15 files changed, 232 insertions, 100 deletions

diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index cd18493c9527..aa5c782bf015 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -927,20 +927,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
 
         /*
-        * If the device has not been properly setup, the following will catch
-        * the problem and should stop the system from crashing.
-        * 20030610 - hamish@zot.org
-        */
-        if (pci_enable_device(pdev)) {
-                dev_err(&pdev->dev, "can't enable PCI device\n");
-                agp_put_bridge(bridge);
-                return -ENODEV;
-        }
-
-        /*
         * The following fixes the case where the BIOS has "forgotten" to
         * provide an address range for the GART.
         * 20030610 - hamish@zot.org
+        * This happens before pci_enable_device() intentionally;
+        * calling pci_enable_device() before assigning the resource
+        * will result in the GART being disabled on machines with such
+        * BIOSs (the GART ends up with a BAR starting at 0, which
+        * conflicts a lot of other devices).
         */
         r = &pdev->resource[0];
         if (!r->start && r->end) {
@@ -951,6 +945,17 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 }
         }
 
+        /*
+        * If the device has not been properly setup, the following will catch
+        * the problem and should stop the system from crashing.
+        * 20030610 - hamish@zot.org
+        */
+        if (pci_enable_device(pdev)) {
+                dev_err(&pdev->dev, "can't enable PCI device\n");
+                agp_put_bridge(bridge);
+                return -ENODEV;
+        }
+
         /* Fill in the mode register */
         if (cap_ptr) {
                 pci_read_config_dword(pdev,
@@ -1049,6 +1054,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_G45_HB),
         ID(PCI_DEVICE_ID_INTEL_G41_HB),
         ID(PCI_DEVICE_ID_INTEL_B43_HB),
+        ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 75e0a3497888..6ea3bf6e5b1a 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -534,7 +534,7 @@ static void intel_i830_init_gtt_entries(void)
 
         pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
 
-        if (IS_I965) {
+        if (IS_G33 || IS_I965) {
                 u32 pgetbl_ctl;
                 pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
 
@@ -567,22 +567,6 @@ static void intel_i830_init_gtt_entries(void)
                         size = 512;
                 }
                 size += 4; /* add in BIOS popup space */
-        } else if (IS_G33 && !IS_PINEVIEW) {
-        /* G33's GTT size defined in gmch_ctrl */
-                switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
-                case G33_PGETBL_SIZE_1M:
-                        size = 1024;
-                        break;
-                case G33_PGETBL_SIZE_2M:
-                        size = 2048;
-                        break;
-                default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & G33_PGETBL_SIZE_MASK));
-                        size = 512;
-                }
-                size += 4;
         } else if (IS_G4X || IS_PINEVIEW) {
                 /* On 4 series hardware, GTT stolen is separate from graphics
                  * stolen, ignore it in stolen gtt entries counting.  However,
@@ -1257,24 +1241,31 @@ static int intel_i915_get_gtt_size(void)
         int size;
 
         if (IS_G33) {
-                u16 gmch_ctrl;
+                u32 pgetbl_ctl;
+                pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
 
-                /* G33's GTT size defined in gmch_ctrl */
-                pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
-                case I830_GMCH_GMS_STOLEN_512:
+                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+                case I965_PGETBL_SIZE_128KB:
+                        size = 128;
+                        break;
+                case I965_PGETBL_SIZE_256KB:
+                        size = 256;
+                        break;
+                case I965_PGETBL_SIZE_512KB:
                         size = 512;
                         break;
-                case I830_GMCH_GMS_STOLEN_1024:
+                case I965_PGETBL_SIZE_1MB:
                         size = 1024;
                         break;
-                case I830_GMCH_GMS_STOLEN_8192:
-                        size = 8*1024;
+                case I965_PGETBL_SIZE_2MB:
+                        size = 2048;
+                        break;
+                case I965_PGETBL_SIZE_1_5MB:
+                        size = 1024 + 512;
                         break;
                 default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & I830_GMCH_GMS_MASK));
+                        dev_info(&intel_private.pcidev->dev,
+                                 "unknown page table size, assuming 512KB\n");
                         size = 512;
                 }
         } else {
@@ -1306,14 +1297,6 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
         pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
         pci_read_config_dword(intel_private.pcidev, I915_PTEADDR, &temp2);
 
-        gtt_map_size = intel_i915_get_gtt_size();
-
-        intel_private.gtt = ioremap(temp2, gtt_map_size);
-        if (!intel_private.gtt)
-                return -ENOMEM;
-
-        intel_private.gtt_total_size = gtt_map_size / 4;
-
         temp &= 0xfff80000;
 
         intel_private.registers = ioremap(temp, 128 * 4096);
@@ -1322,6 +1305,14 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
                 return -ENOMEM;
         }
 
+        gtt_map_size = intel_i915_get_gtt_size();
+
+        intel_private.gtt = ioremap(temp2, gtt_map_size);
+        if (!intel_private.gtt)
+                return -ENOMEM;
+
+        intel_private.gtt_total_size = gtt_map_size / 4;
+
         temp = readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
         global_cache_flush();   /* FIXME: ? */
 
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index a0a1829d3198..f8e7d89ceb2c 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -479,6 +479,21 @@ static int hpet_ioctl_ieon(struct hpet_dev *devp)
         if (irq) {
                 unsigned long irq_flags;
 
+                if (devp->hd_flags & HPET_SHARED_IRQ) {
+                        /*
+                         * To prevent the interrupt handler from seeing an
+                         * unwanted interrupt status bit, program the timer
+                         * so that it will not fire in the near future ...
+                         */
+                        writel(readl(&timer->hpet_config) & ~Tn_TYPE_CNF_MASK,
+                               &timer->hpet_config);
+                        write_counter(read_counter(&hpet->hpet_mc),
+                                      &timer->hpet_compare);
+                        /* ... and clear any left-over status. */
+                        isr = 1 << (devp - devp->hd_hpets->hp_dev);
+                        writel(isr, &hpet->hpet_isr);
+                }
+
                 sprintf(devp->hd_name, "hpet%d", (int)(devp - hpetp->hp_dev));
                 irq_flags = devp->hd_flags & HPET_SHARED_IRQ
                                                 ? IRQF_SHARED : IRQF_DISABLED;
@@ -970,6 +985,8 @@ static int hpet_acpi_add(struct acpi_device *device)
                 return -ENODEV;
 
         if (!data.hd_address || !data.hd_nirqs) {
+                if (data.hd_address)
+                        iounmap(data.hd_address);
                 printk("%s: no address or irqs in _CRS\n", __func__);
                 return -ENODEV;
         }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7bd7c45b53ef..22abd188fe12 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -320,6 +320,7 @@ static int unload_when_empty = 1;
 static int add_smi(struct smi_info *smi);
 static int try_smi_init(struct smi_info *smi);
 static void cleanup_one_si(struct smi_info *to_clean);
+static void cleanup_ipmi_si(void);
 
 static ATOMIC_NOTIFIER_HEAD(xaction_notifier_list);
 static int register_xaction_notifier(struct notifier_block *nb)
@@ -1665,6 +1666,17 @@ static int check_hotmod_int_op(const char *curr, const char *option,
         return 0;
 }
 
+static struct smi_info *smi_info_alloc(void)
+{
+        struct smi_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+        if (info) {
+                spin_lock_init(&info->si_lock);
+                spin_lock_init(&info->msg_lock);
+        }
+        return info;
+}
+
 static int hotmod_handler(const char *val, struct kernel_param *kp)
 {
         char *str = kstrdup(val, GFP_KERNEL);
@@ -1779,7 +1791,7 @@ static int hotmod_handler(const char *val, struct kernel_param *kp)
                 }
 
                 if (op == HM_ADD) {
-                        info = kzalloc(sizeof(*info), GFP_KERNEL);
+                        info = smi_info_alloc();
                         if (!info) {
                                 rv = -ENOMEM;
                                 goto out;
@@ -1844,7 +1856,7 @@ static __devinit void hardcode_find_bmc(void)
                 if (!ports[i] && !addrs[i])
                         continue;
 
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -2028,7 +2040,7 @@ static __devinit int try_init_spmi(struct SPMITable *spmi)
                 return -ENODEV;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data (3)\n");
                 return -ENOMEM;
@@ -2138,7 +2150,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         if (!acpi_dev)
                 return -ENODEV;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2319,7 +2331,7 @@ static __devinit void try_init_dmi(struct dmi_ipmi_data *ipmi_data)
 {
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data\n");
                 return;
@@ -2426,7 +2438,7 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2567,7 +2579,7 @@ static int __devinit ipmi_of_probe(struct platform_device *dev,
                 return -EINVAL;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
 
         if (!info) {
                 dev_err(&dev->dev,
@@ -3014,7 +3026,7 @@ static __devinit void default_find_bmc(void)
                 if (check_legacy_ioport(ipmi_defaults[i].port))
                         continue;
 #endif
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -3139,9 +3151,6 @@ static int try_smi_init(struct smi_info *new_smi)
                 goto out_err;
         }
 
-        spin_lock_init(&(new_smi->si_lock));
-        spin_lock_init(&(new_smi->msg_lock));
-
         /* Do low-level detection first. */
         if (new_smi->handlers->detect(new_smi->si_sm)) {
                 if (new_smi->addr_source)
@@ -3428,16 +3437,7 @@ static __devinit int init_ipmi_si(void)
         mutex_lock(&smi_infos_lock);
         if (unload_when_empty && list_empty(&smi_infos)) {
                 mutex_unlock(&smi_infos_lock);
-#ifdef CONFIG_PCI
-                if (pci_registered)
-                        pci_unregister_driver(&ipmi_pci_driver);
-#endif
-
-#ifdef CONFIG_PPC_OF
-                if (of_registered)
-                        of_unregister_platform_driver(&ipmi_of_platform_driver);
-#endif
-                driver_unregister(&ipmi_driver.driver);
+                cleanup_ipmi_si();
                 printk(KERN_WARNING PFX
                        "Unable to find any System Interface(s)\n");
                 return -ENODEV;
diff --git a/drivers/char/n_gsm.c b/drivers/char/n_gsm.c
index 04ef3ef0a422..0e62674072eb 100644
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
                 if (msg->len < 128)
                         *--dp = (msg->len << 1) | EA;
                 else {
-                        *--dp = (msg->len >> 6) | EA;
-                        *--dp = (msg->len & 127) << 1;
+                        *--dp = (msg->len >> 7);        /* bits 7 - 15 */
+                        *--dp = (msg->len & 127) << 1;  /* bits 0 - 6 */
                 }
         }
 
@@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data,
 {
         struct gsm_msg *msg;
         msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);
+        if (msg == NULL)
+                return;
         msg->data[0] = (cmd & 0xFE) << 1 | EA;  /* Clear C/R */
         msg->data[1] = (dlen << 1) | EA;
         memcpy(msg->data + 2, data, dlen);
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 9ecd6bef5d3b..45f9fad4f5dc 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -4127,6 +4127,8 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         if (cmd != SIOCWANDEV)
                 return hdlc_ioctl(dev, ifr, cmd);
 
+        memset(&new_line, 0, size);
+
         switch(ifr->ifr_settings.type) {
         case IF_GET_IFACE: /* return current sync_serial_settings */
 
diff --git a/drivers/char/ramoops.c b/drivers/char/ramoops.c
index 74f00b5ffa36..9445f48c692f 100644
--- a/drivers/char/ramoops.c
+++ b/drivers/char/ramoops.c
@@ -27,7 +27,6 @@
 #include <linux/ioport.h>
 
 #define RAMOOPS_KERNMSG_HDR "===="
-#define RAMOOPS_HEADER_SIZE   (5 + sizeof(struct timeval))
 
 #define RECORD_SIZE 4096
 
@@ -63,8 +62,8 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
                         struct ramoops_context, dump);
         unsigned long s1_start, s2_start;
         unsigned long l1_cpy, l2_cpy;
-        int res;
-        char *buf;
+        int res, hdr_size;
+        char *buf, *buf_orig;
         struct timeval timestamp;
 
         /* Only dump oopses if dump_oops is set */
@@ -72,6 +71,8 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
                 return;
 
         buf = (char *)(cxt->virt_addr + (cxt->count * RECORD_SIZE));
+        buf_orig = buf;
+
         memset(buf, '\0', RECORD_SIZE);
         res = sprintf(buf, "%s", RAMOOPS_KERNMSG_HDR);
         buf += res;
@@ -79,8 +80,9 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
         res = sprintf(buf, "%lu.%lu\n", (long)timestamp.tv_sec, (long)timestamp.tv_usec);
         buf += res;
 
-        l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE));
-        l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE) - l2_cpy);
+        hdr_size = buf - buf_orig;
+        l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - hdr_size));
+        l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - hdr_size) - l2_cpy);
 
         s2_start = l2 - l2_cpy;
         s1_start = l1 - l1_cpy;
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 05ad4a17a28f..2ec5f33cdbd0 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -354,12 +354,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
                     tpm_protected_ordinal_duration[ordinal &
                                                    TPM_PROTECTED_ORDINAL_MASK];
 
-        if (duration_idx != TPM_UNDEFINED)
+        if (duration_idx != TPM_UNDEFINED) {
                 duration = chip->vendor.duration[duration_idx];
-        if (duration <= 0)
+                /* if duration is 0, it's because chip->vendor.duration wasn't */
+                /* filled yet, so we set the lowest timeout just to give enough */
+                /* time for tpm_get_timeouts() to succeed */
+                return (duration <= 0 ? HZ : duration);
+        } else
                 return 2 * 60 * HZ;
-        else
-                return duration;
 }
 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
 
@@ -565,9 +567,11 @@ duration:
         if (rc)
                 return;
 
-        if (be32_to_cpu(tpm_cmd.header.out.return_code)
-            != 3 * sizeof(u32))
+        if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
+            be32_to_cpu(tpm_cmd.header.out.length)
+            != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
                 return;
+
         duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
         chip->vendor.duration[TPM_SHORT] =
             usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
@@ -911,6 +915,18 @@ ssize_t tpm_show_caps_1_2(struct device * dev,
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
 
+ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%d %d %d\n",
+                       jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
+                       jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
+                       jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
+}
+EXPORT_SYMBOL_GPL(tpm_show_timeouts);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 792868d24f2a..ba1779c2cffd 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -56,6 +56,8 @@ extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_temp_deactivated(struct device *,
                                          struct device_attribute *attr, char *);
+extern ssize_t tpm_show_timeouts(struct device *,
+                                 struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 1030f8420137..3e1f2bbeec11 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/wait.h>
+#include <linux/acpi.h>
 #include "tpm.h"
 
 #define TPM_HEADER_SIZE 10
@@ -78,6 +79,26 @@ enum tis_defaults {
 static LIST_HEAD(tis_chips);
 static DEFINE_SPINLOCK(tis_lock);
 
+#ifdef CONFIG_ACPI
+static int is_itpm(struct pnp_dev *dev)
+{
+        struct acpi_device *acpi = pnp_acpi_device(dev);
+        struct acpi_hardware_id *id;
+
+        list_for_each_entry(id, &acpi->pnp.ids, list) {
+                if (!strcmp("INTC0102", id->id))
+                        return 1;
+        }
+
+        return 0;
+}
+#else
+static int is_itpm(struct pnp_dev *dev)
+{
+        return 0;
+}
+#endif
+
 static int check_locality(struct tpm_chip *chip, int l)
 {
         if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
@@ -355,6 +376,7 @@ static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
                    NULL);
 static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
 
 static struct attribute *tis_attrs[] = {
         &dev_attr_pubek.attr,
@@ -364,7 +386,8 @@ static struct attribute *tis_attrs[] = {
         &dev_attr_owned.attr,
         &dev_attr_temp_deactivated.attr,
         &dev_attr_caps.attr,
-        &dev_attr_cancel.attr, NULL,
+        &dev_attr_cancel.attr,
+        &dev_attr_timeouts.attr, NULL,
 };
 
 static struct attribute_group tis_attr_grp = {
@@ -472,6 +495,9 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
 
+        if (is_itpm(to_pnp_dev(dev)))
+                itpm = 1;
+
         if (itpm)
                 dev_info(dev, "Intel iTPM workaround enabled\n");
 
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
index cc1e9850d655..d8210ca00720 100644
--- a/drivers/char/tty_buffer.c
+++ b/drivers/char/tty_buffer.c
@@ -413,7 +413,8 @@ static void flush_to_ldisc(struct work_struct *work)
         spin_lock_irqsave(&tty->buf.lock, flags);
 
         if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
-                struct tty_buffer *head;
+                struct tty_buffer *head, *tail = tty->buf.tail;
+                int seen_tail = 0;
                 while ((head = tty->buf.head) != NULL) {
                         int count;
                         char *char_buf;
@@ -423,6 +424,15 @@ static void flush_to_ldisc(struct work_struct *work)
                         if (!count) {
                                 if (head->next == NULL)
                                         break;
+                                /*
+                                  There's a possibility tty might get new buffer
+                                  added during the unlock window below. We could
+                                  end up spinning in here forever hogging the CPU
+                                  completely. To avoid this let's have a rest each
+                                  time we processed the tail buffer.
+                                */
+                                if (tail == head)
+                                        seen_tail = 1;
                                 tty->buf.head = head->next;
                                 tty_buffer_free(tty, head);
                                 continue;
@@ -432,7 +442,7 @@ static void flush_to_ldisc(struct work_struct *work)
                            line discipline as we want to empty the queue */
                         if (test_bit(TTY_FLUSHPENDING, &tty->flags))
                                 break;
-                        if (!tty->receive_room) {
+                        if (!tty->receive_room || seen_tail) {
                                 schedule_delayed_work(&tty->buf.work, 1);
                                 break;
                         }
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 613c852ee0fe..e0f7f4b8c286 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -553,6 +553,9 @@ void __tty_hangup(struct tty_struct *tty)
 
         tty_lock();
 
+        /* some functions below drop BTM, so we need this bit */
+        set_bit(TTY_HUPPING, &tty->flags);
+
         /* inuse_filps is protected by the single tty lock,
            this really needs to change if we want to flush the
            workqueue with the lock held */
@@ -572,6 +575,10 @@ void __tty_hangup(struct tty_struct *tty)
         }
         spin_unlock(&tty_files_lock);
 
+        /*
+         * it drops BTM and thus races with reopen
+         * we protect the race by TTY_HUPPING
+         */
         tty_ldisc_hangup(tty);
 
         read_lock(&tasklist_lock);
@@ -609,7 +616,6 @@ void __tty_hangup(struct tty_struct *tty)
         tty->session = NULL;
         tty->pgrp = NULL;
         tty->ctrl_status = 0;
-        set_bit(TTY_HUPPED, &tty->flags);
         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
         /* Account for the p->signal references we killed */
@@ -635,6 +641,7 @@ void __tty_hangup(struct tty_struct *tty)
          * can't yet guarantee all that.
          */
         set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
         tty_ldisc_enable(tty);
 
         tty_unlock();
@@ -1304,7 +1311,9 @@ static int tty_reopen(struct tty_struct *tty)
 {
         struct tty_driver *driver = tty->driver;
 
-        if (test_bit(TTY_CLOSING, &tty->flags))
+        if (test_bit(TTY_CLOSING, &tty->flags) ||
+                        test_bit(TTY_HUPPING, &tty->flags) ||
+                        test_bit(TTY_LDISC_CHANGING, &tty->flags))
                 return -EIO;
 
         if (driver->type == TTY_DRIVER_TYPE_PTY &&
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 412f9775d19c..4214d58276f7 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -47,6 +47,7 @@
 
 static DEFINE_SPINLOCK(tty_ldisc_lock);
 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
+static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_idle);
 /* Line disc dispatch table */
 static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
 
@@ -83,6 +84,7 @@ static void put_ldisc(struct tty_ldisc *ld)
                 return;
         }
         local_irq_restore(flags);
+        wake_up(&tty_ldisc_idle);
 }
 
 /**
@@ -452,6 +454,8 @@ static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
                 /* BTM here locks versus a hangup event */
                 WARN_ON(!tty_locked());
                 ret = ld->ops->open(tty);
+                if (ret)
+                        clear_bit(TTY_LDISC_OPEN, &tty->flags);
                 return ret;
         }
         return 0;
@@ -531,6 +535,23 @@ static int tty_ldisc_halt(struct tty_struct *tty)
 }
 
 /**
+ *      tty_ldisc_wait_idle     -       wait for the ldisc to become idle
+ *      @tty: tty to wait for
+ *
+ *      Wait for the line discipline to become idle. The discipline must
+ *      have been halted for this to guarantee it remains idle.
+ */
+static int tty_ldisc_wait_idle(struct tty_struct *tty)
+{
+        int ret;
+        ret = wait_event_interruptible_timeout(tty_ldisc_idle,
+                        atomic_read(&tty->ldisc->users) == 1, 5 * HZ);
+        if (ret < 0)
+                return ret;
+        return ret > 0 ? 0 : -EBUSY;
+}
+
+/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
@@ -634,8 +655,17 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         flush_scheduled_work();
 
+        retval = tty_ldisc_wait_idle(tty);
+
         tty_lock();
         mutex_lock(&tty->ldisc_mutex);
+
+        /* handle wait idle failure locked */
+        if (retval) {
+                tty_ldisc_put(new_ldisc);
+                goto enable;
+        }
+
         if (test_bit(TTY_HUPPED, &tty->flags)) {
                 /* We were raced by the hangup method. It will have stomped
                    the ldisc data and closed the ldisc down */
@@ -669,6 +699,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         tty_ldisc_put(o_ldisc);
 
+enable:
         /*
          *      Allow ldisc referencing to occur again
          */
@@ -714,9 +745,12 @@ static void tty_reset_termios(struct tty_struct *tty)
  *      state closed
  */
 
-static void tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
+static int tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
 {
-        struct tty_ldisc *ld;
+        struct tty_ldisc *ld = tty_ldisc_get(ldisc);
+
+        if (IS_ERR(ld))
+                return -1;
 
         tty_ldisc_close(tty, tty->ldisc);
         tty_ldisc_put(tty->ldisc);
@@ -724,10 +758,10 @@ static void tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
         /*
          *      Switch the line discipline back
          */
-        ld = tty_ldisc_get(ldisc);
-        BUG_ON(IS_ERR(ld));
         tty_ldisc_assign(tty, ld);
         tty_set_termios_ldisc(tty, ldisc);
+
+        return 0;
 }
 
 /**
@@ -802,13 +836,16 @@ void tty_ldisc_hangup(struct tty_struct *tty)
            a FIXME */
         if (tty->ldisc) {       /* Not yet closed */
                 if (reset == 0) {
-                        tty_ldisc_reinit(tty, tty->termios->c_line);
-                        err = tty_ldisc_open(tty, tty->ldisc);
+
+                        if (!tty_ldisc_reinit(tty, tty->termios->c_line))
+                                err = tty_ldisc_open(tty, tty->ldisc);
+                        else
+                                err = 1;
                 }
                 /* If the re-open fails or we reset then go to N_TTY. The
                    N_TTY open cannot fail */
                 if (reset || err) {
-                        tty_ldisc_reinit(tty, N_TTY);
+                        BUG_ON(tty_ldisc_reinit(tty, N_TTY));
                         WARN_ON(tty_ldisc_open(tty, tty->ldisc));
                 }
                 tty_ldisc_enable(tty);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 0f69c5ec0ecd..7dc855b074d3 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1314,6 +1314,17 @@ static void control_work_handler(struct work_struct *work)
         spin_unlock(&portdev->cvq_lock);
 }
 
+static void out_intr(struct virtqueue *vq)
+{
+        struct port *port;
+
+        port = find_port_by_vq(vq->vdev->priv, vq);
+        if (!port)
+                return;
+
+        wake_up_interruptible(&port->waitqueue);
+}
+
 static void in_intr(struct virtqueue *vq)
 {
         struct port *port;
@@ -1430,7 +1441,7 @@ static int init_vqs(struct ports_device *portdev)
          */
         j = 0;
         io_callbacks[j] = in_intr;
-        io_callbacks[j + 1] = NULL;
+        io_callbacks[j + 1] = out_intr;
         io_names[j] = "input";
         io_names[j + 1] = "output";
         j += 2;
@@ -1444,7 +1455,7 @@ static int init_vqs(struct ports_device *portdev)
                 for (i = 1; i < nr_ports; i++) {
                         j += 2;
                         io_callbacks[j] = in_intr;
-                        io_callbacks[j + 1] = NULL;
+                        io_callbacks[j + 1] = out_intr;
                         io_names[j] = "input";
                         io_names[j + 1] = "output";
                 }
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 38df8c19e74c..6b68a0fb4611 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -503,6 +503,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         struct kbd_struct * kbd;
         unsigned int console;
         unsigned char ucval;
+        unsigned int uival;
         void __user *up = (void __user *)arg;
         int i, perm;
         int ret = 0;
@@ -657,7 +658,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGETMODE:
-                ucval = vc->vc_mode;
+                uival = vc->vc_mode;
                 goto setint;
 
         case KDMAPDISP:
@@ -695,7 +696,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMODE:
-                ucval = ((kbd->kbdmode == VC_RAW) ? K_RAW :
+                uival = ((kbd->kbdmode == VC_RAW) ? K_RAW :
                                  (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW :
                                  (kbd->kbdmode == VC_UNICODE) ? K_UNICODE :
                                  K_XLATE);
@@ -717,9 +718,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMETA:
-                ucval = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
+                uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
         setint:
-                ret = put_user(ucval, (int __user *)arg);
+                ret = put_user(uival, (int __user *)arg);
                 break;
 
         case KDGETKEYCODE:
@@ -949,7 +950,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 for (i = 0; i < MAX_NR_CONSOLES; ++i)
                         if (! VT_IS_IN_USE(i))
                                 break;
-                ucval = i < MAX_NR_CONSOLES ? (i+1) : -1;
+                uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
                 goto setint;             
 
         /*