8 files changed, 223 insertions, 154 deletions

diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 173c899a1fb4..2e541fa02024 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -87,6 +87,11 @@ struct capincci;
 #ifdef CONFIG_ISDN_CAPI_MIDDLEWARE
 struct capiminor;
 
+struct datahandle_queue {
+        struct list_head        list;
+        u16                     datahandle;
+};
+
 struct capiminor {
         struct list_head list;
         struct capincci  *nccip;
@@ -109,12 +114,9 @@ struct capiminor {
         int                 outbytes;
 
         /* transmit path */
-        struct datahandle_queue {
-                    struct datahandle_queue *next;
-                    u16                    datahandle;
-        } *ackqueue;
+        struct list_head ackqueue;
         int nack;
-
+        spinlock_t ackqlock;
 };
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
 
@@ -156,48 +158,54 @@ static LIST_HEAD(capiminor_list);
 
 static int capincci_add_ack(struct capiminor *mp, u16 datahandle)
 {
-        struct datahandle_queue *n, **pp;
+        struct datahandle_queue *n;
+        unsigned long flags;
 
         n = kmalloc(sizeof(*n), GFP_ATOMIC);
-        if (!n) {
-           printk(KERN_ERR "capi: alloc datahandle failed\n");
-           return -1;
+        if (unlikely(!n)) {
+                printk(KERN_ERR "capi: alloc datahandle failed\n");
+                return -1;
         }
-        n->next = NULL;
         n->datahandle = datahandle;
-        for (pp = &mp->ackqueue; *pp; pp = &(*pp)->next) ;
-        *pp = n;
+        INIT_LIST_HEAD(&n->list);
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_add_tail(&n->list, &mp->ackqueue);
         mp->nack++;
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
         return 0;
 }
 
 static int capiminor_del_ack(struct capiminor *mp, u16 datahandle)
 {
-        struct datahandle_queue **pp, *p;
+        struct datahandle_queue *p, *tmp;
+        unsigned long flags;
 
-        for (pp = &mp->ackqueue; *pp; pp = &(*pp)->next) {
-                if ((*pp)->datahandle == datahandle) {
-                        p = *pp;
-                        *pp = (*pp)->next;
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
+                if (p->datahandle == datahandle) {
+                        list_del(&p->list);
                         kfree(p);
                         mp->nack--;
+                        spin_unlock_irqrestore(&mp->ackqlock, flags);
                         return 0;
                 }
         }
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
         return -1;
 }
 
 static void capiminor_del_all_ack(struct capiminor *mp)
 {
-        struct datahandle_queue **pp, *p;
+        struct datahandle_queue *p, *tmp;
+        unsigned long flags;
 
-        pp = &mp->ackqueue;
-        while (*pp) {
-                p = *pp;
-                *pp = (*pp)->next;
+        spin_lock_irqsave(&mp->ackqlock, flags);
+        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
+                list_del(&p->list);
                 kfree(p);
                 mp->nack--;
         }
+        spin_unlock_irqrestore(&mp->ackqlock, flags);
 }
 
 
@@ -220,6 +228,8 @@ static struct capiminor *capiminor_alloc(struct capi20_appl *ap, u32 ncci)
         mp->ncci = ncci;
         mp->msgid = 0;
         atomic_set(&mp->ttyopencount,0);
+        INIT_LIST_HEAD(&mp->ackqueue);
+        spin_lock_init(&mp->ackqlock);
 
         skb_queue_head_init(&mp->inqueue);
         skb_queue_head_init(&mp->outqueue);
diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c
index f1a1f9a9b88e..1f5ebe9ee72c 100644
--- a/drivers/isdn/divert/isdn_divert.c
+++ b/drivers/isdn/divert/isdn_divert.c
@@ -592,7 +592,7 @@ static int put_address(char *st, u_char *p, int len)
 } /* put_address */
 
 /*************************************/
-/* report a succesfull interrogation */
+/* report a successful interrogation */
 /*************************************/
 static int interrogate_success(isdn_ctrl *ic, struct call_struc *cs)
 { char *src = ic->parm.dss1_io.data;
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index eb41aba3ddef..8a45715dd4c1 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -65,23 +65,22 @@ static struct usb_device_id gigaset_table [] = {
 
 MODULE_DEVICE_TABLE(usb, gigaset_table);
 
-/*======================= local function prototypes =============================*/
+/*======================= local function prototypes ==========================*/
 
-/* This function is called if a new device is connected to the USB port. It
- * checks whether this new device belongs to this driver.
- */
+/* function called if a new device belonging to this driver is connected */
 static int gigaset_probe(struct usb_interface *interface,
                          const struct usb_device_id *id);
 
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
 
-static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static int atread_submit(struct cardstate *, int);
 static void stopurbs(struct bas_bc_state *);
+static int req_submit(struct bc_state *, int, int, int);
 static int atwrite_submit(struct cardstate *, unsigned char *, int);
 static int start_cbsend(struct cardstate *);
 
-/*==============================================================================*/
+/*============================================================================*/
 
 struct bas_cardstate {
         struct usb_device       *udev;          /* USB device pointer */
@@ -91,6 +90,7 @@ struct bas_cardstate {
         struct urb              *urb_ctrl;      /* control pipe default URB */
         struct usb_ctrlrequest  dr_ctrl;
         struct timer_list       timer_ctrl;     /* control request timeout */
+        int                     retry_ctrl;
 
         struct timer_list       timer_atrdy;    /* AT command ready timeout */
         struct urb              *urb_cmd_out;   /* for sending AT commands */
@@ -307,6 +307,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
  * hang up any existing connection because of an unrecoverable error
  * This function may be called from any context and takes care of scheduling
  * the necessary actions for execution outside of interrupt context.
+ * cs->lock must not be held.
  * argument:
  *      B channel control structure
  */
@@ -325,14 +326,17 @@ static inline void error_hangup(struct bc_state *bcs)
 
 /* error_reset
  * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context, and should take care of
+ * This function may be called from any context, and takes care of
  * scheduling the necessary actions for execution outside of interrupt context.
- * Right now, it just generates a kernel message calling for help.
+ * cs->lock must not be held.
  * argument:
  *      controller state structure
  */
 static inline void error_reset(struct cardstate *cs)
 {
+        /* close AT command channel to recover (ignore errors) */
+        req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
+
         //FIXME try to recover without bothering the user
         dev_err(cs->dev,
             "unrecoverable error - please disconnect Gigaset base to reset\n");
@@ -403,14 +407,30 @@ static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
         struct bas_cardstate *ucs = cs->hw.bas;
+        int rc;
 
         if (!ucs->rcvbuf_size) {
                 gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
                 return;
         }
 
-        dev_err(cs->dev, "timeout reading AT response\n");
-        error_reset(cs);        //FIXME retry?
+        if (ucs->retry_cmd_in++ < BAS_RETRY) {
+                dev_notice(cs->dev, "control read: timeout, retry %d\n",
+                           ucs->retry_cmd_in);
+                rc = atread_submit(cs, BAS_TIMEOUT);
+                if (rc >= 0 || rc == -ENODEV)
+                        /* resubmitted or disconnected */
+                        /* - bypass regular exit block */
+                        return;
+        } else {
+                dev_err(cs->dev,
+                        "control read: timeout, giving up after %d tries\n",
+                        ucs->retry_cmd_in);
+        }
+        kfree(ucs->rcvbuf);
+        ucs->rcvbuf = NULL;
+        ucs->rcvbuf_size = 0;
+        error_reset(cs);
 }
 
 /* set/clear bits in base connection state, return previous state
@@ -428,6 +448,96 @@ inline static int update_basstate(struct bas_cardstate *ucs,
         return state;
 }
 
+/* read_ctrl_callback
+ * USB completion handler for control pipe input
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *      urb     USB request block
+ *              urb->context = inbuf structure for controller state
+ */
+static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
+{
+        struct inbuf_t *inbuf = urb->context;
+        struct cardstate *cs = inbuf->cs;
+        struct bas_cardstate *ucs = cs->hw.bas;
+        int have_data = 0;
+        unsigned numbytes;
+        int rc;
+
+        update_basstate(ucs, 0, BS_ATRDPEND);
+
+        if (!ucs->rcvbuf_size) {
+                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
+                return;
+        }
+
+        del_timer(&ucs->timer_cmd_in);
+
+        switch (urb->status) {
+        case 0:                         /* normal completion */
+                numbytes = urb->actual_length;
+                if (unlikely(numbytes != ucs->rcvbuf_size)) {
+                        dev_warn(cs->dev,
+                               "control read: received %d chars, expected %d\n",
+                                 numbytes, ucs->rcvbuf_size);
+                        if (numbytes > ucs->rcvbuf_size)
+                                numbytes = ucs->rcvbuf_size;
+                }
+
+                /* copy received bytes to inbuf */
+                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
+
+                if (unlikely(numbytes < ucs->rcvbuf_size)) {
+                        /* incomplete - resubmit for remaining bytes */
+                        ucs->rcvbuf_size -= numbytes;
+                        ucs->retry_cmd_in = 0;
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
+                                return;
+                        error_reset(cs);
+                }
+                break;
+
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
+        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                /* no action necessary */
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
+                break;
+
+        default:                        /* severe trouble */
+                dev_warn(cs->dev, "control read: %s\n",
+                         get_usb_statmsg(urb->status));
+                if (ucs->retry_cmd_in++ < BAS_RETRY) {
+                        dev_notice(cs->dev, "control read: retry %d\n",
+                                   ucs->retry_cmd_in);
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
+                                return;
+                } else {
+                        dev_err(cs->dev,
+                                "control read: giving up after %d tries\n",
+                                ucs->retry_cmd_in);
+                }
+                error_reset(cs);
+        }
+
+        kfree(ucs->rcvbuf);
+        ucs->rcvbuf = NULL;
+        ucs->rcvbuf_size = 0;
+        if (have_data) {
+                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
+                gigaset_schedule_event(cs);
+        }
+}
+
 /* atread_submit
  * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
  * parameters:
@@ -466,7 +576,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
                 update_basstate(ucs, 0, BS_ATRDPEND);
                 dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(ret));
                 return ret;
         }
 
@@ -611,9 +721,12 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        if (rc != -ENODEV)
+                        if (rc != -ENODEV) {
                                 //FIXME corrective action?
+                                spin_unlock_irqrestore(&cs->lock, flags);
                                 error_reset(cs);
+                                break;
+                        }
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
                 break;
@@ -643,97 +756,6 @@ resubmit:
         }
 }
 
-/* read_ctrl_callback
- * USB completion handler for control pipe input
- * called by the USB subsystem in interrupt context
- * parameter:
- *      urb     USB request block
- *              urb->context = inbuf structure for controller state
- */
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
-{
-        struct inbuf_t *inbuf = urb->context;
-        struct cardstate *cs = inbuf->cs;
-        struct bas_cardstate *ucs = cs->hw.bas;
-        int have_data = 0;
-        unsigned numbytes;
-        int rc;
-
-        update_basstate(ucs, 0, BS_ATRDPEND);
-
-        if (!ucs->rcvbuf_size) {
-                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                return;
-        }
-
-        del_timer(&ucs->timer_cmd_in);
-
-        switch (urb->status) {
-        case 0:                         /* normal completion */
-                numbytes = urb->actual_length;
-                if (unlikely(numbytes == 0)) {
-                        dev_warn(cs->dev,
-                                 "control read: empty block received\n");
-                        goto retry;
-                }
-                if (unlikely(numbytes != ucs->rcvbuf_size)) {
-                        dev_warn(cs->dev,
-                               "control read: received %d chars, expected %d\n",
-                                 numbytes, ucs->rcvbuf_size);
-                        if (numbytes > ucs->rcvbuf_size)
-                                numbytes = ucs->rcvbuf_size;
-                }
-
-                /* copy received bytes to inbuf */
-                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
-
-                if (unlikely(numbytes < ucs->rcvbuf_size)) {
-                        /* incomplete - resubmit for remaining bytes */
-                        ucs->rcvbuf_size -= numbytes;
-                        ucs->retry_cmd_in = 0;
-                        goto retry;
-                }
-                break;
-
-        case -ENOENT:                   /* cancelled */
-        case -ECONNRESET:               /* cancelled (async) */
-        case -EINPROGRESS:              /* pending */
-        case -ENODEV:                   /* device removed */
-        case -ESHUTDOWN:                /* device shut down */
-                /* no action necessary */
-                gig_dbg(DEBUG_USBREQ, "%s: %s",
-                        __func__, get_usb_statmsg(urb->status));
-                break;
-
-        default:                        /* severe trouble */
-                dev_warn(cs->dev, "control read: %s\n",
-                         get_usb_statmsg(urb->status));
-        retry:
-                if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                        dev_notice(cs->dev, "control read: retry %d\n",
-                                   ucs->retry_cmd_in);
-                        rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
-                                return;
-                } else {
-                        dev_err(cs->dev,
-                                "control read: giving up after %d tries\n",
-                                ucs->retry_cmd_in);
-                }
-                error_reset(cs);
-        }
-
-        kfree(ucs->rcvbuf);
-        ucs->rcvbuf = NULL;
-        ucs->rcvbuf_size = 0;
-        if (have_data) {
-                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
-                gigaset_schedule_event(cs);
-        }
-}
-
 /* read_iso_callback
  * USB completion handler for B channel isochronous input
  * called by the USB subsystem in interrupt context
@@ -1378,6 +1400,7 @@ static void req_timeout(unsigned long data)
         case HD_CLOSE_B1CHANNEL:
                 dev_err(bcs->cs->dev, "timeout closing channel %d\n",
                         bcs->channel + 1);
+                error_reset(bcs->cs);
                 break;
 
         default:
@@ -1396,22 +1419,61 @@ static void req_timeout(unsigned long data)
 static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
 {
         struct bas_cardstate *ucs = urb->context;
+        int rc;
         unsigned long flags;
 
-        spin_lock_irqsave(&ucs->lock, flags);
-        if (urb->status && ucs->pending) {
-                dev_err(&ucs->interface->dev,
-                        "control request 0x%02x failed: %s\n",
-                        ucs->pending, get_usb_statmsg(urb->status));
-                del_timer(&ucs->timer_ctrl);
-                ucs->pending = 0;
-        }
-        /* individual handling of specific request types */
-        switch (ucs->pending) {
-        case HD_DEVICE_INIT_ACK:                /* no reply expected */
-                ucs->pending = 0;
+        /* check status */
+        switch (urb->status) {
+        case 0:                                 /* normal completion */
+                spin_lock_irqsave(&ucs->lock, flags);
+                switch (ucs->pending) {
+                case HD_DEVICE_INIT_ACK:        /* no reply expected */
+                        del_timer(&ucs->timer_ctrl);
+                        ucs->pending = 0;
+                        break;
+                }
+                spin_unlock_irqrestore(&ucs->lock, flags);
+                return;
+
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
+        case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                /* ignore silently */
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 break;
+
+        default:                                /* any failure */
+                if (++ucs->retry_ctrl > BAS_RETRY) {
+                        dev_err(&ucs->interface->dev,
+                                "control request 0x%02x failed: %s\n",
+                                ucs->dr_ctrl.bRequest,
+                                get_usb_statmsg(urb->status));
+                        break;          /* give up */
+                }
+                dev_notice(&ucs->interface->dev,
+                           "control request 0x%02x: %s, retry %d\n",
+                           ucs->dr_ctrl.bRequest, get_usb_statmsg(urb->status),
+                           ucs->retry_ctrl);
+                /* urb->dev is clobbered by USB subsystem */
+                urb->dev = ucs->udev;
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
+                if (unlikely(rc)) {
+                        dev_err(&ucs->interface->dev,
+                                "could not resubmit request 0x%02x: %s\n",
+                                ucs->dr_ctrl.bRequest, get_usb_rcmsg(rc));
+                        break;
+                }
+                /* resubmitted */
+                return;
         }
+
+        /* failed, clear pending request */
+        spin_lock_irqsave(&ucs->lock, flags);
+        del_timer(&ucs->timer_ctrl);
+        ucs->pending = 0;
         spin_unlock_irqrestore(&ucs->lock, flags);
 }
 
@@ -1455,9 +1517,11 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                              usb_sndctrlpipe(ucs->udev, 0),
                              (unsigned char*) &ucs->dr_ctrl, NULL, 0,
                              write_ctrl_callback, ucs);
-        if ((ret = usb_submit_urb(ucs->urb_ctrl, SLAB_ATOMIC)) != 0) {
+        ucs->retry_ctrl = 0;
+        ret = usb_submit_urb(ucs->urb_ctrl, SLAB_ATOMIC);
+        if (unlikely(ret)) {
                 dev_err(bcs->cs->dev, "could not submit request 0x%02x: %s\n",
-                        req, get_usb_statmsg(ret));
+                        req, get_usb_rcmsg(ret));
                 spin_unlock_irqrestore(&ucs->lock, flags);
                 return ret;
         }
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index acb7e2656780..2a56bf33a673 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -981,7 +981,7 @@ exit:
 EXPORT_SYMBOL_GPL(gigaset_stop);
 
 static LIST_HEAD(drivers);
-static spinlock_t driver_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(driver_lock);
 
 struct cardstate *gigaset_get_cs_by_id(int id)
 {
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 18e05c09b71c..44f02dbd1111 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -1262,7 +1262,8 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_HUPMODEM:
                 /* send "+++" (hangup in unimodem mode) */
-                cs->ops->write_cmd(cs, "+++", 3, NULL);
+                if (cs->connected)
+                        cs->ops->write_cmd(cs, "+++", 3, NULL);
                 break;
         case ACT_RING:
                 /* get fresh AT state structure for new CID */
@@ -1294,7 +1295,6 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_ICALL:
                 handle_icall(cs, bcs, p_at_state);
-                at_state = *p_at_state;
                 break;
         case ACT_FAILSDOWN:
                 dev_warn(cs->dev, "Could not shut down the device.\n");
@@ -1334,10 +1334,8 @@ static void do_action(int action, struct cardstate *cs,
                          */
                         at_state->pending_commands |= PC_DLE0;
                         atomic_set(&cs->commands_pending, 1);
-                } else {
+                } else
                         disconnect(p_at_state);
-                        at_state = *p_at_state;
-                }
                 break;
         case ACT_FAKEDLE0:
                 at_state->int_var[VAR_ZDLE] = 0;
@@ -1354,10 +1352,8 @@ static void do_action(int action, struct cardstate *cs,
                 at_state->cid = -1;
                 if (bcs && cs->onechannel)
                         at_state->pending_commands |= PC_DLE0;
-                else {
+                else
                         disconnect(p_at_state);
-                        at_state = *p_at_state;
-                }
                 schedule_init(cs, MS_RECOVER);
                 break;
         case ACT_FAILDLE0:
@@ -1410,7 +1406,6 @@ static void do_action(int action, struct cardstate *cs,
 
         case ACT_ABORTACCEPT:   /* hangup/error/timeout during ICALL processing */
                 disconnect(p_at_state);
-                at_state = *p_at_state;
                 break;
 
         case ACT_ABORTDIAL:     /* error/timeout during dial preparation */
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index abecabf8c271..aacbf0d14b64 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -1402,12 +1402,12 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
                         }
                         /* No, locate it in the table */
                         if (cset == 0) {
-                                for (i = 0; i < IESIZE; i++)
+                                for (i = 0; i < IESIZE_NI1; i++)
                                         if (*buf == ielist_ni1[i].nr)
                                                 break;
 
                                 /* When not found, give appropriate msg */
-                                if (i != IESIZE) {
+                                if (i != IESIZE_NI1) {
                                         dp += sprintf(dp, "  %s\n", ielist_ni1[i].descr);
                                         dp += ielist_ni1[i].f(dp, buf);
                                 } else
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 81accdf35168..b26e509ec759 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -933,7 +933,7 @@ isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
                         count_put = count_pull;
                         if(count_put > 1)
                                 tty_insert_flip_string(tty, skb->data, count_put - 1);
-                        last = skb->data[count_put] - 1;
+                        last = skb->data[count_put - 1];
                         len -= count_put;
 #ifdef CONFIG_ISDN_AUDIO
                 }
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 2ac90242d263..433389daedb2 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -82,7 +82,7 @@ isdn_tty_try_read(modem_info * info, struct sk_buff *skb)
                                                 int l = skb->len;
                                                 unsigned char *dp = skb->data;
                                                 while (--l) {
-                                                        if (*skb->data == DLE)
+                                                        if (*dp == DLE)
                                                                 tty_insert_flip_char(tty, DLE, 0);
                                                         tty_insert_flip_char(tty, *dp++, 0);
                                                 }