19 files changed, 288 insertions, 183 deletions

diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 173c899a1fb4..2e541fa02024 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -87,6 +87,11 @@ struct capincci;
 #ifdef CONFIG_ISDN_CAPI_MIDDLEWARE
 struct capiminor;
 
+struct datahandle_queue {
+        struct list_head        list;
+        u16                     datahandle;
+};
+
 struct capiminor {
         struct list_head list;
         struct capincci  *nccip;
@@ -109,12 +114,9 @@ struct capiminor {
         int                 outbytes;
 
         /* transmit path */
-        struct datahandle_queue {
-                    struct datahandle_queue *next;
-                    u16                    datahandle;
-        } *ackqueue;
+        struct list_head ackqueue;
         int nack;
-
+        spinlock_t ackqlock;
 };
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
 
@@ -156,48 +158,54 @@ static LIST_HEAD(capiminor_list);
 
 static int capincci_add_ack(struct capiminor *mp, u16 datahandle)
 {
-        struct datahandle_queue *n, **pp;
+        struct datahandle_queue *n;
+        unsigned long flags;
 
         n = kmalloc(sizeof(*n), GFP_ATOMIC);
-        if (!n) {
-           printk(KERN_ERR "capi: alloc datahandle failed\n");
-           return -1;
+        if (unlikely(!n)) {
+                printk(KERN_ERR "capi: alloc datahandle failed\n");
+                return -1;
         }
-        n->next = NULL;
         n->datahandle = datahandle;
-        for (pp = &mp->ackqueue; *pp; pp = &(*pp)->next) ;
-        *pp = n;
+        INIT_LIST_HEAD(&n->list);
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_add_tail(&n->list, &mp->ackqueue);
         mp->nack++;
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
         return 0;
 }
 
 static int capiminor_del_ack(struct capiminor *mp, u16 datahandle)
 {
-        struct datahandle_queue **pp, *p;
+        struct datahandle_queue *p, *tmp;
+        unsigned long flags;
 
-        for (pp = &mp->ackqueue; *pp; pp = &(*pp)->next) {
-                if ((*pp)->datahandle == datahandle) {
-                        p = *pp;
-                        *pp = (*pp)->next;
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
+                if (p->datahandle == datahandle) {
+                        list_del(&p->list);
                         kfree(p);
                         mp->nack--;
+                        spin_unlock_irqrestore(&mp->ackqlock, flags);
                         return 0;
                 }
         }
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
         return -1;
 }
 
 static void capiminor_del_all_ack(struct capiminor *mp)
 {
-        struct datahandle_queue **pp, *p;
+        struct datahandle_queue *p, *tmp;
+        unsigned long flags;
 
-        pp = &mp->ackqueue;
-        while (*pp) {
-                p = *pp;
-                *pp = (*pp)->next;
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
+                list_del(&p->list);
                 kfree(p);
                 mp->nack--;
         }
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
 }
 
 
@@ -220,6 +228,8 @@ static struct capiminor *capiminor_alloc(struct capi20_appl *ap, u32 ncci)
         mp->ncci = ncci;
         mp->msgid = 0;
         atomic_set(&mp->ttyopencount,0);
+        INIT_LIST_HEAD(&mp->ackqueue);
+        spin_lock_init(&mp->ackqlock);
 
         skb_queue_head_init(&mp->inqueue);
         skb_queue_head_init(&mp->outqueue);
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index 0a37aded4b54..9ea6bd0ddc35 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -121,10 +121,10 @@ fail:
         return -ENOMEM;
 }
 
-static struct super_block *capifs_get_sb(struct file_system_type *fs_type,
-        int flags, const char *dev_name, void *data)
+static int capifs_get_sb(struct file_system_type *fs_type,
+        int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
-        return get_sb_single(fs_type, flags, data, capifs_fill_super);
+        return get_sb_single(fs_type, flags, data, capifs_fill_super, mnt);
 }
 
 static struct file_system_type capifs_fs_type = {
diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c
index f1a1f9a9b88e..1f5ebe9ee72c 100644
--- a/drivers/isdn/divert/isdn_divert.c
+++ b/drivers/isdn/divert/isdn_divert.c
@@ -592,7 +592,7 @@ static int put_address(char *st, u_char *p, int len)
 } /* put_address */
 
 /*************************************/
-/* report a succesfull interrogation */
+/* report a successful interrogation */
 /*************************************/
 static int interrogate_success(isdn_ctrl *ic, struct call_struc *cs)
 { char *src = ic->parm.dss1_io.data;
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index eb41aba3ddef..8a45715dd4c1 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -65,23 +65,22 @@ static struct usb_device_id gigaset_table [] = {
 
 MODULE_DEVICE_TABLE(usb, gigaset_table);
 
-/*======================= local function prototypes =============================*/
+/*======================= local function prototypes ==========================*/
 
-/* This function is called if a new device is connected to the USB port. It
- * checks whether this new device belongs to this driver.
- */
+/* function called if a new device belonging to this driver is connected */
 static int gigaset_probe(struct usb_interface *interface,
                          const struct usb_device_id *id);
 
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
 
-static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static int atread_submit(struct cardstate *, int);
 static void stopurbs(struct bas_bc_state *);
+static int req_submit(struct bc_state *, int, int, int);
 static int atwrite_submit(struct cardstate *, unsigned char *, int);
 static int start_cbsend(struct cardstate *);
 
-/*==============================================================================*/
+/*============================================================================*/
 
 struct bas_cardstate {
         struct usb_device       *udev;          /* USB device pointer */
@@ -91,6 +90,7 @@ struct bas_cardstate {
         struct urb              *urb_ctrl;      /* control pipe default URB */
         struct usb_ctrlrequest  dr_ctrl;
         struct timer_list       timer_ctrl;     /* control request timeout */
+        int                     retry_ctrl;
 
         struct timer_list       timer_atrdy;    /* AT command ready timeout */
         struct urb              *urb_cmd_out;   /* for sending AT commands */
@@ -307,6 +307,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
  * hang up any existing connection because of an unrecoverable error
  * This function may be called from any context and takes care of scheduling
  * the necessary actions for execution outside of interrupt context.
+ * cs->lock must not be held.
  * argument:
  *      B channel control structure
  */
@@ -325,14 +326,17 @@ static inline void error_hangup(struct bc_state *bcs)
 
 /* error_reset
  * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context, and should take care of
+ * This function may be called from any context, and takes care of
  * scheduling the necessary actions for execution outside of interrupt context.
- * Right now, it just generates a kernel message calling for help.
+ * cs->lock must not be held.
  * argument:
  *      controller state structure
  */
 static inline void error_reset(struct cardstate *cs)
 {
+        /* close AT command channel to recover (ignore errors) */
+        req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
+
         //FIXME try to recover without bothering the user
         dev_err(cs->dev,
             "unrecoverable error - please disconnect Gigaset base to reset\n");
@@ -403,14 +407,30 @@ static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
         struct bas_cardstate *ucs = cs->hw.bas;
+        int rc;
 
         if (!ucs->rcvbuf_size) {
                 gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
                 return;
         }
 
-        dev_err(cs->dev, "timeout reading AT response\n");
-        error_reset(cs);        //FIXME retry?
+        if (ucs->retry_cmd_in++ < BAS_RETRY) {
+                dev_notice(cs->dev, "control read: timeout, retry %d\n",
+                           ucs->retry_cmd_in);
+                rc = atread_submit(cs, BAS_TIMEOUT);
+                if (rc >= 0 || rc == -ENODEV)
+                        /* resubmitted or disconnected */
+                        /* - bypass regular exit block */
+                        return;
+        } else {
+                dev_err(cs->dev,
+                        "control read: timeout, giving up after %d tries\n",
+                        ucs->retry_cmd_in);
+        }
+        kfree(ucs->rcvbuf);
+        ucs->rcvbuf = NULL;
+        ucs->rcvbuf_size = 0;
+        error_reset(cs);
 }
 
 /* set/clear bits in base connection state, return previous state
@@ -428,6 +448,96 @@ inline static int update_basstate(struct bas_cardstate *ucs,
         return state;
 }
 
+/* read_ctrl_callback
+ * USB completion handler for control pipe input
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *      urb     USB request block
+ *              urb->context = inbuf structure for controller state
+ */
+static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
+{
+        struct inbuf_t *inbuf = urb->context;
+        struct cardstate *cs = inbuf->cs;
+        struct bas_cardstate *ucs = cs->hw.bas;
+        int have_data = 0;
+        unsigned numbytes;
+        int rc;
+
+        update_basstate(ucs, 0, BS_ATRDPEND);
+
+        if (!ucs->rcvbuf_size) {
+                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
+                return;
+        }
+
+        del_timer(&ucs->timer_cmd_in);
+
+        switch (urb->status) {
+        case 0:                         /* normal completion */
+                numbytes = urb->actual_length;
+                if (unlikely(numbytes != ucs->rcvbuf_size)) {
+                        dev_warn(cs->dev,
+                               "control read: received %d chars, expected %d\n",
+                                 numbytes, ucs->rcvbuf_size);
+                        if (numbytes > ucs->rcvbuf_size)
+                                numbytes = ucs->rcvbuf_size;
+                }
+
+                /* copy received bytes to inbuf */
+                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
+
+                if (unlikely(numbytes < ucs->rcvbuf_size)) {
+                        /* incomplete - resubmit for remaining bytes */
+                        ucs->rcvbuf_size -= numbytes;
+                        ucs->retry_cmd_in = 0;
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
+                                return;
+                        error_reset(cs);
+                }
+                break;
+
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
+        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                /* no action necessary */
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
+                break;
+
+        default:                        /* severe trouble */
+                dev_warn(cs->dev, "control read: %s\n",
+                         get_usb_statmsg(urb->status));
+                if (ucs->retry_cmd_in++ < BAS_RETRY) {
+                        dev_notice(cs->dev, "control read: retry %d\n",
+                                   ucs->retry_cmd_in);
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
+                                return;
+                } else {
+                        dev_err(cs->dev,
+                                "control read: giving up after %d tries\n",
+                                ucs->retry_cmd_in);
+                }
+                error_reset(cs);
+        }
+
+        kfree(ucs->rcvbuf);
+        ucs->rcvbuf = NULL;
+        ucs->rcvbuf_size = 0;
+        if (have_data) {
+                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
+                gigaset_schedule_event(cs);
+        }
+}
+
 /* atread_submit
  * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
  * parameters:
@@ -466,7 +576,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
                 update_basstate(ucs, 0, BS_ATRDPEND);
                 dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(ret));
                 return ret;
         }
 
@@ -611,9 +721,12 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        if (rc != -ENODEV)
+                        if (rc != -ENODEV) {
                                 //FIXME corrective action?
+                                spin_unlock_irqrestore(&cs->lock, flags);
                                 error_reset(cs);
+                                break;
+                        }
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
                 break;
@@ -643,97 +756,6 @@ resubmit:
         }
 }
 
-/* read_ctrl_callback
- * USB completion handler for control pipe input
- * called by the USB subsystem in interrupt context
- * parameter:
- *      urb     USB request block
- *              urb->context = inbuf structure for controller state
- */
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
-{
-        struct inbuf_t *inbuf = urb->context;
-        struct cardstate *cs = inbuf->cs;
-        struct bas_cardstate *ucs = cs->hw.bas;
-        int have_data = 0;
-        unsigned numbytes;
-        int rc;
-
-        update_basstate(ucs, 0, BS_ATRDPEND);
-
-        if (!ucs->rcvbuf_size) {
-                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                return;
-        }
-
-        del_timer(&ucs->timer_cmd_in);
-
-        switch (urb->status) {
-        case 0:                         /* normal completion */
-                numbytes = urb->actual_length;
-                if (unlikely(numbytes == 0)) {
-                        dev_warn(cs->dev,
-                                 "control read: empty block received\n");
-                        goto retry;
-                }
-                if (unlikely(numbytes != ucs->rcvbuf_size)) {
-                        dev_warn(cs->dev,
-                               "control read: received %d chars, expected %d\n",
-                                 numbytes, ucs->rcvbuf_size);
-                        if (numbytes > ucs->rcvbuf_size)
-                                numbytes = ucs->rcvbuf_size;
-                }
-
-                /* copy received bytes to inbuf */
-                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
-
-                if (unlikely(numbytes < ucs->rcvbuf_size)) {
-                        /* incomplete - resubmit for remaining bytes */
-                        ucs->rcvbuf_size -= numbytes;
-                        ucs->retry_cmd_in = 0;
-                        goto retry;
-                }
-                break;
-
-        case -ENOENT:                   /* cancelled */
-        case -ECONNRESET:               /* cancelled (async) */
-        case -EINPROGRESS:              /* pending */
-        case -ENODEV:                   /* device removed */
-        case -ESHUTDOWN:                /* device shut down */
-                /* no action necessary */
-                gig_dbg(DEBUG_USBREQ, "%s: %s",
-                        __func__, get_usb_statmsg(urb->status));
-                break;
-
-        default:                        /* severe trouble */
-                dev_warn(cs->dev, "control read: %s\n",
-                         get_usb_statmsg(urb->status));
-        retry:
-                if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                        dev_notice(cs->dev, "control read: retry %d\n",
-                                   ucs->retry_cmd_in);
-                        rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
-                                return;
-                } else {
-                        dev_err(cs->dev,
-                                "control read: giving up after %d tries\n",
-                                ucs->retry_cmd_in);
-                }
-                error_reset(cs);
-        }
-
-        kfree(ucs->rcvbuf);
-        ucs->rcvbuf = NULL;
-        ucs->rcvbuf_size = 0;
-        if (have_data) {
-                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
-                gigaset_schedule_event(cs);
-        }
-}
-
 /* read_iso_callback
  * USB completion handler for B channel isochronous input
  * called by the USB subsystem in interrupt context
@@ -1378,6 +1400,7 @@ static void req_timeout(unsigned long data)
         case HD_CLOSE_B1CHANNEL:
                 dev_err(bcs->cs->dev, "timeout closing channel %d\n",
                         bcs->channel + 1);
+                error_reset(bcs->cs);
                 break;
 
         default:
@@ -1396,22 +1419,61 @@ static void req_timeout(unsigned long data)
 static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
 {
         struct bas_cardstate *ucs = urb->context;
+        int rc;
         unsigned long flags;
 
-        spin_lock_irqsave(&ucs->lock, flags);
-        if (urb->status && ucs->pending) {
-                dev_err(&ucs->interface->dev,
-                        "control request 0x%02x failed: %s\n",
-                        ucs->pending, get_usb_statmsg(urb->status));
-                del_timer(&ucs->timer_ctrl);
-                ucs->pending = 0;
-        }
-        /* individual handling of specific request types */
-        switch (ucs->pending) {
-        case HD_DEVICE_INIT_ACK:                /* no reply expected */
-                ucs->pending = 0;
+        /* check status */
+        switch (urb->status) {
+        case 0:                                 /* normal completion */
+                spin_lock_irqsave(&ucs->lock, flags);
+                switch (ucs->pending) {
+                case HD_DEVICE_INIT_ACK:        /* no reply expected */
+                        del_timer(&ucs->timer_ctrl);
+                        ucs->pending = 0;
+                        break;
+                }
+                spin_unlock_irqrestore(&ucs->lock, flags);
+                return;
+
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
+        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                /* ignore silently */
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 break;
+
+        default:                                /* any failure */
+                if (++ucs->retry_ctrl > BAS_RETRY) {
+                        dev_err(&ucs->interface->dev,
+                                "control request 0x%02x failed: %s\n",
+                                ucs->dr_ctrl.bRequest,
+                                get_usb_statmsg(urb->status));
+                        break;          /* give up */
+                }
+                dev_notice(&ucs->interface->dev,
+                           "control request 0x%02x: %s, retry %d\n",
+                           ucs->dr_ctrl.bRequest, get_usb_statmsg(urb->status),
+                           ucs->retry_ctrl);
+                /* urb->dev is clobbered by USB subsystem */
+                urb->dev = ucs->udev;
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
+                if (unlikely(rc)) {
+                        dev_err(&ucs->interface->dev,
+                                "could not resubmit request 0x%02x: %s\n",
+                                ucs->dr_ctrl.bRequest, get_usb_rcmsg(rc));
+                        break;
+                }
+                /* resubmitted */
+                return;
         }
+
+        /* failed, clear pending request */
+        spin_lock_irqsave(&ucs->lock, flags);
+        del_timer(&ucs->timer_ctrl);
+        ucs->pending = 0;
         spin_unlock_irqrestore(&ucs->lock, flags);
 }
 
@@ -1455,9 +1517,11 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                              usb_sndctrlpipe(ucs->udev, 0),
                              (unsigned char*) &ucs->dr_ctrl, NULL, 0,
                              write_ctrl_callback, ucs);
-        if ((ret = usb_submit_urb(ucs->urb_ctrl, SLAB_ATOMIC)) != 0) {
+        ucs->retry_ctrl = 0;
+        ret = usb_submit_urb(ucs->urb_ctrl, SLAB_ATOMIC);
+        if (unlikely(ret)) {
                 dev_err(bcs->cs->dev, "could not submit request 0x%02x: %s\n",
-                        req, get_usb_statmsg(ret));
+                        req, get_usb_rcmsg(ret));
                 spin_unlock_irqrestore(&ucs->lock, flags);
                 return ret;
         }
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index e55767b2ccd3..2a56bf33a673 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -460,6 +460,9 @@ void gigaset_freecs(struct cardstate *cs)
 
         switch (cs->cs_init) {
         default:
+                /* clear device sysfs */
+                gigaset_free_dev_sysfs(cs);
+
                 gigaset_if_free(cs);
 
                 gig_dbg(DEBUG_INIT, "clearing hw");
@@ -699,6 +702,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         cs->open_count = 0;
         cs->dev = NULL;
         cs->tty = NULL;
+        cs->class = NULL;
         cs->cidmode = cidmode != 0;
 
         //if(onechannel) { //FIXME
@@ -760,6 +764,9 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
 
         gigaset_if_init(cs);
 
+        /* set up device sysfs */
+        gigaset_init_dev_sysfs(cs);
+
         spin_lock_irqsave(&cs->lock, flags);
         cs->running = 1;
         spin_unlock_irqrestore(&cs->lock, flags);
@@ -902,9 +909,6 @@ int gigaset_start(struct cardstate *cs)
 
         wait_event(cs->waitqueue, !cs->waiting);
 
-        /* set up device sysfs */
-        gigaset_init_dev_sysfs(cs);
-
         mutex_unlock(&cs->mutex);
         return 1;
 
@@ -969,9 +973,6 @@ void gigaset_stop(struct cardstate *cs)
                 //FIXME
         }
 
-        /* clear device sysfs */
-        gigaset_free_dev_sysfs(cs);
-
         cleanup_cs(cs);
 
 exit:
@@ -980,7 +981,7 @@ exit:
 EXPORT_SYMBOL_GPL(gigaset_stop);
 
 static LIST_HEAD(drivers);
-static spinlock_t driver_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(driver_lock);
 
 struct cardstate *gigaset_get_cs_by_id(int id)
 {
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 18e05c09b71c..44f02dbd1111 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -1262,7 +1262,8 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_HUPMODEM:
                 /* send "+++" (hangup in unimodem mode) */
-                cs->ops->write_cmd(cs, "+++", 3, NULL);
+                if (cs->connected)
+                        cs->ops->write_cmd(cs, "+++", 3, NULL);
                 break;
         case ACT_RING:
                 /* get fresh AT state structure for new CID */
@@ -1294,7 +1295,6 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_ICALL:
                 handle_icall(cs, bcs, p_at_state);
-                at_state = *p_at_state;
                 break;
         case ACT_FAILSDOWN:
                 dev_warn(cs->dev, "Could not shut down the device.\n");
@@ -1334,10 +1334,8 @@ static void do_action(int action, struct cardstate *cs,
                          */
                         at_state->pending_commands |= PC_DLE0;
                         atomic_set(&cs->commands_pending, 1);
-                } else {
+                } else
                         disconnect(p_at_state);
-                        at_state = *p_at_state;
-                }
                 break;
         case ACT_FAKEDLE0:
                 at_state->int_var[VAR_ZDLE] = 0;
@@ -1354,10 +1352,8 @@ static void do_action(int action, struct cardstate *cs,
                 at_state->cid = -1;
                 if (bcs && cs->onechannel)
                         at_state->pending_commands |= PC_DLE0;
-                else {
+                else
                         disconnect(p_at_state);
-                        at_state = *p_at_state;
-                }
                 schedule_init(cs, MS_RECOVER);
                 break;
         case ACT_FAILDLE0:
@@ -1410,7 +1406,6 @@ static void do_action(int action, struct cardstate *cs,
 
         case ACT_ABORTACCEPT:   /* hangup/error/timeout during ICALL processing */
                 disconnect(p_at_state);
-                at_state = *p_at_state;
                 break;
 
         case ACT_ABORTDIAL:     /* error/timeout during dial preparation */
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 22b9693f7c0a..8d63d822104f 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -445,6 +445,7 @@ struct cardstate {
         struct gigaset_driver *driver;
         unsigned minor_index;
         struct device *dev;
+        struct class_device *class;
 
         const struct gigaset_ops *ops;
 
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 08e4c4eea14d..74fd234956c8 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -625,7 +625,14 @@ void gigaset_if_init(struct cardstate *cs)
                 return;
 
         tasklet_init(&cs->if_wake_tasklet, &if_wake, (unsigned long) cs);
-        tty_register_device(drv->tty, cs->minor_index, NULL);
+        cs->class = tty_register_device(drv->tty, cs->minor_index, NULL);
+
+        if (!IS_ERR(cs->class))
+                class_set_devdata(cs->class, cs);
+        else {
+                warn("could not register device to the tty subsystem");
+                cs->class = NULL;
+        }
 }
 
 void gigaset_if_free(struct cardstate *cs)
@@ -638,6 +645,7 @@ void gigaset_if_free(struct cardstate *cs)
 
         tasklet_disable(&cs->if_wake_tasklet);
         tasklet_kill(&cs->if_wake_tasklet);
+        cs->class = NULL;
         tty_unregister_device(drv->tty, cs->minor_index);
 }
 
diff --git a/drivers/isdn/gigaset/proc.c b/drivers/isdn/gigaset/proc.c
index d267a636b53c..9ae3a7f3e7b3 100644
--- a/drivers/isdn/gigaset/proc.c
+++ b/drivers/isdn/gigaset/proc.c
@@ -16,12 +16,11 @@
 #include "gigaset.h"
 #include <linux/ctype.h>
 
-static ssize_t show_cidmode(struct device *dev, struct device_attribute *attr,
-                            char *buf)
+static ssize_t show_cidmode(struct class_device *class, char *buf)
 {
         int ret;
         unsigned long flags;
-        struct cardstate *cs = dev_get_drvdata(dev);
+        struct cardstate *cs = class_get_devdata(class);
 
         spin_lock_irqsave(&cs->lock, flags);
         ret = sprintf(buf, "%u\n", cs->cidmode);
@@ -30,10 +29,10 @@ static ssize_t show_cidmode(struct device *dev, struct device_attribute *attr,
         return ret;
 }
 
-static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr,
+static ssize_t set_cidmode(struct class_device *class,
                            const char *buf, size_t count)
 {
-        struct cardstate *cs = dev_get_drvdata(dev);
+        struct cardstate *cs = class_get_devdata(class);
         long int value;
         char *end;
 
@@ -65,18 +64,24 @@ static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr,
         return count;
 }
 
-static DEVICE_ATTR(cidmode, S_IRUGO|S_IWUSR, show_cidmode, set_cidmode);
+static CLASS_DEVICE_ATTR(cidmode, S_IRUGO|S_IWUSR, show_cidmode, set_cidmode);
 
 /* free sysfs for device */
 void gigaset_free_dev_sysfs(struct cardstate *cs)
 {
+        if (!cs->class)
+                return;
+
         gig_dbg(DEBUG_INIT, "removing sysfs entries");
-        device_remove_file(cs->dev, &dev_attr_cidmode);
+        class_device_remove_file(cs->class, &class_device_attr_cidmode);
 }
 
 /* initialize sysfs for device */
 void gigaset_init_dev_sysfs(struct cardstate *cs)
 {
+        if (!cs->class)
+                return;
+
         gig_dbg(DEBUG_INIT, "setting up sysfs");
-        device_create_file(cs->dev, &dev_attr_cidmode);
+        class_device_create_file(cs->class, &class_device_attr_cidmode);
 }
diff --git a/drivers/isdn/hardware/avm/b1pcmcia.c b/drivers/isdn/hardware/avm/b1pcmcia.c
index 9746cc5ffff8..ad5025155b4e 100644
--- a/drivers/isdn/hardware/avm/b1pcmcia.c
+++ b/drivers/isdn/hardware/avm/b1pcmcia.c
@@ -82,7 +82,7 @@ static int b1pcmcia_add_card(unsigned int port, unsigned irq,
         card->irq = irq;
         card->cardtype = cardtype;
 
-        retval = request_irq(card->irq, b1_interrupt, 0, card->name, card);
+        retval = request_irq(card->irq, b1_interrupt, SA_SHIRQ, card->name, card);
         if (retval) {
                 printk(KERN_ERR "b1pcmcia: unable to get IRQ %d.\n",
                        card->irq);
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 91d25acb5ede..3622720f0505 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1688,7 +1688,7 @@ setup_hfcpci(struct IsdnCard *card)
                                 printk(KERN_WARNING "HFC-PCI: No IRQ for PCI card found\n");
                                 return (0);
                         }
-                        cs->hw.hfcpci.pci_io = (char *) dev_hfcpci->resource[ 1].start;
+                        cs->hw.hfcpci.pci_io = (char *)(unsigned long)dev_hfcpci->resource[1].start;
                         printk(KERN_INFO "HiSax: HFC-PCI card manufacturer: %s card name: %s\n", id_list[i].vendor_name, id_list[i].card_name);
                 } else {
                         printk(KERN_WARNING "HFC-PCI: No PCI card found\n");
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index abecabf8c271..aacbf0d14b64 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -1402,12 +1402,12 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
                         }
                         /* No, locate it in the table */
                         if (cset == 0) {
-                                for (i = 0; i < IESIZE; i++)
+                                for (i = 0; i < IESIZE_NI1; i++)
                                         if (*buf == ielist_ni1[i].nr)
                                                 break;
 
                                 /* When not found, give appropriate msg */
-                                if (i != IESIZE) {
+                                if (i != IESIZE_NI1) {
                                         dp += sprintf(dp, "  %s\n", ielist_ni1[i].descr);
                                         dp += ielist_ni1[i].f(dp, buf);
                                 } else
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index 9bb18f3f7829..f9c14a2970bc 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -164,7 +164,7 @@ static int sedlbauer_probe(struct pcmcia_device *link)
     link->priv = local;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
     link->irq.Handler = NULL;
 
diff --git a/drivers/isdn/hisax/teles3.c b/drivers/isdn/hisax/teles3.c
index a3eaf4d65707..090abd16b4bc 100644
--- a/drivers/isdn/hisax/teles3.c
+++ b/drivers/isdn/hisax/teles3.c
@@ -369,6 +369,7 @@ setup_teles3(struct IsdnCard *card)
                                cs->hw.teles3.hscx[1] + 96);
                         return (0);
                 }
+                cs->irq_flags |= SA_SHIRQ; /* cardbus can share */
         } else {
                 if (cs->hw.teles3.cfg_reg) {
                         if (cs->typ == ISDN_CTYPE_COMPAQ_ISA) {
diff --git a/drivers/isdn/hisax/telespci.c b/drivers/isdn/hisax/telespci.c
index e2bb4fd8e25e..e82ab2251b82 100644
--- a/drivers/isdn/hisax/telespci.c
+++ b/drivers/isdn/hisax/telespci.c
@@ -311,8 +311,9 @@ setup_telespci(struct IsdnCard *card)
                 }
                 cs->hw.teles0.membase = ioremap(pci_resource_start(dev_tel, 0),
                         PAGE_SIZE);
-                printk(KERN_INFO "Found: Zoran, base-address: 0x%lx, irq: 0x%x\n",
-                        pci_resource_start(dev_tel, 0), dev_tel->irq);
+                printk(KERN_INFO "Found: Zoran, base-address: 0x%llx, irq: 0x%x\n",
+                        (unsigned long long)pci_resource_start(dev_tel, 0),
+                        dev_tel->irq);
         } else {
                 printk(KERN_WARNING "TelesPCI: No PCI card found\n");
                 return(0);
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 22759c01746a..eb21063e6f63 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -340,6 +340,16 @@ isdn_command(isdn_ctrl *cmd)
                 printk(KERN_WARNING "isdn_command command(%x) driver -1\n", cmd->command);
                 return(1);
         }
+        if (!dev->drv[cmd->driver]) {
+                printk(KERN_WARNING "isdn_command command(%x) dev->drv[%d] NULL\n",
+                        cmd->command, cmd->driver);
+                return(1);
+        }
+        if (!dev->drv[cmd->driver]->interface) {
+                printk(KERN_WARNING "isdn_command command(%x) dev->drv[%d]->interface NULL\n",
+                        cmd->command, cmd->driver);
+                return(1);
+        }
         if (cmd->command == ISDN_CMD_SETL2) {
                 int idx = isdn_dc2minor(cmd->driver, cmd->arg & 255);
                 unsigned long l2prot = (cmd->arg >> 8) & 255;
@@ -933,7 +943,7 @@ isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
                         count_put = count_pull;
                         if(count_put > 1)
                                 tty_insert_flip_string(tty, skb->data, count_put - 1);
-                        last = skb->data[count_put] - 1;
+                        last = skb->data[count_put - 1];
                         len -= count_put;
 #ifdef CONFIG_ISDN_AUDIO
                 }
@@ -1177,9 +1187,8 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off
                         goto out;
                 }
                 chidx = isdn_minor2chan(minor);
-                while (isdn_writebuf_stub(drvidx, chidx, buf, count) != count)
+                while ((retval = isdn_writebuf_stub(drvidx, chidx, buf, count)) == 0)
                         interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]);
-                retval = count;
                 goto out;
         }
         if (minor <= ISDN_MINOR_CTRLMAX) {
@@ -1904,6 +1913,11 @@ isdn_free_channel(int di, int ch, int usage)
 {
         int i;
 
+        if ((di < 0) || (ch < 0)) {
+                printk(KERN_WARNING "%s: called with invalid drv(%d) or channel(%d)\n",
+                        __FUNCTION__, di, ch);
+                return;
+        }
         for (i = 0; i < ISDN_MAX_CHANNELS; i++)
                 if (((!usage) || ((dev->usage[i] & ISDN_USAGE_MASK) == usage)) &&
                     (dev->drvmap[i] == di) &&
@@ -1919,7 +1933,8 @@ isdn_free_channel(int di, int ch, int usage)
                         dev->v110[i] = NULL;
 // 20.10.99 JIM, try to reinitialize v110 !
                         isdn_info_update();
-                        skb_queue_purge(&dev->drv[di]->rpqueue[ch]);
+                        if (dev->drv[di])
+                                skb_queue_purge(&dev->drv[di]->rpqueue[ch]);
                 }
 }
 
@@ -1951,9 +1966,10 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char __user * buf, int len)
         struct sk_buff *skb = alloc_skb(hl + len, GFP_ATOMIC);
 
         if (!skb)
-                return 0;
+                return -ENOMEM;
         skb_reserve(skb, hl);
-        copy_from_user(skb_put(skb, len), buf, len);
+        if (copy_from_user(skb_put(skb, len), buf, len))
+                return -EFAULT;
         ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
         if (ret <= 0)
                 dev_kfree_skb(skb);
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 2ac90242d263..433389daedb2 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -82,7 +82,7 @@ isdn_tty_try_read(modem_info * info, struct sk_buff *skb)
                                                 int l = skb->len;
                                                 unsigned char *dp = skb->data;
                                                 while (--l) {
-                                                        if (*skb->data == DLE)
+                                                        if (*dp == DLE)
                                                                 tty_insert_flip_char(tty, DLE, 0);
                                                         tty_insert_flip_char(tty, *dp++, 0);
                                                 }
diff --git a/drivers/isdn/i4l/isdn_x25iface.c b/drivers/isdn/i4l/isdn_x25iface.c
index 743ac4077f35..8b3efc243161 100644
--- a/drivers/isdn/i4l/isdn_x25iface.c
+++ b/drivers/isdn/i4l/isdn_x25iface.c
@@ -208,7 +208,7 @@ static int isdn_x25iface_receive(struct concap_proto *cprot, struct sk_buff *skb
  */
 static int isdn_x25iface_connect_ind(struct concap_proto *cprot)
 {
-        struct sk_buff * skb = dev_alloc_skb(1);
+        struct sk_buff * skb;
         enum wan_states *state_p 
           = &( ( (ix25_pdata_t*) (cprot->proto_data) ) -> state);
         IX25DEBUG( "isdn_x25iface_connect_ind %s \n"
@@ -220,6 +220,8 @@ static int isdn_x25iface_connect_ind(struct concap_proto *cprot)
                 return -1;
         }
         *state_p = WAN_CONNECTED;
+
+        skb = dev_alloc_skb(1);
         if( skb ){
                 *( skb_put(skb, 1) ) = 0x01;
                 skb->protocol = x25_type_trans(skb, cprot->net_dev);
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index f4f71226a078..57c4ab96d136 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -97,6 +97,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 
         case SCIOCSTART:
         {
+                kfree(rcvmsg);
                 pr_debug("%s: SCIOSTART: ioctl received\n",
                                 sc_adapter[card]->devicename);
                 if(sc_adapter[card]->EngineUp) {