dependent data.
-                (random_write): Add sanity checking to the arguments to
-                random_write(), so that bad arguments won't cause a kernel
-                SEGV. 
-                (random_read): Update the access time of the device inode
-                when you return data to the user.
-                (random_ioctl): Wake up the random_wait channel when there
-                are only WAIT_INPUT_BITS available.  Add more paranoia
-                checks to make sure entropy_count doesn't go beyond the
-                bounds of (0, POOLSIZE).  Add a few missing verify_area
-                checks.  Add support for the RNDCLEARPOOL ioctl, which
-                zaps the random pool.
-                (add_timer_randomness): Wake up the random_wait
-                channel only when there are WAIT_INPUT_BITS available.
-                (random_select): Allow a random refresh daemon process to
-                select on /dev/random for writing; wake up the daemon when
-                there are less than WAIT_OUTPUT_BITS bits of randomness
-                available.
-Tue Apr 23 22:56:07 1996    <tytso@rsts-11.mit.edu>
-        * tty_io.c (init_dev): Change return code when user attempts to
-                open master pty which is already open from EAGAIN to EIO,
-                to match with BSD expectations.  EIO is more correct
-                anyway, since EAGAIN implies that retrying will be
-                successful --- which it might be.... Eventually!!
-        * pty.c (pty_open, pty_close): Fix wait loop so that we don't
-                busy loop while waiting for the master side to open.
-                Fix tty opening/closing logic.  TTY_SLAVE_CLOSED was
-                renamed to TTY_OTHER_CLOSED, so that the name is more
-                descriptive.  Also fixed code so that the tty flag
-                actually works correctly now....
-Mon Apr  1 10:22:01 1996    <tytso@rsts-11.mit.edu>
-        * serial.c (rs_close): Cleaned up modularization changes.
-                Remove code which forced line discipline back to N_TTY
-                this is done in the tty upper layers, and there's no
-                reason to do it here.  (Making this change also
-                removed the requirement that the serial module access
-                the internal kernel symbol "ldiscs".)
-        * tty_io.c (tty_init): Formally register a tty_driver entry for
-                /dev/tty (device 4, 0) and /dev/console (device 5, 0).
-                This guarantees that major device numbers 4 and 5 will be
-                reserved for the tty subsystem (as they have to be because
-                of /dev/tty and /dev/console).  Removed tty_regdev, as
-                this interface is no longer necessary.
-Sun Mar 17 20:42:47 GMT 1996 <ah@doc.ic.ac.uk>
-        * serial.c : modularisation (changes in linux/fs/device.c allow
-                kerneld to automatically load the serial module).
-        * Makefile, Config.in : serial modularisation adds.
-        * tty_io.c : tty_init_ctty used by to register "cua" driver just
-                for the /dev/tty device (5,0).  Added tty_regdev.
-        
-        * serial.c (shutdown, rs_ioctl) : when port shuts down wakeup processes
-          waiting on delta_msr_wait. The TIOCMIWAIT ioctl returns EIO
-          if no change was done since the time of call.
-Sat Mar 16 14:33:13 1996 <aeb@cwi.nl>
-        * tty_io.c (disassociate_ctty): If disassociate_ctty is called by
-                exit, do not perform an implicit vhangup on a pty.
-Fri Feb  9 14:15:47 1996    <tytso@rsts-11.mit.edu>
-        * serial.c (block_til_ready): Fixed another race condition which
-                happens if a hangup happens during the open.
-Wed Jan 10 10:08:00 1996    <tytso@rsts-11.mit.edu>
-        * serial.c (block_til_ready): Remove race condition which happened
-                if a hangup condition happened during the setup of the
-                UART, before rs_open() called block_til_ready().  This
-                caused the info->count counter to be erroneously
-                decremented.
-        * serial.c (startup, rs_open): Remove race condition that could
-                cause a memory leak of one page.  (Fortunately, both race
-                conditions were relatively rare in practice.)
-Tue Dec  5 13:21:27 1995    <tytso@rsts-11.mit.edu>
-        * serial.c (check_modem_status, rs_ioctl): Support the new
-                ioctl()'s TIOCGICOUNT, TIOCMIWAIT.  These allow an
-                application program to wait on a modem serial register
-                status bit change, and to find out how many changes have
-                taken place for the MSR bits.
-                (rs_write): Eliminate a race condition which is introduced
-                if it is necessary to wait for the semaphore.
-Sat Nov  4 17:14:45 1995    <tytso@rsts-11.mit.edu>
-        * tty_io.c (tty_init): Move registration of TTY_MAJOR and
-                TTY_AUX_MAJOR to the end, so that /proc/devices looks
-                prettier. 
-        * pty.c (pty_init): Use new major numbers for PTY master and slave
-                devices.  This allow us to have more than 64 pty's.  We
-                register the old pty devices for backwards compatibility.
-                Note that a system should either be using the old pty
-                devices or the new pty devices --- in general, it should
-                try to use both, since they map into the same pty table.
-                The old pty devices are strictly for backwards compatibility.
-Wed Oct 11 12:45:24 1995    <tytso@rsts-11.mit.edu>
-        * tty_io.c (disassociate_ctty): If disassociate_ctty is called by
-                exit, perform an implicit vhangup on the tty.
-        * pty.c (pty_close): When the master pty is closed, send a hangup
-                to the slave pty.
-                (pty_open): Use the flag TTY_SLAVE_CLOSED to test to see
-                if there are any open slave ptys, instead of using
-                tty->link->count.  The old method got confused if there
-                were processes that had hung-up file descriptors on the
-                slave tty.
-Tue May  2 00:53:25 1995    <tytso@rsx-11.mit.edu>
-        * tty_io.c (tty_set_ldisc): Wait until the output buffer is
-                drained before closing the old line discipline --- needed
-                in only one case: XON/XOFF processing.
-        * n_tty.c (n_tty_close): Don't bother waiting until the output
-                driver is closed; in general, the line discipline
-                shouldn't care if the hardware is finished
-                transmitting before the line discipline terminates.
-        * tty_io.c (release_dev): Shutdown the line discipline after
-                decrementing the tty count variable; but set the
-                TTY_CLOSING flag so that we know that this tty structure
-                isn't long for this world.
-        * tty_io.c (init_dev): Add sanity code to check to see if
-                TTY_CLOSING is set on a tty structure; if so, something
-                bad has happened (probably a line discipline close blocked
-                when it shouldn't have; so do a kernel printk and then
-                return an error).
-Wed Apr 26 10:23:44 1995  Theodore Y. Ts'o  <tytso@localhost>
-        * tty_io.c (release_dev): Try to shutdown the line discipline
-                *before* decrementing the tty count variable; this removes
-                a potential race condition which occurs when the line
-                discipline close blocks, and another process then tries
-                open the same serial port.
-        * serial.c (rs_hangup): When hanging up, flush the output buffer
-                before shutting down the UART.  Otherwise the line
-                discipline close blocks waiting for the characters to get
-                flushed, which never happens until the serial port gets reused.
-Wed Apr 12 08:06:16 1995  Theodore Y. Ts'o  <tytso@localhost>
-        * serial.c (do_serial_hangup, do_softint, check_modem_status,
-                rs_init):  Hangups are now scheduled via a separate tqueue
-                structure in the async_struct structure, tqueue_hangup.
-                This task is pushed on to the tq_schedule queue, so that
-                it is processed synchronously by the scheduler.
-Sat Feb 18 12:13:51 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (disassociate_ctty, tty_open, tty_ioctl): Clear
-                current->tty_old_pgrp field when a session leader
-                acquires a controlling tty, and after a session leader
-                has disassociated from a controlling tty.
-Fri Feb 17 09:34:09 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_interrupt_single, rs_interrupt, rs_interrupt_multi): 
-                Change the number of passes made from 64 to be 256,
-                configurable with the #define RS_ISR_PASS_LIMIT.
-        * serial.c (rs_init, set_serial_info, get_serial_info, rs_close):
-                Remove support for closing_wait2.  Instead, set
-                tty->closing and rely on the line discipline to prevent
-                echo wars.
-        * n_tty.c (n_tty_receive_char):  IEXTEN does not need to be
-                enabled in order for IXANY to be active.
-                If tty->closing is set, then only process XON and XOFF
-                characters.
-Sun Feb 12 23:57:48 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_timer): Change the interrupt poll time from 60
-                seconds to 10 seconds, configurable with the #define
-                RS_STROBE_TIME.
-        * serial.c (rs_interrupt_multi, startup, shutdown, rs_ioctl,
-                set_multiport_struct, get_multiport_struct): Add
-                provisions for a new type of interrupt service routine,
-                which better supports multiple serial ports on a single
-                IRQ.  
-Sun Feb  5 19:35:11 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_ioctl.c (n_tty_ioctl, set_termios, tty_wait_until_sent): 
-        * serial.c (rs_ioctl, rs_close): 
-        * cyclades.c (cy_ioctl, cy_close): 
-        * n_tty.c (n_tty_close):  Rename wait_until_sent to
-                tty_wait_until_sent, so that it's a better name to export
-                in ksyms.c.
-Sat Feb  4 23:36:20 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_close): Added missing check for closing_wait2 being
-                ASYNC_CLOSING_WAIT_NONE.
-Thu Jan 26 09:02:49 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_init, set_serial_info, get_serial_info,
-                rs_close): Support close_wait in the serial driver.
-                This is helpful for slow devices (like serial
-                plotters) so that their outputs don't get flushed upon
-                device close.  This has to be configurable because
-                normally we don't want ports to be hung up for long
-                periods of time during a close when they are not
-                connected to a device, or the device is powered off.
-                The default is to wait 30 seconds; in the case of a
-                very slow device, the close_wait timeout should be
-                lengthened.  If it is set to 0, the kernel will wait
-                forever for all of the data to be transmitted.
-Thu Jan 17 01:17:20 1995  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (startup, change_speed, rs_init): Add support to detect
-                the StarTech 16650 chip.  Treat it as a 16450 for now,
-                because of its FIFO bugs.
-Thu Jan  5 21:21:57 1995  <dahinds@users.sourceforge.net>
-        * serial.c: (receive_char): Added counter to prevent infinite loop
-                when a PCMCIA serial device is ejected.
-Thu Dec 29 17:53:48 1994    <tytso@rsx-11.mit.edu>
-        * tty_io.c (check_tty_count): New procedure which checks
-                tty->count to make sure that it matches with the number of
-                open file descriptors which point at the structure.  If
-                the number doesn't match, it prints a warning message.
-Wed Dec 28 15:41:51 1994    <tytso@rsx-11.mit.edu>
-        * tty_io.c (do_tty_hangup, disassociate_ctty): At hangup time,
-                save the tty's current foreground process group in the
-                session leader's task structure.  When the session leader
-                terminates, send a SIGHUP, SIGCONT to that process group.
-                This is not required by POSIX, but it's not prohibited
-                either, and it appears to be the least intrusive way
-                to fix a problem that dialup servers have with
-                orphaned process groups caused by modem hangups.
-Thu Dec  8 14:52:11 1994    <tytso@rsx-11.mit.edu>
-        * serial.c (rs_ioctl): Don't allow most ioctl's if the serial port
-                isn't initialized.
-        * serial.c (rs_close): Don't clear the IER if the serial port
-                isn't initialized. 
-        * serial.c (block_til_ready): Don't try to block on the dialin
-                port if the serial port isn't initialized.
-Wed Dec  7 10:48:30 1994  Si Park (si@wimpol.demon.co.uk)
-        * tty_io.c (tty_register_driver): Fix bug when linking onto
-                the tty_drivers list. We now test that there are elements
-                already on the list before setting the back link from the
-                first element to the new driver.
-        * tty_io.c (tty_unregister_driver): Fix bug in unlinking the
-                specified driver from the tty_drivers list. We were not
-                setting the back link correctly. This used to result in
-                a dangling back link pointer and cause panics on the next
-                call to get_tty_driver().
-Tue Nov 29 10:21:09 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (tty_unregister_driver): Fix bug in
-                tty_unregister_driver where the pointer to the refcount is
-                tested, instead of the refcount itself.  This caused
-                tty_unregister_driver to always return EBUSY.
-Sat Nov 26 11:59:24 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (tty_ioctl): Add support for the new ioctl
-                TIOCTTYGSTRUCT, which allow a kernel debugging program
-                direct read access to the tty and tty_driver structures.
-Fri Nov 25 17:26:22 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_set_termios): Don't wake up processes blocked in
-                open when the CLOCAL flag changes, since a blocking
-                open only samples the CLOCAL flag once when it blocks,
-                and doesn't check it again.  (n.b.  FreeBSD has a
-                different behavior for blocking opens; it's not clear
-                whether Linux or FreeBSD's interpretation is correct.
-                POSIX doesn't give clear guidance on this issue, so
-                this may change in the future....)
-        * serial.c (block_til_ready): Use the correct termios structure to
-                check the CLOCAL flag.  If the cuaXX device is active,
-                then check the saved termios for the ttySXX device.
-                Otherwise, use the currently active termios structure.
-Sun Nov  6 21:05:44 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (change_speed): Add support for direct access of
-                57,600 and 115,200 bps.
-Wed Nov  2 10:32:36 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * n_tty.c (n_tty_receive_room): Only allow excess characters
-                through if we are in ICANON mode *and* there are other no
-                pending lines in the buffer.  Otherwise cut and paste over
-                4k breaks.
-Sat Oct 29 18:17:34 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_ioctl, get_lsr_info): Added patch suggested by Arne
-                Riiber so that user mode programs can tell when the
-                transmitter shift register is empty.
-Thu Oct 27 23:14:29 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_ioctl.c (wait_until_sent): Added debugging printk statements
-                (under the #ifdef TTY_DEBUG_WAIT_UNTIL_SENT)  
-        * serial.c (rs_interrupt, rs_interrupt_single, receive_chars,
-                change_speed, rs_close): rs_close now disables receiver
-                interrupts when closing the serial port.  This allows the
-                serial port to close quickly when Linux and a modem (or a
-                mouse) are engaged in an echo war; when closing the serial
-                port, we now first stop listening to incoming characters,
-                and *then* wait for the transmit buffer to drain.  
-                In order to make this change, the info->read_status_mask
-                is now used to control what bits of the line status
-                register are looked at in the interrupt routine in all
-                cases; previously it was only used in receive_chars to
-                select a few of the status bits.
-Mon Oct 24 23:36:21 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_close): Add a timeout to the transmitter flush
-                loop; this is just a sanity check in case we have flaky
-                (or non-existent-but-configured-by-the-user) hardware.
-Fri Oct 21 09:37:23 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (tty_fasync): When asynchronous I/O is enabled, if the
-                process or process group has not be specified yet, set it
-                to be the tty's process group, or if that is not yet set,
-                to the current process's pid.
-Thu Oct 20 23:17:28 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * n_tty.c (n_tty_receive_room): If we are doing input
-                canonicalization, let as many characters through as
-                possible, so that the excess characters can be "beeped".
-Tue Oct 18 10:02:43 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_start): Removed an incorrect '!' that was
-                preventing transmit interrupts from being re-enabled in
-                rs_start().  Fortunately in most cases it would be
-                re-enabled elsewhere, but this still should be fixed
-                correctly.
-Sun Oct  9 23:46:03 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (do_tty_hangup): If the tty driver flags
-                TTY_DRIVER_RESET_TERMIOS is set, then reset the termios
-                settings back to the driver's initial configuration.  This
-                allows the termios settings to be reset even if a process
-                has hung up file descriptors keeping a pty's termios from
-                being freed and reset.
-        * tty_io.c (release_dev): Fix memory leak.  The pty's other
-                termios structure should also be freed.
-        * serial.c (rs_close, shutdown): Change how we wait for the
-                transmitter to completely drain before shutting down the
-                serial port.  We now do it by scheduling in another
-                process instead of busy looping with the interrupts turned
-                on.  This may eliminate some race condition problems that
-                some people seem to be reporting.
-Sun Sep 25 14:18:14 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (release_dev): When freeing a tty make sure that both
-                the tty and the o_tty (if present) aren't a process's
-                controlling tty.  (Previously, we only checked the tty.)
-        * serial.c (change_speed): Only enable the Modem Status
-                Interrupt for a port if CLOCAL is not set or CRTSCTS
-                is set.  If we're not checking the carrier detect and
-                CTS line, there's no point in enabling the modem
-                status interrupt.  This will save spurious interrupts
-                from slowing down systems who have terminals that
-                don't support either line.  (Of course, if you want
-                only one of CD and CTS support, you will need a
-                properly wired serial cable.)
-Thu Sep 22 08:32:48 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (do_SAK): Return if tty is null.
-        * tty_io.c (_tty_name): Return "NULL tty" if the passed in tty is
-                NULL.
-Sat Sep 17 13:19:25 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_ioctl.c (n_tty_ioctl): Fix TIOCGLCKTRMIOS and
-                TIOCSLCKTRMIOS, which were totally broken.  Remove
-                extra indirection from argument; it should be a struct
-                termios *, not a struct termios **.
-                &real_tty->termios_locked should have been
-                real_tty->termios_locked.  This caused us to be
-                reading and writing the termios_locked structure to
-                random places in kernel memory.  
-        * tty_io.c (release_dev): Oops!  Forgot to delete a critical kfree
-                of the locked_termios.  This leaves the locked_termios
-                structure pointed at a freed object.  
-Fri Sep 16 08:13:25 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * tty_io.c (tty_open): Don't check for an exclusive open until
-                after the device specific open routine has been called.
-                Otherwise, the serial device ref counting will be screwed
-                up.
-        * serial.c (rs_open, block_til_ready): Don't set termios structure
-                until after block_til_ready has returned successfully.
-                Modify block_til_ready to check the normal_termios
-                structure directly, so it doesn't rely on termios being
-                set before it's called.
-Thu Sep 15 23:34:01 1994  Theodore Y. Ts'o  (tytso@rt-11)
-        * serial.c (rs_close): Turn off interrupts during rs_close() to
-                prevent a race condition with the hangup code (which
-                runs during a software interrupt).
-        * tty_io.c (release_dev): Don't free the locked_termios structure;
-                its state must be retained across device opens.
-        * tty_io.c (tty_unregister_driver): Added function to unregister a
-                tty driver.  (For loadable device drivers.)
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 2fb3a480f6b0..4b66c69eaf57 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -57,7 +57,7 @@ config AGP_AMD
 config AGP_AMD64
        tristate "AMD Opteron/Athlon64 on-CPU GART support"
-        depends on AGP && X86
+        depends on AGP && X86 && K8_NB
        help
          This option gives you AGP support for the GLX component of
          X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index 73dbf40c874d..a7637d72cef6 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -6,9 +6,9 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/agp_backend.h>
-#include <linux/gfp.h>
 #include <linux/page-flags.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include "agp.h"
 #define AMD_MMBASE      0x14
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index c3ab46da51a3..ee4f855611b6 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/miscdevice.h>
 #include <linux/pm.h>
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 58c57cb2518c..9d2c97a69cdd 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/fs.h>
 #include <linux/agpgart.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include "agp.h"
 #include "compat_ioctl.h"
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index c50543966eb2..fb86708e47ed 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -38,6 +38,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <asm/cacheflush.h>
 #include <asm/pgtable.h>
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 58752b70efea..056b289a1e89 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/agp_backend.h>
 #include <linux/log2.h>
+#include <linux/slab.h>
 #include <asm/acpi-ext.h>
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 919a28558d36..aa4248efc5d8 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -4,6 +4,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/pagemap.h>
@@ -97,6 +98,9 @@ EXPORT_SYMBOL(intel_agp_enabled);
 #define IS_PINEVIEW (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
+#define IS_SNB (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
@@ -107,8 +111,7 @@ EXPORT_SYMBOL(intel_agp_enabled);
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || \
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB || \
                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
+                IS_SNB)
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
 extern int agp_memory_reserved;
@@ -175,6 +178,10 @@ extern int agp_memory_reserved;
 #define SNB_GMCH_GMS_STOLEN_448M        (0xe << 3)
 #define SNB_GMCH_GMS_STOLEN_480M        (0xf << 3)
 #define SNB_GMCH_GMS_STOLEN_512M        (0x10 << 3)
+#define SNB_GTT_SIZE_0M                 (0 << 8)
+#define SNB_GTT_SIZE_1M                 (1 << 8)
+#define SNB_GTT_SIZE_2M                 (2 << 8)
+#define SNB_GTT_SIZE_MASK               (3 << 8)
 static const struct aper_size_info_fixed intel_i810_sizes[] =
 {
@@ -298,7 +305,7 @@ static void intel_agp_insert_sg_entries(struct agp_memory *mem,
                        j++;
                }
        } else {
-                /* sg may merge pages, but we have to seperate
+                /* sg may merge pages, but we have to separate
                 * per-page addr for GTT */
                unsigned int len, m;
@@ -1200,6 +1207,9 @@ static void intel_i9xx_setup_flush(void)
        if (intel_private.ifp_resource.start)
                return;
+        if (IS_SNB)
+                return;
        /* setup a resource for this object */
        intel_private.ifp_resource.name = "Intel Flush Page";
        intel_private.ifp_resource.flags = IORESOURCE_MEM;
@@ -1438,6 +1448,8 @@ static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
 static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
 {
+        u16 snb_gmch_ctl;
        switch (agp_bridge->dev->device) {
        case PCI_DEVICE_ID_INTEL_GM45_HB:
        case PCI_DEVICE_ID_INTEL_EAGLELAKE_HB:
@@ -1449,9 +1461,26 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
        case PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB:
        case PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB:
        case PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB:
+                *gtt_offset = *gtt_size = MB(2);
+                break;
        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB:
        case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB:
-                *gtt_offset = *gtt_size = MB(2);
+                *gtt_offset = MB(2);
+                pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
+                switch (snb_gmch_ctl & SNB_GTT_SIZE_MASK) {
+                default:
+                case SNB_GTT_SIZE_0M:
+                        printk(KERN_ERR "Bad GTT size mask: 0x%04x.\n", snb_gmch_ctl);
+                        *gtt_size = MB(0);
+                        break;
+                case SNB_GTT_SIZE_1M:
+                        *gtt_size = MB(1);
+                        break;
+                case SNB_GTT_SIZE_2M:
+                        *gtt_size = MB(2);
+                        break;
+                }
                break;
        default:
                *gtt_offset = *gtt_size = KB(512);
@@ -1788,8 +1817,6 @@ static int intel_845_configure(void)
        pci_write_config_byte(agp_bridge->dev, INTEL_I845_AGPM, temp2 | (1 << 1));
        /* clear any possible error conditions */
        pci_write_config_word(agp_bridge->dev, INTEL_I845_ERRSTS, 0x001c);
-        intel_i830_setup_flush();
        return 0;
 }
@@ -2159,7 +2186,6 @@ static const struct agp_bridge_driver intel_845_driver = {
        .agp_destroy_page       = agp_generic_destroy_page,
        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
-        .chipset_flush          = intel_i830_chipset_flush,
 };
 static const struct agp_bridge_driver intel_850_driver = {
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index 7e36d2b4f9d4..10f24e349a26 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -8,7 +8,6 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/agp_backend.h>
-#include <linux/gfp.h>
 #include <linux/page-flags.h>
 #include <linux/mm.h>
 #include <linux/jiffies.h>
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index 0d426ae39c85..ffa888cd1c88 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -14,6 +14,7 @@
 #include <linux/acpi.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/agp_backend.h>
 #include <asm/sn/addrs.h>
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index d89da4ac061f..6f48931ac1ce 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -3,6 +3,7 @@
 */
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/pagemap.h>
 #include <linux/agp_backend.h>
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 6c32fbf07164..56b27671adc4 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -2021,8 +2021,6 @@ static int __init rs_init(void)
        state->baud_base = amiga_colorclock;
        state->xmit_fifo_size = 1;
-        local_irq_save(flags);
        /* set ISRs, and then disable the rx interrupts */
        error = request_irq(IRQ_AMIGA_TBE, ser_tx_int, 0, "serial TX", state);
        if (error)
@@ -2033,6 +2031,8 @@ static int __init rs_init(void)
        if (error)
                goto fail_free_irq;
+        local_irq_save(flags);
        /* turn off Rx and Tx interrupts */
        custom.intena = IF_RBF | IF_TBE;
        mb();
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index fe2cb2f5db17..a7424bf7eacf 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -14,7 +14,7 @@
 /* et passe en argument a acinit, mais est scrute sur le bus pour s'adapter  */
 /* au nombre de cartes presentes sur le bus. IOCL code 6 affichait V2.4.3    */
 /* F.LAFORSE 28/11/95 creation de fichiers acXX.o avec les differentes       */
-/* adresses de base des cartes, IOCTL 6 plus complet                         */
+/* addresses de base des cartes, IOCTL 6 plus complet                         */
 /* J.PAGET le 19/08/96 copie de la version V2.6 en V2.8.0 sans modification  */
 /* de code autre que le texte V2.6.1 en V2.8.0                               */
 /*****************************************************************************/
diff --git a/drivers/char/bfin_jtag_comm.c b/drivers/char/bfin_jtag_comm.c
index 2628c7415ea8..e397df3ad98e 100644
--- a/drivers/char/bfin_jtag_comm.c
+++ b/drivers/char/bfin_jtag_comm.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index d8cff909001c..555cd93c2ee5 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -14,7 +14,6 @@
 #include <linux/kernel.h>
 #include <linux/wait.h>
 #include <linux/string.h>
-#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/char/bsr.c b/drivers/char/bsr.c
index c02db01f736e..7fef305774de 100644
--- a/drivers/char/bsr.c
+++ b/drivers/char/bsr.c
@@ -27,6 +27,7 @@
 #include <linux/cdev.h>
 #include <linux/list.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index b861c08263a4..9824b4162904 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -79,6 +79,7 @@
 #include <linux/bitops.h>
 #include <linux/firmware.h>
 #include <linux/device.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
diff --git a/drivers/char/dsp56k.c b/drivers/char/dsp56k.c
index 85832ab924e6..8a1b28a10ef0 100644
--- a/drivers/char/dsp56k.c
+++ b/drivers/char/dsp56k.c
@@ -24,7 +24,6 @@
 */
 #include <linux/module.h>
-#include <linux/slab.h> /* for kmalloc() and kfree() */
 #include <linux/major.h>
 #include <linux/types.h>
 #include <linux/errno.h>
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 17b044a71e02..6f5ffe1320f7 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -36,7 +36,6 @@
 #include <linux/ctype.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
-#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
diff --git a/drivers/char/generic_serial.c b/drivers/char/generic_serial.c
index d400cbd280f2..5954ee1dc953 100644
--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -29,6 +29,7 @@
 #include <linux/interrupt.h>
 #include <linux/tty_flip.h>
 #include <linux/delay.h>
+#include <linux/gfp.h>
 #include <asm/uaccess.h>
 #define DEBUG 
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index e481c5938bad..9ded667625ac 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -31,6 +31,7 @@
 #include <linux/seq_file.h>
 #include <linux/bitops.h>
 #include <linux/clocksource.h>
+#include <linux/slab.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
@@ -215,9 +216,7 @@ static void hpet_timer_set_irq(struct hpet_dev *devp)
        else
                v &= ~0xffff;
-        for (irq = find_first_bit(&v, HPET_MAX_IRQ); irq < HPET_MAX_IRQ;
+        for_each_set_bit(irq, &v, HPET_MAX_IRQ) {
-                irq = find_next_bit(&v, HPET_MAX_IRQ, 1 + irq)) {
                if (irq >= nr_irqs) {
                        irq = HPET_MAX_IRQ;
                        break;
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 465185fc0f52..35cca4c7fb18 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -38,6 +38,7 @@
 #include <linux/spinlock.h>
 #include <linux/delay.h>
 #include <linux/freezer.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
@@ -312,6 +313,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
        spin_lock_irqsave(&hp->lock, flags);
        /* Check and then increment for fast path open. */
        if (hp->count++ > 0) {
+                tty_kref_get(tty);
                spin_unlock_irqrestore(&hp->lock, flags);
                hvc_kick();
                return 0;
@@ -319,7 +321,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
        tty->driver_data = hp;
-        hp->tty = tty;
+        hp->tty = tty_kref_get(tty);
        spin_unlock_irqrestore(&hp->lock, flags);
@@ -336,6 +338,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
                spin_lock_irqsave(&hp->lock, flags);
                hp->tty = NULL;
                spin_unlock_irqrestore(&hp->lock, flags);
+                tty_kref_put(tty);
                tty->driver_data = NULL;
                kref_put(&hp->kref, destroy_hvc_struct);
                printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc);
@@ -363,6 +366,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
                return;
        hp = tty->driver_data;
        spin_lock_irqsave(&hp->lock, flags);
        if (--hp->count == 0) {
@@ -389,6 +393,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
                spin_unlock_irqrestore(&hp->lock, flags);
        }
+        tty_kref_put(tty);
        kref_put(&hp->kref, destroy_hvc_struct);
 }
@@ -424,10 +429,11 @@ static void hvc_hangup(struct tty_struct *tty)
        spin_unlock_irqrestore(&hp->lock, flags);
        if (hp->ops->notifier_hangup)
-                        hp->ops->notifier_hangup(hp, hp->data);
+                hp->ops->notifier_hangup(hp, hp->data);
        while(temp_open_count) {
                --temp_open_count;
+                tty_kref_put(tty);
                kref_put(&hp->kref, destroy_hvc_struct);
        }
 }
@@ -592,7 +598,7 @@ int hvc_poll(struct hvc_struct *hp)
        }
        /* No tty attached, just skip */
-        tty = hp->tty;
+        tty = tty_kref_get(hp->tty);
        if (tty == NULL)
                goto bail;
@@ -672,6 +678,8 @@ int hvc_poll(struct hvc_struct *hp)
                tty_flip_buffer_push(tty);
        }
+        if (tty)
+                tty_kref_put(tty);
        return poll_mask;
 }
@@ -807,7 +815,7 @@ int hvc_remove(struct hvc_struct *hp)
        struct tty_struct *tty;
        spin_lock_irqsave(&hp->lock, flags);
-        tty = hp->tty;
+        tty = tty_kref_get(hp->tty);
        if (hp->index < MAX_NR_HVC_CONSOLES)
                vtermnos[hp->index] = -1;
@@ -819,18 +827,18 @@ int hvc_remove(struct hvc_struct *hp)
        /*
         * We 'put' the instance that was grabbed when the kref instance
         * was initialized using kref_init().  Let the last holder of this
-         * kref cause it to be removed, which will probably be the tty_hangup
+         * kref cause it to be removed, which will probably be the tty_vhangup
         * below.
         */
        kref_put(&hp->kref, destroy_hvc_struct);
        /*
-         * This function call will auto chain call hvc_hangup.  The tty should
+         * This function call will auto chain call hvc_hangup.
-         * always be valid at this time unless a simultaneous tty close already
-         * cleaned up the hvc_struct.
         */
-        if (tty)
+        if (tty) {
-                tty_hangup(tty);
+                tty_vhangup(tty);
+                tty_kref_put(tty);
+        }
        return 0;
 }
 EXPORT_SYMBOL_GPL(hvc_remove);
diff --git a/drivers/char/hvc_iseries.c b/drivers/char/hvc_iseries.c
index fd0242676a2a..21c54955084e 100644
--- a/drivers/char/hvc_iseries.c
+++ b/drivers/char/hvc_iseries.c
@@ -353,7 +353,7 @@ static void hvc_close_event(struct HvLpEvent *event)
        if (!hvlpevent_is_int(event)) {
                printk(KERN_WARNING
-                        "hvc: got unexpected close acknowlegement\n");
+                        "hvc: got unexpected close acknowledgement\n");
                return;
        }
diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index 37b0542a4eeb..5a80ad68ef22 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -12,6 +12,7 @@
 #define pr_fmt(fmt)             KMSG_COMPONENT ": " fmt
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <asm/ebcdic.h>
 #include <linux/ctype.h>
 #include <linux/delay.h>
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 266b858b8f85..bedc6c1b6fa5 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -74,6 +74,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/stat.h>
 #include <linux/tty.h>
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 91b53eb1c053..86fe45c19968 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -30,6 +30,7 @@
 #include <linux/pci.h>
 #include <linux/stop_machine.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/io.h>
diff --git a/drivers/char/hw_random/n2-drv.c b/drivers/char/hw_random/n2-drv.c
index 9b3e09cd41f9..10f868eefaa6 100644
--- a/drivers/char/hw_random/n2-drv.c
+++ b/drivers/char/hw_random/n2-drv.c
@@ -71,7 +71,7 @@ MODULE_VERSION(DRV_MODULE_VERSION);
 *        x22 + x21 + x17 + x15 + x13 + x12 + x11 + x7 + x5 + x + 1
 *
 * The RNG_CTL_VCO value of each noise cell must be programmed
- * seperately.  This is why 4 control register values must be provided
+ * separately.  This is why 4 control register values must be provided
 * to the hypervisor.  During a write, the hypervisor writes them all,
 * one at a time, to the actual RNG_CTL register.  The first three
 * values are used to setup the desired RNG_CTL_VCO for each entropy
diff --git a/drivers/char/hw_random/octeon-rng.c b/drivers/char/hw_random/octeon-rng.c
index 54b0d9ba65cf..9cd0feca318c 100644
--- a/drivers/char/hw_random/octeon-rng.c
+++ b/drivers/char/hw_random/octeon-rng.c
@@ -15,6 +15,7 @@
 #include <linux/device.h>
 #include <linux/hw_random.h>
 #include <linux/io.h>
+#include <linux/gfp.h>
 #include <asm/octeon/octeon.h>
 #include <asm/octeon/cvmx-rnm-defs.h>
diff --git a/drivers/char/hw_random/tx4939-rng.c b/drivers/char/hw_random/tx4939-rng.c
index 544d9085a8e8..0bc0cb70210b 100644
--- a/drivers/char/hw_random/tx4939-rng.c
+++ b/drivers/char/hw_random/tx4939-rng.c
@@ -14,6 +14,7 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/hw_random.h>
+#include <linux/gfp.h>
 #define TX4939_RNG_RCSR         0x00000000
 #define TX4939_RNG_ROR(n)       (0x00000018 + (n) * 8)
diff --git a/drivers/char/ip2/i2hw.h b/drivers/char/ip2/i2hw.h
index 8aa6e7ab8d5b..c0ba6c05f0cd 100644
--- a/drivers/char/ip2/i2hw.h
+++ b/drivers/char/ip2/i2hw.h
@@ -559,7 +559,7 @@ Loadware may be sent to the board in two ways:
 2) It may be hard-coded into your source by including a .h file (typically
        supplied by Computone), which declares a data array and initializes every
-        element. This acheives the same result as if an entire loadware file had 
+        element. This achieves the same result as if an entire loadware file had 
        been read into the array.
        This requires more data space in your program, but access to the file system
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index ec5e3f8df648..c6ad4234378d 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2272,42 +2272,52 @@ static int create_files(struct bmc_device *bmc)
        bmc->device_id_attr.attr.name = "device_id";
        bmc->device_id_attr.attr.mode = S_IRUGO;
        bmc->device_id_attr.show = device_id_show;
+        sysfs_attr_init(&bmc->device_id_attr.attr);
        bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
        bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
        bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
+        sysfs_attr_init(&bmc->provides_dev_sdrs_attr.attr);
        bmc->revision_attr.attr.name = "revision";
        bmc->revision_attr.attr.mode = S_IRUGO;
        bmc->revision_attr.show = revision_show;
+        sysfs_attr_init(&bmc->revision_attr.attr);
        bmc->firmware_rev_attr.attr.name = "firmware_revision";
        bmc->firmware_rev_attr.attr.mode = S_IRUGO;
        bmc->firmware_rev_attr.show = firmware_rev_show;
+        sysfs_attr_init(&bmc->firmware_rev_attr.attr);
        bmc->version_attr.attr.name = "ipmi_version";
        bmc->version_attr.attr.mode = S_IRUGO;
        bmc->version_attr.show = ipmi_version_show;
+        sysfs_attr_init(&bmc->version_attr.attr);
        bmc->add_dev_support_attr.attr.name = "additional_device_support";
        bmc->add_dev_support_attr.attr.mode = S_IRUGO;
        bmc->add_dev_support_attr.show = add_dev_support_show;
+        sysfs_attr_init(&bmc->add_dev_support_attr.attr);
        bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
        bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
        bmc->manufacturer_id_attr.show = manufacturer_id_show;
+        sysfs_attr_init(&bmc->manufacturer_id_attr.attr);
        bmc->product_id_attr.attr.name = "product_id";
        bmc->product_id_attr.attr.mode = S_IRUGO;
        bmc->product_id_attr.show = product_id_show;
+        sysfs_attr_init(&bmc->product_id_attr.attr);
        bmc->guid_attr.attr.name = "guid";
        bmc->guid_attr.attr.mode = S_IRUGO;
        bmc->guid_attr.show = guid_show;
+        sysfs_attr_init(&bmc->guid_attr.attr);
        bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
        bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
        bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
+        sysfs_attr_init(&bmc->aux_firmware_rev_attr.attr);
        err = device_create_file(&bmc->dev->dev,
                           &bmc->device_id_attr);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 176f1751237f..4462b113ba3f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -295,6 +295,9 @@ struct smi_info {
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
+static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
+static int num_max_busy_us;
 static int unload_when_empty = 1;
 static int try_smi_init(struct smi_info *smi);
@@ -925,23 +928,77 @@ static void set_run_to_completion(void *send_info, int i_run_to_completion)
        }
 }
+/*
+ * Use -1 in the nsec value of the busy waiting timespec to tell that
+ * we are spinning in kipmid looking for something and not delaying
+ * between checks
+ */
+static inline void ipmi_si_set_not_busy(struct timespec *ts)
+{
+        ts->tv_nsec = -1;
+}
+static inline int ipmi_si_is_busy(struct timespec *ts)
+{
+        return ts->tv_nsec != -1;
+}
+static int ipmi_thread_busy_wait(enum si_sm_result smi_result,
+                                 const struct smi_info *smi_info,
+                                 struct timespec *busy_until)
+{
+        unsigned int max_busy_us = 0;
+        if (smi_info->intf_num < num_max_busy_us)
+                max_busy_us = kipmid_max_busy_us[smi_info->intf_num];
+        if (max_busy_us == 0 || smi_result != SI_SM_CALL_WITH_DELAY)
+                ipmi_si_set_not_busy(busy_until);
+        else if (!ipmi_si_is_busy(busy_until)) {
+                getnstimeofday(busy_until);
+                timespec_add_ns(busy_until, max_busy_us*NSEC_PER_USEC);
+        } else {
+                struct timespec now;
+                getnstimeofday(&now);
+                if (unlikely(timespec_compare(&now, busy_until) > 0)) {
+                        ipmi_si_set_not_busy(busy_until);
+                        return 0;
+                }
+        }
+        return 1;
+}
+/*
+ * A busy-waiting loop for speeding up IPMI operation.
+ *
+ * Lousy hardware makes this hard.  This is only enabled for systems
+ * that are not BT and do not have interrupts.  It starts spinning
+ * when an operation is complete or until max_busy tells it to stop
+ * (if that is enabled).  See the paragraph on kimid_max_busy_us in
+ * Documentation/IPMI.txt for details.
+ */
 static int ipmi_thread(void *data)
 {
        struct smi_info *smi_info = data;
        unsigned long flags;
        enum si_sm_result smi_result;
+        struct timespec busy_until;
+        ipmi_si_set_not_busy(&busy_until);
        set_user_nice(current, 19);
        while (!kthread_should_stop()) {
+                int busy_wait;
                spin_lock_irqsave(&(smi_info->si_lock), flags);
                smi_result = smi_event_handler(smi_info, 0);
                spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+                busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
+                                                  &busy_until);
                if (smi_result == SI_SM_CALL_WITHOUT_DELAY)
                        ; /* do nothing */
-                else if (smi_result == SI_SM_CALL_WITH_DELAY)
+                else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait)
                        schedule();
                else
-                        schedule_timeout_interruptible(1);
+                        schedule_timeout_interruptible(0);
        }
        return 0;
 }
@@ -1144,7 +1201,7 @@ static int           regsizes[SI_MAX_PARMS];
 static unsigned int num_regsizes;
 static int           regshifts[SI_MAX_PARMS];
 static unsigned int num_regshifts;
-static int slave_addrs[SI_MAX_PARMS];
+static int slave_addrs[SI_MAX_PARMS]; /* Leaving 0 chooses the default value */
 static unsigned int num_slave_addrs;
 #define IPMI_IO_ADDR_SPACE  0
@@ -1212,6 +1269,11 @@ module_param(unload_when_empty, int, 0);
 MODULE_PARM_DESC(unload_when_empty, "Unload the module if no interfaces are"
                 " specified or found, default is 1.  Setting to 0"
                 " is useful for hot add of devices using hotmod.");
+module_param_array(kipmid_max_busy_us, uint, &num_max_busy_us, 0644);
+MODULE_PARM_DESC(kipmid_max_busy_us,
+                 "Max time (in microseconds) to busy-wait for IPMI data before"
+                 " sleeping. 0 (default) means to wait forever. Set to 100-500"
+                 " if kipmid is using up a lot of CPU time.");
 static void std_irq_cleanup(struct smi_info *info)
@@ -1607,7 +1669,7 @@ static int hotmod_handler(const char *val, struct kernel_param *kp)
                regsize = 1;
                regshift = 0;
                irq = 0;
-                ipmb = 0x20;
+                ipmb = 0; /* Choose the default if not specified */
                next = strchr(curr, ':');
                if (next) {
@@ -1799,6 +1861,7 @@ static __devinit void hardcode_find_bmc(void)
                info->irq = irqs[i];
                if (info->irq)
                        info->irq_setup = std_irq_setup;
+                info->slave_addr = slave_addrs[i];
                try_smi_init(info);
        }
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index be2e8f9a27c3..c1ab303455cf 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -130,6 +130,7 @@
 #include <linux/timer.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 #include <linux/io.h>
@@ -878,8 +879,8 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
        if (tport == NULL)
                return -ENODEV;
        port = container_of(tport, struct isi_port, port);
-        card = &isi_card[BOARD(tty->index)];
+        tty->driver_data = port;
        return tty_port_open(tport, tty, filp);
 }
@@ -935,7 +936,12 @@ static void isicom_shutdown(struct tty_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
        struct isi_port *ip = tty->driver_data;
-        struct tty_port *port = &ip->port;
+        struct tty_port *port;
+        if (ip == NULL)
+                return;
+        port = &ip->port;
        if (isicom_paranoia_check(ip, tty->name, "isicom_close"))
                return;
        tty_port_close(port, tty, filp);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 4cd6c527ee41..4e395c956a09 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -827,6 +827,8 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
                return -ENODEV;
        if (portp->devnr < 1)
                return -ENODEV;
+        tty->driver_data = portp;
        return tty_port_open(&portp->port, tty, filp);
 }
diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
index 87c67b42bc08..83bef4efe376 100644
--- a/drivers/char/mbcs.c
+++ b/drivers/char/mbcs.c
@@ -26,6 +26,7 @@
 #include <linux/uio.h>
 #include <linux/mutex.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 48788db4e280..f54dab8acdcd 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 *
- *  Added devfs support. 
+ *  Added devfs support.
 *    Jan-11-1998, C. Scott Ananian <cananian@alumni.princeton.edu>
 *  Shared /dev/zero mmapping support, Feb 2000, Kanoj Sarcar <kanoj@sgi.com>
 */
@@ -44,36 +44,6 @@ static inline unsigned long size_inside_page(unsigned long start,
        return min(sz, size);
 }
-/*
- * Architectures vary in how they handle caching for addresses
- * outside of main memory.
- *
- */
-static inline int uncached_access(struct file *file, unsigned long addr)
-{
-#if defined(CONFIG_IA64)
-        /*
-         * On ia64, we ignore O_DSYNC because we cannot tolerate memory attribute aliases.
-         */
-        return !(efi_mem_attributes(addr) & EFI_MEMORY_WB);
-#elif defined(CONFIG_MIPS)
-        {
-                extern int __uncached_access(struct file *file,
-                                             unsigned long addr);
-                return __uncached_access(file, addr);
-        }
-#else
-        /*
-         * Accessing memory above the top the kernel knows about or through a file pointer
-         * that was marked O_DSYNC will be done non-cached.
-         */
-        if (file->f_flags & O_DSYNC)
-                return 1;
-        return addr >= __pa(high_memory);
-#endif
-}
 #ifndef ARCH_HAS_VALID_PHYS_ADDR_RANGE
 static inline int valid_phys_addr_range(unsigned long addr, size_t count)
 {
@@ -115,15 +85,15 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 }
 #endif
-void __attribute__((weak)) unxlate_dev_mem_ptr(unsigned long phys, void *addr)
+void __weak unxlate_dev_mem_ptr(unsigned long phys, void *addr)
 {
 }
 /*
- * This funcion reads the *physical* memory. The f_pos points directly to the 
+ * This funcion reads the *physical* memory. The f_pos points directly to the
- * memory location. 
+ * memory location.
 */
-static ssize_t read_mem(struct file * file, char __user * buf,
+static ssize_t read_mem(struct file *file, char __user *buf,
                        size_t count, loff_t *ppos)
 {
        unsigned long p = *ppos;
@@ -140,10 +110,10 @@ static ssize_t read_mem(struct file * file, char __user * buf,
                if (sz > 0) {
                        if (clear_user(buf, sz))
                                return -EFAULT;
-                        buf += sz; 
+                        buf += sz;
-                        p += sz; 
+                        p += sz;
-                        count -= sz; 
+                        count -= sz;
-                        read += sz; 
+                        read += sz;
                }
        }
 #endif
@@ -157,9 +127,9 @@ static ssize_t read_mem(struct file * file, char __user * buf,
                        return -EPERM;
                /*
-                 * On ia64 if a page has been mapped somewhere as
+                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * uncached, then it must also be accessed uncached
+                 * it must also be accessed uncached by the kernel or data
-                 * by the kernel or data corruption may occur
+                 * corruption may occur.
                 */
                ptr = xlate_dev_mem_ptr(p);
                if (!ptr)
@@ -180,7 +150,7 @@ static ssize_t read_mem(struct file * file, char __user * buf,
        return read;
 }
-static ssize_t write_mem(struct file * file, const char __user * buf, 
+static ssize_t write_mem(struct file *file, const char __user *buf,
                         size_t count, loff_t *ppos)
 {
        unsigned long p = *ppos;
@@ -212,9 +182,9 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
                        return -EPERM;
                /*
-                 * On ia64 if a page has been mapped somewhere as
+                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * uncached, then it must also be accessed uncached
+                 * it must also be accessed uncached by the kernel or data
-                 * by the kernel or data corruption may occur
+                 * corruption may occur.
                 */
                ptr = xlate_dev_mem_ptr(p);
                if (!ptr) {
@@ -242,13 +212,48 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
        return written;
 }
-int __attribute__((weak)) phys_mem_access_prot_allowed(struct file *file,
+int __weak phys_mem_access_prot_allowed(struct file *file,
        unsigned long pfn, unsigned long size, pgprot_t *vma_prot)
 {
        return 1;
 }
 #ifndef __HAVE_PHYS_MEM_ACCESS_PROT
+/*
+ * Architectures vary in how they handle caching for addresses
+ * outside of main memory.
+ *
+ */
+#ifdef pgprot_noncached
+static int uncached_access(struct file *file, unsigned long addr)
+{
+#if defined(CONFIG_IA64)
+        /*
+         * On ia64, we ignore O_DSYNC because we cannot tolerate memory
+         * attribute aliases.
+         */
+        return !(efi_mem_attributes(addr) & EFI_MEMORY_WB);
+#elif defined(CONFIG_MIPS)
+        {
+                extern int __uncached_access(struct file *file,
+                                             unsigned long addr);
+                return __uncached_access(file, addr);
+        }
+#else
+        /*
+         * Accessing memory above the top the kernel knows about or through a
+         * file pointer
+         * that was marked O_DSYNC will be done non-cached.
+         */
+        if (file->f_flags & O_DSYNC)
+                return 1;
+        return addr >= __pa(high_memory);
+#endif
+}
+#endif
 static pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
                                     unsigned long size, pgprot_t vma_prot)
 {
@@ -294,7 +299,7 @@ static const struct vm_operations_struct mmap_mem_ops = {
 #endif
 };
-static int mmap_mem(struct file * file, struct vm_area_struct * vma)
+static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
        size_t size = vma->vm_end - vma->vm_start;
@@ -329,7 +334,7 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 }
 #ifdef CONFIG_DEVKMEM
-static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
+static int mmap_kmem(struct file *file, struct vm_area_struct *vma)
 {
        unsigned long pfn;
@@ -337,9 +342,9 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
        /*
-         * RED-PEN: on some architectures there is more mapped memory
+         * RED-PEN: on some architectures there is more mapped memory than
-         * than available in mem_map which pfn_valid checks
+         * available in mem_map which pfn_valid checks for. Perhaps should add a
-         * for. Perhaps should add a new macro here.
+         * new macro here.
         *
         * RED-PEN: vmalloc is not supported right now.
         */
@@ -389,7 +394,7 @@ static ssize_t read_oldmem(struct file *file, char __user *buf,
 /*
 * This function reads the *virtual* memory as seen by the kernel.
 */
-static ssize_t read_kmem(struct file *file, char __user *buf, 
+static ssize_t read_kmem(struct file *file, char __user *buf,
                         size_t count, loff_t *ppos)
 {
        unsigned long p = *ppos;
@@ -400,8 +405,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
        read = 0;
        if (p < (unsigned long) high_memory) {
                low_count = count;
-                if (count > (unsigned long) high_memory - p)
+                if (count > (unsigned long)high_memory - p)
-                        low_count = (unsigned long) high_memory - p;
+                        low_count = (unsigned long)high_memory - p;
 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
                /* we don't have page 0 mapped on sparc and m68k.. */
@@ -465,9 +470,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 }
-static inline ssize_t
+static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
-do_write_kmem(unsigned long p, const char __user *buf,
+                                size_t count, loff_t *ppos)
-              size_t count, loff_t *ppos)
 {
        ssize_t written, sz;
        unsigned long copied;
@@ -491,9 +495,9 @@ do_write_kmem(unsigned long p, const char __user *buf,
                sz = size_inside_page(p, count);
                /*
-                 * On ia64 if a page has been mapped somewhere as
+                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * uncached, then it must also be accessed uncached
+                 * it must also be accessed uncached by the kernel or data
-                 * by the kernel or data corruption may occur
+                 * corruption may occur.
                 */
                ptr = xlate_dev_kmem_ptr((char *)p);
@@ -514,11 +518,10 @@ do_write_kmem(unsigned long p, const char __user *buf,
        return written;
 }
 /*
 * This function writes to the *virtual* memory as seen by the kernel.
 */
-static ssize_t write_kmem(struct file * file, const char __user * buf, 
+static ssize_t write_kmem(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
        unsigned long p = *ppos;
@@ -570,17 +573,17 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
 #endif
 #ifdef CONFIG_DEVPORT
-static ssize_t read_port(struct file * file, char __user * buf,
+static ssize_t read_port(struct file *file, char __user *buf,
                         size_t count, loff_t *ppos)
 {
        unsigned long i = *ppos;
        char __user *tmp = buf;
        if (!access_ok(VERIFY_WRITE, buf, count))
-                return -EFAULT; 
+                return -EFAULT;
        while (count-- > 0 && i < 65536) {
-                if (__put_user(inb(i),tmp) < 0) 
+                if (__put_user(inb(i), tmp) < 0)
-                        return -EFAULT;  
+                        return -EFAULT;
                i++;
                tmp++;
        }
@@ -588,22 +591,22 @@ static ssize_t read_port(struct file * file, char __user * buf,
        return tmp-buf;
 }
-static ssize_t write_port(struct file * file, const char __user * buf,
+static ssize_t write_port(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
        unsigned long i = *ppos;
        const char __user * tmp = buf;
-        if (!access_ok(VERIFY_READ,buf,count))
+        if (!access_ok(VERIFY_READ, buf, count))
                return -EFAULT;
        while (count-- > 0 && i < 65536) {
                char c;
                if (__get_user(c, tmp)) {
                        if (tmp > buf)
                                break;
-                        return -EFAULT; 
+                        return -EFAULT;
                }
-                outb(c,i);
+                outb(c, i);
                i++;
                tmp++;
        }
@@ -612,13 +615,13 @@ static ssize_t write_port(struct file * file, const char __user * buf,
 }
 #endif
-static ssize_t read_null(struct file * file, char __user * buf,
+static ssize_t read_null(struct file *file, char __user *buf,
                         size_t count, loff_t *ppos)
 {
        return 0;
 }
-static ssize_t write_null(struct file * file, const char __user * buf,
+static ssize_t write_null(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
        return count;
@@ -630,13 +633,13 @@ static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
        return sd->len;
 }
-static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+static ssize_t splice_write_null(struct pipe_inode_info *pipe, struct file *out,
                                 loff_t *ppos, size_t len, unsigned int flags)
 {
        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
 }
-static ssize_t read_zero(struct file * file, char __user * buf, 
+static ssize_t read_zero(struct file *file, char __user *buf,
                         size_t count, loff_t *ppos)
 {
        size_t written;
@@ -667,7 +670,7 @@ static ssize_t read_zero(struct file * file, char __user * buf,
        return written ? written : -EFAULT;
 }
-static int mmap_zero(struct file * file, struct vm_area_struct * vma)
+static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 {
 #ifndef CONFIG_MMU
        return -ENOSYS;
@@ -677,7 +680,7 @@ static int mmap_zero(struct file * file, struct vm_area_struct * vma)
        return 0;
 }
-static ssize_t write_full(struct file * file, const char __user * buf,
+static ssize_t write_full(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
        return -ENOSPC;
@@ -688,8 +691,7 @@ static ssize_t write_full(struct file * file, const char __user * buf,
 * can fopen() both devices with "a" now.  This was previously impossible.
 * -- SRB.
 */
+static loff_t null_lseek(struct file *file, loff_t offset, int orig)
-static loff_t null_lseek(struct file * file, loff_t offset, int orig)
 {
        return file->f_pos = 0;
 }
@@ -702,24 +704,26 @@ static loff_t null_lseek(struct file * file, loff_t offset, int orig)
 * also note that seeking relative to the "end of file" isn't supported:
 * it has no meaning, so it returns -EINVAL.
 */
-static loff_t memory_lseek(struct file * file, loff_t offset, int orig)
+static loff_t memory_lseek(struct file *file, loff_t offset, int orig)
 {
        loff_t ret;
        mutex_lock(&file->f_path.dentry->d_inode->i_mutex);
        switch (orig) {
-                case 0:
+        case SEEK_CUR:
-                        file->f_pos = offset;
+                offset += file->f_pos;
-                        ret = file->f_pos;
+        case SEEK_SET:
-                        force_successful_syscall_return();
+                /* to avoid userland mistaking f_pos=-9 as -EBADF=-9 */
-                        break;
+                if ((unsigned long long)offset >= ~0xFFFULL) {
-                case 1:
+                        ret = -EOVERFLOW;
-                        file->f_pos += offset;
-                        ret = file->f_pos;
-                        force_successful_syscall_return();
                        break;
-                default:
+                }
-                        ret = -EINVAL;
+                file->f_pos = offset;
+                ret = file->f_pos;
+                force_successful_syscall_return();
+                break;
+        default:
+                ret = -EINVAL;
        }
        mutex_unlock(&file->f_path.dentry->d_inode->i_mutex);
        return ret;
@@ -803,7 +807,7 @@ static const struct file_operations oldmem_fops = {
 };
 #endif
-static ssize_t kmsg_write(struct file * file, const char __user * buf,
+static ssize_t kmsg_write(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
        char *tmp;
@@ -825,7 +829,7 @@ static ssize_t kmsg_write(struct file * file, const char __user * buf,
 }
 static const struct file_operations kmsg_fops = {
-        .write =        kmsg_write,
+        .write = kmsg_write,
 };
 static const struct memdev {
@@ -876,7 +880,7 @@ static int memory_open(struct inode *inode, struct file *filp)
 }
 static const struct file_operations memory_fops = {
-        .open           = memory_open,
+        .open = memory_open,
 };
 static char *mem_devnode(struct device *dev, mode_t *mode)
@@ -897,10 +901,13 @@ static int __init chr_dev_init(void)
        if (err)
                return err;
-        if (register_chrdev(MEM_MAJOR,"mem",&memory_fops))
+        if (register_chrdev(MEM_MAJOR, "mem", &memory_fops))
                printk("unable to get major %d for memory devs\n", MEM_MAJOR);
        mem_class = class_create(THIS_MODULE, "mem");
+        if (IS_ERR(mem_class))
+                return PTR_ERR(mem_class);
        mem_class->devnode = mem_devnode;
        for (minor = 1; minor < ARRAY_SIZE(devlist); minor++) {
                if (!devlist[minor].name)
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 94a136e96c06..92ab03d28294 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -40,7 +40,6 @@
 #include <linux/miscdevice.h>
 #include <linux/kernel.h>
 #include <linux/major.h>
-#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -49,6 +48,7 @@
 #include <linux/device.h>
 #include <linux/tty.h>
 #include <linux/kmod.h>
+#include <linux/gfp.h>
 /*
 * Head entry for the doubly linked miscdevice list
diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
index 918711aa56f3..ea7c99fa978f 100644
--- a/drivers/char/mmtimer.c
+++ b/drivers/char/mmtimer.c
@@ -33,6 +33,7 @@
 #include <linux/time.h>
 #include <linux/math64.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/sn/addrs.h>
@@ -546,7 +547,7 @@ static void mmtimer_tasklet(unsigned long data)
 {
        int nodeid = data;
        struct mmtimer_node *mn = &timers[nodeid];
-        struct mmtimer *x = rb_entry(mn->next, struct mmtimer, list);
+        struct mmtimer *x;
        struct k_itimer *t;
        unsigned long flags;
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 166495d6a1d7..107b0bd58d19 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -43,6 +43,7 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 #include <asm/system.h>
 #include <asm/io.h>
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index e0c5d2a69046..d2692d443f7b 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -33,12 +33,12 @@
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
-#include <linux/gfp.h>
 #include <linux/ioport.h>
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 #include <asm/system.h>
 #include <asm/io.h>
@@ -1011,6 +1011,7 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
        if (!info->ioaddr)
                return -ENODEV;
+        tty->driver_data = info;
        return tty_port_open(&info->port, tty, filp);
 }
@@ -1074,7 +1075,7 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
        struct mxser_port *info = tty->driver_data;
        struct tty_port *port = &info->port;
-        if (tty->index == MXSER_PORTS)
+        if (tty->index == MXSER_PORTS || info == NULL)
                return;
        if (tty_port_close_start(port, tty, filp) == 0)
                return;
@@ -1768,7 +1769,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                int len, lsr;
                len = mxser_chars_in_buffer(tty);
-                spin_lock(&info->slock);
+                spin_lock_irq(&info->slock);
                lsr = inb(info->ioaddr + UART_LSR) & UART_LSR_THRE;
                spin_unlock_irq(&info->slock);
                len += (lsr ? 0 : 1);
@@ -1778,12 +1779,12 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
        case MOXA_ASPP_MON: {
                int mcr, status;
-                spin_lock(&info->slock);
+                spin_lock_irq(&info->slock);
                status = mxser_get_msr(info->ioaddr, 1, tty->index);
                mxser_check_modem_status(tty, info, status);
                mcr = inb(info->ioaddr + UART_MCR);
-                spin_unlock(&info->slock);
+                spin_unlock_irq(&info->slock);
                if (mcr & MOXA_MUST_MCR_XON_FLAG)
                        info->mon_data.hold_reason &= ~NPPI_NOTIFY_XOFFHOLD;
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 2e50f4dfc79c..bdae8327143c 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -48,6 +48,7 @@
 #include <linux/audit.h>
 #include <linux/file.h>
 #include <linux/uaccess.h>
+#include <linux/module.h>
 #include <asm/system.h>
@@ -2091,3 +2092,19 @@ struct tty_ldisc_ops tty_ldisc_N_TTY = {
        .receive_buf     = n_tty_receive_buf,
        .write_wakeup    = n_tty_write_wakeup
 };
+/**
+ *      n_tty_inherit_ops       -       inherit N_TTY methods
+ *      @ops: struct tty_ldisc_ops where to save N_TTY methods
+ *
+ *      Used by a generic struct tty_ldisc_ops to easily inherit N_TTY
+ *      methods.
+ */
+void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+{
+        *ops = tty_ldisc_N_TTY;
+        ops->owner = NULL;
+        ops->refcount = ops->flags = 0;
+}
+EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index a3f32a15fde4..a6638003f530 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -55,6 +55,7 @@
 #include <linux/init.h>
 #include <linux/kfifo.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 #include <asm/byteorder.h>
 #include <linux/delay.h>
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 5eb83c3ca20d..47e8f7b0e4c1 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -100,7 +100,6 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/miscdevice.h>
-#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/fcntl.h>
 #include <linux/mc146818rtc.h>
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index c9bc896d68af..90b199f97bec 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1026,14 +1026,16 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
        xoutb(0, REG_FLAGS1(iobase));   /* clear detectCMM */
        /* last check before exit */
-        if (!io_detect_cm4000(iobase, dev))
+        if (!io_detect_cm4000(iobase, dev)) {
-                count = -ENODEV;
+                rc = -ENODEV;
+                goto release_io;
+        }
        if (test_bit(IS_INVREV, &dev->flags) && count > 0)
                str_invert_revert(dev->rbuf, count);
        if (copy_to_user(buf, dev->rbuf, count))
-                return -EFAULT;
+                rc = -EFAULT;
 release_io:
        clear_bit(LOCK_IO, &dev->flags);
diff --git a/drivers/char/pcmcia/ipwireless/network.c b/drivers/char/pcmcia/ipwireless/network.c
index 590762a7f217..65920163f53d 100644
--- a/drivers/char/pcmcia/ipwireless/network.c
+++ b/drivers/char/pcmcia/ipwireless/network.c
@@ -21,6 +21,7 @@
 #include <linux/netdevice.h>
 #include <linux/ppp_channel.h>
 #include <linux/ppp_defs.h>
+#include <linux/slab.h>
 #include <linux/if_ppp.h>
 #include <linux/skbuff.h>
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 432655bcb04c..fdd37543aa79 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -64,6 +64,7 @@
 #include <linux/parport.h>
 #include <linux/ctype.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include <linux/major.h>
 #include <linux/ppdev.h>
 #include <linux/smp_lock.h>
diff --git a/drivers/char/ps3flash.c b/drivers/char/ps3flash.c
index f424d394a286..606048b72bcf 100644
--- a/drivers/char/ps3flash.c
+++ b/drivers/char/ps3flash.c
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 #include <asm/lv1call.h>
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 385c44b3034f..d83a43130df4 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -29,6 +29,7 @@
 #include <linux/uaccess.h>
 #include <linux/bitops.h>
 #include <linux/devpts_fs.h>
+#include <linux/slab.h>
 #include <asm/system.h>
@@ -220,7 +221,7 @@ static void pty_set_termios(struct tty_struct *tty,
 *      @tty: tty being resized
 *      @ws: window size being set.
 *
- *      Update the termios variables and send the neccessary signals to
+ *      Update the termios variables and send the necessary signals to
 *      peform a terminal resize correctly
 */
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 2849713d2231..2fd3d39995d5 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1191,7 +1191,7 @@ const struct file_operations urandom_fops = {
 void generate_random_uuid(unsigned char uuid_out[16])
 {
        get_random_bytes(uuid_out, 16);
-        /* Set UUID version to 4 --- truely random generation */
+        /* Set UUID version to 4 --- truly random generation */
        uuid_out[6] = (uuid_out[6] & 0x0F) | 0x40;
        /* Set the UUID variant to DCE */
        uuid_out[8] = (uuid_out[8] & 0x3F) | 0x80;
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 64acd05f71c8..8756ab0daa8b 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -20,6 +20,7 @@
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/smp_lock.h>
+#include <linux/gfp.h>
 #include <asm/uaccess.h>
@@ -247,6 +248,7 @@ static const struct file_operations raw_fops = {
        .aio_read =     generic_file_aio_read,
        .write  =       do_sync_write,
        .aio_write =    blkdev_aio_write,
+        .fsync  =       blkdev_fsync,
        .open   =       raw_open,
        .release=       raw_release,
        .ioctl  =       raw_ioctl,
diff --git a/drivers/char/rio/rioinit.c b/drivers/char/rio/rioinit.c
index be0ba401966e..24a282bb89d4 100644
--- a/drivers/char/rio/rioinit.c
+++ b/drivers/char/rio/rioinit.c
@@ -31,7 +31,6 @@
 */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <asm/io.h>
diff --git a/drivers/char/rio/riointr.c b/drivers/char/rio/riointr.c
index 71f87600907c..2e71aecae206 100644
--- a/drivers/char/rio/riointr.c
+++ b/drivers/char/rio/riointr.c
@@ -31,7 +31,6 @@
 */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/char/rio/rioparam.c b/drivers/char/rio/rioparam.c
index d687c17be152..6415f3f32a72 100644
--- a/drivers/char/rio/rioparam.c
+++ b/drivers/char/rio/rioparam.c
@@ -31,7 +31,6 @@
 */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
 #include <asm/io.h>
diff --git a/drivers/char/rio/rioroute.c b/drivers/char/rio/rioroute.c
index 706c2a25f7aa..f9b936ac3394 100644
--- a/drivers/char/rio/rioroute.c
+++ b/drivers/char/rio/rioroute.c
@@ -31,7 +31,6 @@
 */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <asm/io.h>
 #include <asm/system.h>
diff --git a/drivers/char/rio/riotty.c b/drivers/char/rio/riotty.c
index 47fab7c33073..8a90393faf3c 100644
--- a/drivers/char/rio/riotty.c
+++ b/drivers/char/rio/riotty.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
 #include <linux/string.h>
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 0a8d1e56c993..b02332a5412f 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -909,6 +909,7 @@ static int rc_open(struct tty_struct *tty, struct file *filp)
        if (error)
                return error;
+        tty->driver_data = port;
        return tty_port_open(&port->port, tty, filp);
 }
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 986aa606a6b6..8dfd24721a82 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -64,6 +64,7 @@
 #include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/tty_flip.h>
+#include <linux/gfp.h>
 #include <asm/system.h>
 #include <asm/io.h>
@@ -1989,7 +1990,7 @@ void mvme167_serial_console_setup(int cflag)
        /*
         * Attempt to set up all channels to something reasonable, and
         * bang out a INIT_CHAN command.  We should then be able to limit
-         * the ammount of fiddling we have to do in normal running.
+         * the amount of fiddling we have to do in normal running.
         */
        for (ch = 3; ch >= 0; ch--) {
diff --git a/drivers/char/snsc_event.c b/drivers/char/snsc_event.c
index 55a95892ccf9..ee156948b9f8 100644
--- a/drivers/char/snsc_event.c
+++ b/drivers/char/snsc_event.c
@@ -17,6 +17,7 @@
 #include <linux/interrupt.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <asm/byteorder.h>
 #include <asm/sn/sn_sal.h>
 #include <asm/unaligned.h>
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index bba727c3807e..73f66d03624d 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -50,6 +50,7 @@
 #include <linux/err.h>
 #include <linux/kfifo.h>
 #include <linux/platform_device.h>
+#include <linux/gfp.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 07ac14d949ce..2c24fcdc722a 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -94,6 +94,7 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/uaccess.h>
+#include <linux/gfp.h>
 #include "specialix_io8.h"
 #include "cd1865.h"
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 0e511d61f544..6049fd731924 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -724,7 +724,6 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 {
        struct stlport  *portp;
        struct stlbrd   *brdp;
-        struct tty_port *port;
        unsigned int    minordev, brdnr, panelnr;
        int             portnr;
@@ -754,7 +753,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
        portp = brdp->panels[panelnr]->ports[portnr];
        if (portp == NULL)
                return -ENODEV;
-        port = &portp->port;
+        tty->driver_data = portp;
        return tty_port_open(&portp->port, tty, filp);
 }
@@ -841,7 +841,8 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
        pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
        portp = tty->driver_data;
-        BUG_ON(portp == NULL);
+        if(portp == NULL)
+                return;
        tty_port_close(&portp->port, tty, filp);
 }
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 1ae2de7d8b4f..59de2525d303 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -38,6 +38,7 @@
 #include <linux/workqueue.h>
 #include <linux/hrtimer.h>
 #include <linux/oom.h>
+#include <linux/slab.h>
 #include <asm/ptrace.h>
 #include <asm/irq_regs.h>
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index f06bb37defb1..068c816e6942 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -24,6 +24,7 @@
 */
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index bf2170fb1cdd..0636520fa9bf 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -22,6 +22,7 @@
 #include <linux/fs.h>
 #include <linux/security.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <acpi/acpi.h>
 #include "tpm.h"
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 70efba2ee053..a605cb7dd898 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -20,6 +20,7 @@
 */
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include "tpm.h"
 /* National definitions */
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 2405f17b29dd..94345994f8a6 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pnp.h>
+#include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/wait.h>
 #include "tpm.h"
diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
index ac16fbec72d0..1b8ee590b4ca 100644
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@ -10,6 +10,7 @@
 */
 #include <linux/audit.h>
+#include <linux/slab.h>
 #include <linux/tty.h>
 struct tty_audit_buf {
@@ -148,7 +149,6 @@ void tty_audit_fork(struct signal_struct *sig)
        spin_lock_irq(&current->sighand->siglock);
        sig->audit_tty = current->signal->audit_tty;
        spin_unlock_irq(&current->sighand->siglock);
-        sig->tty_audit_buf = NULL;
 }
 /**
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
index af8d97715728..7ee52164d474 100644
--- a/drivers/char/tty_buffer.c
+++ b/drivers/char/tty_buffer.c
@@ -248,7 +248,7 @@ int tty_insert_flip_string_fixed_flag(struct tty_struct *tty,
 {
        int copied = 0;
        do {
-                int goal = min(size - copied, TTY_BUFFER_PAGE);
+                int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
                int space = tty_buffer_request_room(tty, goal);
                struct tty_buffer *tb = tty->buf.tail;
                /* If there is no space then tb may be NULL */
@@ -285,7 +285,7 @@ int tty_insert_flip_string_flags(struct tty_struct *tty,
 {
        int copied = 0;
        do {
-                int goal = min(size - copied, TTY_BUFFER_PAGE);
+                int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
                int space = tty_buffer_request_room(tty, goal);
                struct tty_buffer *tb = tty->buf.tail;
                /* If there is no space then tb may be NULL */
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index dcb9083ecde0..6da962c9b21c 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1423,6 +1423,8 @@ static void release_one_tty(struct work_struct *work)
        list_del_init(&tty->tty_files);
        file_list_unlock();
+        put_pid(tty->pgrp);
+        put_pid(tty->session);
        free_tty_struct(tty);
 }
@@ -2028,7 +2030,7 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
 *      @rows: rows (character)
 *      @cols: cols (character)
 *
- *      Update the termios variables and send the neccessary signals to
+ *      Update the termios variables and send the necessary signals to
 *      peform a terminal resize correctly
 */
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index be492dd66437..a3bd1d0b66cf 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -119,7 +119,7 @@ EXPORT_SYMBOL(tty_port_tty_set);
 static void tty_port_shutdown(struct tty_port *port)
 {
        mutex_lock(&port->mutex);
-        if (port->ops->shutdown &&
+        if (port->ops->shutdown && !port->console &&
                test_and_clear_bit(ASYNCB_INITIALIZED, &port->flags))
                        port->ops->shutdown(port);
        mutex_unlock(&port->mutex);
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 042c8149a6d1..1144a04cda6e 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -47,6 +47,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index f404ccfc9c20..196428c2287a 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -25,6 +25,7 @@
 #include <linux/list.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/virtio.h>
 #include <linux/virtio_console.h>
@@ -32,6 +33,35 @@
 #include <linux/workqueue.h>
 #include "hvc_console.h"
+/* Moved here from .h file in order to disable MULTIPORT. */
+#define VIRTIO_CONSOLE_F_MULTIPORT 1    /* Does host provide multiple ports? */
+struct virtio_console_multiport_conf {
+        struct virtio_console_config config;
+        /* max. number of ports this device can hold */
+        __u32 max_nr_ports;
+        /* number of ports added so far */
+        __u32 nr_ports;
+} __attribute__((packed));
+/*
+ * A message that's passed between the Host and the Guest for a
+ * particular port.
+ */
+struct virtio_console_control {
+        __u32 id;               /* Port number */
+        __u16 event;            /* The kind of control event (see below) */
+        __u16 value;            /* Extra information for the key */
+};
+/* Some events for control messages */
+#define VIRTIO_CONSOLE_PORT_READY       0
+#define VIRTIO_CONSOLE_CONSOLE_PORT     1
+#define VIRTIO_CONSOLE_RESIZE           2
+#define VIRTIO_CONSOLE_PORT_OPEN        3
+#define VIRTIO_CONSOLE_PORT_NAME        4
+#define VIRTIO_CONSOLE_PORT_REMOVE      5
 /*
 * This is a global struct for storing common data for all the devices
 * this driver handles.
@@ -120,7 +150,7 @@ struct ports_device {
        spinlock_t cvq_lock;
        /* The current config space is stored here */
-        struct virtio_console_config config;
+        struct virtio_console_multiport_conf config;
        /* The virtio device we're associated with */
        struct virtio_device *vdev;
@@ -415,20 +445,16 @@ static ssize_t send_buf(struct port *port, void *in_buf, size_t in_count)
        out_vq->vq_ops->kick(out_vq);
        if (ret < 0) {
-                len = 0;
+                in_count = 0;
                goto fail;
        }
-        /*
+        /* Wait till the host acknowledges it pushed out the data we sent. */
-         * Wait till the host acknowledges it pushed out the data we
-         * sent. Also ensure we return to userspace the number of
-         * bytes that were successfully consumed by the host.
-         */
        while (!out_vq->vq_ops->get_buf(out_vq, &len))
                cpu_relax();
 fail:
        /* We're expected to return the amount of data we wrote */
-        return len;
+        return in_count;
 }
 /*
@@ -645,13 +671,13 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 {
        struct port *port;
+        if (unlikely(early_put_chars))
+                return early_put_chars(vtermno, buf, count);
        port = find_port_by_vtermno(vtermno);
        if (!port)
                return 0;
-        if (unlikely(early_put_chars))
-                return early_put_chars(vtermno, buf, count);
        return send_buf(port, (void *)buf, count);
 }
@@ -681,6 +707,10 @@ static void resize_console(struct port *port)
        struct virtio_device *vdev;
        struct winsize ws;
+        /* The port could have been hot-unplugged */
+        if (!port)
+                return;
        vdev = port->portdev->vdev;
        if (virtio_has_feature(vdev, VIRTIO_CONSOLE_F_SIZE)) {
                vdev->config->get(vdev,
@@ -947,11 +977,18 @@ static void handle_control_message(struct ports_device *portdev,
                 */
                err = sysfs_create_group(&port->dev->kobj,
                                         &port_attribute_group);
-                if (err)
+                if (err) {
                        dev_err(port->dev,
                                "Error %d creating sysfs device attributes\n",
                                err);
+                } else {
+                        /*
+                         * Generate a udev event so that appropriate
+                         * symlinks can be created based on udev
+                         * rules.
+                         */
+                        kobject_uevent(&port->dev->kobj, KOBJ_CHANGE);
+                }
                break;
        case VIRTIO_CONSOLE_PORT_REMOVE:
                /*
@@ -1206,7 +1243,7 @@ fail:
 */
 static void config_work_handler(struct work_struct *work)
 {
-        struct virtio_console_config virtconconf;
+        struct virtio_console_multiport_conf virtconconf;
        struct ports_device *portdev;
        struct virtio_device *vdev;
        int err;
@@ -1215,7 +1252,8 @@ static void config_work_handler(struct work_struct *work)
        vdev = portdev->vdev;
        vdev->config->get(vdev,
-                          offsetof(struct virtio_console_config, nr_ports),
+                          offsetof(struct virtio_console_multiport_conf,
+                                   nr_ports),
                          &virtconconf.nr_ports,
                          sizeof(virtconconf.nr_ports));
@@ -1407,16 +1445,19 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
        multiport = false;
        portdev->config.nr_ports = 1;
        portdev->config.max_nr_ports = 1;
+#if 0 /* Multiport is not quite ready yet --RR */
        if (virtio_has_feature(vdev, VIRTIO_CONSOLE_F_MULTIPORT)) {
                multiport = true;
                vdev->features[0] |= 1 << VIRTIO_CONSOLE_F_MULTIPORT;
-                vdev->config->get(vdev, offsetof(struct virtio_console_config,
+                vdev->config->get(vdev,
-                                                 nr_ports),
+                                  offsetof(struct virtio_console_multiport_conf,
+                                           nr_ports),
                                  &portdev->config.nr_ports,
                                  sizeof(portdev->config.nr_ports));
-                vdev->config->get(vdev, offsetof(struct virtio_console_config,
+                vdev->config->get(vdev,
-                                                 max_nr_ports),
+                                  offsetof(struct virtio_console_multiport_conf,
+                                           max_nr_ports),
                                  &portdev->config.max_nr_ports,
                                  sizeof(portdev->config.max_nr_ports));
                if (portdev->config.nr_ports > portdev->config.max_nr_ports) {
@@ -1432,6 +1473,7 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
        /* Let the Host know we support multiple ports.*/
        vdev->config->finalize_features(vdev);
+#endif
        err = init_vqs(portdev);
        if (err < 0) {
@@ -1514,7 +1556,6 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
        VIRTIO_CONSOLE_F_SIZE,
-        VIRTIO_CONSOLE_F_MULTIPORT,
 };
 static struct virtio_driver virtio_console = {
diff --git a/drivers/char/vme_scc.c b/drivers/char/vme_scc.c
index 8b24729fec89..12de1202d22c 100644
--- a/drivers/char/vme_scc.c
+++ b/drivers/char/vme_scc.c
@@ -27,7 +27,6 @@
 #include <linux/fcntl.h>
 #include <linux/major.h>
 #include <linux/delay.h>
-#include <linux/slab.h>
 #include <linux/miscdevice.h>
 #include <linux/console.h>
 #include <linux/init.h>
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 50faa1fb0f06..bd1d1164fec5 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -821,7 +821,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
 *
 *      Resize a virtual console, clipping according to the actual constraints.
 *      If the caller passes a tty structure then update the termios winsize
- *      information and perform any neccessary signal handling.
+ *      information and perform any necessary signal handling.
 *
 *      Caller must hold the console semaphore. Takes the termios mutex and
 *      ctrl_lock of the tty IFF a tty is passed.
@@ -2119,8 +2119,6 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
        uint8_t inverse;
        uint8_t width;
        u16 himask, charmask;
-        const unsigned char *orig_buf = NULL;
-        int orig_count;
        if (in_interrupt())
                return count;
@@ -2142,8 +2140,6 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
            release_console_sem();
            return 0;
        }
-        orig_buf = buf;
-        orig_count = count;
        himask = vc->vc_hi_font_mask;
        charmask = himask ? 0x1ff : 0xff;
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 87778dcf8727..6aa10284104a 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -888,7 +888,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                        ret = -EFAULT;
                        goto out;
                }
-                if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS && tmp.mode != VT_PROCESS_AUTO) {
+                if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS) {
                        ret = -EINVAL;
                        goto out;
                }
@@ -1622,7 +1622,7 @@ static void complete_change_console(struct vc_data *vc)
         * telling it that it has acquired. Also check if it has died and
         * clean up (similar to logic employed in change_console())
         */
-        if (vc->vt_mode.mode == VT_PROCESS || vc->vt_mode.mode == VT_PROCESS_AUTO) {
+        if (vc->vt_mode.mode == VT_PROCESS) {
                /*
                 * Send the signal as privileged - kill_pid() will
                 * tell us if the process has gone or something else
@@ -1682,7 +1682,7 @@ void change_console(struct vc_data *new_vc)
         * vt to auto control.
         */
        vc = vc_cons[fg_console].d;
-        if (vc->vt_mode.mode == VT_PROCESS || vc->vt_mode.mode == VT_PROCESS_AUTO) {
+        if (vc->vt_mode.mode == VT_PROCESS) {
                /*
                 * Send the signal as privileged - kill_pid() will
                 * tell us if the process has gone or something else
@@ -1693,28 +1693,27 @@ void change_console(struct vc_data *new_vc)
                 */
                vc->vt_newvt = new_vc->vc_num;
                if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
-                        if(vc->vt_mode.mode == VT_PROCESS)
-                                /*
-                                 * It worked. Mark the vt to switch to and
-                                 * return. The process needs to send us a
-                                 * VT_RELDISP ioctl to complete the switch.
-                                 */
-                                return;
-                } else {
                        /*
-                         * The controlling process has died, so we revert back to
+                         * It worked. Mark the vt to switch to and
-                         * normal operation. In this case, we'll also change back
+                         * return. The process needs to send us a
-                         * to KD_TEXT mode. I'm not sure if this is strictly correct
+                         * VT_RELDISP ioctl to complete the switch.
-                         * but it saves the agony when the X server dies and the screen
-                         * remains blanked due to KD_GRAPHICS! It would be nice to do
-                         * this outside of VT_PROCESS but there is no single process
-                         * to account for and tracking tty count may be undesirable.
                         */
-                        reset_vc(vc);
+                        return;
                }
                /*
-                 * Fall through to normal (VT_AUTO and VT_PROCESS_AUTO) handling of the switch...
+                 * The controlling process has died, so we revert back to
+                 * normal operation. In this case, we'll also change back
+                 * to KD_TEXT mode. I'm not sure if this is strictly correct
+                 * but it saves the agony when the X server dies and the screen
+                 * remains blanked due to KD_GRAPHICS! It would be nice to do
+                 * this outside of VT_PROCESS but there is no single process
+                 * to account for and tracking tty count may be undesirable.
+                 */
+                reset_vc(vc);
+                /*
+                 * Fall through to normal (VT_AUTO) handling of the switch...
                 */
        }
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index 4846d50199f3..7261b8d9087c 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -86,6 +86,7 @@
 #include <linux/fs.h>
 #include <linux/cdev.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>