Merge branch 'dmaengine' into async-tx-next

Conflicts:
	crypto/async_tx/async_xor.c
	drivers/dma/ioat/dma_v2.h
	drivers/dma/ioat/pci.c
	drivers/md/raid5.c

73 files changed, 2433 insertions, 1166 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 735bbe2be51a..0bd01f49cfd8 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -97,6 +97,19 @@ config DEVKMEM
           kind of kernel debugging operations.
           When in doubt, say "N".
 
+config BFIN_JTAG_COMM
+        tristate "Blackfin JTAG Communication"
+        depends on BLACKFIN
+        help
+          Add support for emulating a TTY device over the Blackfin JTAG.
+
+          To compile this driver as a module, choose M here: the
+          module will be called bfin_jtag_comm.
+
+config BFIN_JTAG_COMM_CONSOLE
+        bool "Console on Blackfin JTAG"
+        depends on BFIN_JTAG_COMM=y
+
 config SERIAL_NONSTANDARD
         bool "Non-standard serial port support"
         depends on HAS_IOMEM
@@ -679,7 +692,7 @@ config HVCS
           this driver.
 
           To compile this driver as a module, choose M here: the
-          module will be called hvcs.ko.  Additionally, this module
+          module will be called hvcs.  Additionally, this module
           will depend on arch specific APIs exported from hvcserver.ko
           which will also be compiled when this driver is built as a
           module.
@@ -794,7 +807,7 @@ if RTC_LIB=n
 config RTC
         tristate "Enhanced Real Time Clock Support (legacy PC RTC driver)"
         depends on !PPC && !PARISC && !IA64 && !M68K && !SPARC && !FRV \
-                        && !ARM && !SUPERH && !S390 && !AVR32
+                        && !ARM && !SUPERH && !S390 && !AVR32 && !BLACKFIN
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
@@ -893,7 +906,7 @@ config DTLK
 
 config XILINX_HWICAP
         tristate "Xilinx HWICAP Support"
-        depends on XILINX_VIRTEX
+        depends on XILINX_VIRTEX || MICROBLAZE
         help
           This option enables support for Xilinx Internal Configuration
           Access Port (ICAP) driver.  The ICAP is used on Xilinx Virtex
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 9caf5b5ad1c0..189efcff08ce 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_LEGACY_PTYS)	+= pty.o
 obj-$(CONFIG_UNIX98_PTYS)       += pty.o
 obj-y                           += misc.o
 obj-$(CONFIG_VT)                += vt_ioctl.o vc_screen.o selection.o keyboard.o
+obj-$(CONFIG_BFIN_JTAG_COMM)    += bfin_jtag_comm.o
 obj-$(CONFIG_CONSOLE_TRANSLATIONS) += consolemap.o consolemap_deftbl.o
 obj-$(CONFIG_HW_CONSOLE)        += vt.o defkeymap.o
 obj-$(CONFIG_AUDIT)             += tty_audit.o
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 46f507531177..178e2e9e9f09 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -107,7 +107,7 @@ struct agp_bridge_driver {
         void (*agp_enable)(struct agp_bridge_data *, u32);
         void (*cleanup)(void);
         void (*tlb_flush)(struct agp_memory *);
-        unsigned long (*mask_memory)(struct agp_bridge_data *, unsigned long, int);
+        unsigned long (*mask_memory)(struct agp_bridge_data *, struct page *, int);
         void (*cache_flush)(void);
         int (*create_gatt_table)(struct agp_bridge_data *);
         int (*free_gatt_table)(struct agp_bridge_data *);
@@ -115,9 +115,9 @@ struct agp_bridge_driver {
         int (*remove_memory)(struct agp_memory *, off_t, int);
         struct agp_memory *(*alloc_by_type) (size_t, int);
         void (*free_by_type)(struct agp_memory *);
-        void *(*agp_alloc_page)(struct agp_bridge_data *);
+        struct page *(*agp_alloc_page)(struct agp_bridge_data *);
         int (*agp_alloc_pages)(struct agp_bridge_data *, struct agp_memory *, size_t);
-        void (*agp_destroy_page)(void *, int flags);
+        void (*agp_destroy_page)(struct page *, int flags);
         void (*agp_destroy_pages)(struct agp_memory *);
         int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
         void (*chipset_flush)(struct agp_bridge_data *);
@@ -278,10 +278,10 @@ int agp_generic_insert_memory(struct agp_memory *mem, off_t pg_start, int type);
 int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type);
 struct agp_memory *agp_generic_alloc_by_type(size_t page_count, int type);
 void agp_generic_free_by_type(struct agp_memory *curr);
-void *agp_generic_alloc_page(struct agp_bridge_data *bridge);
+struct page *agp_generic_alloc_page(struct agp_bridge_data *bridge);
 int agp_generic_alloc_pages(struct agp_bridge_data *agp_bridge,
                             struct agp_memory *memory, size_t page_count);
-void agp_generic_destroy_page(void *addr, int flags);
+void agp_generic_destroy_page(struct page *page, int flags);
 void agp_generic_destroy_pages(struct agp_memory *memory);
 void agp_free_key(int key);
 int agp_num_entries(void);
@@ -291,7 +291,7 @@ int agp_3_5_enable(struct agp_bridge_data *bridge);
 void global_cache_flush(void);
 void get_agp_version(struct agp_bridge_data *bridge);
 unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
-        unsigned long addr, int type);
+                                      struct page *page, int type);
 int agp_generic_type_to_mask_type(struct agp_bridge_data *bridge,
                                   int type);
 struct agp_bridge_data *agp_generic_find_bridge(struct pci_dev *pdev);
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index dc8d1a90971f..201ef3ffd484 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -141,37 +141,37 @@ static void m1541_cache_flush(void)
         }
 }
 
-static void *m1541_alloc_page(struct agp_bridge_data *bridge)
+static struct page *m1541_alloc_page(struct agp_bridge_data *bridge)
 {
-        void *addr = agp_generic_alloc_page(agp_bridge);
+        struct page *page = agp_generic_alloc_page(agp_bridge);
         u32 temp;
 
-        if (!addr)
+        if (!page)
                 return NULL;
 
         pci_read_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL, &temp);
         pci_write_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL,
                         (((temp & ALI_CACHE_FLUSH_ADDR_MASK) |
-                          virt_to_gart(addr)) | ALI_CACHE_FLUSH_EN ));
-        return addr;
+                          phys_to_gart(page_to_phys(page))) | ALI_CACHE_FLUSH_EN ));
+        return page;
 }
 
-static void ali_destroy_page(void * addr, int flags)
+static void ali_destroy_page(struct page *page, int flags)
 {
-        if (addr) {
+        if (page) {
                 if (flags & AGP_PAGE_DESTROY_UNMAP) {
                         global_cache_flush();   /* is this really needed?  --hch */
-                        agp_generic_destroy_page(addr, flags);
+                        agp_generic_destroy_page(page, flags);
                 } else
-                        agp_generic_destroy_page(addr, flags);
+                        agp_generic_destroy_page(page, flags);
         }
 }
 
-static void m1541_destroy_page(void * addr, int flags)
+static void m1541_destroy_page(struct page *page, int flags)
 {
         u32 temp;
 
-        if (addr == NULL)
+        if (page == NULL)
                 return;
 
         if (flags & AGP_PAGE_DESTROY_UNMAP) {
@@ -180,9 +180,9 @@ static void m1541_destroy_page(void * addr, int flags)
                 pci_read_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL, &temp);
                 pci_write_config_dword(agp_bridge->dev, ALI_CACHE_FLUSH_CTRL,
                                        (((temp & ALI_CACHE_FLUSH_ADDR_MASK) |
-                                         virt_to_gart(addr)) | ALI_CACHE_FLUSH_EN));
+                                         phys_to_gart(page_to_phys(page))) | ALI_CACHE_FLUSH_EN));
         }
-        agp_generic_destroy_page(addr, flags);
+        agp_generic_destroy_page(page, flags);
 }
 
 
@@ -346,7 +346,7 @@ found:
                         devs[j].chipset_name = "M1641";
                         break;
                 case 0x43:
-                        devs[j].chipset_name = "M????";
+                        devs[j].chipset_name = "M1621";
                         break;
                 case 0x47:
                         devs[j].chipset_name = "M1647";
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index 3f98254b911f..ba9bde71eaaf 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -325,7 +325,7 @@ static int amd_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
                 addr = (j * PAGE_SIZE) + agp_bridge->gart_bus_addr;
                 cur_gatt = GET_GATT(addr);
                 writel(agp_generic_mask_memory(agp_bridge,
-                        mem->memory[i], mem->type), cur_gatt+GET_GATT_OFF(addr));
+                        mem->pages[i], mem->type), cur_gatt+GET_GATT_OFF(addr));
                 readl(cur_gatt+GET_GATT_OFF(addr));     /* PCI Posting. */
         }
         amd_irongate_tlbflush(mem);
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index d765afda9c2a..3bf5dda90f4a 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -79,7 +79,7 @@ static int amd64_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 tmp = agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mask_type);
+                        mem->pages[i], mask_type);
 
                 BUG_ON(tmp & 0xffffff0000000ffcULL);
                 pte = (tmp & 0x000000ff00000000ULL) >> 28;
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index f1537eece07f..33656e144cc5 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -269,12 +269,17 @@ static int ati_insert_memory(struct agp_memory * mem,
         int i, j, num_entries;
         unsigned long __iomem *cur_gatt;
         unsigned long addr;
+        int mask_type;
 
         num_entries = A_SIZE_LVL2(agp_bridge->current_size)->num_entries;
 
-        if (type != 0 || mem->type != 0)
+        mask_type = agp_generic_type_to_mask_type(mem->bridge, type);
+        if (mask_type != 0 || type != mem->type)
                 return -EINVAL;
 
+        if (mem->page_count == 0)
+                return 0;
+
         if ((pg_start + mem->page_count) > num_entries)
                 return -EINVAL;
 
@@ -296,10 +301,11 @@ static int ati_insert_memory(struct agp_memory * mem,
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 addr = (j * PAGE_SIZE) + agp_bridge->gart_bus_addr;
                 cur_gatt = GET_GATT(addr);
-                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type), cur_gatt+GET_GATT_OFF(addr));
-                readl(cur_gatt+GET_GATT_OFF(addr));     /* PCI Posting. */
+                writel(agp_bridge->driver->mask_memory(agp_bridge,      
+                                                       mem->pages[i], mem->type),
+                       cur_gatt+GET_GATT_OFF(addr));
         }
+        readl(GET_GATT(agp_bridge->gart_bus_addr)); /* PCI posting */
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
@@ -310,17 +316,22 @@ static int ati_remove_memory(struct agp_memory * mem, off_t pg_start,
         int i;
         unsigned long __iomem *cur_gatt;
         unsigned long addr;
+        int mask_type;
 
-        if (type != 0 || mem->type != 0)
+        mask_type = agp_generic_type_to_mask_type(mem->bridge, type);
+        if (mask_type != 0 || type != mem->type)
                 return -EINVAL;
 
+        if (mem->page_count == 0)
+                return 0;
+
         for (i = pg_start; i < (mem->page_count + pg_start); i++) {
                 addr = (i * PAGE_SIZE) + agp_bridge->gart_bus_addr;
                 cur_gatt = GET_GATT(addr);
                 writel(agp_bridge->scratch_page, cur_gatt+GET_GATT_OFF(addr));
-                readl(cur_gatt+GET_GATT_OFF(addr)); /* PCI Posting. */
         }
 
+        readl(GET_GATT(agp_bridge->gart_bus_addr)); /* PCI posting */
         agp_bridge->driver->tlb_flush(mem);
         return 0;
 }
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index 8c617ad7497f..cfa5a649dfe7 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -141,17 +141,17 @@ static int agp_backend_initialize(struct agp_bridge_data *bridge)
         bridge->version = &agp_current_version;
 
         if (bridge->driver->needs_scratch_page) {
-                void *addr = bridge->driver->agp_alloc_page(bridge);
+                struct page *page = bridge->driver->agp_alloc_page(bridge);
 
-                if (!addr) {
+                if (!page) {
                         dev_err(&bridge->dev->dev,
                                 "can't get memory for scratch page\n");
                         return -ENOMEM;
                 }
 
-                bridge->scratch_page_real = virt_to_gart(addr);
+                bridge->scratch_page_real = phys_to_gart(page_to_phys(page));
                 bridge->scratch_page =
-                    bridge->driver->mask_memory(bridge, bridge->scratch_page_real, 0);
+                    bridge->driver->mask_memory(bridge, page, 0);
         }
 
         size_value = bridge->driver->fetch_size();
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index 453543a1f293..35d50f2861b6 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -65,8 +65,9 @@ static const struct gatt_mask efficeon_generic_masks[] =
 };
 
 /* This function does the same thing as mask_memory() for this chipset... */
-static inline unsigned long efficeon_mask_memory(unsigned long addr)
+static inline unsigned long efficeon_mask_memory(struct page *page)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         return addr | 0x00000001;
 }
 
@@ -257,7 +258,7 @@ static int efficeon_insert_memory(struct agp_memory * mem, off_t pg_start, int t
         last_page = NULL;
         for (i = 0; i < count; i++) {
                 int index = pg_start + i;
-                unsigned long insert = efficeon_mask_memory(mem->memory[i]);
+                unsigned long insert = efficeon_mask_memory(mem->pages[i]);
 
                 page = (unsigned int *) efficeon_private.l1_table[index >> 10];
 
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 2224b762b7fb..1e8b461b91f1 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -95,13 +95,13 @@ EXPORT_SYMBOL(agp_flush_chipset);
 
 void agp_alloc_page_array(size_t size, struct agp_memory *mem)
 {
-        mem->memory = NULL;
+        mem->pages = NULL;
         mem->vmalloc_flag = false;
 
         if (size <= 2*PAGE_SIZE)
-                mem->memory = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
-        if (mem->memory == NULL) {
-                mem->memory = vmalloc(size);
+                mem->pages = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
+        if (mem->pages == NULL) {
+                mem->pages = vmalloc(size);
                 mem->vmalloc_flag = true;
         }
 }
@@ -110,9 +110,9 @@ EXPORT_SYMBOL(agp_alloc_page_array);
 void agp_free_page_array(struct agp_memory *mem)
 {
         if (mem->vmalloc_flag) {
-                vfree(mem->memory);
+                vfree(mem->pages);
         } else {
-                kfree(mem->memory);
+                kfree(mem->pages);
         }
 }
 EXPORT_SYMBOL(agp_free_page_array);
@@ -136,7 +136,7 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
 
         agp_alloc_page_array(alloc_size, new);
 
-        if (new->memory == NULL) {
+        if (new->pages == NULL) {
                 agp_free_key(new->key);
                 kfree(new);
                 return NULL;
@@ -162,7 +162,7 @@ struct agp_memory *agp_create_memory(int scratch_pages)
 
         agp_alloc_page_array(PAGE_SIZE * scratch_pages, new);
 
-        if (new->memory == NULL) {
+        if (new->pages == NULL) {
                 agp_free_key(new->key);
                 kfree(new);
                 return NULL;
@@ -206,15 +206,13 @@ void agp_free_memory(struct agp_memory *curr)
                 } else {
 
                         for (i = 0; i < curr->page_count; i++) {
-                                curr->memory[i] = (unsigned long)gart_to_virt(
-                                        curr->memory[i]);
                                 curr->bridge->driver->agp_destroy_page(
-                                        (void *)curr->memory[i],
+                                        curr->pages[i],
                                         AGP_PAGE_DESTROY_UNMAP);
                         }
                         for (i = 0; i < curr->page_count; i++) {
                                 curr->bridge->driver->agp_destroy_page(
-                                        (void *)curr->memory[i],
+                                        curr->pages[i],
                                         AGP_PAGE_DESTROY_FREE);
                         }
                 }
@@ -282,13 +280,13 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
         }
 
         for (i = 0; i < page_count; i++) {
-                void *addr = bridge->driver->agp_alloc_page(bridge);
+                struct page *page = bridge->driver->agp_alloc_page(bridge);
 
-                if (addr == NULL) {
+                if (page == NULL) {
                         agp_free_memory(new);
                         return NULL;
                 }
-                new->memory[i] = virt_to_gart(addr);
+                new->pages[i] = page;
                 new->page_count++;
         }
         new->bridge = bridge;
@@ -1134,7 +1132,7 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(bridge->driver->mask_memory(bridge, mem->memory[i], mask_type),
+                writel(bridge->driver->mask_memory(bridge, mem->pages[i], mask_type),
                        bridge->gatt_table+j);
         }
         readl(bridge->gatt_table+j-1);  /* PCI Posting. */
@@ -1204,7 +1202,7 @@ struct agp_memory *agp_generic_alloc_user(size_t page_count, int type)
                 return NULL;
 
         for (i = 0; i < page_count; i++)
-                new->memory[i] = 0;
+                new->pages[i] = 0;
         new->page_count = 0;
         new->type = type;
         new->num_scratch_pages = pages;
@@ -1237,23 +1235,20 @@ int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *m
                 get_page(page);
                 atomic_inc(&agp_bridge->current_memory_agp);
 
-                /* set_memory_array_uc() needs virtual address */
-                mem->memory[i] = (unsigned long)page_address(page);
+                mem->pages[i] = page;
                 mem->page_count++;
         }
 
 #ifdef CONFIG_X86
-        set_memory_array_uc(mem->memory, num_pages);
+        set_pages_array_uc(mem->pages, num_pages);
 #endif
         ret = 0;
 out:
-        for (i = 0; i < mem->page_count; i++)
-                mem->memory[i] = virt_to_gart((void *)mem->memory[i]);
         return ret;
 }
 EXPORT_SYMBOL(agp_generic_alloc_pages);
 
-void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
+struct page *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page * page;
 
@@ -1265,56 +1260,47 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 
         get_page(page);
         atomic_inc(&agp_bridge->current_memory_agp);
-        return page_address(page);
+        return page;
 }
 EXPORT_SYMBOL(agp_generic_alloc_page);
 
 void agp_generic_destroy_pages(struct agp_memory *mem)
 {
         int i;
-        void *addr;
         struct page *page;
 
         if (!mem)
                 return;
 
-        for (i = 0; i < mem->page_count; i++)
-                mem->memory[i] = (unsigned long)gart_to_virt(mem->memory[i]);
-
 #ifdef CONFIG_X86
-        set_memory_array_wb(mem->memory, mem->page_count);
+        set_pages_array_wb(mem->pages, mem->page_count);
 #endif
 
         for (i = 0; i < mem->page_count; i++) {
-                addr = (void *)mem->memory[i];
-                page = virt_to_page(addr);
+                page = mem->pages[i];
 
 #ifndef CONFIG_X86
                 unmap_page_from_agp(page);
 #endif
-
                 put_page(page);
-                free_page((unsigned long)addr);
+                __free_page(page);
                 atomic_dec(&agp_bridge->current_memory_agp);
-                mem->memory[i] = 0;
+                mem->pages[i] = NULL;
         }
 }
 EXPORT_SYMBOL(agp_generic_destroy_pages);
 
-void agp_generic_destroy_page(void *addr, int flags)
+void agp_generic_destroy_page(struct page *page, int flags)
 {
-        struct page *page;
-
-        if (addr == NULL)
+        if (page == NULL)
                 return;
 
-        page = virt_to_page(addr);
         if (flags & AGP_PAGE_DESTROY_UNMAP)
                 unmap_page_from_agp(page);
 
         if (flags & AGP_PAGE_DESTROY_FREE) {
                 put_page(page);
-                free_page((unsigned long)addr);
+                __free_page(page);
                 atomic_dec(&agp_bridge->current_memory_agp);
         }
 }
@@ -1361,8 +1347,9 @@ void global_cache_flush(void)
 EXPORT_SYMBOL(global_cache_flush);
 
 unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
-        unsigned long addr, int type)
+                                      struct page *page, int type)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         /* memory type is ignored in the generic routine */
         if (bridge->driver->masks)
                 return addr | bridge->driver->masks[0].mask;
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 183ac3fe44fb..8f3d4c184914 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -361,13 +361,11 @@ hp_zx1_insert_memory (struct agp_memory *mem, off_t pg_start, int type)
         for (i = 0, j = io_pg_start; i < mem->page_count; i++) {
                 unsigned long paddr;
 
-                paddr = mem->memory[i];
+                paddr = page_to_phys(mem->pages[i]);
                 for (k = 0;
                      k < hp->io_pages_per_kpage;
                      k++, j++, paddr += hp->io_page_size) {
-                        hp->gatt[j] =
-                                agp_bridge->driver->mask_memory(agp_bridge,
-                                        paddr, type);
+                        hp->gatt[j] = HP_ZX1_PDIR_VALID_BIT | paddr;
                 }
         }
 
@@ -397,8 +395,9 @@ hp_zx1_remove_memory (struct agp_memory *mem, off_t pg_start, int type)
 
 static unsigned long
 hp_zx1_mask_memory (struct agp_bridge_data *bridge,
-        unsigned long addr, int type)
+                    struct page *page, int type)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         return HP_ZX1_PDIR_VALID_BIT | addr;
 }
 
@@ -518,8 +517,9 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
         if (hp_zx1_setup(sba_hpa + HP_ZX1_IOC_OFFSET, lba_hpa))
                 return AE_OK;
 
-        printk(KERN_INFO PFX "Detected HP ZX1 %s AGP chipset (ioc=%lx, lba=%lx)\n",
-                (char *) context, sba_hpa + HP_ZX1_IOC_OFFSET, lba_hpa);
+        printk(KERN_INFO PFX "Detected HP ZX1 %s AGP chipset "
+                "(ioc=%llx, lba=%llx)\n", (char *)context,
+                sba_hpa + HP_ZX1_IOC_OFFSET, lba_hpa);
 
         hp_zx1_gart_found = 1;
         return AE_CTRL_TERMINATE; /* we only support one bridge; quit looking */
diff --git a/drivers/char/agp/i460-agp.c b/drivers/char/agp/i460-agp.c
index 10da687d131a..60cc35bb5db7 100644
--- a/drivers/char/agp/i460-agp.c
+++ b/drivers/char/agp/i460-agp.c
@@ -60,6 +60,9 @@
  */
 #define WR_FLUSH_GATT(index)    RD_GATT(index)
 
+static unsigned long i460_mask_memory (struct agp_bridge_data *bridge,
+                                       unsigned long addr, int type);
+
 static struct {
         void *gatt;                             /* ioremap'd GATT area */
 
@@ -74,6 +77,7 @@ static struct {
                 unsigned long *alloced_map;     /* bitmap of kernel-pages in use */
                 int refcount;                   /* number of kernel pages using the large page */
                 u64 paddr;                      /* physical address of large page */
+                struct page *page;              /* page pointer */
         } *lp_desc;
 } i460;
 
@@ -294,7 +298,7 @@ static int i460_insert_memory_small_io_page (struct agp_memory *mem,
         void *temp;
 
         pr_debug("i460_insert_memory_small_io_page(mem=%p, pg_start=%ld, type=%d, paddr0=0x%lx)\n",
-                 mem, pg_start, type, mem->memory[0]);
+                 mem, pg_start, type, page_to_phys(mem->pages[0]));
 
         if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
                 return -EINVAL;
@@ -321,10 +325,9 @@ static int i460_insert_memory_small_io_page (struct agp_memory *mem,
 
         io_page_size = 1UL << I460_IO_PAGE_SHIFT;
         for (i = 0, j = io_pg_start; i < mem->page_count; i++) {
-                paddr = mem->memory[i];
+                paddr = phys_to_gart(page_to_phys(mem->pages[i]));
                 for (k = 0; k < I460_IOPAGES_PER_KPAGE; k++, j++, paddr += io_page_size)
-                        WR_GATT(j, agp_bridge->driver->mask_memory(agp_bridge,
-                                paddr, mem->type));
+                        WR_GATT(j, i460_mask_memory(agp_bridge, paddr, mem->type));
         }
         WR_FLUSH_GATT(j - 1);
         return 0;
@@ -364,10 +367,9 @@ static int i460_alloc_large_page (struct lp_desc *lp)
 {
         unsigned long order = I460_IO_PAGE_SHIFT - PAGE_SHIFT;
         size_t map_size;
-        void *lpage;
 
-        lpage = (void *) __get_free_pages(GFP_KERNEL, order);
-        if (!lpage) {
+        lp->page = alloc_pages(GFP_KERNEL, order);
+        if (!lp->page) {
                 printk(KERN_ERR PFX "Couldn't alloc 4M GART page...\n");
                 return -ENOMEM;
         }
@@ -375,12 +377,12 @@ static int i460_alloc_large_page (struct lp_desc *lp)
         map_size = ((I460_KPAGES_PER_IOPAGE + BITS_PER_LONG - 1) & -BITS_PER_LONG)/8;
         lp->alloced_map = kzalloc(map_size, GFP_KERNEL);
         if (!lp->alloced_map) {
-                free_pages((unsigned long) lpage, order);
+                __free_pages(lp->page, order);
                 printk(KERN_ERR PFX "Out of memory, we're in trouble...\n");
                 return -ENOMEM;
         }
 
-        lp->paddr = virt_to_gart(lpage);
+        lp->paddr = phys_to_gart(page_to_phys(lp->page));
         lp->refcount = 0;
         atomic_add(I460_KPAGES_PER_IOPAGE, &agp_bridge->current_memory_agp);
         return 0;
@@ -391,7 +393,7 @@ static void i460_free_large_page (struct lp_desc *lp)
         kfree(lp->alloced_map);
         lp->alloced_map = NULL;
 
-        free_pages((unsigned long) gart_to_virt(lp->paddr), I460_IO_PAGE_SHIFT - PAGE_SHIFT);
+        __free_pages(lp->page, I460_IO_PAGE_SHIFT - PAGE_SHIFT);
         atomic_sub(I460_KPAGES_PER_IOPAGE, &agp_bridge->current_memory_agp);
 }
 
@@ -439,8 +441,8 @@ static int i460_insert_memory_large_io_page (struct agp_memory *mem,
                         if (i460_alloc_large_page(lp) < 0)
                                 return -ENOMEM;
                         pg = lp - i460.lp_desc;
-                        WR_GATT(pg, agp_bridge->driver->mask_memory(agp_bridge,
-                                lp->paddr, 0));
+                        WR_GATT(pg, i460_mask_memory(agp_bridge,
+                                                     lp->paddr, 0));
                         WR_FLUSH_GATT(pg);
                 }
 
@@ -448,7 +450,7 @@ static int i460_insert_memory_large_io_page (struct agp_memory *mem,
                      idx < ((lp == end) ? (end_offset + 1) : I460_KPAGES_PER_IOPAGE);
                      idx++, i++)
                 {
-                        mem->memory[i] = lp->paddr + idx*PAGE_SIZE;
+                        mem->pages[i] = lp->page;
                         __set_bit(idx, lp->alloced_map);
                         ++lp->refcount;
                 }
@@ -463,7 +465,7 @@ static int i460_remove_memory_large_io_page (struct agp_memory *mem,
         struct lp_desc *start, *end, *lp;
         void *temp;
 
-        temp = agp_bridge->driver->current_size;
+        temp = agp_bridge->current_size;
         num_entries = A_SIZE_8(temp)->num_entries;
 
         /* Figure out what pg_start means in terms of our large GART pages */
@@ -477,7 +479,7 @@ static int i460_remove_memory_large_io_page (struct agp_memory *mem,
                      idx < ((lp == end) ? (end_offset + 1) : I460_KPAGES_PER_IOPAGE);
                      idx++, i++)
                 {
-                        mem->memory[i] = 0;
+                        mem->pages[i] = NULL;
                         __clear_bit(idx, lp->alloced_map);
                         --lp->refcount;
                 }
@@ -521,7 +523,7 @@ static int i460_remove_memory (struct agp_memory *mem,
  * Let's just hope nobody counts on the allocated AGP memory being there before bind time
  * (I don't think current drivers do)...
  */
-static void *i460_alloc_page (struct agp_bridge_data *bridge)
+static struct page *i460_alloc_page (struct agp_bridge_data *bridge)
 {
         void *page;
 
@@ -534,7 +536,7 @@ static void *i460_alloc_page (struct agp_bridge_data *bridge)
         return page;
 }
 
-static void i460_destroy_page (void *page, int flags)
+static void i460_destroy_page (struct page *page, int flags)
 {
         if (I460_IO_PAGE_SHIFT <= PAGE_SHIFT) {
                 agp_generic_destroy_page(page, flags);
@@ -544,13 +546,20 @@ static void i460_destroy_page (void *page, int flags)
 #endif /* I460_LARGE_IO_PAGES */
 
 static unsigned long i460_mask_memory (struct agp_bridge_data *bridge,
-        unsigned long addr, int type)
+                                       unsigned long addr, int type)
 {
         /* Make sure the returned address is a valid GATT entry */
         return bridge->driver->masks[0].mask
                 | (((addr & ~((1 << I460_IO_PAGE_SHIFT) - 1)) & 0xfffff000) >> 12);
 }
 
+static unsigned long i460_page_mask_memory(struct agp_bridge_data *bridge,
+                                           struct page *page, int type)
+{
+        unsigned long addr = phys_to_gart(page_to_phys(page));
+        return i460_mask_memory(bridge, addr, type);
+}
+
 const struct agp_bridge_driver intel_i460_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = i460_sizes,
@@ -560,7 +569,7 @@ const struct agp_bridge_driver intel_i460_driver = {
         .fetch_size             = i460_fetch_size,
         .cleanup                = i460_cleanup,
         .tlb_flush              = i460_tlb_flush,
-        .mask_memory            = i460_mask_memory,
+        .mask_memory            = i460_page_mask_memory,
         .masks                  = i460_masks,
         .agp_enable             = agp_generic_enable,
         .cache_flush            = global_cache_flush,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 3686912427ba..8c9d50db5c3a 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -46,6 +46,10 @@
 #define PCI_DEVICE_ID_INTEL_G45_IG          0x2E22
 #define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
 #define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
+#define PCI_DEVICE_ID_INTEL_IGDNG_D_HB      0x0040
+#define PCI_DEVICE_ID_INTEL_IGDNG_D_IG      0x0042
+#define PCI_DEVICE_ID_INTEL_IGDNG_M_HB      0x0044
+#define PCI_DEVICE_ID_INTEL_IGDNG_M_IG      0x0046
 
 /* cover 915 and 945 variants */
 #define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
@@ -75,7 +79,9 @@
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB)
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB)
 
 extern int agp_memory_reserved;
 
@@ -251,7 +257,7 @@ static void intel_i810_agp_enable(struct agp_bridge_data *bridge, u32 mode)
 }
 
 /* Exists to support ARGB cursors */
-static void *i8xx_alloc_pages(void)
+static struct page *i8xx_alloc_pages(void)
 {
         struct page *page;
 
@@ -266,17 +272,14 @@ static void *i8xx_alloc_pages(void)
         }
         get_page(page);
         atomic_inc(&agp_bridge->current_memory_agp);
-        return page_address(page);
+        return page;
 }
 
-static void i8xx_destroy_pages(void *addr)
+static void i8xx_destroy_pages(struct page *page)
 {
-        struct page *page;
-
-        if (addr == NULL)
+        if (page == NULL)
                 return;
 
-        page = virt_to_page(addr);
         set_pages_wb(page, 4);
         put_page(page);
         __free_pages(page, 2);
@@ -340,7 +343,7 @@ static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
                         global_cache_flush();
                 for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                         writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                                               mem->memory[i],
+                                                               mem->pages[i],
                                                                mask_type),
                                intel_private.registers+I810_PTE_BASE+(j*4));
                 }
@@ -383,37 +386,37 @@ static int intel_i810_remove_entries(struct agp_memory *mem, off_t pg_start,
 static struct agp_memory *alloc_agpphysmem_i8xx(size_t pg_count, int type)
 {
         struct agp_memory *new;
-        void *addr;
+        struct page *page;
 
         switch (pg_count) {
-        case 1: addr = agp_bridge->driver->agp_alloc_page(agp_bridge);
+        case 1: page = agp_bridge->driver->agp_alloc_page(agp_bridge);
                 break;
         case 4:
                 /* kludge to get 4 physical pages for ARGB cursor */
-                addr = i8xx_alloc_pages();
+                page = i8xx_alloc_pages();
                 break;
         default:
                 return NULL;
         }
 
-        if (addr == NULL)
+        if (page == NULL)
                 return NULL;
 
         new = agp_create_memory(pg_count);
         if (new == NULL)
                 return NULL;
 
-        new->memory[0] = virt_to_gart(addr);
+        new->pages[0] = page;
         if (pg_count == 4) {
                 /* kludge to get 4 physical pages for ARGB cursor */
-                new->memory[1] = new->memory[0] + PAGE_SIZE;
-                new->memory[2] = new->memory[1] + PAGE_SIZE;
-                new->memory[3] = new->memory[2] + PAGE_SIZE;
+                new->pages[1] = new->pages[0] + 1;
+                new->pages[2] = new->pages[1] + 1;
+                new->pages[3] = new->pages[2] + 1;
         }
         new->page_count = pg_count;
         new->num_scratch_pages = pg_count;
         new->type = AGP_PHYS_MEMORY;
-        new->physical = new->memory[0];
+        new->physical = page_to_phys(new->pages[0]);
         return new;
 }
 
@@ -445,13 +448,11 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
         agp_free_key(curr->key);
         if (curr->type == AGP_PHYS_MEMORY) {
                 if (curr->page_count == 4)
-                        i8xx_destroy_pages(gart_to_virt(curr->memory[0]));
+                        i8xx_destroy_pages(curr->pages[0]);
                 else {
-                        void *va = gart_to_virt(curr->memory[0]);
-
-                        agp_bridge->driver->agp_destroy_page(va,
+                        agp_bridge->driver->agp_destroy_page(curr->pages[0],
                                                              AGP_PAGE_DESTROY_UNMAP);
-                        agp_bridge->driver->agp_destroy_page(va,
+                        agp_bridge->driver->agp_destroy_page(curr->pages[0],
                                                              AGP_PAGE_DESTROY_FREE);
                 }
                 agp_free_page_array(curr);
@@ -460,8 +461,9 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
 }
 
 static unsigned long intel_i810_mask_memory(struct agp_bridge_data *bridge,
-        unsigned long addr, int type)
+                                            struct page *page, int type)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         /* Type checking must be done elsewhere */
         return addr | bridge->driver->masks[type].mask;
 }
@@ -849,7 +851,7 @@ static int intel_i830_insert_entries(struct agp_memory *mem, off_t pg_start,
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                                       mem->memory[i], mask_type),
+                                                       mem->pages[i], mask_type),
                        intel_private.registers+I810_PTE_BASE+(j*4));
         }
         readl(intel_private.registers+I810_PTE_BASE+((j-1)*4));
@@ -1079,7 +1081,7 @@ static int intel_i915_insert_entries(struct agp_memory *mem, off_t pg_start,
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mask_type), intel_private.gtt+j);
+                                                       mem->pages[i], mask_type), intel_private.gtt+j);
         }
 
         readl(intel_private.gtt+j-1);
@@ -1194,8 +1196,9 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
  * this conditional.
  */
 static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
-        unsigned long addr, int type)
+                                            struct page *page, int type)
 {
+        dma_addr_t addr = phys_to_gart(page_to_phys(page));
         /* Shift high bits down */
         addr |= (addr >> 28) & 0xf0;
 
@@ -1211,6 +1214,8 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
         case PCI_DEVICE_ID_INTEL_Q45_HB:
         case PCI_DEVICE_ID_INTEL_G45_HB:
         case PCI_DEVICE_ID_INTEL_G41_HB:
+        case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
+        case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
                 *gtt_offset = *gtt_size = MB(2);
                 break;
         default:
@@ -2186,6 +2191,10 @@ static const struct intel_driver_description {
             "G45/G43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0,
             "G41", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_IGDNG_D_HB, PCI_DEVICE_ID_INTEL_IGDNG_D_IG, 0,
+            "IGDNG/D", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_IGDNG_M_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+            "IGDNG/M", NULL, &intel_i965_driver },
         { 0, 0, 0, NULL, NULL, NULL }
 };
 
@@ -2387,6 +2396,8 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_Q45_HB),
         ID(PCI_DEVICE_ID_INTEL_G45_HB),
         ID(PCI_DEVICE_ID_INTEL_G41_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
+        ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
         { }
 };
 
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index 16acee2de117..263d71dd441c 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -225,7 +225,7 @@ static int nvidia_insert_memory(struct agp_memory *mem, off_t pg_start, int type
         }
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mask_type),
+                        mem->pages[i], mask_type),
                         agp_bridge->gatt_table+nvidia_private.pg_offset+j);
         }
 
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index 699e3422ad93..f4bb43fb8016 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -31,6 +31,10 @@
 #define AGP8X_MODE_BIT          3
 #define AGP8X_MODE              (1 << AGP8X_MODE_BIT)
 
+static unsigned long
+parisc_agp_mask_memory(struct agp_bridge_data *bridge, unsigned long addr,
+                       int type);
+
 static struct _parisc_agp_info {
         void __iomem *ioc_regs;
         void __iomem *lba_regs;
@@ -149,12 +153,12 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
         for (i = 0, j = io_pg_start; i < mem->page_count; i++) {
                 unsigned long paddr;
 
-                paddr = mem->memory[i];
+                paddr = page_to_phys(mem->pages[i]);
                 for (k = 0;
                      k < info->io_pages_per_kpage;
                      k++, j++, paddr += info->io_page_size) {
                         info->gatt[j] =
-                                agp_bridge->driver->mask_memory(agp_bridge,
+                                parisc_agp_mask_memory(agp_bridge,
                                         paddr, type);
                 }
         }
@@ -185,9 +189,17 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 }
 
 static unsigned long
-parisc_agp_mask_memory(struct agp_bridge_data *bridge,
-                    unsigned long addr, int type)
+parisc_agp_mask_memory(struct agp_bridge_data *bridge, unsigned long addr,
+                       int type)
+{
+        return SBA_PDIR_VALID_BIT | addr;
+}
+
+static unsigned long
+parisc_agp_page_mask_memory(struct agp_bridge_data *bridge, struct page *page,
+                            int type)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         return SBA_PDIR_VALID_BIT | addr;
 }
 
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index b972d83bb1b2..d3ea2e4226b5 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -38,7 +38,7 @@ static struct aper_size_info_fixed sgi_tioca_sizes[] = {
         {0, 0, 0},
 };
 
-static void *sgi_tioca_alloc_page(struct agp_bridge_data *bridge)
+static struct page *sgi_tioca_alloc_page(struct agp_bridge_data *bridge)
 {
         struct page *page;
         int nid;
@@ -52,7 +52,7 @@ static void *sgi_tioca_alloc_page(struct agp_bridge_data *bridge)
 
         get_page(page);
         atomic_inc(&agp_bridge->current_memory_agp);
-        return page_address(page);
+        return page;
 }
 
 /*
@@ -71,8 +71,9 @@ static void sgi_tioca_tlbflush(struct agp_memory *mem)
  */
 static unsigned long
 sgi_tioca_mask_memory(struct agp_bridge_data *bridge,
-                      unsigned long addr, int type)
+                      struct page *page, int type)
 {
+        unsigned long addr = phys_to_gart(page_to_phys(page));
         return tioca_physpage_to_gart(addr);
 }
 
@@ -189,7 +190,7 @@ static int sgi_tioca_insert_memory(struct agp_memory *mem, off_t pg_start,
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 table[j] =
-                    bridge->driver->mask_memory(bridge, mem->memory[i],
+                    bridge->driver->mask_memory(bridge, mem->pages[i],
                                                 mem->type);
         }
 
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 6224df8b7f0a..b964a2199329 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -349,7 +349,7 @@ static int serverworks_insert_memory(struct agp_memory *mem,
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 addr = (j * PAGE_SIZE) + agp_bridge->gart_bus_addr;
                 cur_gatt = SVRWRKS_GET_GATT(addr);
-                writel(agp_bridge->driver->mask_memory(agp_bridge, mem->memory[i], mem->type), cur_gatt+GET_GATT_OFF(addr));
+                writel(agp_bridge->driver->mask_memory(agp_bridge, mem->pages[i], mem->type), cur_gatt+GET_GATT_OFF(addr));
         }
         serverworks_tlbflush(mem);
         return 0;
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 03f95ec08f59..f192c3b9ad41 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -146,13 +146,20 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start,
 {
         int i, j, num_entries;
         void *temp;
+        int mask_type;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_32(temp)->num_entries;
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+        if (mask_type != 0) {
                 /* We know nothing of memory types */
                 return -EINVAL;
+        }
+
         if ((pg_start + mem->page_count) > num_entries)
                 return -EINVAL;
 
@@ -166,9 +173,9 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start,
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 agp_bridge->gatt_table[j] =
-                    cpu_to_le32((mem->memory[i] & 0xFFFFF000UL) | 0x1UL);
-                flush_dcache_range((unsigned long)__va(mem->memory[i]),
-                                   (unsigned long)__va(mem->memory[i])+0x1000);
+                        cpu_to_le32((page_to_phys(mem->pages[i]) & 0xFFFFF000UL) | 0x1UL);
+                flush_dcache_range((unsigned long)__va(page_to_phys(mem->pages[i])),
+                                   (unsigned long)__va(page_to_phys(mem->pages[i]))+0x1000);
         }
         (void)in_le32((volatile u32*)&agp_bridge->gatt_table[pg_start]);
         mb();
@@ -184,13 +191,20 @@ static int u3_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
         int i, num_entries;
         void *temp;
         u32 *gp;
+        int mask_type;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_32(temp)->num_entries;
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+        if (mask_type != 0) {
                 /* We know nothing of memory types */
                 return -EINVAL;
+        }
+
         if ((pg_start + mem->page_count) > num_entries)
                 return -EINVAL;
 
@@ -205,9 +219,9 @@ static int u3_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
         }
 
         for (i = 0; i < mem->page_count; i++) {
-                gp[i] = (mem->memory[i] >> PAGE_SHIFT) | 0x80000000UL;
-                flush_dcache_range((unsigned long)__va(mem->memory[i]),
-                                   (unsigned long)__va(mem->memory[i])+0x1000);
+                gp[i] = (page_to_phys(mem->pages[i]) >> PAGE_SHIFT) | 0x80000000UL;
+                flush_dcache_range((unsigned long)__va(page_to_phys(mem->pages[i])),
+                                   (unsigned long)__va(page_to_phys(mem->pages[i]))+0x1000);
         }
         mb();
         flush_dcache_range((unsigned long)gp, (unsigned long) &gp[i]);
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index fd3ebd1be570..72429b6b2fa8 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -779,7 +779,7 @@ static void change_speed(struct async_struct *info,
                 info->IER |= UART_IER_MSI;
         }
         /* TBD:
-         * Does clearing IER_MSI imply that we should disbale the VBL interrupt ?
+         * Does clearing IER_MSI imply that we should disable the VBL interrupt ?
          */
 
         /*
diff --git a/drivers/char/bfin_jtag_comm.c b/drivers/char/bfin_jtag_comm.c
new file mode 100644
index 000000000000..1d7c34c73b20
--- /dev/null
+++ b/drivers/char/bfin_jtag_comm.c
@@ -0,0 +1,365 @@
+/*
+ * TTY over Blackfin JTAG Communication
+ *
+ * Copyright 2008-2009 Analog Devices Inc.
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#define DRV_NAME "bfin-jtag-comm"
+#define DEV_NAME "ttyBFJC"
+#define pr_fmt(fmt) DRV_NAME ": " fmt
+
+#include <linux/circ_buf.h>
+#include <linux/console.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+#include <asm/atomic.h>
+
+#define pr_init(fmt, args...) ({ static const __initconst char __fmt[] = fmt; printk(__fmt, ## args); })
+
+/* See the Debug/Emulation chapter in the HRM */
+#define EMUDOF   0x00000001     /* EMUDAT_OUT full & valid */
+#define EMUDIF   0x00000002     /* EMUDAT_IN full & valid */
+#define EMUDOOVF 0x00000004     /* EMUDAT_OUT overflow */
+#define EMUDIOVF 0x00000008     /* EMUDAT_IN overflow */
+
+static inline uint32_t bfin_write_emudat(uint32_t emudat)
+{
+        __asm__ __volatile__("emudat = %0;" : : "d"(emudat));
+        return emudat;
+}
+
+static inline uint32_t bfin_read_emudat(void)
+{
+        uint32_t emudat;
+        __asm__ __volatile__("%0 = emudat;" : "=d"(emudat));
+        return emudat;
+}
+
+static inline uint32_t bfin_write_emudat_chars(char a, char b, char c, char d)
+{
+        return bfin_write_emudat((a << 0) | (b << 8) | (c << 16) | (d << 24));
+}
+
+#define CIRC_SIZE 2048  /* see comment in tty_io.c:do_tty_write() */
+#define CIRC_MASK (CIRC_SIZE - 1)
+#define circ_empty(circ)     ((circ)->head == (circ)->tail)
+#define circ_free(circ)      CIRC_SPACE((circ)->head, (circ)->tail, CIRC_SIZE)
+#define circ_cnt(circ)       CIRC_CNT((circ)->head, (circ)->tail, CIRC_SIZE)
+#define circ_byte(circ, idx) ((circ)->buf[(idx) & CIRC_MASK])
+
+static struct tty_driver *bfin_jc_driver;
+static struct task_struct *bfin_jc_kthread;
+static struct tty_struct * volatile bfin_jc_tty;
+static unsigned long bfin_jc_count;
+static DEFINE_MUTEX(bfin_jc_tty_mutex);
+static volatile struct circ_buf bfin_jc_write_buf;
+
+static int
+bfin_jc_emudat_manager(void *arg)
+{
+        uint32_t inbound_len = 0, outbound_len = 0;
+
+        while (!kthread_should_stop()) {
+                /* no one left to give data to, so sleep */
+                if (bfin_jc_tty == NULL && circ_empty(&bfin_jc_write_buf)) {
+                        pr_debug("waiting for readers\n");
+                        __set_current_state(TASK_UNINTERRUPTIBLE);
+                        schedule();
+                        __set_current_state(TASK_RUNNING);
+                }
+
+                /* no data available, so just chill */
+                if (!(bfin_read_DBGSTAT() & EMUDIF) && circ_empty(&bfin_jc_write_buf)) {
+                        pr_debug("waiting for data (in_len = %i) (circ: %i %i)\n",
+                                inbound_len, bfin_jc_write_buf.tail, bfin_jc_write_buf.head);
+                        if (inbound_len)
+                                schedule();
+                        else
+                                schedule_timeout_interruptible(HZ);
+                        continue;
+                }
+
+                /* if incoming data is ready, eat it */
+                if (bfin_read_DBGSTAT() & EMUDIF) {
+                        struct tty_struct *tty;
+                        mutex_lock(&bfin_jc_tty_mutex);
+                        tty = (struct tty_struct *)bfin_jc_tty;
+                        if (tty != NULL) {
+                                uint32_t emudat = bfin_read_emudat();
+                                if (inbound_len == 0) {
+                                        pr_debug("incoming length: 0x%08x\n", emudat);
+                                        inbound_len = emudat;
+                                } else {
+                                        size_t num_chars = (4 <= inbound_len ? 4 : inbound_len);
+                                        pr_debug("  incoming data: 0x%08x (pushing %zu)\n", emudat, num_chars);
+                                        inbound_len -= num_chars;
+                                        tty_insert_flip_string(tty, (unsigned char *)&emudat, num_chars);
+                                        tty_flip_buffer_push(tty);
+                                }
+                        }
+                        mutex_unlock(&bfin_jc_tty_mutex);
+                }
+
+                /* if outgoing data is ready, post it */
+                if (!(bfin_read_DBGSTAT() & EMUDOF) && !circ_empty(&bfin_jc_write_buf)) {
+                        if (outbound_len == 0) {
+                                outbound_len = circ_cnt(&bfin_jc_write_buf);
+                                bfin_write_emudat(outbound_len);
+                                pr_debug("outgoing length: 0x%08x\n", outbound_len);
+                        } else {
+                                struct tty_struct *tty;
+                                int tail = bfin_jc_write_buf.tail;
+                                size_t ate = (4 <= outbound_len ? 4 : outbound_len);
+                                uint32_t emudat =
+                                bfin_write_emudat_chars(
+                                        circ_byte(&bfin_jc_write_buf, tail + 0),
+                                        circ_byte(&bfin_jc_write_buf, tail + 1),
+                                        circ_byte(&bfin_jc_write_buf, tail + 2),
+                                        circ_byte(&bfin_jc_write_buf, tail + 3)
+                                );
+                                bfin_jc_write_buf.tail += ate;
+                                outbound_len -= ate;
+                                mutex_lock(&bfin_jc_tty_mutex);
+                                tty = (struct tty_struct *)bfin_jc_tty;
+                                if (tty)
+                                        tty_wakeup(tty);
+                                mutex_unlock(&bfin_jc_tty_mutex);
+                                pr_debug("  outgoing data: 0x%08x (pushing %zu)\n", emudat, ate);
+                        }
+                }
+        }
+
+        __set_current_state(TASK_RUNNING);
+        return 0;
+}
+
+static int
+bfin_jc_open(struct tty_struct *tty, struct file *filp)
+{
+        mutex_lock(&bfin_jc_tty_mutex);
+        pr_debug("open %lu\n", bfin_jc_count);
+        ++bfin_jc_count;
+        bfin_jc_tty = tty;
+        wake_up_process(bfin_jc_kthread);
+        mutex_unlock(&bfin_jc_tty_mutex);
+        return 0;
+}
+
+static void
+bfin_jc_close(struct tty_struct *tty, struct file *filp)
+{
+        mutex_lock(&bfin_jc_tty_mutex);
+        pr_debug("close %lu\n", bfin_jc_count);
+        if (--bfin_jc_count == 0)
+                bfin_jc_tty = NULL;
+        wake_up_process(bfin_jc_kthread);
+        mutex_unlock(&bfin_jc_tty_mutex);
+}
+
+/* XXX: we dont handle the put_char() case where we must handle count = 1 */
+static int
+bfin_jc_circ_write(const unsigned char *buf, int count)
+{
+        int i;
+        count = min(count, circ_free(&bfin_jc_write_buf));
+        pr_debug("going to write chunk of %i bytes\n", count);
+        for (i = 0; i < count; ++i)
+                circ_byte(&bfin_jc_write_buf, bfin_jc_write_buf.head + i) = buf[i];
+        bfin_jc_write_buf.head += i;
+        return i;
+}
+
+#ifndef CONFIG_BFIN_JTAG_COMM_CONSOLE
+# define acquire_console_sem()
+# define release_console_sem()
+#endif
+static int
+bfin_jc_write(struct tty_struct *tty, const unsigned char *buf, int count)
+{
+        int i;
+        acquire_console_sem();
+        i = bfin_jc_circ_write(buf, count);
+        release_console_sem();
+        wake_up_process(bfin_jc_kthread);
+        return i;
+}
+
+static void
+bfin_jc_flush_chars(struct tty_struct *tty)
+{
+        wake_up_process(bfin_jc_kthread);
+}
+
+static int
+bfin_jc_write_room(struct tty_struct *tty)
+{
+        return circ_free(&bfin_jc_write_buf);
+}
+
+static int
+bfin_jc_chars_in_buffer(struct tty_struct *tty)
+{
+        return circ_cnt(&bfin_jc_write_buf);
+}
+
+static void
+bfin_jc_wait_until_sent(struct tty_struct *tty, int timeout)
+{
+        unsigned long expire = jiffies + timeout;
+        while (!circ_empty(&bfin_jc_write_buf)) {
+                if (signal_pending(current))
+                        break;
+                if (time_after(jiffies, expire))
+                        break;
+        }
+}
+
+static struct tty_operations bfin_jc_ops = {
+        .open            = bfin_jc_open,
+        .close           = bfin_jc_close,
+        .write           = bfin_jc_write,
+        /*.put_char        = bfin_jc_put_char,*/
+        .flush_chars     = bfin_jc_flush_chars,
+        .write_room      = bfin_jc_write_room,
+        .chars_in_buffer = bfin_jc_chars_in_buffer,
+        .wait_until_sent = bfin_jc_wait_until_sent,
+};
+
+static int __init bfin_jc_init(void)
+{
+        int ret;
+
+        bfin_jc_kthread = kthread_create(bfin_jc_emudat_manager, NULL, DRV_NAME);
+        if (IS_ERR(bfin_jc_kthread))
+                return PTR_ERR(bfin_jc_kthread);
+
+        ret = -ENOMEM;
+
+        bfin_jc_write_buf.head = bfin_jc_write_buf.tail = 0;
+        bfin_jc_write_buf.buf = kmalloc(CIRC_SIZE, GFP_KERNEL);
+        if (!bfin_jc_write_buf.buf)
+                goto err;
+
+        bfin_jc_driver = alloc_tty_driver(1);
+        if (!bfin_jc_driver)
+                goto err;
+
+        bfin_jc_driver->owner        = THIS_MODULE;
+        bfin_jc_driver->driver_name  = DRV_NAME;
+        bfin_jc_driver->name         = DEV_NAME;
+        bfin_jc_driver->type         = TTY_DRIVER_TYPE_SERIAL;
+        bfin_jc_driver->subtype      = SERIAL_TYPE_NORMAL;
+        bfin_jc_driver->init_termios = tty_std_termios;
+        tty_set_operations(bfin_jc_driver, &bfin_jc_ops);
+
+        ret = tty_register_driver(bfin_jc_driver);
+        if (ret)
+                goto err;
+
+        pr_init(KERN_INFO DRV_NAME ": initialized\n");
+
+        return 0;
+
+ err:
+        put_tty_driver(bfin_jc_driver);
+        kfree(bfin_jc_write_buf.buf);
+        kthread_stop(bfin_jc_kthread);
+        return ret;
+}
+module_init(bfin_jc_init);
+
+static void __exit bfin_jc_exit(void)
+{
+        kthread_stop(bfin_jc_kthread);
+        kfree(bfin_jc_write_buf.buf);
+        tty_unregister_driver(bfin_jc_driver);
+        put_tty_driver(bfin_jc_driver);
+}
+module_exit(bfin_jc_exit);
+
+#if defined(CONFIG_BFIN_JTAG_COMM_CONSOLE) || defined(CONFIG_EARLY_PRINTK)
+static void
+bfin_jc_straight_buffer_write(const char *buf, unsigned count)
+{
+        unsigned ate = 0;
+        while (bfin_read_DBGSTAT() & EMUDOF)
+                continue;
+        bfin_write_emudat(count);
+        while (ate < count) {
+                while (bfin_read_DBGSTAT() & EMUDOF)
+                        continue;
+                bfin_write_emudat_chars(buf[ate], buf[ate+1], buf[ate+2], buf[ate+3]);
+                ate += 4;
+        }
+}
+#endif
+
+#ifdef CONFIG_BFIN_JTAG_COMM_CONSOLE
+static void
+bfin_jc_console_write(struct console *co, const char *buf, unsigned count)
+{
+        if (bfin_jc_kthread == NULL)
+                bfin_jc_straight_buffer_write(buf, count);
+        else
+                bfin_jc_circ_write(buf, count);
+}
+
+static struct tty_driver *
+bfin_jc_console_device(struct console *co, int *index)
+{
+        *index = co->index;
+        return bfin_jc_driver;
+}
+
+static struct console bfin_jc_console = {
+        .name    = DEV_NAME,
+        .write   = bfin_jc_console_write,
+        .device  = bfin_jc_console_device,
+        .flags   = CON_ANYTIME | CON_PRINTBUFFER,
+        .index   = -1,
+};
+
+static int __init bfin_jc_console_init(void)
+{
+        register_console(&bfin_jc_console);
+        return 0;
+}
+console_initcall(bfin_jc_console_init);
+#endif
+
+#ifdef CONFIG_EARLY_PRINTK
+static void __init
+bfin_jc_early_write(struct console *co, const char *buf, unsigned int count)
+{
+        bfin_jc_straight_buffer_write(buf, count);
+}
+
+static struct __initdata console bfin_jc_early_console = {
+        .name   = "early_BFJC",
+        .write   = bfin_jc_early_write,
+        .flags   = CON_ANYTIME | CON_PRINTBUFFER,
+        .index   = -1,
+};
+
+struct console * __init
+bfin_jc_early_init(unsigned int port, unsigned int cflag)
+{
+        return &bfin_jc_early_console;
+}
+#endif
+
+MODULE_AUTHOR("Mike Frysinger <vapier@gentoo.org>");
+MODULE_DESCRIPTION("TTY over Blackfin JTAG Communication");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index 1fdb9f657d8f..f3366d3f06cf 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -604,7 +604,6 @@
 
 #define NR_PORTS        256
 
-#define ZE_V1_NPORTS    64
 #define ZO_V1   0
 #define ZO_V2   1
 #define ZE_V1   2
@@ -663,18 +662,6 @@
 static void cy_throttle(struct tty_struct *tty);
 static void cy_send_xchar(struct tty_struct *tty, char ch);
 
-#define IS_CYC_Z(card) ((card).num_chips == (unsigned int)-1)
-
-#define Z_FPGA_CHECK(card) \
-        ((readl(&((struct RUNTIME_9060 __iomem *) \
-                ((card).ctl_addr))->init_ctrl) & (1<<17)) != 0)
-
-#define ISZLOADED(card) (((ZO_V1 == readl(&((struct RUNTIME_9060 __iomem *) \
-                        ((card).ctl_addr))->mail_box_0)) || \
-                        Z_FPGA_CHECK(card)) && \
-                        (ZFIRM_ID == readl(&((struct FIRM_ID __iomem *) \
-                        ((card).base_addr+ID_ADDRESS))->signature)))
-
 #ifndef SERIAL_XMIT_SIZE
 #define SERIAL_XMIT_SIZE        (min(PAGE_SIZE, 4096))
 #endif
@@ -687,8 +674,6 @@ static void cy_send_xchar(struct tty_struct *tty, char ch);
 #define DRIVER_VERSION  0x02010203
 #define RAM_SIZE 0x80000
 
-#define Z_FPGA_LOADED(X)        ((readl(&(X)->init_ctrl) & (1<<17)) != 0)
-
 enum zblock_type {
         ZBLOCK_PRG = 0,
         ZBLOCK_FPGA = 1
@@ -883,6 +868,29 @@ static void cyz_rx_restart(unsigned long);
 static struct timer_list cyz_rx_full_timer[NR_PORTS];
 #endif                          /* CONFIG_CYZ_INTR */
 
+static inline bool cy_is_Z(struct cyclades_card *card)
+{
+        return card->num_chips == (unsigned int)-1;
+}
+
+static inline bool __cyz_fpga_loaded(struct RUNTIME_9060 __iomem *ctl_addr)
+{
+        return readl(&ctl_addr->init_ctrl) & (1 << 17);
+}
+
+static inline bool cyz_fpga_loaded(struct cyclades_card *card)
+{
+        return __cyz_fpga_loaded(card->ctl_addr.p9060);
+}
+
+static inline bool cyz_is_loaded(struct cyclades_card *card)
+{
+        struct FIRM_ID __iomem *fw_id = card->base_addr + ID_ADDRESS;
+
+        return (card->hw_ver == ZO_V1 || cyz_fpga_loaded(card)) &&
+                        readl(&fw_id->signature) == ZFIRM_ID;
+}
+
 static inline int serial_paranoia_check(struct cyclades_port *info,
                 char *name, const char *routine)
 {
@@ -1395,19 +1403,15 @@ cyz_fetch_msg(struct cyclades_card *cinfo,
         unsigned long loc_doorbell;
 
         firm_id = cinfo->base_addr + ID_ADDRESS;
-        if (!ISZLOADED(*cinfo))
-                return -1;
         zfw_ctrl = cinfo->base_addr + (readl(&firm_id->zfwctrl_addr) & 0xfffff);
         board_ctrl = &zfw_ctrl->board_ctrl;
 
-        loc_doorbell = readl(&((struct RUNTIME_9060 __iomem *)
-                                  (cinfo->ctl_addr))->loc_doorbell);
+        loc_doorbell = readl(&cinfo->ctl_addr.p9060->loc_doorbell);
         if (loc_doorbell) {
                 *cmd = (char)(0xff & loc_doorbell);
                 *channel = readl(&board_ctrl->fwcmd_channel);
                 *param = (__u32) readl(&board_ctrl->fwcmd_param);
-                cy_writel(&((struct RUNTIME_9060 __iomem *)(cinfo->ctl_addr))->
-                          loc_doorbell, 0xffffffff);
+                cy_writel(&cinfo->ctl_addr.p9060->loc_doorbell, 0xffffffff);
                 return 1;
         }
         return 0;
@@ -1424,15 +1428,14 @@ cyz_issue_cmd(struct cyclades_card *cinfo,
         unsigned int index;
 
         firm_id = cinfo->base_addr + ID_ADDRESS;
-        if (!ISZLOADED(*cinfo))
+        if (!cyz_is_loaded(cinfo))
                 return -1;
 
         zfw_ctrl = cinfo->base_addr + (readl(&firm_id->zfwctrl_addr) & 0xfffff);
         board_ctrl = &zfw_ctrl->board_ctrl;
 
         index = 0;
-        pci_doorbell =
-            &((struct RUNTIME_9060 __iomem *)(cinfo->ctl_addr))->pci_doorbell;
+        pci_doorbell = &cinfo->ctl_addr.p9060->pci_doorbell;
         while ((readl(pci_doorbell) & 0xff) != 0) {
                 if (index++ == 1000)
                         return (int)(readl(pci_doorbell) & 0xff);
@@ -1624,10 +1627,8 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo)
         static struct BOARD_CTRL __iomem *board_ctrl;
         static struct CH_CTRL __iomem *ch_ctrl;
         static struct BUF_CTRL __iomem *buf_ctrl;
-        __u32 channel;
+        __u32 channel, param, fw_ver;
         __u8 cmd;
-        __u32 param;
-        __u32 hw_ver, fw_ver;
         int special_count;
         int delta_count;
 
@@ -1635,8 +1636,6 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo)
         zfw_ctrl = cinfo->base_addr + (readl(&firm_id->zfwctrl_addr) & 0xfffff);
         board_ctrl = &zfw_ctrl->board_ctrl;
         fw_ver = readl(&board_ctrl->fw_version);
-        hw_ver = readl(&((struct RUNTIME_9060 __iomem *)(cinfo->ctl_addr))->
-                        mail_box_0);
 
         while (cyz_fetch_msg(cinfo, &channel, &cmd, &param) == 1) {
                 special_count = 0;
@@ -1737,15 +1736,7 @@ static irqreturn_t cyz_interrupt(int irq, void *dev_id)
 {
         struct cyclades_card *cinfo = dev_id;
 
-        if (unlikely(cinfo == NULL)) {
-#ifdef CY_DEBUG_INTERRUPTS
-                printk(KERN_DEBUG "cyz_interrupt: spurious interrupt %d\n",
-                                                                        irq);
-#endif
-                return IRQ_NONE;        /* spurious interrupt */
-        }
-
-        if (unlikely(!ISZLOADED(*cinfo))) {
+        if (unlikely(!cyz_is_loaded(cinfo))) {
 #ifdef CY_DEBUG_INTERRUPTS
                 printk(KERN_DEBUG "cyz_interrupt: board not yet loaded "
                                 "(IRQ%d).\n", irq);
@@ -1785,7 +1776,6 @@ static void cyz_poll(unsigned long arg)
         struct tty_struct *tty;
         struct FIRM_ID __iomem *firm_id;
         struct ZFW_CTRL __iomem *zfw_ctrl;
-        struct BOARD_CTRL __iomem *board_ctrl;
         struct BUF_CTRL __iomem *buf_ctrl;
         unsigned long expires = jiffies + HZ;
         unsigned int port, card;
@@ -1793,19 +1783,17 @@ static void cyz_poll(unsigned long arg)
         for (card = 0; card < NR_CARDS; card++) {
                 cinfo = &cy_card[card];
 
-                if (!IS_CYC_Z(*cinfo))
+                if (!cy_is_Z(cinfo))
                         continue;
-                if (!ISZLOADED(*cinfo))
+                if (!cyz_is_loaded(cinfo))
                         continue;
 
                 firm_id = cinfo->base_addr + ID_ADDRESS;
                 zfw_ctrl = cinfo->base_addr +
                                 (readl(&firm_id->zfwctrl_addr) & 0xfffff);
-                board_ctrl = &(zfw_ctrl->board_ctrl);
 
         /* Skip first polling cycle to avoid racing conditions with the FW */
                 if (!cinfo->intr_enabled) {
-                        cinfo->nports = (int)readl(&board_ctrl->n_channel);
                         cinfo->intr_enabled = 1;
                         continue;
                 }
@@ -1874,7 +1862,7 @@ static int startup(struct cyclades_port *info)
 
         set_line_char(info);
 
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -1931,7 +1919,7 @@ static int startup(struct cyclades_port *info)
                 base_addr = card->base_addr;
 
                 firm_id = base_addr + ID_ADDRESS;
-                if (!ISZLOADED(*card))
+                if (!cyz_is_loaded(card))
                         return -ENODEV;
 
                 zfw_ctrl = card->base_addr +
@@ -2026,7 +2014,7 @@ static void start_xmit(struct cyclades_port *info)
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -2070,7 +2058,7 @@ static void shutdown(struct cyclades_port *info)
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -2126,7 +2114,7 @@ static void shutdown(struct cyclades_port *info)
 #endif
 
                 firm_id = base_addr + ID_ADDRESS;
-                if (!ISZLOADED(*card))
+                if (!cyz_is_loaded(card))
                         return;
 
                 zfw_ctrl = card->base_addr +
@@ -2233,7 +2221,7 @@ block_til_ready(struct tty_struct *tty, struct file *filp,
 #endif
         info->port.blocked_open++;
 
-        if (!IS_CYC_Z(*cinfo)) {
+        if (!cy_is_Z(cinfo)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = cinfo->bus_index;
@@ -2296,7 +2284,7 @@ block_til_ready(struct tty_struct *tty, struct file *filp,
 
                 base_addr = cinfo->base_addr;
                 firm_id = base_addr + ID_ADDRESS;
-                if (!ISZLOADED(*cinfo)) {
+                if (!cyz_is_loaded(cinfo)) {
                         __set_current_state(TASK_RUNNING);
                         remove_wait_queue(&info->port.open_wait, &wait);
                         return -EINVAL;
@@ -2397,16 +2385,14 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
            treat it as absent from the system.  This
            will make the user pay attention.
          */
-        if (IS_CYC_Z(*info->card)) {
+        if (cy_is_Z(info->card)) {
                 struct cyclades_card *cinfo = info->card;
                 struct FIRM_ID __iomem *firm_id = cinfo->base_addr + ID_ADDRESS;
 
-                if (!ISZLOADED(*cinfo)) {
-                        if (((ZE_V1 == readl(&((struct RUNTIME_9060 __iomem *)
-                                         (cinfo->ctl_addr))->mail_box_0)) &&
-                                        Z_FPGA_CHECK(*cinfo)) &&
-                                        (ZFIRM_HLT == readl(
-                                                &firm_id->signature))) {
+                if (!cyz_is_loaded(cinfo)) {
+                        if (cinfo->hw_ver == ZE_V1 && cyz_fpga_loaded(cinfo) &&
+                                        readl(&firm_id->signature) ==
+                                        ZFIRM_HLT) {
                                 printk(KERN_ERR "cyc:Cyclades-Z Error: you "
                                         "need an external power supply for "
                                         "this number of ports.\nFirmware "
@@ -2423,18 +2409,13 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
                    interrupts should be enabled as soon as the first open
                    happens to one of its ports. */
                         if (!cinfo->intr_enabled) {
-                                struct ZFW_CTRL __iomem *zfw_ctrl;
-                                struct BOARD_CTRL __iomem *board_ctrl;
-
-                                zfw_ctrl = cinfo->base_addr +
-                                        (readl(&firm_id->zfwctrl_addr) &
-                                         0xfffff);
-
-                                board_ctrl = &zfw_ctrl->board_ctrl;
+                                u16 intr;
 
                                 /* Enable interrupts on the PLX chip */
-                                cy_writew(cinfo->ctl_addr + 0x68,
-                                        readw(cinfo->ctl_addr + 0x68) | 0x0900);
+                                intr = readw(&cinfo->ctl_addr.p9060->
+                                                intr_ctrl_stat) | 0x0900;
+                                cy_writew(&cinfo->ctl_addr.p9060->
+                                                intr_ctrl_stat, intr);
                                 /* Enable interrupts on the FW */
                                 retval = cyz_issue_cmd(cinfo, 0,
                                                 C_CM_IRQ_ENBL, 0L);
@@ -2442,8 +2423,6 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
                                         printk(KERN_ERR "cyc:IRQ enable retval "
                                                 "was %x\n", retval);
                                 }
-                                cinfo->nports =
-                                        (int)readl(&board_ctrl->n_channel);
                                 cinfo->intr_enabled = 1;
                         }
                 }
@@ -2556,7 +2535,7 @@ static void cy_wait_until_sent(struct tty_struct *tty, int timeout)
 #endif
         card = info->card;
         channel = (info->line) - (card->first_line);
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -2601,7 +2580,7 @@ static void cy_flush_buffer(struct tty_struct *tty)
         info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
         spin_unlock_irqrestore(&card->card_lock, flags);
 
-        if (IS_CYC_Z(*card)) {  /* If it is a Z card, flush the on-board
+        if (cy_is_Z(card)) {    /* If it is a Z card, flush the on-board
                                            buffers as well */
                 spin_lock_irqsave(&card->card_lock, flags);
                 retval = cyz_issue_cmd(card, channel, C_CM_FLUSH_TX, 0L);
@@ -2682,7 +2661,7 @@ static void cy_close(struct tty_struct *tty, struct file *filp)
 
         spin_lock_irqsave(&card->card_lock, flags);
 
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 int channel = info->line - card->first_line;
                 int index = card->bus_index;
                 void __iomem *base_addr = card->base_addr +
@@ -2902,7 +2881,7 @@ static int cy_chars_in_buffer(struct tty_struct *tty)
         channel = (info->line) - (card->first_line);
 
 #ifdef Z_EXT_CHARS_IN_BUFFER
-        if (!IS_CYC_Z(cy_card[card])) {
+        if (!cy_is_Z(card)) {
 #endif                          /* Z_EXT_CHARS_IN_BUFFER */
 #ifdef CY_DEBUG_IO
                 printk(KERN_DEBUG "cyc:cy_chars_in_buffer ttyC%d %d\n",
@@ -2984,7 +2963,6 @@ static void set_line_char(struct cyclades_port *info)
         void __iomem *base_addr;
         int chip, channel, index;
         unsigned cflag, iflag;
-        unsigned short chip_number;
         int baud, baud_rate = 0;
         int i;
 
@@ -3013,9 +2991,8 @@ static void set_line_char(struct cyclades_port *info)
 
         card = info->card;
         channel = info->line - card->first_line;
-        chip_number = channel / 4;
 
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
 
                 index = card->bus_index;
 
@@ -3233,21 +3210,17 @@ static void set_line_char(struct cyclades_port *info)
         } else {
                 struct FIRM_ID __iomem *firm_id;
                 struct ZFW_CTRL __iomem *zfw_ctrl;
-                struct BOARD_CTRL __iomem *board_ctrl;
                 struct CH_CTRL __iomem *ch_ctrl;
-                struct BUF_CTRL __iomem *buf_ctrl;
                 __u32 sw_flow;
                 int retval;
 
                 firm_id = card->base_addr + ID_ADDRESS;
-                if (!ISZLOADED(*card))
+                if (!cyz_is_loaded(card))
                         return;
 
                 zfw_ctrl = card->base_addr +
                         (readl(&firm_id->zfwctrl_addr) & 0xfffff);
-                board_ctrl = &zfw_ctrl->board_ctrl;
                 ch_ctrl = &(zfw_ctrl->ch_ctrl[channel]);
-                buf_ctrl = &zfw_ctrl->buf_ctrl[channel];
 
                 /* baud rate */
                 baud = tty_get_baud_rate(info->port.tty);
@@ -3457,7 +3430,7 @@ static int get_lsr_info(struct cyclades_port *info, unsigned int __user *value)
 
         card = info->card;
         channel = (info->line) - (card->first_line);
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3497,7 +3470,7 @@ static int cy_tiocmget(struct tty_struct *tty, struct file *file)
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3523,7 +3496,7 @@ static int cy_tiocmget(struct tty_struct *tty, struct file *file)
         } else {
                 base_addr = card->base_addr;
                 firm_id = card->base_addr + ID_ADDRESS;
-                if (ISZLOADED(*card)) {
+                if (cyz_is_loaded(card)) {
                         zfw_ctrl = card->base_addr +
                                 (readl(&firm_id->zfwctrl_addr) & 0xfffff);
                         board_ctrl = &zfw_ctrl->board_ctrl;
@@ -3566,7 +3539,7 @@ cy_tiocmset(struct tty_struct *tty, struct file *file,
 
         card = info->card;
         channel = (info->line) - (card->first_line);
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3641,7 +3614,7 @@ cy_tiocmset(struct tty_struct *tty, struct file *file,
                 base_addr = card->base_addr;
 
                 firm_id = card->base_addr + ID_ADDRESS;
-                if (ISZLOADED(*card)) {
+                if (cyz_is_loaded(card)) {
                         zfw_ctrl = card->base_addr +
                                 (readl(&firm_id->zfwctrl_addr) & 0xfffff);
                         board_ctrl = &zfw_ctrl->board_ctrl;
@@ -3713,7 +3686,7 @@ static int cy_break(struct tty_struct *tty, int break_state)
         card = info->card;
 
         spin_lock_irqsave(&card->card_lock, flags);
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 /* Let the transmit ISR take care of this (since it
                    requires stuffing characters into the output stream).
                  */
@@ -3782,7 +3755,7 @@ static int set_threshold(struct cyclades_port *info, unsigned long value)
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3810,7 +3783,7 @@ static int get_threshold(struct cyclades_port *info,
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3844,7 +3817,7 @@ static int set_timeout(struct cyclades_port *info, unsigned long value)
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -3867,7 +3840,7 @@ static int get_timeout(struct cyclades_port *info,
 
         card = info->card;
         channel = info->line - card->first_line;
-        if (!IS_CYC_Z(*card)) {
+        if (!cy_is_Z(card)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 index = card->bus_index;
@@ -4121,7 +4094,7 @@ static void cy_send_xchar(struct tty_struct *tty, char ch)
         card = info->card;
         channel = info->line - card->first_line;
 
-        if (IS_CYC_Z(*card)) {
+        if (cy_is_Z(card)) {
                 if (ch == STOP_CHAR(tty))
                         cyz_issue_cmd(card, channel, C_CM_SENDXOFF, 0L);
                 else if (ch == START_CHAR(tty))
@@ -4154,7 +4127,7 @@ static void cy_throttle(struct tty_struct *tty)
         card = info->card;
 
         if (I_IXOFF(tty)) {
-                if (!IS_CYC_Z(*card))
+                if (!cy_is_Z(card))
                         cy_send_xchar(tty, STOP_CHAR(tty));
                 else
                         info->throttle = 1;
@@ -4162,7 +4135,7 @@ static void cy_throttle(struct tty_struct *tty)
 
         if (tty->termios->c_cflag & CRTSCTS) {
                 channel = info->line - card->first_line;
-                if (!IS_CYC_Z(*card)) {
+                if (!cy_is_Z(card)) {
                         chip = channel >> 2;
                         channel &= 0x03;
                         index = card->bus_index;
@@ -4219,7 +4192,7 @@ static void cy_unthrottle(struct tty_struct *tty)
         if (tty->termios->c_cflag & CRTSCTS) {
                 card = info->card;
                 channel = info->line - card->first_line;
-                if (!IS_CYC_Z(*card)) {
+                if (!cy_is_Z(card)) {
                         chip = channel >> 2;
                         channel &= 0x03;
                         index = card->bus_index;
@@ -4263,7 +4236,7 @@ static void cy_stop(struct tty_struct *tty)
 
         cinfo = info->card;
         channel = info->line - cinfo->first_line;
-        if (!IS_CYC_Z(*cinfo)) {
+        if (!cy_is_Z(cinfo)) {
                 index = cinfo->bus_index;
                 chip = channel >> 2;
                 channel &= 0x03;
@@ -4296,7 +4269,7 @@ static void cy_start(struct tty_struct *tty)
         cinfo = info->card;
         channel = info->line - cinfo->first_line;
         index = cinfo->bus_index;
-        if (!IS_CYC_Z(*cinfo)) {
+        if (!cy_is_Z(cinfo)) {
                 chip = channel >> 2;
                 channel &= 0x03;
                 base_addr = cinfo->base_addr + (cy_chip_offset[chip] << index);
@@ -4347,33 +4320,20 @@ static void cy_hangup(struct tty_struct *tty)
 static int __devinit cy_init_card(struct cyclades_card *cinfo)
 {
         struct cyclades_port *info;
-        u32 uninitialized_var(mailbox);
-        unsigned int nports, port;
+        unsigned int port;
         unsigned short chip_number;
-        int uninitialized_var(index);
 
         spin_lock_init(&cinfo->card_lock);
+        cinfo->intr_enabled = 0;
 
-        if (IS_CYC_Z(*cinfo)) { /* Cyclades-Z */
-                mailbox = readl(&((struct RUNTIME_9060 __iomem *)
-                                     cinfo->ctl_addr)->mail_box_0);
-                nports = (mailbox == ZE_V1) ? ZE_V1_NPORTS : 8;
-                cinfo->intr_enabled = 0;
-                cinfo->nports = 0;      /* Will be correctly set later, after
-                                           Z FW is loaded */
-        } else {
-                index = cinfo->bus_index;
-                nports = cinfo->nports = CyPORTS_PER_CHIP * cinfo->num_chips;
-        }
-
-        cinfo->ports = kzalloc(sizeof(*cinfo->ports) * nports, GFP_KERNEL);
+        cinfo->ports = kcalloc(cinfo->nports, sizeof(*cinfo->ports),
+                        GFP_KERNEL);
         if (cinfo->ports == NULL) {
                 printk(KERN_ERR "Cyclades: cannot allocate ports\n");
-                cinfo->nports = 0;
                 return -ENOMEM;
         }
 
-        for (port = cinfo->first_line; port < cinfo->first_line + nports;
+        for (port = cinfo->first_line; port < cinfo->first_line + cinfo->nports;
                         port++) {
                 info = &cinfo->ports[port - cinfo->first_line];
                 tty_port_init(&info->port);
@@ -4387,9 +4347,9 @@ static int __devinit cy_init_card(struct cyclades_card *cinfo)
                 init_completion(&info->shutdown_wait);
                 init_waitqueue_head(&info->delta_msr_wait);
 
-                if (IS_CYC_Z(*cinfo)) {
+                if (cy_is_Z(cinfo)) {
                         info->type = PORT_STARTECH;
-                        if (mailbox == ZO_V1)
+                        if (cinfo->hw_ver == ZO_V1)
                                 info->xmit_fifo_size = CYZ_FIFO_SIZE;
                         else
                                 info->xmit_fifo_size = 4 * CYZ_FIFO_SIZE;
@@ -4398,6 +4358,7 @@ static int __devinit cy_init_card(struct cyclades_card *cinfo)
                                 cyz_rx_restart, (unsigned long)info);
 #endif
                 } else {
+                        int index = cinfo->bus_index;
                         info->type = PORT_CIRRUS;
                         info->xmit_fifo_size = CyMAX_CHAR_FIFO;
                         info->cor1 = CyPARITY_NONE | Cy_1_STOP | Cy_8_BITS;
@@ -4430,7 +4391,7 @@ static int __devinit cy_init_card(struct cyclades_card *cinfo)
         }
 
 #ifndef CONFIG_CYZ_INTR
-        if (IS_CYC_Z(*cinfo) && !timer_pending(&cyz_timerlist)) {
+        if (cy_is_Z(cinfo) && !timer_pending(&cyz_timerlist)) {
                 mod_timer(&cyz_timerlist, jiffies + 1);
 #ifdef CY_PCI_DEBUG
                 printk(KERN_DEBUG "Cyclades-Z polling initialized\n");
@@ -4621,11 +4582,12 @@ static int __init cy_detect_isa(void)
 
                 /* set cy_card */
                 cy_card[j].base_addr = cy_isa_address;
-                cy_card[j].ctl_addr = NULL;
+                cy_card[j].ctl_addr.p9050 = NULL;
                 cy_card[j].irq = (int)cy_isa_irq;
                 cy_card[j].bus_index = 0;
                 cy_card[j].first_line = cy_next_channel;
-                cy_card[j].num_chips = cy_isa_nchan / 4;
+                cy_card[j].num_chips = cy_isa_nchan / CyPORTS_PER_CHIP;
+                cy_card[j].nports = cy_isa_nchan;
                 if (cy_init_card(&cy_card[j])) {
                         cy_card[j].base_addr = NULL;
                         free_irq(cy_isa_irq, &cy_card[j]);
@@ -4781,7 +4743,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
         struct CUSTOM_REG __iomem *cust = base_addr;
         struct ZFW_CTRL __iomem *pt_zfwctrl;
         void __iomem *tmp;
-        u32 mailbox, status;
+        u32 mailbox, status, nchan;
         unsigned int i;
         int retval;
 
@@ -4793,7 +4755,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
 
         /* Check whether the firmware is already loaded and running. If
            positive, skip this board */
-        if (Z_FPGA_LOADED(ctl_addr) && readl(&fid->signature) == ZFIRM_ID) {
+        if (__cyz_fpga_loaded(ctl_addr) && readl(&fid->signature) == ZFIRM_ID) {
                 u32 cntval = readl(base_addr + 0x190);
 
                 udelay(100);
@@ -4812,7 +4774,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
 
         mailbox = readl(&ctl_addr->mail_box_0);
 
-        if (mailbox == 0 || Z_FPGA_LOADED(ctl_addr)) {
+        if (mailbox == 0 || __cyz_fpga_loaded(ctl_addr)) {
                 /* stops CPU and set window to beginning of RAM */
                 cy_writel(&ctl_addr->loc_addr_base, WIN_CREG);
                 cy_writel(&cust->cpu_stop, 0);
@@ -4828,7 +4790,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
                                 base_addr);
                 if (retval)
                         goto err_rel;
-                if (!Z_FPGA_LOADED(ctl_addr)) {
+                if (!__cyz_fpga_loaded(ctl_addr)) {
                         dev_err(&pdev->dev, "fw upload successful, but fw is "
                                         "not loaded\n");
                         goto err_rel;
@@ -4887,7 +4849,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
                                 "system before loading the new FW to the "
                                 "Cyclades-Z.\n");
 
-                        if (Z_FPGA_LOADED(ctl_addr))
+                        if (__cyz_fpga_loaded(ctl_addr))
                                 plx_init(pdev, irq, ctl_addr);
 
                         retval = -EIO;
@@ -4902,16 +4864,16 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
                         base_addr + ID_ADDRESS, readl(&fid->zfwctrl_addr),
                         base_addr + readl(&fid->zfwctrl_addr));
 
+        nchan = readl(&pt_zfwctrl->board_ctrl.n_channel);
         dev_info(&pdev->dev, "Cyclades-Z FW loaded: version = %x, ports = %u\n",
-                readl(&pt_zfwctrl->board_ctrl.fw_version),
-                readl(&pt_zfwctrl->board_ctrl.n_channel));
+                readl(&pt_zfwctrl->board_ctrl.fw_version), nchan);
 
-        if (readl(&pt_zfwctrl->board_ctrl.n_channel) == 0) {
+        if (nchan == 0) {
                 dev_warn(&pdev->dev, "no Cyclades-Z ports were found. Please "
                         "check the connection between the Z host card and the "
                         "serial expanders.\n");
 
-                if (Z_FPGA_LOADED(ctl_addr))
+                if (__cyz_fpga_loaded(ctl_addr))
                         plx_init(pdev, irq, ctl_addr);
 
                 dev_info(&pdev->dev, "Null number of ports detected. Board "
@@ -4932,9 +4894,7 @@ static int __devinit cyz_load_fw(struct pci_dev *pdev, void __iomem *base_addr,
         cy_writel(&ctl_addr->intr_ctrl_stat, readl(&ctl_addr->intr_ctrl_stat) |
                         0x00030800UL);
 
-        plx_init(pdev, irq, ctl_addr);
-
-        return 0;
+        return nchan;
 err_rel:
         release_firmware(fw);
 err:
@@ -4946,7 +4906,7 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
 {
         void __iomem *addr0 = NULL, *addr2 = NULL;
         char *card_name = NULL;
-        u32 mailbox;
+        u32 uninitialized_var(mailbox);
         unsigned int device_id, nchan = 0, card_no, i;
         unsigned char plx_ver;
         int retval, irq;
@@ -5023,11 +4983,12 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                 }
 
                 /* Disable interrupts on the PLX before resetting it */
-                cy_writew(addr0 + 0x68, readw(addr0 + 0x68) & ~0x0900);
+                cy_writew(&ctl_addr->intr_ctrl_stat,
+                                readw(&ctl_addr->intr_ctrl_stat) & ~0x0900);
 
                 plx_init(pdev, irq, addr0);
 
-                mailbox = (u32)readl(&ctl_addr->mail_box_0);
+                mailbox = readl(&ctl_addr->mail_box_0);
 
                 addr2 = ioremap_nocache(pci_resource_start(pdev, 2),
                                 mailbox == ZE_V1 ? CyPCI_Ze_win : CyPCI_Zwin);
@@ -5038,12 +4999,8 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
 
                 if (mailbox == ZE_V1) {
                         card_name = "Cyclades-Ze";
-
-                        readl(&ctl_addr->mail_box_0);
-                        nchan = ZE_V1_NPORTS;
                 } else {
                         card_name = "Cyclades-8Zo";
-
 #ifdef CY_PCI_DEBUG
                         if (mailbox == ZO_V1) {
                                 cy_writel(&ctl_addr->loc_addr_base, WIN_CREG);
@@ -5065,15 +5022,12 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                          */
                         if ((mailbox == ZO_V1) || (mailbox == ZO_V2))
                                 cy_writel(addr2 + ID_ADDRESS, 0L);
-
-                        retval = cyz_load_fw(pdev, addr2, addr0, irq);
-                        if (retval)
-                                goto err_unmap;
-                        /* This must be a Cyclades-8Zo/PCI.  The extendable
-                           version will have a different device_id and will
-                           be allocated its maximum number of ports. */
-                        nchan = 8;
                 }
+
+                retval = cyz_load_fw(pdev, addr2, addr0, irq);
+                if (retval <= 0)
+                        goto err_unmap;
+                nchan = retval;
         }
 
         if ((cy_next_channel + nchan) > NR_PORTS) {
@@ -5103,8 +5057,10 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                         dev_err(&pdev->dev, "could not allocate IRQ\n");
                         goto err_unmap;
                 }
-                cy_card[card_no].num_chips = nchan / 4;
+                cy_card[card_no].num_chips = nchan / CyPORTS_PER_CHIP;
         } else {
+                cy_card[card_no].hw_ver = mailbox;
+                cy_card[card_no].num_chips = (unsigned int)-1;
 #ifdef CONFIG_CYZ_INTR
                 /* allocate IRQ only if board has an IRQ */
                 if (irq != 0 && irq != 255) {
@@ -5117,15 +5073,15 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                         }
                 }
 #endif                          /* CONFIG_CYZ_INTR */
-                cy_card[card_no].num_chips = (unsigned int)-1;
         }
 
         /* set cy_card */
         cy_card[card_no].base_addr = addr2;
-        cy_card[card_no].ctl_addr = addr0;
+        cy_card[card_no].ctl_addr.p9050 = addr0;
         cy_card[card_no].irq = irq;
         cy_card[card_no].bus_index = 1;
         cy_card[card_no].first_line = cy_next_channel;
+        cy_card[card_no].nports = nchan;
         retval = cy_init_card(&cy_card[card_no]);
         if (retval)
                 goto err_null;
@@ -5138,17 +5094,20 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                 plx_ver = readb(addr2 + CyPLX_VER) & 0x0f;
                 switch (plx_ver) {
                 case PLX_9050:
-
                         cy_writeb(addr0 + 0x4c, 0x43);
                         break;
 
                 case PLX_9060:
                 case PLX_9080:
                 default:        /* Old boards, use PLX_9060 */
-                        plx_init(pdev, irq, addr0);
-                        cy_writew(addr0 + 0x68, readw(addr0 + 0x68) | 0x0900);
+                {
+                        struct RUNTIME_9060 __iomem *ctl_addr = addr0;
+                        plx_init(pdev, irq, ctl_addr);
+                        cy_writew(&ctl_addr->intr_ctrl_stat,
+                                readw(&ctl_addr->intr_ctrl_stat) | 0x0900);
                         break;
                 }
+                }
         }
 
         dev_info(&pdev->dev, "%s/PCI #%d found: %d channels starting from "
@@ -5179,22 +5138,23 @@ static void __devexit cy_pci_remove(struct pci_dev *pdev)
         unsigned int i;
 
         /* non-Z with old PLX */
-        if (!IS_CYC_Z(*cinfo) && (readb(cinfo->base_addr + CyPLX_VER) & 0x0f) ==
+        if (!cy_is_Z(cinfo) && (readb(cinfo->base_addr + CyPLX_VER) & 0x0f) ==
                         PLX_9050)
-                cy_writeb(cinfo->ctl_addr + 0x4c, 0);
+                cy_writeb(cinfo->ctl_addr.p9050 + 0x4c, 0);
         else
 #ifndef CONFIG_CYZ_INTR
-                if (!IS_CYC_Z(*cinfo))
+                if (!cy_is_Z(cinfo))
 #endif
-                cy_writew(cinfo->ctl_addr + 0x68,
-                                readw(cinfo->ctl_addr + 0x68) & ~0x0900);
+                cy_writew(&cinfo->ctl_addr.p9060->intr_ctrl_stat,
+                        readw(&cinfo->ctl_addr.p9060->intr_ctrl_stat) &
+                        ~0x0900);
 
         iounmap(cinfo->base_addr);
-        if (cinfo->ctl_addr)
-                iounmap(cinfo->ctl_addr);
+        if (cinfo->ctl_addr.p9050)
+                iounmap(cinfo->ctl_addr.p9050);
         if (cinfo->irq
 #ifndef CONFIG_CYZ_INTR
-                && !IS_CYC_Z(*cinfo)
+                && !cy_is_Z(cinfo)
 #endif /* CONFIG_CYZ_INTR */
                 )
                 free_irq(cinfo->irq, cinfo);
@@ -5240,7 +5200,7 @@ static int cyclades_proc_show(struct seq_file *m, void *v)
                                         (cur_jifs - info->idle_stats.recv_idle)/
                                         HZ, info->idle_stats.overruns,
                                         /* FIXME: double check locking */
-                                        (long)info->port.tty->ldisc.ops->num);
+                                        (long)info->port.tty->ldisc->ops->num);
                         else
                                 seq_printf(m, "%3d %8lu %10lu %8lu "
                                         "%10lu %8lu %9lu %6ld\n",
@@ -5386,11 +5346,11 @@ static void __exit cy_cleanup_module(void)
                         /* clear interrupt */
                         cy_writeb(card->base_addr + Cy_ClrIntr, 0);
                         iounmap(card->base_addr);
-                        if (card->ctl_addr)
-                                iounmap(card->ctl_addr);
+                        if (card->ctl_addr.p9050)
+                                iounmap(card->ctl_addr.p9050);
                         if (card->irq
 #ifndef CONFIG_CYZ_INTR
-                                && !IS_CYC_Z(*card)
+                                && !cy_is_Z(card)
 #endif /* CONFIG_CYZ_INTR */
                                 )
                                 free_irq(card->irq, card);
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index 6b900b297cc6..52e06589821d 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -571,7 +571,7 @@ static char dtlk_read_tts(void)
                 portval = inb_p(dtlk_port_tts);
         } while ((portval & TTS_READABLE) == 0 &&
                  retries++ < DTLK_MAX_RETRIES);
-        if (retries == DTLK_MAX_RETRIES)
+        if (retries > DTLK_MAX_RETRIES)
                 printk(KERN_ERR "dtlk_read_tts() timeout\n");
 
         ch = inb_p(dtlk_port_tts);      /* input from TTS port */
@@ -583,7 +583,7 @@ static char dtlk_read_tts(void)
                 portval = inb_p(dtlk_port_tts);
         } while ((portval & TTS_READABLE) != 0 &&
                  retries++ < DTLK_MAX_RETRIES);
-        if (retries == DTLK_MAX_RETRIES)
+        if (retries > DTLK_MAX_RETRIES)
                 printk(KERN_ERR "dtlk_read_tts() timeout\n");
 
         TRACE_RET;
@@ -640,7 +640,7 @@ static char dtlk_write_tts(char ch)
                 while ((inb_p(dtlk_port_tts) & TTS_WRITABLE) == 0 &&
                        retries++ < DTLK_MAX_RETRIES)    /* DT ready? */
                         ;
-        if (retries == DTLK_MAX_RETRIES)
+        if (retries > DTLK_MAX_RETRIES)
                 printk(KERN_ERR "dtlk_write_tts() timeout\n");
 
         outb_p(ch, dtlk_port_tts);      /* output to TTS port */
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index af7c13ca9493..abef1f7d84fe 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -745,7 +745,7 @@ static int epca_carrier_raised(struct tty_port *port)
         return 0;
 }
 
-static void epca_raise_dtr_rts(struct tty_port *port)
+static void epca_dtr_rts(struct tty_port *port, int onoff)
 {
 }
 
@@ -925,7 +925,7 @@ static const struct tty_operations pc_ops = {
 
 static const struct tty_port_operations epca_port_ops = {
         .carrier_raised = epca_carrier_raised,
-        .raise_dtr_rts = epca_raise_dtr_rts,
+        .dtr_rts = epca_dtr_rts,
 };
 
 static int info_open(struct tty_struct *tty, struct file *filp)
@@ -1518,7 +1518,7 @@ static void doevent(int crd)
                 if (event & MODEMCHG_IND) {
                         /* A modem signal change has been indicated */
                         ch->imodem = mstat;
-                        if (test_bit(ASYNC_CHECK_CD, &ch->port.flags)) {
+                        if (test_bit(ASYNCB_CHECK_CD, &ch->port.flags)) {
                                 /* We are now receiving dcd */
                                 if (mstat & ch->dcd)
                                         wake_up_interruptible(&ch->port.open_wait);
@@ -1765,9 +1765,9 @@ static void epcaparam(struct tty_struct *tty, struct channel *ch)
                  * that the driver will wait on carrier detect.
                  */
                 if (ts->c_cflag & CLOCAL)
-                        clear_bit(ASYNC_CHECK_CD, &ch->port.flags);
+                        clear_bit(ASYNCB_CHECK_CD, &ch->port.flags);
                 else
-                        set_bit(ASYNC_CHECK_CD, &ch->port.flags);
+                        set_bit(ASYNCB_CHECK_CD, &ch->port.flags);
                 mval = ch->m_dtr | ch->m_rts;
         } /* End CBAUD not detected */
         iflag = termios2digi_i(ch, ts->c_iflag);
@@ -2114,8 +2114,8 @@ static int pc_ioctl(struct tty_struct *tty, struct file *file,
                         tty_wait_until_sent(tty, 0);
                 } else {
                         /* ldisc lock already held in ioctl */
-                        if (tty->ldisc.ops->flush_buffer)
-                                tty->ldisc.ops->flush_buffer(tty);
+                        if (tty->ldisc->ops->flush_buffer)
+                                tty->ldisc->ops->flush_buffer(tty);
                 }
                 unlock_kernel();
                 /* Fall Thru */
@@ -2244,7 +2244,8 @@ static void do_softint(struct work_struct *work)
                         if (test_and_clear_bit(EPCA_EVENT_HANGUP, &ch->event)) {
                                 tty_hangup(tty);
                                 wake_up_interruptible(&ch->port.open_wait);
-                                clear_bit(ASYNC_NORMAL_ACTIVE, &ch->port.flags);
+                                clear_bit(ASYNCB_NORMAL_ACTIVE,
+                                                &ch->port.flags);
                         }
                 }
                 tty_kref_put(tty);
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 340ba4f9dc54..4a9f3492b921 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -224,7 +224,7 @@ static void hpet_timer_set_irq(struct hpet_dev *devp)
                         break;
                 }
 
-                gsi = acpi_register_gsi(irq, ACPI_LEVEL_SENSITIVE,
+                gsi = acpi_register_gsi(NULL, irq, ACPI_LEVEL_SENSITIVE,
                                         ACPI_ACTIVE_LOW);
                 if (gsi > 0)
                         break;
@@ -939,7 +939,7 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
                 irqp = &res->data.extended_irq;
 
                 for (i = 0; i < irqp->interrupt_count; i++) {
-                        irq = acpi_register_gsi(irqp->interrupts[i],
+                        irq = acpi_register_gsi(NULL, irqp->interrupts[i],
                                       irqp->triggering, irqp->polarity);
                         if (irq < 0)
                                 return AE_ERROR;
diff --git a/drivers/char/hvc_iseries.c b/drivers/char/hvc_iseries.c
index 449727b6166d..936d05bf37fa 100644
--- a/drivers/char/hvc_iseries.c
+++ b/drivers/char/hvc_iseries.c
@@ -241,7 +241,7 @@ static int __devexit hvc_vio_remove(struct vio_dev *vdev)
 static struct vio_driver hvc_vio_driver = {
         .id_table       = hvc_driver_table,
         .probe          = hvc_vio_probe,
-        .remove         = hvc_vio_remove,
+        .remove         = __devexit_p(hvc_vio_remove),
         .driver         = {
                 .name   = hvc_driver_name,
                 .owner  = THIS_MODULE,
diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index 54481a887769..86105efb4eb6 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -4,7 +4,7 @@
  * This HVC device driver provides terminal access using
  * z/VM IUCV communication paths.
  *
- * Copyright IBM Corp. 2008
+ * Copyright IBM Corp. 2008, 2009
  *
  * Author(s):   Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
  */
@@ -15,6 +15,7 @@
 #include <asm/ebcdic.h>
 #include <linux/ctype.h>
 #include <linux/delay.h>
+#include <linux/device.h>
 #include <linux/init.h>
 #include <linux/mempool.h>
 #include <linux/moduleparam.h>
@@ -74,6 +75,7 @@ struct hvc_iucv_private {
         wait_queue_head_t       sndbuf_waitq;   /* wait for send completion */
         struct list_head        tty_outqueue;   /* outgoing IUCV messages */
         struct list_head        tty_inqueue;    /* incoming IUCV messages */
+        struct device           *dev;           /* device structure */
 };
 
 struct iucv_tty_buffer {
@@ -542,7 +544,68 @@ static void flush_sndbuf_sync(struct hvc_iucv_private *priv)
 
         if (sync_wait)
                 wait_event_timeout(priv->sndbuf_waitq,
-                                   tty_outqueue_empty(priv), HZ);
+                                   tty_outqueue_empty(priv), HZ/10);
+}
+
+/**
+ * hvc_iucv_hangup() - Sever IUCV path and schedule hvc tty hang up
+ * @priv:       Pointer to hvc_iucv_private structure
+ *
+ * This routine severs an existing IUCV communication path and hangs
+ * up the underlying HVC terminal device.
+ * The hang-up occurs only if an IUCV communication path is established;
+ * otherwise there is no need to hang up the terminal device.
+ *
+ * The IUCV HVC hang-up is separated into two steps:
+ * 1. After the IUCV path has been severed, the iucv_state is set to
+ *    IUCV_SEVERED.
+ * 2. Later, when the HVC thread calls hvc_iucv_get_chars(), the
+ *    IUCV_SEVERED state causes the tty hang-up in the HVC layer.
+ *
+ * If the tty has not yet been opened, clean up the hvc_iucv_private
+ * structure to allow re-connects.
+ * If the tty has been opened, let get_chars() return -EPIPE to signal
+ * the HVC layer to hang up the tty and, if so, wake up the HVC thread
+ * to call get_chars()...
+ *
+ * Special notes on hanging up a HVC terminal instantiated as console:
+ * Hang-up:     1. do_tty_hangup() replaces file ops (= hung_up_tty_fops)
+ *              2. do_tty_hangup() calls tty->ops->close() for console_filp
+ *                      => no hangup notifier is called by HVC (default)
+ *              2. hvc_close() returns because of tty_hung_up_p(filp)
+ *                      => no delete notifier is called!
+ * Finally, the back-end is not being notified, thus, the tty session is
+ * kept active (TTY_OPEN) to be ready for re-connects.
+ *
+ * Locking:     spin_lock(&priv->lock) w/o disabling bh
+ */
+static void hvc_iucv_hangup(struct hvc_iucv_private *priv)
+{
+        struct iucv_path *path;
+
+        path = NULL;
+        spin_lock(&priv->lock);
+        if (priv->iucv_state == IUCV_CONNECTED) {
+                path = priv->path;
+                priv->path = NULL;
+                priv->iucv_state = IUCV_SEVERED;
+                if (priv->tty_state == TTY_CLOSED)
+                        hvc_iucv_cleanup(priv);
+                else
+                        /* console is special (see above) */
+                        if (priv->is_console) {
+                                hvc_iucv_cleanup(priv);
+                                priv->tty_state = TTY_OPENED;
+                        } else
+                                hvc_kick();
+        }
+        spin_unlock(&priv->lock);
+
+        /* finally sever path (outside of priv->lock due to lock ordering) */
+        if (path) {
+                iucv_path_sever(path, NULL);
+                iucv_path_free(path);
+        }
 }
 
 /**
@@ -735,11 +798,8 @@ out_path_handled:
  * @ipuser:     User specified data for this path
  *              (AF_IUCV: port/service name and originator port)
  *
- * The function also severs the path (as required by the IUCV protocol) and
- * sets the iucv state to IUCV_SEVERED for the associated struct
- * hvc_iucv_private instance. Later, the IUCV_SEVERED state triggers a tty
- * hangup (hvc_iucv_get_chars() / hvc_iucv_write()).
- * If tty portion of the HVC is closed, clean up the outqueue.
+ * This function calls the hvc_iucv_hangup() function for the
+ * respective IUCV HVC terminal.
  *
  * Locking:     struct hvc_iucv_private->lock
  */
@@ -747,33 +807,7 @@ static void hvc_iucv_path_severed(struct iucv_path *path, u8 ipuser[16])
 {
         struct hvc_iucv_private *priv = path->private;
 
-        spin_lock(&priv->lock);
-        priv->iucv_state = IUCV_SEVERED;
-
-        /* If the tty has not yet been opened, clean up the hvc_iucv_private
-         * structure to allow re-connects.
-         * This is also done for our console device because console hangups
-         * are handled specially and no notifier is called by HVC.
-         * The tty session is active (TTY_OPEN) and ready for re-connects...
-         *
-         * If it has been opened, let get_chars() return -EPIPE to signal the
-         * HVC layer to hang up the tty.
-         * If so, we need to wake up the HVC thread to call get_chars()...
-         */
-        priv->path = NULL;
-        if (priv->tty_state == TTY_CLOSED)
-                hvc_iucv_cleanup(priv);
-        else
-                if (priv->is_console) {
-                        hvc_iucv_cleanup(priv);
-                        priv->tty_state = TTY_OPENED;
-                } else
-                        hvc_kick();
-        spin_unlock(&priv->lock);
-
-        /* finally sever path (outside of priv->lock due to lock ordering) */
-        iucv_path_sever(path, ipuser);
-        iucv_path_free(path);
+        hvc_iucv_hangup(priv);
 }
 
 /**
@@ -853,6 +887,37 @@ static void hvc_iucv_msg_complete(struct iucv_path *path,
         destroy_tty_buffer_list(&list_remove);
 }
 
+/**
+ * hvc_iucv_pm_freeze() - Freeze PM callback
+ * @dev:        IUVC HVC terminal device
+ *
+ * Sever an established IUCV communication path and
+ * trigger a hang-up of the underlying HVC terminal.
+ */
+static int hvc_iucv_pm_freeze(struct device *dev)
+{
+        struct hvc_iucv_private *priv = dev_get_drvdata(dev);
+
+        local_bh_disable();
+        hvc_iucv_hangup(priv);
+        local_bh_enable();
+
+        return 0;
+}
+
+/**
+ * hvc_iucv_pm_restore_thaw() - Thaw and restore PM callback
+ * @dev:        IUVC HVC terminal device
+ *
+ * Wake up the HVC thread to trigger hang-up and respective
+ * HVC back-end notifier invocations.
+ */
+static int hvc_iucv_pm_restore_thaw(struct device *dev)
+{
+        hvc_kick();
+        return 0;
+}
+
 
 /* HVC operations */
 static struct hv_ops hvc_iucv_ops = {
@@ -863,6 +928,20 @@ static struct hv_ops hvc_iucv_ops = {
         .notifier_hangup = hvc_iucv_notifier_hangup,
 };
 
+/* Suspend / resume device operations */
+static struct dev_pm_ops hvc_iucv_pm_ops = {
+        .freeze   = hvc_iucv_pm_freeze,
+        .thaw     = hvc_iucv_pm_restore_thaw,
+        .restore  = hvc_iucv_pm_restore_thaw,
+};
+
+/* IUCV HVC device driver */
+static struct device_driver hvc_iucv_driver = {
+        .name = KMSG_COMPONENT,
+        .bus  = &iucv_bus,
+        .pm   = &hvc_iucv_pm_ops,
+};
+
 /**
  * hvc_iucv_alloc() - Allocates a new struct hvc_iucv_private instance
  * @id:                 hvc_iucv_table index
@@ -897,14 +976,12 @@ static int __init hvc_iucv_alloc(int id, unsigned int is_console)
         /* set console flag */
         priv->is_console = is_console;
 
-        /* finally allocate hvc */
+        /* allocate hvc device */
         priv->hvc = hvc_alloc(HVC_IUCV_MAGIC + id, /*             PAGE_SIZE */
                               HVC_IUCV_MAGIC + id, &hvc_iucv_ops, 256);
         if (IS_ERR(priv->hvc)) {
                 rc = PTR_ERR(priv->hvc);
-                free_page((unsigned long) priv->sndbuf);
-                kfree(priv);
-                return rc;
+                goto out_error_hvc;
         }
 
         /* notify HVC thread instead of using polling */
@@ -915,8 +992,45 @@ static int __init hvc_iucv_alloc(int id, unsigned int is_console)
         memcpy(priv->srv_name, name, 8);
         ASCEBC(priv->srv_name, 8);
 
+        /* create and setup device */
+        priv->dev = kzalloc(sizeof(*priv->dev), GFP_KERNEL);
+        if (!priv->dev) {
+                rc = -ENOMEM;
+                goto out_error_dev;
+        }
+        dev_set_name(priv->dev, "hvc_iucv%d", id);
+        dev_set_drvdata(priv->dev, priv);
+        priv->dev->bus = &iucv_bus;
+        priv->dev->parent = iucv_root;
+        priv->dev->driver = &hvc_iucv_driver;
+        priv->dev->release = (void (*)(struct device *)) kfree;
+        rc = device_register(priv->dev);
+        if (rc) {
+                kfree(priv->dev);
+                goto out_error_dev;
+        }
+
         hvc_iucv_table[id] = priv;
         return 0;
+
+out_error_dev:
+        hvc_remove(priv->hvc);
+out_error_hvc:
+        free_page((unsigned long) priv->sndbuf);
+        kfree(priv);
+
+        return rc;
+}
+
+/**
+ * hvc_iucv_destroy() - Destroy and free hvc_iucv_private instances
+ */
+static void __init hvc_iucv_destroy(struct hvc_iucv_private *priv)
+{
+        hvc_remove(priv->hvc);
+        device_unregister(priv->dev);
+        free_page((unsigned long) priv->sndbuf);
+        kfree(priv);
 }
 
 /**
@@ -1109,6 +1223,11 @@ static int __init hvc_iucv_init(void)
                 goto out_error;
         }
 
+        /* register IUCV HVC device driver */
+        rc = driver_register(&hvc_iucv_driver);
+        if (rc)
+                goto out_error;
+
         /* parse hvc_iucv_allow string and create z/VM user ID filter list */
         if (hvc_iucv_filter_string) {
                 rc = hvc_iucv_setup_filter(hvc_iucv_filter_string);
@@ -1183,15 +1302,14 @@ out_error_iucv:
         iucv_unregister(&hvc_iucv_handler, 0);
 out_error_hvc:
         for (i = 0; i < hvc_iucv_devices; i++)
-                if (hvc_iucv_table[i]) {
-                        if (hvc_iucv_table[i]->hvc)
-                                hvc_remove(hvc_iucv_table[i]->hvc);
-                        kfree(hvc_iucv_table[i]);
-                }
+                if (hvc_iucv_table[i])
+                        hvc_iucv_destroy(hvc_iucv_table[i]);
 out_error_memory:
         mempool_destroy(hvc_iucv_mempool);
         kmem_cache_destroy(hvc_iucv_buffer_cache);
 out_error:
+        if (hvc_iucv_filter)
+                kfree(hvc_iucv_filter);
         hvc_iucv_devices = 0; /* ensure that we do not provide any device */
         return rc;
 }
diff --git a/drivers/char/hvc_vio.c b/drivers/char/hvc_vio.c
index bd62dc86b47d..c72b994652ac 100644
--- a/drivers/char/hvc_vio.c
+++ b/drivers/char/hvc_vio.c
@@ -113,7 +113,7 @@ static int __devexit hvc_vio_remove(struct vio_dev *vdev)
 static struct vio_driver hvc_vio_driver = {
         .id_table       = hvc_driver_table,
         .probe          = hvc_vio_probe,
-        .remove         = hvc_vio_remove,
+        .remove         = __devexit_p(hvc_vio_remove),
         .driver         = {
                 .name   = hvc_driver_name,
                 .owner  = THIS_MODULE,
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index c76bccf5354d..266b858b8f85 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -347,7 +347,7 @@ static void __exit hvcs_module_exit(void);
 
 static inline struct hvcs_struct *from_vio_dev(struct vio_dev *viod)
 {
-        return viod->dev.driver_data;
+        return dev_get_drvdata(&viod->dev);
 }
 /* The sysfs interface for the driver and devices */
 
@@ -785,7 +785,7 @@ static int __devinit hvcs_probe(
         kref_init(&hvcsd->kref);
 
         hvcsd->vdev = dev;
-        dev->dev.driver_data = hvcsd;
+        dev_set_drvdata(&dev->dev, hvcsd);
 
         hvcsd->index = index;
 
@@ -831,7 +831,7 @@ static int __devinit hvcs_probe(
 
 static int __devexit hvcs_remove(struct vio_dev *dev)
 {
-        struct hvcs_struct *hvcsd = dev->dev.driver_data;
+        struct hvcs_struct *hvcsd = dev_get_drvdata(&dev->dev);
         unsigned long flags;
         struct tty_struct *tty;
 
@@ -868,7 +868,7 @@ static int __devexit hvcs_remove(struct vio_dev *dev)
 static struct vio_driver hvcs_vio_driver = {
         .id_table       = hvcs_driver_table,
         .probe          = hvcs_probe,
-        .remove         = hvcs_remove,
+        .remove         = __devexit_p(hvcs_remove),
         .driver         = {
                 .name   = hvcs_driver_name,
                 .owner  = THIS_MODULE,
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 5fab6470f4b2..ce66a70184f7 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -88,7 +88,7 @@ config HW_RANDOM_N2RNG
 
 config HW_RANDOM_VIA
         tristate "VIA HW Random Number Generator support"
-        depends on HW_RANDOM && X86_32
+        depends on HW_RANDOM && X86
         default HW_RANDOM
         ---help---
           This driver provides kernel-side support for the Random Number
@@ -148,3 +148,28 @@ config HW_RANDOM_VIRTIO
 
           To compile this driver as a module, choose M here: the
           module will be called virtio-rng.  If unsure, say N.
+
+config HW_RANDOM_TX4939
+        tristate "TX4939 Random Number Generator support"
+        depends on HW_RANDOM && SOC_TX4939
+        default HW_RANDOM
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on TX4939 SoC.
+
+          To compile this driver as a module, choose M here: the
+          module will be called tx4939-rng.
+
+          If unsure, say Y.
+
+config HW_RANDOM_MXC_RNGA
+        tristate "Freescale i.MX RNGA Random Number Generator"
+        depends on HW_RANDOM && ARCH_HAS_RNGA
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on Freescale i.MX processors.
+
+          To compile this driver as a module, choose M here: the
+          module will be called mxc-rnga.
+
+          If unsure, say Y.
diff --git a/drivers/char/hw_random/Makefile b/drivers/char/hw_random/Makefile
index e81d21a5f28f..676828ba8123 100644
--- a/drivers/char/hw_random/Makefile
+++ b/drivers/char/hw_random/Makefile
@@ -15,3 +15,5 @@ obj-$(CONFIG_HW_RANDOM_IXP4XX) += ixp4xx-rng.o
 obj-$(CONFIG_HW_RANDOM_OMAP) += omap-rng.o
 obj-$(CONFIG_HW_RANDOM_PASEMI) += pasemi-rng.o
 obj-$(CONFIG_HW_RANDOM_VIRTIO) += virtio-rng.o
+obj-$(CONFIG_HW_RANDOM_TX4939) += tx4939-rng.o
+obj-$(CONFIG_HW_RANDOM_MXC_RNGA) += mxc-rnga.o
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index e5d583c84e4f..fc93e2fc7c71 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -153,6 +153,7 @@ static const struct file_operations rng_chrdev_ops = {
 static struct miscdevice rng_miscdev = {
         .minor          = RNG_MISCDEV_MINOR,
         .name           = RNG_MODULE_NAME,
+        .devnode        = "hwrng",
         .fops           = &rng_chrdev_ops,
 };
 
diff --git a/drivers/char/hw_random/mxc-rnga.c b/drivers/char/hw_random/mxc-rnga.c
new file mode 100644
index 000000000000..187c6be80f43
--- /dev/null
+++ b/drivers/char/hw_random/mxc-rnga.c
@@ -0,0 +1,247 @@
+/*
+ * RNG driver for Freescale RNGA
+ *
+ * Copyright 2008-2009 Freescale Semiconductor, Inc. All Rights Reserved.
+ * Author: Alan Carvalho de Assis <acassis@gmail.com>
+ */
+
+/*
+ * The code contained herein is licensed under the GNU General Public
+ * License. You may obtain a copy of the GNU General Public License
+ * Version 2 or later at the following locations:
+ *
+ * http://www.opensource.org/licenses/gpl-license.html
+ * http://www.gnu.org/copyleft/gpl.html
+ *
+ * This driver is based on other RNG drivers.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/hw_random.h>
+#include <linux/io.h>
+
+/* RNGA Registers */
+#define RNGA_CONTROL                    0x00
+#define RNGA_STATUS                     0x04
+#define RNGA_ENTROPY                    0x08
+#define RNGA_OUTPUT_FIFO                0x0c
+#define RNGA_MODE                       0x10
+#define RNGA_VERIFICATION_CONTROL       0x14
+#define RNGA_OSC_CONTROL_COUNTER        0x18
+#define RNGA_OSC1_COUNTER               0x1c
+#define RNGA_OSC2_COUNTER               0x20
+#define RNGA_OSC_COUNTER_STATUS         0x24
+
+/* RNGA Registers Range */
+#define RNG_ADDR_RANGE                  0x28
+
+/* RNGA Control Register */
+#define RNGA_CONTROL_SLEEP              0x00000010
+#define RNGA_CONTROL_CLEAR_INT          0x00000008
+#define RNGA_CONTROL_MASK_INTS          0x00000004
+#define RNGA_CONTROL_HIGH_ASSURANCE     0x00000002
+#define RNGA_CONTROL_GO                 0x00000001
+
+#define RNGA_STATUS_LEVEL_MASK          0x0000ff00
+
+/* RNGA Status Register */
+#define RNGA_STATUS_OSC_DEAD            0x80000000
+#define RNGA_STATUS_SLEEP               0x00000010
+#define RNGA_STATUS_ERROR_INT           0x00000008
+#define RNGA_STATUS_FIFO_UNDERFLOW      0x00000004
+#define RNGA_STATUS_LAST_READ_STATUS    0x00000002
+#define RNGA_STATUS_SECURITY_VIOLATION  0x00000001
+
+static struct platform_device *rng_dev;
+
+static int mxc_rnga_data_present(struct hwrng *rng)
+{
+        int level;
+        void __iomem *rng_base = (void __iomem *)rng->priv;
+
+        /* how many random numbers is in FIFO? [0-16] */
+        level = ((__raw_readl(rng_base + RNGA_STATUS) &
+                        RNGA_STATUS_LEVEL_MASK) >> 8);
+
+        return level > 0 ? 1 : 0;
+}
+
+static int mxc_rnga_data_read(struct hwrng *rng, u32 * data)
+{
+        int err;
+        u32 ctrl;
+        void __iomem *rng_base = (void __iomem *)rng->priv;
+
+        /* retrieve a random number from FIFO */
+        *data = __raw_readl(rng_base + RNGA_OUTPUT_FIFO);
+
+        /* some error while reading this random number? */
+        err = __raw_readl(rng_base + RNGA_STATUS) & RNGA_STATUS_ERROR_INT;
+
+        /* if error: clear error interrupt, but doesn't return random number */
+        if (err) {
+                dev_dbg(&rng_dev->dev, "Error while reading random number!\n");
+                ctrl = __raw_readl(rng_base + RNGA_CONTROL);
+                __raw_writel(ctrl | RNGA_CONTROL_CLEAR_INT,
+                                        rng_base + RNGA_CONTROL);
+                return 0;
+        } else
+                return 4;
+}
+
+static int mxc_rnga_init(struct hwrng *rng)
+{
+        u32 ctrl, osc;
+        void __iomem *rng_base = (void __iomem *)rng->priv;
+
+        /* wake up */
+        ctrl = __raw_readl(rng_base + RNGA_CONTROL);
+        __raw_writel(ctrl & ~RNGA_CONTROL_SLEEP, rng_base + RNGA_CONTROL);
+
+        /* verify if oscillator is working */
+        osc = __raw_readl(rng_base + RNGA_STATUS);
+        if (osc & RNGA_STATUS_OSC_DEAD) {
+                dev_err(&rng_dev->dev, "RNGA Oscillator is dead!\n");
+                return -ENODEV;
+        }
+
+        /* go running */
+        ctrl = __raw_readl(rng_base + RNGA_CONTROL);
+        __raw_writel(ctrl | RNGA_CONTROL_GO, rng_base + RNGA_CONTROL);
+
+        return 0;
+}
+
+static void mxc_rnga_cleanup(struct hwrng *rng)
+{
+        u32 ctrl;
+        void __iomem *rng_base = (void __iomem *)rng->priv;
+
+        ctrl = __raw_readl(rng_base + RNGA_CONTROL);
+
+        /* stop rnga */
+        __raw_writel(ctrl & ~RNGA_CONTROL_GO, rng_base + RNGA_CONTROL);
+}
+
+static struct hwrng mxc_rnga = {
+        .name = "mxc-rnga",
+        .init = mxc_rnga_init,
+        .cleanup = mxc_rnga_cleanup,
+        .data_present = mxc_rnga_data_present,
+        .data_read = mxc_rnga_data_read
+};
+
+static int __init mxc_rnga_probe(struct platform_device *pdev)
+{
+        int err = -ENODEV;
+        struct clk *clk;
+        struct resource *res, *mem;
+        void __iomem *rng_base = NULL;
+
+        if (rng_dev)
+                return -EBUSY;
+
+        clk = clk_get(&pdev->dev, "rng");
+        if (IS_ERR(clk)) {
+                dev_err(&pdev->dev, "Could not get rng_clk!\n");
+                err = PTR_ERR(clk);
+                goto out;
+        }
+
+        clk_enable(clk);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                err = -ENOENT;
+                goto err_region;
+        }
+
+        mem = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (mem == NULL) {
+                err = -EBUSY;
+                goto err_region;
+        }
+
+        rng_base = ioremap(res->start, resource_size(res));
+        if (!rng_base) {
+                err = -ENOMEM;
+                goto err_ioremap;
+        }
+
+        mxc_rnga.priv = (unsigned long)rng_base;
+
+        err = hwrng_register(&mxc_rnga);
+        if (err) {
+                dev_err(&pdev->dev, "MXC RNGA registering failed (%d)\n", err);
+                goto err_register;
+        }
+
+        rng_dev = pdev;
+
+        dev_info(&pdev->dev, "MXC RNGA Registered.\n");
+
+        return 0;
+
+err_register:
+        iounmap(rng_base);
+        rng_base = NULL;
+
+err_ioremap:
+        release_mem_region(res->start, resource_size(res));
+
+err_region:
+        clk_disable(clk);
+        clk_put(clk);
+
+out:
+        return err;
+}
+
+static int __exit mxc_rnga_remove(struct platform_device *pdev)
+{
+        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        void __iomem *rng_base = (void __iomem *)mxc_rnga.priv;
+        struct clk *clk = clk_get(&pdev->dev, "rng");
+
+        hwrng_unregister(&mxc_rnga);
+
+        iounmap(rng_base);
+
+        release_mem_region(res->start, resource_size(res));
+
+        clk_disable(clk);
+        clk_put(clk);
+
+        return 0;
+}
+
+static struct platform_driver mxc_rnga_driver = {
+        .driver = {
+                   .name = "mxc_rnga",
+                   .owner = THIS_MODULE,
+                   },
+        .remove = __exit_p(mxc_rnga_remove),
+};
+
+static int __init mod_init(void)
+{
+        return platform_driver_probe(&mxc_rnga_driver, mxc_rnga_probe);
+}
+
+static void __exit mod_exit(void)
+{
+        platform_driver_unregister(&mxc_rnga_driver);
+}
+
+module_init(mod_init);
+module_exit(mod_exit);
+
+MODULE_AUTHOR("Freescale Semiconductor, Inc.");
+MODULE_DESCRIPTION("H/W RNGA driver for i.MX");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 538313f9e7ac..00dd3de1be51 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -89,7 +89,7 @@ static struct hwrng omap_rng_ops = {
         .data_read      = omap_rng_data_read,
 };
 
-static int __init omap_rng_probe(struct platform_device *pdev)
+static int __devinit omap_rng_probe(struct platform_device *pdev)
 {
         struct resource *res, *mem;
         int ret;
diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c
index dcd352ad0e7f..a94e930575f2 100644
--- a/drivers/char/hw_random/timeriomem-rng.c
+++ b/drivers/char/hw_random/timeriomem-rng.c
@@ -88,9 +88,9 @@ static struct hwrng timeriomem_rng_ops = {
         .priv           = 0,
 };
 
-static int __init timeriomem_rng_probe(struct platform_device *pdev)
+static int __devinit timeriomem_rng_probe(struct platform_device *pdev)
 {
-        struct resource *res, *mem;
+        struct resource *res;
         int ret;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -98,21 +98,12 @@ static int __init timeriomem_rng_probe(struct platform_device *pdev)
         if (!res)
                 return -ENOENT;
 
-        mem = request_mem_region(res->start, res->end - res->start + 1,
-                                 pdev->name);
-        if (mem == NULL)
-                return -EBUSY;
-
-        dev_set_drvdata(&pdev->dev, mem);
-
         timeriomem_rng_data = pdev->dev.platform_data;
 
         timeriomem_rng_data->address = ioremap(res->start,
                                                 res->end - res->start + 1);
-        if (!timeriomem_rng_data->address) {
-                ret = -ENOMEM;
-                goto err_ioremap;
-        }
+        if (!timeriomem_rng_data->address)
+                return -EIO;
 
         if (timeriomem_rng_data->period != 0
                 && usecs_to_jiffies(timeriomem_rng_data->period) > 0) {
@@ -125,7 +116,7 @@ static int __init timeriomem_rng_probe(struct platform_device *pdev)
 
         ret = hwrng_register(&timeriomem_rng_ops);
         if (ret)
-                goto err_register;
+                goto failed;
 
         dev_info(&pdev->dev, "32bits from 0x%p @ %dus\n",
                         timeriomem_rng_data->address,
@@ -133,24 +124,19 @@ static int __init timeriomem_rng_probe(struct platform_device *pdev)
 
         return 0;
 
-err_register:
+failed:
         dev_err(&pdev->dev, "problem registering\n");
         iounmap(timeriomem_rng_data->address);
-err_ioremap:
-        release_resource(mem);
 
         return ret;
 }
 
 static int __devexit timeriomem_rng_remove(struct platform_device *pdev)
 {
-        struct resource *mem = dev_get_drvdata(&pdev->dev);
-
         del_timer_sync(&timeriomem_rng_timer);
         hwrng_unregister(&timeriomem_rng_ops);
 
         iounmap(timeriomem_rng_data->address);
-        release_resource(mem);
 
         return 0;
 }
diff --git a/drivers/char/hw_random/tx4939-rng.c b/drivers/char/hw_random/tx4939-rng.c
new file mode 100644
index 000000000000..544d9085a8e8
--- /dev/null
+++ b/drivers/char/hw_random/tx4939-rng.c
@@ -0,0 +1,184 @@
+/*
+ * RNG driver for TX4939 Random Number Generators (RNG)
+ *
+ * Copyright (C) 2009 Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/hw_random.h>
+
+#define TX4939_RNG_RCSR         0x00000000
+#define TX4939_RNG_ROR(n)       (0x00000018 + (n) * 8)
+
+#define TX4939_RNG_RCSR_INTE    0x00000008
+#define TX4939_RNG_RCSR_RST     0x00000004
+#define TX4939_RNG_RCSR_FIN     0x00000002
+#define TX4939_RNG_RCSR_ST      0x00000001
+
+struct tx4939_rng {
+        struct hwrng rng;
+        void __iomem *base;
+        u64 databuf[3];
+        unsigned int data_avail;
+};
+
+static void rng_io_start(void)
+{
+#ifndef CONFIG_64BIT
+        /*
+         * readq is reading a 64-bit register using a 64-bit load.  On
+         * a 32-bit kernel however interrupts or any other processor
+         * exception would clobber the upper 32-bit of the processor
+         * register so interrupts need to be disabled.
+         */
+        local_irq_disable();
+#endif
+}
+
+static void rng_io_end(void)
+{
+#ifndef CONFIG_64BIT
+        local_irq_enable();
+#endif
+}
+
+static u64 read_rng(void __iomem *base, unsigned int offset)
+{
+        return ____raw_readq(base + offset);
+}
+
+static void write_rng(u64 val, void __iomem *base, unsigned int offset)
+{
+        return ____raw_writeq(val, base + offset);
+}
+
+static int tx4939_rng_data_present(struct hwrng *rng, int wait)
+{
+        struct tx4939_rng *rngdev = container_of(rng, struct tx4939_rng, rng);
+        int i;
+
+        if (rngdev->data_avail)
+                return rngdev->data_avail;
+        for (i = 0; i < 20; i++) {
+                rng_io_start();
+                if (!(read_rng(rngdev->base, TX4939_RNG_RCSR)
+                      & TX4939_RNG_RCSR_ST)) {
+                        rngdev->databuf[0] =
+                                read_rng(rngdev->base, TX4939_RNG_ROR(0));
+                        rngdev->databuf[1] =
+                                read_rng(rngdev->base, TX4939_RNG_ROR(1));
+                        rngdev->databuf[2] =
+                                read_rng(rngdev->base, TX4939_RNG_ROR(2));
+                        rngdev->data_avail =
+                                sizeof(rngdev->databuf) / sizeof(u32);
+                        /* Start RNG */
+                        write_rng(TX4939_RNG_RCSR_ST,
+                                  rngdev->base, TX4939_RNG_RCSR);
+                        wait = 0;
+                }
+                rng_io_end();
+                if (!wait)
+                        break;
+                /* 90 bus clock cycles by default for generation */
+                ndelay(90 * 5);
+        }
+        return rngdev->data_avail;
+}
+
+static int tx4939_rng_data_read(struct hwrng *rng, u32 *buffer)
+{
+        struct tx4939_rng *rngdev = container_of(rng, struct tx4939_rng, rng);
+
+        rngdev->data_avail--;
+        *buffer = *((u32 *)&rngdev->databuf + rngdev->data_avail);
+        return sizeof(u32);
+}
+
+static int __init tx4939_rng_probe(struct platform_device *dev)
+{
+        struct tx4939_rng *rngdev;
+        struct resource *r;
+        int i;
+
+        r = platform_get_resource(dev, IORESOURCE_MEM, 0);
+        if (!r)
+                return -EBUSY;
+        rngdev = devm_kzalloc(&dev->dev, sizeof(*rngdev), GFP_KERNEL);
+        if (!rngdev)
+                return -ENOMEM;
+        if (!devm_request_mem_region(&dev->dev, r->start, resource_size(r),
+                                     dev_name(&dev->dev)))
+                return -EBUSY;
+        rngdev->base = devm_ioremap(&dev->dev, r->start, resource_size(r));
+        if (!rngdev->base)
+                return -EBUSY;
+
+        rngdev->rng.name = dev_name(&dev->dev);
+        rngdev->rng.data_present = tx4939_rng_data_present;
+        rngdev->rng.data_read = tx4939_rng_data_read;
+
+        rng_io_start();
+        /* Reset RNG */
+        write_rng(TX4939_RNG_RCSR_RST, rngdev->base, TX4939_RNG_RCSR);
+        write_rng(0, rngdev->base, TX4939_RNG_RCSR);
+        /* Start RNG */
+        write_rng(TX4939_RNG_RCSR_ST, rngdev->base, TX4939_RNG_RCSR);
+        rng_io_end();
+        /*
+         * Drop first two results.  From the datasheet:
+         * The quality of the random numbers generated immediately
+         * after reset can be insufficient.  Therefore, do not use
+         * random numbers obtained from the first and second
+         * generations; use the ones from the third or subsequent
+         * generation.
+         */
+        for (i = 0; i < 2; i++) {
+                rngdev->data_avail = 0;
+                if (!tx4939_rng_data_present(&rngdev->rng, 1))
+                        return -EIO;
+        }
+
+        platform_set_drvdata(dev, rngdev);
+        return hwrng_register(&rngdev->rng);
+}
+
+static int __exit tx4939_rng_remove(struct platform_device *dev)
+{
+        struct tx4939_rng *rngdev = platform_get_drvdata(dev);
+
+        hwrng_unregister(&rngdev->rng);
+        platform_set_drvdata(dev, NULL);
+        return 0;
+}
+
+static struct platform_driver tx4939_rng_driver = {
+        .driver         = {
+                .name   = "tx4939-rng",
+                .owner  = THIS_MODULE,
+        },
+        .remove = tx4939_rng_remove,
+};
+
+static int __init tx4939rng_init(void)
+{
+        return platform_driver_probe(&tx4939_rng_driver, tx4939_rng_probe);
+}
+
+static void __exit tx4939rng_exit(void)
+{
+        platform_driver_unregister(&tx4939_rng_driver);
+}
+
+module_init(tx4939rng_init);
+module_exit(tx4939rng_exit);
+
+MODULE_DESCRIPTION("H/W Random Number Generator (RNG) driver for TX4939");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index 4e9573c1d39e..794aacb715c1 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -132,6 +132,19 @@ static int via_rng_init(struct hwrng *rng)
         struct cpuinfo_x86 *c = &cpu_data(0);
         u32 lo, hi, old_lo;
 
+        /* VIA Nano CPUs don't have the MSR_VIA_RNG anymore.  The RNG
+         * is always enabled if CPUID rng_en is set.  There is no
+         * RNG configuration like it used to be the case in this
+         * register */
+        if ((c->x86 == 6) && (c->x86_model >= 0x0f)) {
+                if (!cpu_has_xstore_enabled) {
+                        printk(KERN_ERR PFX "can't enable hardware RNG "
+                                "if XSTORE is not enabled\n");
+                        return -ENODEV;
+                }
+                return 0;
+        }
+
         /* Control the RNG via MSR.  Tread lightly and pay very close
          * close attention to values written, as the reserved fields
          * are documented to be "undefined and unpredictable"; but it
@@ -205,5 +218,5 @@ static void __exit mod_exit(void)
 module_init(mod_init);
 module_exit(mod_exit);
 
-MODULE_DESCRIPTION("H/W RNG driver for VIA chipsets");
+MODULE_DESCRIPTION("H/W RNG driver for VIA CPU with PadLock");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index 86e83f883139..32216b623248 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -35,13 +35,13 @@ static DECLARE_COMPLETION(have_data);
 
 static void random_recv_done(struct virtqueue *vq)
 {
-        int len;
+        unsigned int len;
 
         /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
         if (!vq->vq_ops->get_buf(vq, &len))
                 return;
 
-        data_left = len / sizeof(random_data[0]);
+        data_left += len;
         complete(&have_data);
 }
 
@@ -49,7 +49,7 @@ static void register_buffer(void)
 {
         struct scatterlist sg;
 
-        sg_init_one(&sg, random_data, RANDOM_DATA_SIZE);
+        sg_init_one(&sg, random_data+data_left, RANDOM_DATA_SIZE-data_left);
         /* There should always be room for one buffer. */
         if (vq->vq_ops->add_buf(vq, &sg, 0, 1, random_data) != 0)
                 BUG();
@@ -59,24 +59,32 @@ static void register_buffer(void)
 /* At least we don't udelay() in a loop like some other drivers. */
 static int virtio_data_present(struct hwrng *rng, int wait)
 {
-        if (data_left)
+        if (data_left >= sizeof(u32))
                 return 1;
 
+again:
         if (!wait)
                 return 0;
 
         wait_for_completion(&have_data);
+
+        /* Not enough?  Re-register. */
+        if (unlikely(data_left < sizeof(u32))) {
+                register_buffer();
+                goto again;
+        }
+
         return 1;
 }
 
 /* virtio_data_present() must have succeeded before this is called. */
 static int virtio_data_read(struct hwrng *rng, u32 *data)
 {
-        BUG_ON(!data_left);
-
-        *data = random_data[--data_left];
+        BUG_ON(data_left < sizeof(u32));
+        data_left -= sizeof(u32);
+        *data = random_data[data_left / 4];
 
-        if (!data_left) {
+        if (data_left < sizeof(u32)) {
                 init_completion(&have_data);
                 register_buffer();
         }
@@ -94,13 +102,13 @@ static int virtrng_probe(struct virtio_device *vdev)
         int err;
 
         /* We expect a single virtqueue. */
-        vq = vdev->config->find_vq(vdev, 0, random_recv_done);
+        vq = virtio_find_single_vq(vdev, random_recv_done, "input");
         if (IS_ERR(vq))
                 return PTR_ERR(vq);
 
         err = hwrng_register(&virtio_hwrng);
         if (err) {
-                vdev->config->del_vq(vq);
+                vdev->config->del_vqs(vdev);
                 return err;
         }
 
@@ -112,7 +120,7 @@ static void virtrng_remove(struct virtio_device *vdev)
 {
         vdev->config->reset(vdev);
         hwrng_unregister(&virtio_hwrng);
-        vdev->config->del_vq(vq);
+        vdev->config->del_vqs(vdev);
 }
 
 static struct virtio_device_id id_table[] = {
diff --git a/drivers/char/ip2/i2lib.c b/drivers/char/ip2/i2lib.c
index 0061e18aff60..0d10b89218ed 100644
--- a/drivers/char/ip2/i2lib.c
+++ b/drivers/char/ip2/i2lib.c
@@ -868,11 +868,11 @@ i2Input(i2ChanStrPtr pCh)
                 amountToMove = count;
         }
         // Move the first block
-        pCh->pTTY->ldisc.ops->receive_buf( pCh->pTTY,
+        pCh->pTTY->ldisc->ops->receive_buf( pCh->pTTY,
                  &(pCh->Ibuf[stripIndex]), NULL, amountToMove );
         // If we needed to wrap, do the second data move
         if (count > amountToMove) {
-                pCh->pTTY->ldisc.ops->receive_buf( pCh->pTTY,
+                pCh->pTTY->ldisc->ops->receive_buf( pCh->pTTY,
                  pCh->Ibuf, NULL, count - amountToMove );
         }
         // Bump and wrap the stripIndex all at once by the amount of data read. This
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index afd9247cf082..517271c762e6 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -1315,8 +1315,8 @@ static inline void  isig(int sig, struct tty_struct *tty, int flush)
         if (tty->pgrp)
                 kill_pgrp(tty->pgrp, sig, 1);
         if (flush || !L_NOFLSH(tty)) {
-                if ( tty->ldisc.ops->flush_buffer )  
-                        tty->ldisc.ops->flush_buffer(tty);
+                if ( tty->ldisc->ops->flush_buffer )  
+                        tty->ldisc->ops->flush_buffer(tty);
                 i2InputFlush( tty->driver_data );
         }
 }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 259644646b82..d2e698096ace 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2375,14 +2375,14 @@ static int __devinit ipmi_of_probe(struct of_device *dev,
                 info->io.addr_data, info->io.regsize, info->io.regspacing,
                 info->irq);
 
-        dev->dev.driver_data = (void *) info;
+        dev_set_drvdata(&dev->dev, info);
 
         return try_smi_init(info);
 }
 
 static int __devexit ipmi_of_remove(struct of_device *dev)
 {
-        cleanup_one_si(dev->dev.driver_data);
+        cleanup_one_si(dev_get_drvdata(&dev->dev));
         return 0;
 }
 
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index a59eac584d16..4159292e35cf 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -329,7 +329,7 @@ static inline void drop_rts(struct isi_port *port)
 
 /* card->lock MUST NOT be held */
 
-static void isicom_raise_dtr_rts(struct tty_port *port)
+static void isicom_dtr_rts(struct tty_port *port, int on)
 {
         struct isi_port *ip = container_of(port, struct isi_port, port);
         struct isi_board *card = ip->card;
@@ -339,10 +339,17 @@ static void isicom_raise_dtr_rts(struct tty_port *port)
         if (!lock_card(card))
                 return;
 
-        outw(0x8000 | (channel << card->shift_count) | 0x02, base);
-        outw(0x0f04, base);
-        InterruptTheCard(base);
-        ip->status |= (ISI_DTR | ISI_RTS);
+        if (on) {
+                outw(0x8000 | (channel << card->shift_count) | 0x02, base);
+                outw(0x0f04, base);
+                InterruptTheCard(base);
+                ip->status |= (ISI_DTR | ISI_RTS);
+        } else {
+                outw(0x8000 | (channel << card->shift_count) | 0x02, base);
+                outw(0x0C04, base);
+                InterruptTheCard(base);
+                ip->status &= ~(ISI_DTR | ISI_RTS);
+        }
         unlock_card(card);
 }
 
@@ -1339,7 +1346,7 @@ static const struct tty_operations isicom_ops = {
 
 static const struct tty_port_operations isicom_port_ops = {
         .carrier_raised         = isicom_carrier_raised,
-        .raise_dtr_rts          = isicom_raise_dtr_rts,
+        .dtr_rts                = isicom_dtr_rts,
 };
 
 static int __devinit reset_card(struct pci_dev *pdev,
@@ -1586,7 +1593,7 @@ static unsigned int card_count;
 static int __devinit isicom_probe(struct pci_dev *pdev,
         const struct pci_device_id *ent)
 {
-        unsigned int signature, index;
+        unsigned int uninitialized_var(signature), index;
         int retval = -EPERM;
         struct isi_board *board = NULL;
 
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index fff19f7e29d2..0c999f5bb3db 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -1140,14 +1140,14 @@ static int stli_carrier_raised(struct tty_port *port)
         return (portp->sigs & TIOCM_CD) ? 1 : 0;
 }
 
-static void stli_raise_dtr_rts(struct tty_port *port)
+static void stli_dtr_rts(struct tty_port *port, int on)
 {
         struct stliport *portp = container_of(port, struct stliport, port);
         struct stlibrd *brdp = stli_brds[portp->brdnr];
-        stli_mkasysigs(&portp->asig, 1, 1);
+        stli_mkasysigs(&portp->asig, on, on);
         if (stli_cmdwait(brdp, portp, A_SETSIGNALS, &portp->asig,
                 sizeof(asysigs_t), 0) < 0)
-                        printk(KERN_WARNING "istallion: dtr raise failed.\n");
+                        printk(KERN_WARNING "istallion: dtr set failed.\n");
 }
 
 
@@ -3785,7 +3785,7 @@ err:
         return retval;
 }
 
-static void stli_pciremove(struct pci_dev *pdev)
+static void __devexit stli_pciremove(struct pci_dev *pdev)
 {
         struct stlibrd *brdp = pci_get_drvdata(pdev);
 
@@ -4417,7 +4417,7 @@ static const struct tty_operations stli_ops = {
 
 static const struct tty_port_operations stli_port_ops = {
         .carrier_raised = stli_carrier_raised,
-        .raise_dtr_rts = stli_raise_dtr_rts,
+        .dtr_rts = stli_dtr_rts,
 };
 
 /*****************************************************************************/
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index de26a978fbdd..737be953cc58 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1123,8 +1123,6 @@ static int emulate_raw(struct vc_data *vc, unsigned int keycode,
 
 #define HW_RAW(dev)     0
 
-#warning "Cannot generate rawmode keyboard for your architecture yet."
-
 static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char up_flag)
 {
         if (keycode > 127)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 65e12bca657c..afa8813e737a 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -694,9 +694,8 @@ static ssize_t read_zero(struct file * file, char __user * buf,
                 written += chunk - unwritten;
                 if (unwritten)
                         break;
-                /* Consider changing this to just 'signal_pending()' with lots of testing */
-                if (fatal_signal_pending(current))
-                        return written ? written : -EINTR;
+                if (signal_pending(current))
+                        return written ? written : -ERESTARTSYS;
                 buf += chunk;
                 count -= chunk;
                 cond_resched();
@@ -864,59 +863,58 @@ static const struct file_operations kmsg_fops = {
         .write =        kmsg_write,
 };
 
-static int memory_open(struct inode * inode, struct file * filp)
-{
-        int ret = 0;
-
-        lock_kernel();
-        switch (iminor(inode)) {
-                case 1:
-                        filp->f_op = &mem_fops;
-                        filp->f_mapping->backing_dev_info =
-                                &directly_mappable_cdev_bdi;
-                        break;
+static const struct {
+        unsigned int            minor;
+        char                    *name;
+        umode_t                 mode;
+        const struct file_operations    *fops;
+        struct backing_dev_info *dev_info;
+} devlist[] = { /* list of minor devices */
+        {1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops,
+                &directly_mappable_cdev_bdi},
 #ifdef CONFIG_DEVKMEM
-                case 2:
-                        filp->f_op = &kmem_fops;
-                        filp->f_mapping->backing_dev_info =
-                                &directly_mappable_cdev_bdi;
-                        break;
+        {2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops,
+                &directly_mappable_cdev_bdi},
 #endif
-                case 3:
-                        filp->f_op = &null_fops;
-                        break;
+        {3, "null",    S_IRUGO | S_IWUGO,           &null_fops, NULL},
 #ifdef CONFIG_DEVPORT
-                case 4:
-                        filp->f_op = &port_fops;
-                        break;
+        {4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops, NULL},
 #endif
-                case 5:
-                        filp->f_mapping->backing_dev_info = &zero_bdi;
-                        filp->f_op = &zero_fops;
-                        break;
-                case 7:
-                        filp->f_op = &full_fops;
-                        break;
-                case 8:
-                        filp->f_op = &random_fops;
-                        break;
-                case 9:
-                        filp->f_op = &urandom_fops;
-                        break;
-                case 11:
-                        filp->f_op = &kmsg_fops;
-                        break;
+        {5, "zero",    S_IRUGO | S_IWUGO,           &zero_fops, &zero_bdi},
+        {7, "full",    S_IRUGO | S_IWUGO,           &full_fops, NULL},
+        {8, "random",  S_IRUGO | S_IWUSR,           &random_fops, NULL},
+        {9, "urandom", S_IRUGO | S_IWUSR,           &urandom_fops, NULL},
+        {11,"kmsg",    S_IRUGO | S_IWUSR,           &kmsg_fops, NULL},
 #ifdef CONFIG_CRASH_DUMP
-                case 12:
-                        filp->f_op = &oldmem_fops;
-                        break;
+        {12,"oldmem",    S_IRUSR | S_IWUSR | S_IRGRP, &oldmem_fops, NULL},
 #endif
-                default:
-                        unlock_kernel();
-                        return -ENXIO;
+};
+
+static int memory_open(struct inode *inode, struct file *filp)
+{
+        int ret = 0;
+        int i;
+
+        lock_kernel();
+
+        for (i = 0; i < ARRAY_SIZE(devlist); i++) {
+                if (devlist[i].minor == iminor(inode)) {
+                        filp->f_op = devlist[i].fops;
+                        if (devlist[i].dev_info) {
+                                filp->f_mapping->backing_dev_info =
+                                        devlist[i].dev_info;
+                        }
+
+                        break;
+                }
         }
-        if (filp->f_op && filp->f_op->open)
-                ret = filp->f_op->open(inode,filp);
+
+        if (i == ARRAY_SIZE(devlist))
+                ret = -ENXIO;
+        else
+                if (filp->f_op && filp->f_op->open)
+                        ret = filp->f_op->open(inode, filp);
+
         unlock_kernel();
         return ret;
 }
@@ -925,30 +923,6 @@ static const struct file_operations memory_fops = {
         .open           = memory_open,  /* just a selector for the real open */
 };
 
-static const struct {
-        unsigned int            minor;
-        char                    *name;
-        umode_t                 mode;
-        const struct file_operations    *fops;
-} devlist[] = { /* list of minor devices */
-        {1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
-#ifdef CONFIG_DEVKMEM
-        {2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
-#endif
-        {3, "null",    S_IRUGO | S_IWUGO,           &null_fops},
-#ifdef CONFIG_DEVPORT
-        {4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},
-#endif
-        {5, "zero",    S_IRUGO | S_IWUGO,           &zero_fops},
-        {7, "full",    S_IRUGO | S_IWUGO,           &full_fops},
-        {8, "random",  S_IRUGO | S_IWUSR,           &random_fops},
-        {9, "urandom", S_IRUGO | S_IWUSR,           &urandom_fops},
-        {11,"kmsg",    S_IRUGO | S_IWUSR,           &kmsg_fops},
-#ifdef CONFIG_CRASH_DUMP
-        {12,"oldmem",    S_IRUSR | S_IWUSR | S_IRGRP, &oldmem_fops},
-#endif
-};
-
 static struct class *mem_class;
 
 static int __init chr_dev_init(void)
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index a5e0db9d7662..62c99fa59e2b 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -168,7 +168,6 @@ static const struct file_operations misc_fops = {
         .open           = misc_open,
 };
 
-
 /**
  *      misc_register   -       register a miscellaneous device
  *      @misc: device structure
@@ -217,8 +216,8 @@ int misc_register(struct miscdevice * misc)
                 misc_minors[misc->minor >> 3] |= 1 << (misc->minor & 7);
         dev = MKDEV(MISC_MAJOR, misc->minor);
 
-        misc->this_device = device_create(misc_class, misc->parent, dev, NULL,
-                                          "%s", misc->name);
+        misc->this_device = device_create(misc_class, misc->parent, dev,
+                                          misc, "%s", misc->name);
         if (IS_ERR(misc->this_device)) {
                 err = PTR_ERR(misc->this_device);
                 goto out;
@@ -264,6 +263,15 @@ int misc_deregister(struct miscdevice *misc)
 EXPORT_SYMBOL(misc_register);
 EXPORT_SYMBOL(misc_deregister);
 
+static char *misc_nodename(struct device *dev)
+{
+        struct miscdevice *c = dev_get_drvdata(dev);
+
+        if (c->devnode)
+                return kstrdup(c->devnode, GFP_KERNEL);
+        return NULL;
+}
+
 static int __init misc_init(void)
 {
         int err;
@@ -279,6 +287,7 @@ static int __init misc_init(void)
         err = -EIO;
         if (register_chrdev(MISC_MAJOR,"misc",&misc_fops))
                 goto fail_printk;
+        misc_class->nodename = misc_nodename;
         return 0;
 
 fail_printk:
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 4a4cab73d0be..65b6ff2442c6 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
                 return -ENODEV;
         }
 
+        if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
+                mutex_unlock(&moxa_openlock);
+                return -ENODEV;
+        }
+
         ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
         ch->port.count++;
         tty->driver_data = ch;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 13f8871e5b21..52d953eb30c3 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -547,14 +547,18 @@ static int mxser_carrier_raised(struct tty_port *port)
         return (inb(mp->ioaddr + UART_MSR) & UART_MSR_DCD)?1:0;
 }
 
-static void mxser_raise_dtr_rts(struct tty_port *port)
+static void mxser_dtr_rts(struct tty_port *port, int on)
 {
         struct mxser_port *mp = container_of(port, struct mxser_port, port);
         unsigned long flags;
 
         spin_lock_irqsave(&mp->slock, flags);
-        outb(inb(mp->ioaddr + UART_MCR) |
-                UART_MCR_DTR | UART_MCR_RTS, mp->ioaddr + UART_MCR);
+        if (on)
+                outb(inb(mp->ioaddr + UART_MCR) |
+                        UART_MCR_DTR | UART_MCR_RTS, mp->ioaddr + UART_MCR);
+        else
+                outb(inb(mp->ioaddr + UART_MCR)&~(UART_MCR_DTR | UART_MCR_RTS),
+                        mp->ioaddr + UART_MCR);
         spin_unlock_irqrestore(&mp->slock, flags);
 }
 
@@ -1044,8 +1048,6 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
         if (retval)
                 return retval;
 
-        /* unmark here for very high baud rate (ex. 921600 bps) used */
-        tty->low_latency = 1;
         return 0;
 }
 
@@ -2356,7 +2358,7 @@ static const struct tty_operations mxser_ops = {
 
 struct tty_port_operations mxser_port_ops = {
         .carrier_raised = mxser_carrier_raised,
-        .raise_dtr_rts = mxser_raise_dtr_rts,
+        .dtr_rts = mxser_dtr_rts,
 };
 
 /*
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index bacb3e2872ae..1c43c8cdee25 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -10,7 +10,6 @@
  *      Paul Mackerras <Paul.Mackerras@cs.anu.edu.au>
  *
  * Original release 01/11/99
- * $Id: n_hdlc.c,v 4.8 2003/05/06 21:18:51 paulkf Exp $
  *
  * This code is released under the GNU General Public License (GPL)
  *
@@ -79,7 +78,6 @@
  */
 
 #define HDLC_MAGIC 0x239e
-#define HDLC_VERSION "$Revision: 4.8 $"
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -114,7 +112,7 @@
 #define MAX_HDLC_FRAME_SIZE 65535 
 #define DEFAULT_RX_BUF_COUNT 10
 #define MAX_RX_BUF_COUNT 60
-#define DEFAULT_TX_BUF_COUNT 1
+#define DEFAULT_TX_BUF_COUNT 3
 
 struct n_hdlc_buf {
         struct n_hdlc_buf *link;
@@ -199,6 +197,31 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty);
 #define tty2n_hdlc(tty) ((struct n_hdlc *) ((tty)->disc_data))
 #define n_hdlc2tty(n_hdlc)      ((n_hdlc)->tty)
 
+static void flush_rx_queue(struct tty_struct *tty)
+{
+        struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
+        struct n_hdlc_buf *buf;
+
+        while ((buf = n_hdlc_buf_get(&n_hdlc->rx_buf_list)))
+                n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, buf);
+}
+
+static void flush_tx_queue(struct tty_struct *tty)
+{
+        struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
+        struct n_hdlc_buf *buf;
+        unsigned long flags;
+
+        while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
+                n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
+        spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
+        if (n_hdlc->tbuf) {
+                n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
+                n_hdlc->tbuf = NULL;
+        }
+        spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
+}
+
 static struct tty_ldisc_ops n_hdlc_ldisc = {
         .owner          = THIS_MODULE,
         .magic          = TTY_LDISC_MAGIC,
@@ -211,6 +234,7 @@ static struct tty_ldisc_ops n_hdlc_ldisc = {
         .poll           = n_hdlc_tty_poll,
         .receive_buf    = n_hdlc_tty_receive,
         .write_wakeup   = n_hdlc_tty_wakeup,
+        .flush_buffer   = flush_rx_queue,
 };
 
 /**
@@ -341,10 +365,7 @@ static int n_hdlc_tty_open (struct tty_struct *tty)
         set_bit(TTY_NO_WRITE_SPLIT,&tty->flags);
 #endif
         
-        /* Flush any pending characters in the driver and discipline. */
-        if (tty->ldisc.ops->flush_buffer)
-                tty->ldisc.ops->flush_buffer(tty);
-
+        /* flush receive data from driver */
         tty_driver_flush_buffer(tty);
                 
         if (debuglevel >= DEBUG_LEVEL_INFO)     
@@ -763,6 +784,14 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 error = put_user(count, (int __user *)arg);
                 break;
 
+        case TCFLSH:
+                switch (arg) {
+                case TCIOFLUSH:
+                case TCOFLUSH:
+                        flush_tx_queue(tty);
+                }
+                /* fall through to default */
+
         default:
                 error = n_tty_ioctl_helper(tty, file, cmd, arg);
                 break;
@@ -919,8 +948,7 @@ static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
 }       /* end of n_hdlc_buf_get() */
 
 static char hdlc_banner[] __initdata =
-        KERN_INFO "HDLC line discipline: version " HDLC_VERSION
-        ", maxframe=%u\n";
+        KERN_INFO "HDLC line discipline maxframe=%u\n";
 static char hdlc_register_ok[] __initdata =
         KERN_INFO "N_HDLC line discipline registered.\n";
 static char hdlc_register_fail[] __initdata =
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index d2e93e343226..2e99158ebb8a 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -1062,7 +1062,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
         struct r3964_client_info *pClient;
         struct r3964_message *pMsg;
         struct r3964_client_message theMsg;
-        int count;
+        int ret;
 
         TRACE_L("read()");
 
@@ -1074,8 +1074,8 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                 if (pMsg == NULL) {
                         /* no messages available. */
                         if (file->f_flags & O_NONBLOCK) {
-                                unlock_kernel();
-                                return -EAGAIN;
+                                ret = -EAGAIN;
+                                goto unlock;
                         }
                         /* block until there is a message: */
                         wait_event_interruptible(pInfo->read_wait,
@@ -1085,29 +1085,31 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                 /* If we still haven't got a message, we must have been signalled */
 
                 if (!pMsg) {
-                        unlock_kernel();
-                        return -EINTR;
+                        ret = -EINTR;
+                        goto unlock;
                 }
 
                 /* deliver msg to client process: */
                 theMsg.msg_id = pMsg->msg_id;
                 theMsg.arg = pMsg->arg;
                 theMsg.error_code = pMsg->error_code;
-                count = sizeof(struct r3964_client_message);
+                ret = sizeof(struct r3964_client_message);
 
                 kfree(pMsg);
                 TRACE_M("r3964_read - msg kfree %p", pMsg);
 
-                if (copy_to_user(buf, &theMsg, count)) {
-                        unlock_kernel();
-                        return -EFAULT;
+                if (copy_to_user(buf, &theMsg, ret)) {
+                        ret = -EFAULT;
+                        goto unlock;
                 }
 
-                TRACE_PS("read - return %d", count);
-                return count;
+                TRACE_PS("read - return %d", ret);
+                goto unlock;
         }
+        ret = -EPERM;
+unlock:
         unlock_kernel();
-        return -EPERM;
+        return ret;
 }
 
 static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index f6f0e4ec2b51..94a5d5020abc 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -73,24 +73,6 @@
 #define ECHO_OP_SET_CANON_COL 0x81
 #define ECHO_OP_ERASE_TAB 0x82
 
-static inline unsigned char *alloc_buf(void)
-{
-        gfp_t prio = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
-
-        if (PAGE_SIZE != N_TTY_BUF_SIZE)
-                return kmalloc(N_TTY_BUF_SIZE, prio);
-        else
-                return (unsigned char *)__get_free_page(prio);
-}
-
-static inline void free_buf(unsigned char *buf)
-{
-        if (PAGE_SIZE != N_TTY_BUF_SIZE)
-                kfree(buf);
-        else
-                free_page((unsigned long) buf);
-}
-
 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
                                unsigned char __user *ptr)
 {
@@ -1558,11 +1540,11 @@ static void n_tty_close(struct tty_struct *tty)
 {
         n_tty_flush_buffer(tty);
         if (tty->read_buf) {
-                free_buf(tty->read_buf);
+                kfree(tty->read_buf);
                 tty->read_buf = NULL;
         }
         if (tty->echo_buf) {
-                free_buf(tty->echo_buf);
+                kfree(tty->echo_buf);
                 tty->echo_buf = NULL;
         }
 }
@@ -1584,17 +1566,16 @@ static int n_tty_open(struct tty_struct *tty)
 
         /* These are ugly. Currently a malloc failure here can panic */
         if (!tty->read_buf) {
-                tty->read_buf = alloc_buf();
+                tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
                 if (!tty->read_buf)
                         return -ENOMEM;
         }
         if (!tty->echo_buf) {
-                tty->echo_buf = alloc_buf();
+                tty->echo_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
+
                 if (!tty->echo_buf)
                         return -ENOMEM;
         }
-        memset(tty->read_buf, 0, N_TTY_BUF_SIZE);
-        memset(tty->echo_buf, 0, N_TTY_BUF_SIZE);
         reset_buffer_flags(tty);
         tty->column = 0;
         n_tty_set_termios(tty, NULL);
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index d6102b644b55..574f1c79b6e6 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -1591,8 +1591,6 @@ static int ntty_open(struct tty_struct *tty, struct file *file)
 
         /* Enable interrupt downlink for channel */
         if (port->port.count == 1) {
-                /* FIXME: is this needed now ? */
-                tty->low_latency = 1;
                 tty->driver_data = port;
                 tty_port_tty_set(&port->port, tty);
                 DBG1("open: %d", port->token_dl);
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index dbb912574569..881934c068c8 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1575,7 +1575,8 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 clear_bit(LOCK_IO, &dev->flags);
                 wake_up_interruptible(&dev->ioq);
 
-                return 0;
+                rc = 0;
+                break;
         case CM_IOCSPTS:
                 {
                         struct ptsreq krnptsreq;
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 19d79fc54461..77b364889224 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -383,7 +383,7 @@ static void async_mode(MGSLPC_INFO *info);
 static void tx_timeout(unsigned long context);
 
 static int carrier_raised(struct tty_port *port);
-static void raise_dtr_rts(struct tty_port *port);
+static void dtr_rts(struct tty_port *port, int onoff);
 
 #if SYNCLINK_GENERIC_HDLC
 #define dev_to_port(D) (dev_to_hdlc(D)->priv)
@@ -513,7 +513,7 @@ static void ldisc_receive_buf(struct tty_struct *tty,
 
 static const struct tty_port_operations mgslpc_port_ops = {
         .carrier_raised = carrier_raised,
-        .raise_dtr_rts = raise_dtr_rts
+        .dtr_rts = dtr_rts
 };
 
 static int mgslpc_probe(struct pcmcia_device *link)
@@ -2528,13 +2528,16 @@ static int carrier_raised(struct tty_port *port)
         return 0;
 }
 
-static void raise_dtr_rts(struct tty_port *port)
+static void dtr_rts(struct tty_port *port, int onoff)
 {
         MGSLPC_INFO *info = container_of(port, MGSLPC_INFO, port);
         unsigned long flags;
 
         spin_lock_irqsave(&info->lock,flags);
-        info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        if (onoff)
+                info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        else
+                info->serial_signals &= ~SerialSignal_RTS + SerialSignal_DTR;
         set_signals(info);
         spin_unlock_irqrestore(&info->lock,flags);
 }
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index c84c34fb1231..432655bcb04c 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -114,8 +114,7 @@ static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
 
         if (!(pp->flags & PP_CLAIMED)) {
                 /* Don't have the port claimed */
-                printk (KERN_DEBUG CHRDEV "%x: claim the port first\n",
-                        minor);
+                pr_debug(CHRDEV "%x: claim the port first\n", minor);
                 return -EINVAL;
         }
 
@@ -198,8 +197,7 @@ static ssize_t pp_write (struct file * file, const char __user * buf,
 
         if (!(pp->flags & PP_CLAIMED)) {
                 /* Don't have the port claimed */
-                printk (KERN_DEBUG CHRDEV "%x: claim the port first\n",
-                        minor);
+                pr_debug(CHRDEV "%x: claim the port first\n", minor);
                 return -EINVAL;
         }
 
@@ -313,7 +311,7 @@ static int register_device (int minor, struct pp_struct *pp)
         }
 
         pp->pdev = pdev;
-        printk (KERN_DEBUG "%s: registered pardevice\n", name);
+        pr_debug("%s: registered pardevice\n", name);
         return 0;
 }
 
@@ -343,8 +341,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 int ret;
 
                 if (pp->flags & PP_CLAIMED) {
-                        printk (KERN_DEBUG CHRDEV
-                                "%x: you've already got it!\n", minor);
+                        pr_debug(CHRDEV "%x: you've already got it!\n", minor);
                         return -EINVAL;
                 }
 
@@ -379,7 +376,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
             }
         case PPEXCL:
                 if (pp->pdev) {
-                        printk (KERN_DEBUG CHRDEV "%x: too late for PPEXCL; "
+                        pr_debug(CHRDEV "%x: too late for PPEXCL; "
                                 "already registered\n", minor);
                         if (pp->flags & PP_EXCL)
                                 /* But it's not really an error. */
@@ -491,8 +488,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         /* Everything else requires the port to be claimed, so check
          * that now. */
         if ((pp->flags & PP_CLAIMED) == 0) {
-                printk (KERN_DEBUG CHRDEV "%x: claim the port first\n",
-                        minor);
+                pr_debug(CHRDEV "%x: claim the port first\n", minor);
                 return -EINVAL;
         }
 
@@ -624,8 +620,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return 0;
 
         default:
-                printk (KERN_DEBUG CHRDEV "%x: What? (cmd=0x%x)\n", minor,
-                        cmd);
+                pr_debug(CHRDEV "%x: What? (cmd=0x%x)\n", minor, cmd);
                 return -EINVAL;
         }
 
@@ -698,9 +693,8 @@ static int pp_release (struct inode * inode, struct file * file)
         }
         if (compat_negot) {
                 parport_negotiate (pp->pdev->port, IEEE1284_MODE_COMPAT);
-                printk (KERN_DEBUG CHRDEV
-                        "%x: negotiated back to compatibility mode because "
-                        "user-space forgot\n", minor);
+                pr_debug(CHRDEV "%x: negotiated back to compatibility "
+                        "mode because user-space forgot\n", minor);
         }
 
         if (pp->flags & PP_CLAIMED) {
@@ -713,7 +707,7 @@ static int pp_release (struct inode * inode, struct file * file)
                 info->phase = pp->saved_state.phase;
                 parport_release (pp->pdev);
                 if (compat_negot != 1) {
-                        printk (KERN_DEBUG CHRDEV "%x: released pardevice "
+                        pr_debug(CHRDEV "%x: released pardevice "
                                 "because user-space forgot\n", minor);
                 }
         }
@@ -723,8 +717,7 @@ static int pp_release (struct inode * inode, struct file * file)
                 parport_unregister_device (pp->pdev);
                 kfree (name);
                 pp->pdev = NULL;
-                printk (KERN_DEBUG CHRDEV "%x: unregistered pardevice\n",
-                        minor);
+                pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
 
         kfree (pp);
diff --git a/drivers/char/ps3flash.c b/drivers/char/ps3flash.c
index afbe45676d71..f424d394a286 100644
--- a/drivers/char/ps3flash.c
+++ b/drivers/char/ps3flash.c
@@ -33,48 +33,64 @@
 
 struct ps3flash_private {
         struct mutex mutex;     /* Bounce buffer mutex */
+        u64 chunk_sectors;
+        int tag;                /* Start sector of buffer, -1 if invalid */
+        bool dirty;
 };
 
 static struct ps3_storage_device *ps3flash_dev;
 
-static ssize_t ps3flash_read_write_sectors(struct ps3_storage_device *dev,
-                                           u64 lpar, u64 start_sector,
-                                           u64 sectors, int write)
+static int ps3flash_read_write_sectors(struct ps3_storage_device *dev,
+                                       u64 start_sector, int write)
 {
-        u64 res = ps3stor_read_write_sectors(dev, lpar, start_sector, sectors,
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 res = ps3stor_read_write_sectors(dev, dev->bounce_lpar,
+                                             start_sector, priv->chunk_sectors,
                                              write);
         if (res) {
                 dev_err(&dev->sbd.core, "%s:%u: %s failed 0x%llx\n", __func__,
                         __LINE__, write ? "write" : "read", res);
                 return -EIO;
         }
-        return sectors;
+        return 0;
 }
 
-static ssize_t ps3flash_read_sectors(struct ps3_storage_device *dev,
-                                     u64 start_sector, u64 sectors,
-                                     unsigned int sector_offset)
+static int ps3flash_writeback(struct ps3_storage_device *dev)
 {
-        u64 max_sectors, lpar;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        int res;
 
-        max_sectors = dev->bounce_size / dev->blk_size;
-        if (sectors > max_sectors) {
-                dev_dbg(&dev->sbd.core, "%s:%u Limiting sectors to %llu\n",
-                        __func__, __LINE__, max_sectors);
-                sectors = max_sectors;
-        }
+        if (!priv->dirty || priv->tag < 0)
+                return 0;
 
-        lpar = dev->bounce_lpar + sector_offset * dev->blk_size;
-        return ps3flash_read_write_sectors(dev, lpar, start_sector, sectors,
-                                           0);
+        res = ps3flash_read_write_sectors(dev, priv->tag, 1);
+        if (res)
+                return res;
+
+        priv->dirty = false;
+        return 0;
 }
 
-static ssize_t ps3flash_write_chunk(struct ps3_storage_device *dev,
-                                    u64 start_sector)
+static int ps3flash_fetch(struct ps3_storage_device *dev, u64 start_sector)
 {
-       u64 sectors = dev->bounce_size / dev->blk_size;
-       return ps3flash_read_write_sectors(dev, dev->bounce_lpar, start_sector,
-                                          sectors, 1);
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        int res;
+
+        if (start_sector == priv->tag)
+                return 0;
+
+        res = ps3flash_writeback(dev);
+        if (res)
+                return res;
+
+        priv->tag = -1;
+
+        res = ps3flash_read_write_sectors(dev, start_sector, 0);
+        if (res)
+                return res;
+
+        priv->tag = start_sector;
+        return 0;
 }
 
 static loff_t ps3flash_llseek(struct file *file, loff_t offset, int origin)
@@ -104,18 +120,19 @@ out:
         return res;
 }
 
-static ssize_t ps3flash_read(struct file *file, char __user *buf, size_t count,
-                             loff_t *pos)
+static ssize_t ps3flash_read(char __user *userbuf, void *kernelbuf,
+                             size_t count, loff_t *pos)
 {
         struct ps3_storage_device *dev = ps3flash_dev;
-        struct ps3flash_private *priv = dev->sbd.core.driver_data;
-        u64 size, start_sector, end_sector, offset;
-        ssize_t sectors_read;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 size, sector, offset;
+        int res;
         size_t remaining, n;
+        const void *src;
 
         dev_dbg(&dev->sbd.core,
-                "%s:%u: Reading %zu bytes at position %lld to user 0x%p\n",
-                __func__, __LINE__, count, *pos, buf);
+                "%s:%u: Reading %zu bytes at position %lld to U0x%p/K0x%p\n",
+                __func__, __LINE__, count, *pos, userbuf, kernelbuf);
 
         size = dev->regions[dev->region_idx].size*dev->blk_size;
         if (*pos >= size || !count)
@@ -128,61 +145,63 @@ static ssize_t ps3flash_read(struct file *file, char __user *buf, size_t count,
                 count = size - *pos;
         }
 
-        start_sector = *pos / dev->blk_size;
-        offset = *pos % dev->blk_size;
-        end_sector = DIV_ROUND_UP(*pos + count, dev->blk_size);
+        sector = *pos / dev->bounce_size * priv->chunk_sectors;
+        offset = *pos % dev->bounce_size;
 
         remaining = count;
         do {
+                n = min_t(u64, remaining, dev->bounce_size - offset);
+                src = dev->bounce_buf + offset;
+
                 mutex_lock(&priv->mutex);
 
-                sectors_read = ps3flash_read_sectors(dev, start_sector,
-                                                     end_sector-start_sector,
-                                                     0);
-                if (sectors_read < 0) {
-                        mutex_unlock(&priv->mutex);
+                res = ps3flash_fetch(dev, sector);
+                if (res)
                         goto fail;
-                }
 
-                n = min_t(u64, remaining, sectors_read*dev->blk_size-offset);
                 dev_dbg(&dev->sbd.core,
-                        "%s:%u: copy %lu bytes from 0x%p to user 0x%p\n",
-                        __func__, __LINE__, n, dev->bounce_buf+offset, buf);
-                if (copy_to_user(buf, dev->bounce_buf+offset, n)) {
-                        mutex_unlock(&priv->mutex);
-                        sectors_read = -EFAULT;
-                        goto fail;
+                        "%s:%u: copy %lu bytes from 0x%p to U0x%p/K0x%p\n",
+                        __func__, __LINE__, n, src, userbuf, kernelbuf);
+                if (userbuf) {
+                        if (copy_to_user(userbuf, src, n)) {
+                                res = -EFAULT;
+                                goto fail;
+                        }
+                        userbuf += n;
+                }
+                if (kernelbuf) {
+                        memcpy(kernelbuf, src, n);
+                        kernelbuf += n;
                 }
 
                 mutex_unlock(&priv->mutex);
 
                 *pos += n;
-                buf += n;
                 remaining -= n;
-                start_sector += sectors_read;
+                sector += priv->chunk_sectors;
                 offset = 0;
         } while (remaining > 0);
 
         return count;
 
 fail:
-        return sectors_read;
+        mutex_unlock(&priv->mutex);
+        return res;
 }
 
-static ssize_t ps3flash_write(struct file *file, const char __user *buf,
-                              size_t count, loff_t *pos)
+static ssize_t ps3flash_write(const char __user *userbuf,
+                              const void *kernelbuf, size_t count, loff_t *pos)
 {
         struct ps3_storage_device *dev = ps3flash_dev;
-        struct ps3flash_private *priv = dev->sbd.core.driver_data;
-        u64 size, chunk_sectors, start_write_sector, end_write_sector,
-            end_read_sector, start_read_sector, head, tail, offset;
-        ssize_t res;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 size, sector, offset;
+        int res = 0;
         size_t remaining, n;
-        unsigned int sec_off;
+        void *dst;
 
         dev_dbg(&dev->sbd.core,
-                "%s:%u: Writing %zu bytes at position %lld from user 0x%p\n",
-                __func__, __LINE__, count, *pos, buf);
+                "%s:%u: Writing %zu bytes at position %lld from U0x%p/K0x%p\n",
+                __func__, __LINE__, count, *pos, userbuf, kernelbuf);
 
         size = dev->regions[dev->region_idx].size*dev->blk_size;
         if (*pos >= size || !count)
@@ -195,89 +214,46 @@ static ssize_t ps3flash_write(struct file *file, const char __user *buf,
                 count = size - *pos;
         }
 
-        chunk_sectors = dev->bounce_size / dev->blk_size;
-
-        start_write_sector = *pos / dev->bounce_size * chunk_sectors;
+        sector = *pos / dev->bounce_size * priv->chunk_sectors;
         offset = *pos % dev->bounce_size;
-        end_write_sector = DIV_ROUND_UP(*pos + count, dev->bounce_size) *
-                           chunk_sectors;
-
-        end_read_sector = DIV_ROUND_UP(*pos, dev->blk_size);
-        start_read_sector = (*pos + count) / dev->blk_size;
-
-        /*
-         * As we have to write in 256 KiB chunks, while we can read in blk_size
-         * (usually 512 bytes) chunks, we perform the following steps:
-         *   1. Read from start_write_sector to end_read_sector ("head")
-         *   2. Read from start_read_sector to end_write_sector ("tail")
-         *   3. Copy data to buffer
-         *   4. Write from start_write_sector to end_write_sector
-         * All of this is complicated by using only one 256 KiB bounce buffer.
-         */
-
-        head = end_read_sector - start_write_sector;
-        tail = end_write_sector - start_read_sector;
 
         remaining = count;
         do {
+                n = min_t(u64, remaining, dev->bounce_size - offset);
+                dst = dev->bounce_buf + offset;
+
                 mutex_lock(&priv->mutex);
 
-                if (end_read_sector >= start_read_sector) {
-                        /* Merge head and tail */
-                        dev_dbg(&dev->sbd.core,
-                                "Merged head and tail: %llu sectors at %llu\n",
-                                chunk_sectors, start_write_sector);
-                        res = ps3flash_read_sectors(dev, start_write_sector,
-                                                    chunk_sectors, 0);
-                        if (res < 0)
+                if (n != dev->bounce_size)
+                        res = ps3flash_fetch(dev, sector);
+                else if (sector != priv->tag)
+                        res = ps3flash_writeback(dev);
+                if (res)
+                        goto fail;
+
+                dev_dbg(&dev->sbd.core,
+                        "%s:%u: copy %lu bytes from U0x%p/K0x%p to 0x%p\n",
+                        __func__, __LINE__, n, userbuf, kernelbuf, dst);
+                if (userbuf) {
+                        if (copy_from_user(dst, userbuf, n)) {
+                                res = -EFAULT;
                                 goto fail;
-                } else {
-                        if (head) {
-                                /* Read head */
-                                dev_dbg(&dev->sbd.core,
-                                        "head: %llu sectors at %llu\n", head,
-                                        start_write_sector);
-                                res = ps3flash_read_sectors(dev,
-                                                            start_write_sector,
-                                                            head, 0);
-                                if (res < 0)
-                                        goto fail;
-                        }
-                        if (start_read_sector <
-                            start_write_sector+chunk_sectors) {
-                                /* Read tail */
-                                dev_dbg(&dev->sbd.core,
-                                        "tail: %llu sectors at %llu\n", tail,
-                                        start_read_sector);
-                                sec_off = start_read_sector-start_write_sector;
-                                res = ps3flash_read_sectors(dev,
-                                                            start_read_sector,
-                                                            tail, sec_off);
-                                if (res < 0)
-                                        goto fail;
                         }
+                        userbuf += n;
                 }
-
-                n = min_t(u64, remaining, dev->bounce_size-offset);
-                dev_dbg(&dev->sbd.core,
-                        "%s:%u: copy %lu bytes from user 0x%p to 0x%p\n",
-                        __func__, __LINE__, n, buf, dev->bounce_buf+offset);
-                if (copy_from_user(dev->bounce_buf+offset, buf, n)) {
-                        res = -EFAULT;
-                        goto fail;
+                if (kernelbuf) {
+                        memcpy(dst, kernelbuf, n);
+                        kernelbuf += n;
                 }
 
-                res = ps3flash_write_chunk(dev, start_write_sector);
-                if (res < 0)
-                        goto fail;
+                priv->tag = sector;
+                priv->dirty = true;
 
                 mutex_unlock(&priv->mutex);
 
                 *pos += n;
-                buf += n;
                 remaining -= n;
-                start_write_sector += chunk_sectors;
-                head = 0;
+                sector += priv->chunk_sectors;
                 offset = 0;
         } while (remaining > 0);
 
@@ -288,6 +264,51 @@ fail:
         return res;
 }
 
+static ssize_t ps3flash_user_read(struct file *file, char __user *buf,
+                                  size_t count, loff_t *pos)
+{
+        return ps3flash_read(buf, NULL, count, pos);
+}
+
+static ssize_t ps3flash_user_write(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *pos)
+{
+        return ps3flash_write(buf, NULL, count, pos);
+}
+
+static ssize_t ps3flash_kernel_read(void *buf, size_t count, loff_t pos)
+{
+        return ps3flash_read(NULL, buf, count, &pos);
+}
+
+static ssize_t ps3flash_kernel_write(const void *buf, size_t count,
+                                     loff_t pos)
+{
+        ssize_t res;
+        int wb;
+
+        res = ps3flash_write(NULL, buf, count, &pos);
+        if (res < 0)
+                return res;
+
+        /* Make kernel writes synchronous */
+        wb = ps3flash_writeback(ps3flash_dev);
+        if (wb)
+                return wb;
+
+        return res;
+}
+
+static int ps3flash_flush(struct file *file, fl_owner_t id)
+{
+        return ps3flash_writeback(ps3flash_dev);
+}
+
+static int ps3flash_fsync(struct file *file, struct dentry *dentry,
+                          int datasync)
+{
+        return ps3flash_writeback(ps3flash_dev);
+}
 
 static irqreturn_t ps3flash_interrupt(int irq, void *data)
 {
@@ -312,12 +333,18 @@ static irqreturn_t ps3flash_interrupt(int irq, void *data)
         return IRQ_HANDLED;
 }
 
-
 static const struct file_operations ps3flash_fops = {
         .owner  = THIS_MODULE,
         .llseek = ps3flash_llseek,
-        .read   = ps3flash_read,
-        .write  = ps3flash_write,
+        .read   = ps3flash_user_read,
+        .write  = ps3flash_user_write,
+        .flush  = ps3flash_flush,
+        .fsync  = ps3flash_fsync,
+};
+
+static const struct ps3_os_area_flash_ops ps3flash_kernel_ops = {
+        .read   = ps3flash_kernel_read,
+        .write  = ps3flash_kernel_write,
 };
 
 static struct miscdevice ps3flash_misc = {
@@ -366,11 +393,13 @@ static int __devinit ps3flash_probe(struct ps3_system_bus_device *_dev)
                 goto fail;
         }
 
-        dev->sbd.core.driver_data = priv;
+        ps3_system_bus_set_drvdata(&dev->sbd, priv);
         mutex_init(&priv->mutex);
+        priv->tag = -1;
 
         dev->bounce_size = ps3flash_bounce_buffer.size;
         dev->bounce_buf = ps3flash_bounce_buffer.address;
+        priv->chunk_sectors = dev->bounce_size / dev->blk_size;
 
         error = ps3stor_setup(dev, ps3flash_interrupt);
         if (error)
@@ -386,13 +415,15 @@ static int __devinit ps3flash_probe(struct ps3_system_bus_device *_dev)
 
         dev_info(&dev->sbd.core, "%s:%u: registered misc device %d\n",
                  __func__, __LINE__, ps3flash_misc.minor);
+
+        ps3_os_area_flash_register(&ps3flash_kernel_ops);
         return 0;
 
 fail_teardown:
         ps3stor_teardown(dev);
 fail_free_priv:
         kfree(priv);
-        dev->sbd.core.driver_data = NULL;
+        ps3_system_bus_set_drvdata(&dev->sbd, NULL);
 fail:
         ps3flash_dev = NULL;
         return error;
@@ -402,10 +433,11 @@ static int ps3flash_remove(struct ps3_system_bus_device *_dev)
 {
         struct ps3_storage_device *dev = to_ps3_storage_device(&_dev->core);
 
+        ps3_os_area_flash_register(NULL);
         misc_deregister(&ps3flash_misc);
         ps3stor_teardown(dev);
-        kfree(dev->sbd.core.driver_data);
-        dev->sbd.core.driver_data = NULL;
+        kfree(ps3_system_bus_get_drvdata(&dev->sbd));
+        ps3_system_bus_set_drvdata(&dev->sbd, NULL);
         ps3flash_dev = NULL;
         return 0;
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 31038a0052a2..daebe1ba43d4 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -30,7 +30,6 @@
 
 #include <asm/system.h>
 
-/* These are global because they are accessed in tty_io.c */
 #ifdef CONFIG_UNIX98_PTYS
 static struct tty_driver *ptm_driver;
 static struct tty_driver *pts_driver;
@@ -96,23 +95,34 @@ static void pty_unthrottle(struct tty_struct *tty)
  * a count.
  *
  * FIXME: Our pty_write method is called with our ldisc lock held but
- * not our partners. We can't just take the other one blindly without
- * risking deadlocks.
+ * not our partners. We can't just wait on the other one blindly without
+ * risking deadlocks. At some point when everything has settled down we need
+ * to look into making pty_write at least able to sleep over an ldisc change.
+ *
+ * The return on no ldisc is a bit counter intuitive but the logic works
+ * like this. During an ldisc change the other end will flush its buffers. We
+ * thus return the full length which is identical to the case where we had
+ * proper locking and happened to queue the bytes just before the flush during
+ * the ldisc change.
  */
 static int pty_write(struct tty_struct *tty, const unsigned char *buf,
                                                                 int count)
 {
         struct tty_struct *to = tty->link;
-        int     c;
+        struct tty_ldisc *ld;
+        int c = count;
 
         if (!to || tty->stopped)
                 return 0;
-
-        c = to->receive_room;
-        if (c > count)
-                c = count;
-        to->ldisc.ops->receive_buf(to, buf, NULL, c);
-
+        ld = tty_ldisc_ref(to);
+
+        if (ld) {
+                c = to->receive_room;
+                if (c > count)
+                        c = count;
+                ld->ops->receive_buf(to, buf, NULL, c);
+                tty_ldisc_deref(ld);
+        }
         return c;
 }
 
@@ -146,14 +156,23 @@ static int pty_write_room(struct tty_struct *tty)
 static int pty_chars_in_buffer(struct tty_struct *tty)
 {
         struct tty_struct *to = tty->link;
-        int count;
+        struct tty_ldisc *ld;
+        int count = 0;
 
         /* We should get the line discipline lock for "tty->link" */
-        if (!to || !to->ldisc.ops->chars_in_buffer)
+        if (!to)
+                return 0;
+        /* We cannot take a sleeping reference here without deadlocking with
+           an ldisc change - but it doesn't really matter */
+        ld = tty_ldisc_ref(to);
+        if (ld == NULL)
                 return 0;
 
         /* The ldisc must report 0 if no characters available to be read */
-        count = to->ldisc.ops->chars_in_buffer(to);
+        if (ld->ops->chars_in_buffer)
+                count = ld->ops->chars_in_buffer(to);
+
+        tty_ldisc_deref(ld);
 
         if (tty->driver->subtype == PTY_TYPE_SLAVE)
                 return count;
@@ -183,12 +202,19 @@ static void pty_flush_buffer(struct tty_struct *tty)
 {
         struct tty_struct *to = tty->link;
         unsigned long flags;
+        struct tty_ldisc *ld;
 
         if (!to)
                 return;
+        ld = tty_ldisc_ref(to);
+
+        /* The other end is changing discipline */
+        if (!ld)
+                return;
 
-        if (to->ldisc.ops->flush_buffer)
-                to->ldisc.ops->flush_buffer(to);
+        if (ld->ops->flush_buffer)
+                to->ldisc->ops->flush_buffer(to);
+        tty_ldisc_deref(ld);
 
         if (to->packet) {
                 spin_lock_irqsave(&tty->ctrl_lock, flags);
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 20d90e6a6e50..05f9d18b9361 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -71,7 +71,7 @@ static int raw_open(struct inode *inode, struct file *filp)
         err = bd_claim(bdev, raw_open);
         if (err)
                 goto out1;
-        err = set_blocksize(bdev, bdev_hardsect_size(bdev));
+        err = set_blocksize(bdev, bdev_logical_block_size(bdev));
         if (err)
                 goto out2;
         filp->f_flags |= O_DIRECT;
@@ -261,6 +261,11 @@ static const struct file_operations raw_ctl_fops = {
 
 static struct cdev raw_cdev;
 
+static char *raw_nodename(struct device *dev)
+{
+        return kasprintf(GFP_KERNEL, "raw/%s", dev_name(dev));
+}
+
 static int __init raw_init(void)
 {
         dev_t dev = MKDEV(RAW_MAJOR, 0);
@@ -284,6 +289,7 @@ static int __init raw_init(void)
                 ret = PTR_ERR(raw_class);
                 goto error_region;
         }
+        raw_class->nodename = raw_nodename;
         device_create(raw_class, NULL, MKDEV(RAW_MAJOR, 0), NULL, "rawctl");
 
         return 0;
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index f59fc5cea067..63d5b628477a 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -872,11 +872,16 @@ static int carrier_raised(struct tty_port *port)
         return (sGetChanStatusLo(&info->channel) & CD_ACT) ? 1 : 0;
 }
 
-static void raise_dtr_rts(struct tty_port *port)
+static void dtr_rts(struct tty_port *port, int on)
 {
         struct r_port *info = container_of(port, struct r_port, port);
-        sSetDTR(&info->channel);
-        sSetRTS(&info->channel);
+        if (on) {
+                sSetDTR(&info->channel);
+                sSetRTS(&info->channel);
+        } else {
+                sClrDTR(&info->channel);
+                sClrRTS(&info->channel);
+        }
 }
 
 /*
@@ -934,7 +939,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
         /*
          * Info->count is now 1; so it's safe to sleep now.
          */
-        if (!test_bit(ASYNC_INITIALIZED, &port->flags)) {
+        if (!test_bit(ASYNCB_INITIALIZED, &port->flags)) {
                 cp = &info->channel;
                 sSetRxTrigger(cp, TRIG_1);
                 if (sGetChanStatus(cp) & CD_ACT)
@@ -958,7 +963,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
                 sEnRxFIFO(cp);
                 sEnTransmit(cp);
 
-                set_bit(ASYNC_INITIALIZED, &info->port.flags);
+                set_bit(ASYNCB_INITIALIZED, &info->port.flags);
 
                 /*
                  * Set up the tty->alt_speed kludge
@@ -1641,7 +1646,7 @@ static int rp_write(struct tty_struct *tty,
         /*  Write remaining data into the port's xmit_buf */
         while (1) {
                 /* Hung up ? */
-                if (!test_bit(ASYNC_NORMAL_ACTIVE, &info->port.flags))
+                if (!test_bit(ASYNCB_NORMAL_ACTIVE, &info->port.flags))
                         goto end;
                 c = min(count, XMIT_BUF_SIZE - info->xmit_cnt - 1);
                 c = min(c, XMIT_BUF_SIZE - info->xmit_head);
@@ -2250,7 +2255,7 @@ static const struct tty_operations rocket_ops = {
 
 static const struct tty_port_operations rocket_port_ops = {
         .carrier_raised = carrier_raised,
-        .raise_dtr_rts = raise_dtr_rts,
+        .dtr_rts = dtr_rts,
 };
 
 /*
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index cb8ca5698963..f97b9e848064 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -327,7 +327,7 @@ int paste_selection(struct tty_struct *tty)
                 }
                 count = sel_buffer_lth - pasted;
                 count = min(count, tty->receive_room);
-                tty->ldisc.ops->receive_buf(tty, sel_buffer + pasted,
+                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
                                                                 NULL, count);
                 pasted += count;
         }
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 2ad813a801dc..53e504f41b20 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -772,11 +772,11 @@ static int stl_carrier_raised(struct tty_port *port)
         return (portp->sigs & TIOCM_CD) ? 1 : 0;
 }
 
-static void stl_raise_dtr_rts(struct tty_port *port)
+static void stl_dtr_rts(struct tty_port *port, int on)
 {
         struct stlport *portp = container_of(port, struct stlport, port);
         /* Takes brd_lock internally */
-        stl_setsignals(portp, 1, 1);
+        stl_setsignals(portp, on, on);
 }
 
 /*****************************************************************************/
@@ -2547,7 +2547,7 @@ static const struct tty_operations stl_ops = {
 
 static const struct tty_port_operations stl_port_ops = {
         .carrier_raised = stl_carrier_raised,
-        .raise_dtr_rts = stl_raise_dtr_rts,
+        .dtr_rts = stl_dtr_rts,
 };
 
 /*****************************************************************************/
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index afd0b26ca056..afded3a2379c 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -3247,13 +3247,16 @@ static int carrier_raised(struct tty_port *port)
         return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
 }
 
-static void raise_dtr_rts(struct tty_port *port)
+static void dtr_rts(struct tty_port *port, int on)
 {
         struct mgsl_struct *info = container_of(port, struct mgsl_struct, port);
         unsigned long flags;
 
         spin_lock_irqsave(&info->irq_spinlock,flags);
-        info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        if (on)
+                info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        else
+                info->serial_signals &= ~(SerialSignal_RTS + SerialSignal_DTR);
         usc_set_serial_signals(info);
         spin_unlock_irqrestore(&info->irq_spinlock,flags);
 }
@@ -4258,7 +4261,7 @@ static void mgsl_add_device( struct mgsl_struct *info )
 
 static const struct tty_port_operations mgsl_port_ops = {
         .carrier_raised = carrier_raised,
-        .raise_dtr_rts = raise_dtr_rts,
+        .dtr_rts = dtr_rts,
 };
 
 
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 5e256494686a..a2e67e6df3a1 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -214,6 +214,7 @@ struct slgt_desc
 #define set_desc_next(a,b) (a).next   = cpu_to_le32((unsigned int)(b))
 #define set_desc_count(a,b)(a).count  = cpu_to_le16((unsigned short)(b))
 #define set_desc_eof(a,b)  (a).status = cpu_to_le16((b) ? (le16_to_cpu((a).status) | BIT0) : (le16_to_cpu((a).status) & ~BIT0))
+#define set_desc_status(a, b) (a).status = cpu_to_le16((unsigned short)(b))
 #define desc_count(a)      (le16_to_cpu((a).count))
 #define desc_status(a)     (le16_to_cpu((a).status))
 #define desc_complete(a)   (le16_to_cpu((a).status) & BIT15)
@@ -297,6 +298,7 @@ struct slgt_info {
         u32 max_frame_size;       /* as set by device config */
 
         unsigned int rbuf_fill_level;
+        unsigned int rx_pio;
         unsigned int if_mode;
         unsigned int base_clock;
 
@@ -331,6 +333,8 @@ struct slgt_info {
         struct slgt_desc *rbufs;
         unsigned int rbuf_current;
         unsigned int rbuf_index;
+        unsigned int rbuf_fill_index;
+        unsigned short rbuf_fill_count;
 
         unsigned int tbuf_count;
         struct slgt_desc *tbufs;
@@ -463,7 +467,6 @@ static unsigned int free_tbuf_count(struct slgt_info *info);
 static unsigned int tbuf_bytes(struct slgt_info *info);
 static void reset_tbufs(struct slgt_info *info);
 static void tdma_reset(struct slgt_info *info);
-static void tdma_start(struct slgt_info *info);
 static void tx_load(struct slgt_info *info, const char *buf, unsigned int count);
 
 static void get_signals(struct slgt_info *info);
@@ -791,6 +794,18 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
         }
 }
 
+static void update_tx_timer(struct slgt_info *info)
+{
+        /*
+         * use worst case speed of 1200bps to calculate transmit timeout
+         * based on data in buffers (tbuf_bytes) and FIFO (128 bytes)
+         */
+        if (info->params.mode == MGSL_MODE_HDLC) {
+                int timeout  = (tbuf_bytes(info) * 7) + 1000;
+                mod_timer(&info->tx_timer, jiffies + msecs_to_jiffies(timeout));
+        }
+}
+
 static int write(struct tty_struct *tty,
                  const unsigned char *buf, int count)
 {
@@ -834,8 +849,18 @@ start:
                 spin_lock_irqsave(&info->lock,flags);
                 if (!info->tx_active)
                         tx_start(info);
-                else
-                        tdma_start(info);
+                else if (!(rd_reg32(info, TDCSR) & BIT0)) {
+                        /* transmit still active but transmit DMA stopped */
+                        unsigned int i = info->tbuf_current;
+                        if (!i)
+                                i = info->tbuf_count;
+                        i--;
+                        /* if DMA buf unsent must try later after tx idle */
+                        if (desc_count(info->tbufs[i]))
+                                ret = 0;
+                }
+                if (ret > 0)
+                        update_tx_timer(info);
                 spin_unlock_irqrestore(&info->lock,flags);
         }
 
@@ -1498,10 +1523,9 @@ static int hdlcdev_xmit(struct sk_buff *skb, struct net_device *dev)
         /* save start time for transmit timeout detection */
         dev->trans_start = jiffies;
 
-        /* start hardware transmitter if necessary */
         spin_lock_irqsave(&info->lock,flags);
-        if (!info->tx_active)
-                tx_start(info);
+        tx_start(info);
+        update_tx_timer(info);
         spin_unlock_irqrestore(&info->lock,flags);
 
         return 0;
@@ -2110,6 +2134,40 @@ static void ri_change(struct slgt_info *info, unsigned short status)
         info->pending_bh |= BH_STATUS;
 }
 
+static void isr_rxdata(struct slgt_info *info)
+{
+        unsigned int count = info->rbuf_fill_count;
+        unsigned int i = info->rbuf_fill_index;
+        unsigned short reg;
+
+        while (rd_reg16(info, SSR) & IRQ_RXDATA) {
+                reg = rd_reg16(info, RDR);
+                DBGISR(("isr_rxdata %s RDR=%04X\n", info->device_name, reg));
+                if (desc_complete(info->rbufs[i])) {
+                        /* all buffers full */
+                        rx_stop(info);
+                        info->rx_restart = 1;
+                        continue;
+                }
+                info->rbufs[i].buf[count++] = (unsigned char)reg;
+                /* async mode saves status byte to buffer for each data byte */
+                if (info->params.mode == MGSL_MODE_ASYNC)
+                        info->rbufs[i].buf[count++] = (unsigned char)(reg >> 8);
+                if (count == info->rbuf_fill_level || (reg & BIT10)) {
+                        /* buffer full or end of frame */
+                        set_desc_count(info->rbufs[i], count);
+                        set_desc_status(info->rbufs[i], BIT15 | (reg >> 8));
+                        info->rbuf_fill_count = count = 0;
+                        if (++i == info->rbuf_count)
+                                i = 0;
+                        info->pending_bh |= BH_RECEIVE;
+                }
+        }
+
+        info->rbuf_fill_index = i;
+        info->rbuf_fill_count = count;
+}
+
 static void isr_serial(struct slgt_info *info)
 {
         unsigned short status = rd_reg16(info, SSR);
@@ -2125,6 +2183,8 @@ static void isr_serial(struct slgt_info *info)
                         if (info->tx_count)
                                 isr_txeom(info, status);
                 }
+                if (info->rx_pio && (status & IRQ_RXDATA))
+                        isr_rxdata(info);
                 if ((status & IRQ_RXBREAK) && (status & RXBREAK)) {
                         info->icount.brk++;
                         /* process break detection if tty control allows */
@@ -2141,7 +2201,8 @@ static void isr_serial(struct slgt_info *info)
         } else {
                 if (status & (IRQ_TXIDLE + IRQ_TXUNDER))
                         isr_txeom(info, status);
-
+                if (info->rx_pio && (status & IRQ_RXDATA))
+                        isr_rxdata(info);
                 if (status & IRQ_RXIDLE) {
                         if (status & RXIDLE)
                                 info->icount.rxidle++;
@@ -2642,6 +2703,10 @@ static int rx_enable(struct slgt_info *info, int enable)
                         return -EINVAL;
                 }
                 info->rbuf_fill_level = rbuf_fill_level;
+                if (rbuf_fill_level < 128)
+                        info->rx_pio = 1; /* PIO mode */
+                else
+                        info->rx_pio = 0; /* DMA mode */
                 rx_stop(info); /* restart receiver to use new fill level */
         }
 
@@ -3099,13 +3164,16 @@ static int carrier_raised(struct tty_port *port)
         return (info->signals & SerialSignal_DCD) ? 1 : 0;
 }
 
-static void raise_dtr_rts(struct tty_port *port)
+static void dtr_rts(struct tty_port *port, int on)
 {
         unsigned long flags;
         struct slgt_info *info = container_of(port, struct slgt_info, port);
 
         spin_lock_irqsave(&info->lock,flags);
-        info->signals |= SerialSignal_RTS + SerialSignal_DTR;
+        if (on)
+                info->signals |= SerialSignal_RTS + SerialSignal_DTR;
+        else
+                info->signals &= ~(SerialSignal_RTS + SerialSignal_DTR);
         set_signals(info);
         spin_unlock_irqrestore(&info->lock,flags);
 }
@@ -3419,7 +3487,7 @@ static void add_device(struct slgt_info *info)
 
 static const struct tty_port_operations slgt_port_ops = {
         .carrier_raised = carrier_raised,
-        .raise_dtr_rts = raise_dtr_rts,
+        .dtr_rts = dtr_rts,
 };
 
 /*
@@ -3841,15 +3909,27 @@ static void rx_start(struct slgt_info *info)
         rdma_reset(info);
         reset_rbufs(info);
 
-        /* set 1st descriptor address */
-        wr_reg32(info, RDDAR, info->rbufs[0].pdesc);
-
-        if (info->params.mode != MGSL_MODE_ASYNC) {
-                /* enable rx DMA and DMA interrupt */
-                wr_reg32(info, RDCSR, (BIT2 + BIT0));
+        if (info->rx_pio) {
+                /* rx request when rx FIFO not empty */
+                wr_reg16(info, SCR, (unsigned short)(rd_reg16(info, SCR) & ~BIT14));
+                slgt_irq_on(info, IRQ_RXDATA);
+                if (info->params.mode == MGSL_MODE_ASYNC) {
+                        /* enable saving of rx status */
+                        wr_reg32(info, RDCSR, BIT6);
+                }
         } else {
-                /* enable saving of rx status, rx DMA and DMA interrupt */
-                wr_reg32(info, RDCSR, (BIT6 + BIT2 + BIT0));
+                /* rx request when rx FIFO half full */
+                wr_reg16(info, SCR, (unsigned short)(rd_reg16(info, SCR) | BIT14));
+                /* set 1st descriptor address */
+                wr_reg32(info, RDDAR, info->rbufs[0].pdesc);
+
+                if (info->params.mode != MGSL_MODE_ASYNC) {
+                        /* enable rx DMA and DMA interrupt */
+                        wr_reg32(info, RDCSR, (BIT2 + BIT0));
+                } else {
+                        /* enable saving of rx status, rx DMA and DMA interrupt */
+                        wr_reg32(info, RDCSR, (BIT6 + BIT2 + BIT0));
+                }
         }
 
         slgt_irq_on(info, IRQ_RXOVER);
@@ -3886,50 +3966,19 @@ static void tx_start(struct slgt_info *info)
                         slgt_irq_on(info, IRQ_TXUNDER + IRQ_TXIDLE);
                         /* clear tx idle and underrun status bits */
                         wr_reg16(info, SSR, (unsigned short)(IRQ_TXIDLE + IRQ_TXUNDER));
-                        if (info->params.mode == MGSL_MODE_HDLC)
-                                mod_timer(&info->tx_timer, jiffies +
-                                                msecs_to_jiffies(5000));
                 } else {
                         slgt_irq_off(info, IRQ_TXDATA);
                         slgt_irq_on(info, IRQ_TXIDLE);
                         /* clear tx idle status bit */
                         wr_reg16(info, SSR, IRQ_TXIDLE);
                 }
-                tdma_start(info);
+                /* set 1st descriptor address and start DMA */
+                wr_reg32(info, TDDAR, info->tbufs[info->tbuf_start].pdesc);
+                wr_reg32(info, TDCSR, BIT2 + BIT0);
                 info->tx_active = true;
         }
 }
 
-/*
- * start transmit DMA if inactive and there are unsent buffers
- */
-static void tdma_start(struct slgt_info *info)
-{
-        unsigned int i;
-
-        if (rd_reg32(info, TDCSR) & BIT0)
-                return;
-
-        /* transmit DMA inactive, check for unsent buffers */
-        i = info->tbuf_start;
-        while (!desc_count(info->tbufs[i])) {
-                if (++i == info->tbuf_count)
-                        i = 0;
-                if (i == info->tbuf_current)
-                        return;
-        }
-        info->tbuf_start = i;
-
-        /* there are unsent buffers, start transmit DMA */
-
-        /* reset needed if previous error condition */
-        tdma_reset(info);
-
-        /* set 1st descriptor address */
-        wr_reg32(info, TDDAR, info->tbufs[info->tbuf_start].pdesc);
-        wr_reg32(info, TDCSR, BIT2 + BIT0); /* IRQ + DMA enable */
-}
-
 static void tx_stop(struct slgt_info *info)
 {
         unsigned short val;
@@ -4467,6 +4516,8 @@ static void free_rbufs(struct slgt_info *info, unsigned int i, unsigned int last
 static void reset_rbufs(struct slgt_info *info)
 {
         free_rbufs(info, 0, info->rbuf_count - 1);
+        info->rbuf_fill_index = 0;
+        info->rbuf_fill_count = 0;
 }
 
 /*
@@ -4942,8 +4993,7 @@ static void tx_timeout(unsigned long context)
                 info->icount.txtimeout++;
         }
         spin_lock_irqsave(&info->lock,flags);
-        info->tx_active = false;
-        info->tx_count = 0;
+        tx_stop(info);
         spin_unlock_irqrestore(&info->lock,flags);
 
 #if SYNCLINK_GENERIC_HDLC
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 26de60efe4b2..6f727e3c53ad 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -3277,13 +3277,16 @@ static int carrier_raised(struct tty_port *port)
         return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
 }
 
-static void raise_dtr_rts(struct tty_port *port)
+static void dtr_rts(struct tty_port *port, int on)
 {
         SLMP_INFO *info = container_of(port, SLMP_INFO, port);
         unsigned long flags;
 
         spin_lock_irqsave(&info->lock,flags);
-        info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        if (on)
+                info->serial_signals |= SerialSignal_RTS + SerialSignal_DTR;
+        else
+                info->serial_signals &= ~(SerialSignal_RTS + SerialSignal_DTR);
         set_signals(info);
         spin_unlock_irqrestore(&info->lock,flags);
 }
@@ -3746,7 +3749,7 @@ static void add_device(SLMP_INFO *info)
 
 static const struct tty_port_operations port_ops = {
         .carrier_raised = carrier_raised,
-        .raise_dtr_rts = raise_dtr_rts,
+        .dtr_rts = dtr_rts,
 };
 
 /* Allocate and initialize a device instance structure
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index d6a807f4077d..0db35857e4d8 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -25,6 +25,7 @@
 #include <linux/kbd_kern.h>
 #include <linux/proc_fs.h>
 #include <linux/quotaops.h>
+#include <linux/perf_counter.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/suspend.h>
@@ -120,20 +121,17 @@ static struct sysrq_key_op sysrq_unraw_op = {
 #define sysrq_unraw_op (*(struct sysrq_key_op *)0)
 #endif /* CONFIG_VT */
 
-#ifdef CONFIG_KEXEC
-static void sysrq_handle_crashdump(int key, struct tty_struct *tty)
+static void sysrq_handle_crash(int key, struct tty_struct *tty)
 {
-        crash_kexec(get_irq_regs());
+        char *killer = NULL;
+        *killer = 1;
 }
 static struct sysrq_key_op sysrq_crashdump_op = {
-        .handler        = sysrq_handle_crashdump,
-        .help_msg       = "Crashdump",
-        .action_msg     = "Trigger a crashdump",
+        .handler        = sysrq_handle_crash,
+        .help_msg       = "Crash",
+        .action_msg     = "Trigger a crash",
         .enable_mask    = SYSRQ_ENABLE_DUMP,
 };
-#else
-#define sysrq_crashdump_op (*(struct sysrq_key_op *)0)
-#endif
 
 static void sysrq_handle_reboot(int key, struct tty_struct *tty)
 {
@@ -243,6 +241,7 @@ static void sysrq_handle_showregs(int key, struct tty_struct *tty)
         struct pt_regs *regs = get_irq_regs();
         if (regs)
                 show_regs(regs);
+        perf_counter_print_debug();
 }
 static struct sysrq_key_op sysrq_showregs_op = {
         .handler        = sysrq_handle_showregs,
diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
index 55ba6f142883..ac16fbec72d0 100644
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@ -29,10 +29,7 @@ static struct tty_audit_buf *tty_audit_buf_alloc(int major, int minor,
         buf = kmalloc(sizeof(*buf), GFP_KERNEL);
         if (!buf)
                 goto err;
-        if (PAGE_SIZE != N_TTY_BUF_SIZE)
-                buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
-        else
-                buf->data = (unsigned char *)__get_free_page(GFP_KERNEL);
+        buf->data = kmalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
         if (!buf->data)
                 goto err_buf;
         atomic_set(&buf->count, 1);
@@ -52,10 +49,7 @@ err:
 static void tty_audit_buf_free(struct tty_audit_buf *buf)
 {
         WARN_ON(buf->valid != 0);
-        if (PAGE_SIZE != N_TTY_BUF_SIZE)
-                kfree(buf->data);
-        else
-                free_page((unsigned long)buf->data);
+        kfree(buf->data);
         kfree(buf);
 }
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 66b99a2049e3..a3afa0c387cd 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -295,7 +295,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
         struct tty_driver *p, *res = NULL;
         int tty_line = 0;
         int len;
-        char *str;
+        char *str, *stp;
 
         for (str = name; *str; str++)
                 if ((*str >= '0' && *str <= '9') || *str == ',')
@@ -311,13 +311,14 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
         list_for_each_entry(p, &tty_drivers, tty_drivers) {
                 if (strncmp(name, p->name, len) != 0)
                         continue;
-                if (*str == ',')
-                        str++;
-                if (*str == '\0')
-                        str = NULL;
+                stp = str;
+                if (*stp == ',')
+                        stp++;
+                if (*stp == '\0')
+                        stp = NULL;
 
                 if (tty_line >= 0 && tty_line <= p->num && p->ops &&
-                    p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {
+                    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
                         res = tty_driver_kref_get(p);
                         *line = tty_line;
                         break;
@@ -470,43 +471,6 @@ void tty_wakeup(struct tty_struct *tty)
 EXPORT_SYMBOL_GPL(tty_wakeup);
 
 /**
- *      tty_ldisc_flush -       flush line discipline queue
- *      @tty: tty
- *
- *      Flush the line discipline queue (if any) for this tty. If there
- *      is no line discipline active this is a no-op.
- */
-
-void tty_ldisc_flush(struct tty_struct *tty)
-{
-        struct tty_ldisc *ld = tty_ldisc_ref(tty);
-        if (ld) {
-                if (ld->ops->flush_buffer)
-                        ld->ops->flush_buffer(tty);
-                tty_ldisc_deref(ld);
-        }
-        tty_buffer_flush(tty);
-}
-
-EXPORT_SYMBOL_GPL(tty_ldisc_flush);
-
-/**
- *      tty_reset_termios       -       reset terminal state
- *      @tty: tty to reset
- *
- *      Restore a terminal to the driver default state
- */
-
-static void tty_reset_termios(struct tty_struct *tty)
-{
-        mutex_lock(&tty->termios_mutex);
-        *tty->termios = tty->driver->init_termios;
-        tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
-        tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
-        mutex_unlock(&tty->termios_mutex);
-}
-
-/**
  *      do_tty_hangup           -       actual handler for hangup events
  *      @work: tty device
  *
@@ -535,7 +499,6 @@ static void do_tty_hangup(struct work_struct *work)
         struct file *cons_filp = NULL;
         struct file *filp, *f = NULL;
         struct task_struct *p;
-        struct tty_ldisc *ld;
         int    closecount = 0, n;
         unsigned long flags;
         int refs = 0;
@@ -566,40 +529,8 @@ static void do_tty_hangup(struct work_struct *work)
                 filp->f_op = &hung_up_tty_fops;
         }
         file_list_unlock();
-        /*
-         * FIXME! What are the locking issues here? This may me overdoing
-         * things... This question is especially important now that we've
-         * removed the irqlock.
-         */
-        ld = tty_ldisc_ref(tty);
-        if (ld != NULL) {
-                /* We may have no line discipline at this point */
-                if (ld->ops->flush_buffer)
-                        ld->ops->flush_buffer(tty);
-                tty_driver_flush_buffer(tty);
-                if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
-                    ld->ops->write_wakeup)
-                        ld->ops->write_wakeup(tty);
-                if (ld->ops->hangup)
-                        ld->ops->hangup(tty);
-        }
-        /*
-         * FIXME: Once we trust the LDISC code better we can wait here for
-         * ldisc completion and fix the driver call race
-         */
-        wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
-        wake_up_interruptible_poll(&tty->read_wait, POLLIN);
-        /*
-         * Shutdown the current line discipline, and reset it to
-         * N_TTY.
-         */
-        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
-                tty_reset_termios(tty);
-        /* Defer ldisc switch */
-        /* tty_deferred_ldisc_switch(N_TTY);
 
-          This should get done automatically when the port closes and
-          tty_release is called */
+        tty_ldisc_hangup(tty);
 
         read_lock(&tasklist_lock);
         if (tty->session) {
@@ -628,12 +559,15 @@ static void do_tty_hangup(struct work_struct *work)
         read_unlock(&tasklist_lock);
 
         spin_lock_irqsave(&tty->ctrl_lock, flags);
-        tty->flags = 0;
+        clear_bit(TTY_THROTTLED, &tty->flags);
+        clear_bit(TTY_PUSH, &tty->flags);
+        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         put_pid(tty->session);
         put_pid(tty->pgrp);
         tty->session = NULL;
         tty->pgrp = NULL;
         tty->ctrl_status = 0;
+        set_bit(TTY_HUPPED, &tty->flags);
         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
         /* Account for the p->signal references we killed */
@@ -659,10 +593,7 @@ static void do_tty_hangup(struct work_struct *work)
          * can't yet guarantee all that.
          */
         set_bit(TTY_HUPPED, &tty->flags);
-        if (ld) {
-                tty_ldisc_enable(tty);
-                tty_ldisc_deref(ld);
-        }
+        tty_ldisc_enable(tty);
         unlock_kernel();
         if (f)
                 fput(f);
@@ -1332,7 +1263,9 @@ static int tty_reopen(struct tty_struct *tty)
         tty->count++;
         tty->driver = driver; /* N.B. why do this every time?? */
 
+        mutex_lock(&tty->ldisc_mutex);
         WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
+        mutex_unlock(&tty->ldisc_mutex);
 
         return 0;
 }
@@ -2480,6 +2413,24 @@ static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int
         return tty->ops->tiocmset(tty, file, set, clear);
 }
 
+struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
+{
+        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+            tty->driver->subtype == PTY_TYPE_MASTER)
+                tty = tty->link;
+        return tty;
+}
+EXPORT_SYMBOL(tty_pair_get_tty);
+
+struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
+{
+        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+            tty->driver->subtype == PTY_TYPE_MASTER)
+            return tty;
+        return tty->link;
+}
+EXPORT_SYMBOL(tty_pair_get_pty);
+
 /*
  * Split this up, as gcc can choke on it otherwise..
  */
@@ -2495,11 +2446,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
                 return -EINVAL;
 
-        real_tty = tty;
-        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
-            tty->driver->subtype == PTY_TYPE_MASTER)
-                real_tty = tty->link;
-
+        real_tty = tty_pair_get_tty(tty);
 
         /*
          * Factor out some common prep work
@@ -2555,7 +2502,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case TIOCGSID:
                 return tiocgsid(tty, real_tty, p);
         case TIOCGETD:
-                return put_user(tty->ldisc.ops->num, (int __user *)p);
+                return put_user(tty->ldisc->ops->num, (int __user *)p);
         case TIOCSETD:
                 return tiocsetd(tty, p);
         /*
@@ -2770,6 +2717,7 @@ void initialize_tty_struct(struct tty_struct *tty,
         tty->buf.head = tty->buf.tail = NULL;
         tty_buffer_init(tty);
         mutex_init(&tty->termios_mutex);
+        mutex_init(&tty->ldisc_mutex);
         init_waitqueue_head(&tty->write_wait);
         init_waitqueue_head(&tty->read_wait);
         INIT_WORK(&tty->hangup_work, do_tty_hangup);
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 6f4c7d0a53bf..b24f6c6a1ea3 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -97,14 +97,19 @@ EXPORT_SYMBOL(tty_driver_flush_buffer);
  *      @tty: terminal
  *
  *      Indicate that a tty should stop transmitting data down the stack.
+ *      Takes the termios mutex to protect against parallel throttle/unthrottle
+ *      and also to ensure the driver can consistently reference its own
+ *      termios data at this point when implementing software flow control.
  */
 
 void tty_throttle(struct tty_struct *tty)
 {
+        mutex_lock(&tty->termios_mutex);
         /* check TTY_THROTTLED first so it indicates our state */
         if (!test_and_set_bit(TTY_THROTTLED, &tty->flags) &&
             tty->ops->throttle)
                 tty->ops->throttle(tty);
+        mutex_unlock(&tty->termios_mutex);
 }
 EXPORT_SYMBOL(tty_throttle);
 
@@ -113,13 +118,21 @@ EXPORT_SYMBOL(tty_throttle);
  *      @tty: terminal
  *
  *      Indicate that a tty may continue transmitting data down the stack.
+ *      Takes the termios mutex to protect against parallel throttle/unthrottle
+ *      and also to ensure the driver can consistently reference its own
+ *      termios data at this point when implementing software flow control.
+ *
+ *      Drivers should however remember that the stack can issue a throttle,
+ *      then change flow control method, then unthrottle.
  */
 
 void tty_unthrottle(struct tty_struct *tty)
 {
+        mutex_lock(&tty->termios_mutex);
         if (test_and_clear_bit(TTY_THROTTLED, &tty->flags) &&
             tty->ops->unthrottle)
                 tty->ops->unthrottle(tty);
+        mutex_unlock(&tty->termios_mutex);
 }
 EXPORT_SYMBOL(tty_unthrottle);
 
@@ -613,9 +626,25 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
         return 0;
 }
 
+static void copy_termios(struct tty_struct *tty, struct ktermios *kterm)
+{
+        mutex_lock(&tty->termios_mutex);
+        memcpy(kterm, tty->termios, sizeof(struct ktermios));
+        mutex_unlock(&tty->termios_mutex);
+}
+
+static void copy_termios_locked(struct tty_struct *tty, struct ktermios *kterm)
+{
+        mutex_lock(&tty->termios_mutex);
+        memcpy(kterm, tty->termios_locked, sizeof(struct ktermios));
+        mutex_unlock(&tty->termios_mutex);
+}
+
 static int get_termio(struct tty_struct *tty, struct termio __user *termio)
 {
-        if (kernel_termios_to_user_termio(termio, tty->termios))
+        struct ktermios kterm;
+        copy_termios(tty, &kterm);
+        if (kernel_termios_to_user_termio(termio, &kterm))
                 return -EFAULT;
         return 0;
 }
@@ -917,6 +946,7 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
         struct tty_struct *real_tty;
         void __user *p = (void __user *)arg;
         int ret = 0;
+        struct ktermios kterm;
 
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_MASTER)
@@ -952,23 +982,20 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                 return set_termios(real_tty, p, TERMIOS_OLD);
 #ifndef TCGETS2
         case TCGETS:
-                mutex_lock(&real_tty->termios_mutex);
-                if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios))
+                copy_termios(real_tty, &kterm);
+                if (kernel_termios_to_user_termios((struct termios __user *)arg, &kterm))
                         ret = -EFAULT;
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
 #else
         case TCGETS:
-                mutex_lock(&real_tty->termios_mutex);
-                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios))
+                copy_termios(real_tty, &kterm);
+                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, &kterm))
                         ret = -EFAULT;
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
         case TCGETS2:
-                mutex_lock(&real_tty->termios_mutex);
-                if (kernel_termios_to_user_termios((struct termios2 __user *)arg, real_tty->termios))
+                copy_termios(real_tty, &kterm);
+                if (kernel_termios_to_user_termios((struct termios2 __user *)arg, &kterm))
                         ret = -EFAULT;
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
         case TCSETSF2:
                 return set_termios(real_tty, p,  TERMIOS_FLUSH | TERMIOS_WAIT);
@@ -987,46 +1014,51 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                 return set_termios(real_tty, p, TERMIOS_TERMIO);
 #ifndef TCGETS2
         case TIOCGLCKTRMIOS:
-                mutex_lock(&real_tty->termios_mutex);
-                if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
+                copy_termios_locked(real_tty, &kterm);
+                if (kernel_termios_to_user_termios((struct termios __user *)arg, &kterm))
                         ret = -EFAULT;
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
         case TIOCSLCKTRMIOS:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                mutex_lock(&real_tty->termios_mutex);
-                if (user_termios_to_kernel_termios(real_tty->termios_locked,
+                copy_termios_locked(real_tty, &kterm);
+                if (user_termios_to_kernel_termios(&kterm,
                                                (struct termios __user *) arg))
-                        ret = -EFAULT;
+                        return -EFAULT;
+                mutex_lock(&real_tty->termios_mutex);
+                memcpy(real_tty->termios_locked, &kterm, sizeof(struct ktermios));
                 mutex_unlock(&real_tty->termios_mutex);
-                return ret;
+                return 0;
 #else
         case TIOCGLCKTRMIOS:
-                mutex_lock(&real_tty->termios_mutex);
-                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
+                copy_termios_locked(real_tty, &kterm);
+                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, &kterm))
                         ret = -EFAULT;
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
         case TIOCSLCKTRMIOS:
                 if (!capable(CAP_SYS_ADMIN))
-                        ret = -EPERM;
-                mutex_lock(&real_tty->termios_mutex);
-                if (user_termios_to_kernel_termios_1(real_tty->termios_locked,
+                        return -EPERM;
+                copy_termios_locked(real_tty, &kterm);
+                if (user_termios_to_kernel_termios_1(&kterm,
                                                (struct termios __user *) arg))
-                        ret = -EFAULT;
+                        return -EFAULT;
+                mutex_lock(&real_tty->termios_mutex);
+                memcpy(real_tty->termios_locked, &kterm, sizeof(struct ktermios));
                 mutex_unlock(&real_tty->termios_mutex);
                 return ret;
 #endif
 #ifdef TCGETX
-        case TCGETX:
+        case TCGETX: {
+                struct termiox ktermx;
                 if (real_tty->termiox == NULL)
                         return -EINVAL;
                 mutex_lock(&real_tty->termios_mutex);
-                if (copy_to_user(p, real_tty->termiox, sizeof(struct termiox)))
-                        ret = -EFAULT;
+                memcpy(&ktermx, real_tty->termiox, sizeof(struct termiox));
                 mutex_unlock(&real_tty->termios_mutex);
+                if (copy_to_user(p, &ktermx, sizeof(struct termiox)))
+                        ret = -EFAULT;
                 return ret;
+        }
         case TCSETX:
                 return set_termiox(real_tty, p, 0);
         case TCSETXW:
@@ -1035,10 +1067,9 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                 return set_termiox(real_tty, p, TERMIOS_FLUSH);
 #endif          
         case TIOCGSOFTCAR:
-                mutex_lock(&real_tty->termios_mutex);
-                ret = put_user(C_CLOCAL(real_tty) ? 1 : 0,
+                copy_termios(real_tty, &kterm);
+                ret = put_user((kterm.c_cflag & CLOCAL) ? 1 : 0,
                                                 (int __user *)arg);
-                mutex_unlock(&real_tty->termios_mutex);
                 return ret;
         case TIOCSSOFTCAR:
                 if (get_user(arg, (unsigned int __user *) arg))
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index f78f5b0127a8..a19e935847b0 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -115,19 +115,22 @@ EXPORT_SYMBOL(tty_unregister_ldisc);
 /**
  *      tty_ldisc_try_get       -       try and reference an ldisc
  *      @disc: ldisc number
- *      @ld: tty ldisc structure to complete
  *
  *      Attempt to open and lock a line discipline into place. Return
- *      the line discipline refcounted and assigned in ld. On an error
- *      report the error code back
+ *      the line discipline refcounted or an error.
  */
 
-static int tty_ldisc_try_get(int disc, struct tty_ldisc *ld)
+static struct tty_ldisc *tty_ldisc_try_get(int disc)
 {
         unsigned long flags;
+        struct tty_ldisc *ld;
         struct tty_ldisc_ops *ldops;
         int err = -EINVAL;
-        
+
+        ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
+        if (ld == NULL)
+                return ERR_PTR(-ENOMEM);
+
         spin_lock_irqsave(&tty_ldisc_lock, flags);
         ld->ops = NULL;
         ldops = tty_ldiscs[disc];
@@ -140,17 +143,21 @@ static int tty_ldisc_try_get(int disc, struct tty_ldisc *ld)
                         /* lock it */
                         ldops->refcount++;
                         ld->ops = ldops;
+                        ld->refcount = 0;
                         err = 0;
                 }
         }
         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        return err;
+        if (err) {
+                kfree(ld);
+                return ERR_PTR(err);
+        }
+        return ld;
 }
 
 /**
  *      tty_ldisc_get           -       take a reference to an ldisc
  *      @disc: ldisc number
- *      @ld: tty line discipline structure to use
  *
  *      Takes a reference to a line discipline. Deals with refcounts and
  *      module locking counts. Returns NULL if the discipline is not available.
@@ -161,52 +168,55 @@ static int tty_ldisc_try_get(int disc, struct tty_ldisc *ld)
  *              takes tty_ldisc_lock to guard against ldisc races
  */
 
-static int tty_ldisc_get(int disc, struct tty_ldisc *ld)
+static struct tty_ldisc *tty_ldisc_get(int disc)
 {
-        int err;
+        struct tty_ldisc *ld;
 
         if (disc < N_TTY || disc >= NR_LDISCS)
-                return -EINVAL;
-        err = tty_ldisc_try_get(disc, ld);
-        if (err < 0) {
+                return ERR_PTR(-EINVAL);
+        ld = tty_ldisc_try_get(disc);
+        if (IS_ERR(ld)) {
                 request_module("tty-ldisc-%d", disc);
-                err = tty_ldisc_try_get(disc, ld);
+                ld = tty_ldisc_try_get(disc);
         }
-        return err;
+        return ld;
 }
 
 /**
  *      tty_ldisc_put           -       drop ldisc reference
- *      @disc: ldisc number
+ *      @ld: ldisc
  *
  *      Drop a reference to a line discipline. Manage refcounts and
- *      module usage counts
+ *      module usage counts. Free the ldisc once the recount hits zero.
  *
  *      Locking:
  *              takes tty_ldisc_lock to guard against ldisc races
  */
 
-static void tty_ldisc_put(struct tty_ldisc_ops *ld)
+static void tty_ldisc_put(struct tty_ldisc *ld)
 {
         unsigned long flags;
-        int disc = ld->num;
+        int disc = ld->ops->num;
+        struct tty_ldisc_ops *ldo;
 
         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
 
         spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ld = tty_ldiscs[disc];
-        BUG_ON(ld->refcount == 0);
-        ld->refcount--;
-        module_put(ld->owner);
+        ldo = tty_ldiscs[disc];
+        BUG_ON(ldo->refcount == 0);
+        ldo->refcount--;
+        module_put(ldo->owner);
         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+        WARN_ON(ld->refcount);
+        kfree(ld);
 }
 
-static void * tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
+static void *tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
 {
         return (*pos < NR_LDISCS) ? pos : NULL;
 }
 
-static void * tty_ldiscs_seq_next(struct seq_file *m, void *v, loff_t *pos)
+static void *tty_ldiscs_seq_next(struct seq_file *m, void *v, loff_t *pos)
 {
         (*pos)++;
         return (*pos < NR_LDISCS) ? pos : NULL;
@@ -219,12 +229,13 @@ static void tty_ldiscs_seq_stop(struct seq_file *m, void *v)
 static int tty_ldiscs_seq_show(struct seq_file *m, void *v)
 {
         int i = *(loff_t *)v;
-        struct tty_ldisc ld;
-        
-        if (tty_ldisc_get(i, &ld) < 0)
+        struct tty_ldisc *ld;
+
+        ld = tty_ldisc_try_get(i);
+        if (IS_ERR(ld))
                 return 0;
-        seq_printf(m, "%-10s %2d\n", ld.ops->name ? ld.ops->name : "???", i);
-        tty_ldisc_put(ld.ops);
+        seq_printf(m, "%-10s %2d\n", ld->ops->name ? ld->ops->name : "???", i);
+        tty_ldisc_put(ld);
         return 0;
 }
 
@@ -254,7 +265,7 @@ const struct file_operations tty_ldiscs_proc_fops = {
  *      @ld: line discipline
  *
  *      Install an instance of a line discipline into a tty structure. The
- *      ldisc must have a reference count above zero to ensure it remains/
+ *      ldisc must have a reference count above zero to ensure it remains.
  *      The tty instance refcount starts at zero.
  *
  *      Locking:
@@ -263,8 +274,7 @@ const struct file_operations tty_ldiscs_proc_fops = {
 
 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
 {
-        ld->refcount = 0;
-        tty->ldisc = *ld;
+        tty->ldisc = ld;
 }
 
 /**
@@ -286,7 +296,7 @@ static int tty_ldisc_try(struct tty_struct *tty)
         int ret = 0;
 
         spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ld = &tty->ldisc;
+        ld = tty->ldisc;
         if (test_bit(TTY_LDISC, &tty->flags)) {
                 ld->refcount++;
                 ret = 1;
@@ -315,10 +325,9 @@ struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
         /* wait_event is a macro */
         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
-        WARN_ON(tty->ldisc.refcount == 0);
-        return &tty->ldisc;
+        WARN_ON(tty->ldisc->refcount == 0);
+        return tty->ldisc;
 }
-
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
 /**
@@ -335,10 +344,9 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
 {
         if (tty_ldisc_try(tty))
-                return &tty->ldisc;
+                return tty->ldisc;
         return NULL;
 }
-
 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
 
 /**
@@ -366,7 +374,6 @@ void tty_ldisc_deref(struct tty_ldisc *ld)
                 wake_up(&tty_ldisc_wait);
         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
 }
-
 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
 
 /**
@@ -389,6 +396,26 @@ void tty_ldisc_enable(struct tty_struct *tty)
 }
 
 /**
+ *      tty_ldisc_flush -       flush line discipline queue
+ *      @tty: tty
+ *
+ *      Flush the line discipline queue (if any) for this tty. If there
+ *      is no line discipline active this is a no-op.
+ */
+
+void tty_ldisc_flush(struct tty_struct *tty)
+{
+        struct tty_ldisc *ld = tty_ldisc_ref(tty);
+        if (ld) {
+                if (ld->ops->flush_buffer)
+                        ld->ops->flush_buffer(tty);
+                tty_ldisc_deref(ld);
+        }
+        tty_buffer_flush(tty);
+}
+EXPORT_SYMBOL_GPL(tty_ldisc_flush);
+
+/**
  *      tty_set_termios_ldisc           -       set ldisc field
  *      @tty: tty structure
  *      @num: line discipline number
@@ -407,6 +434,39 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
         mutex_unlock(&tty->termios_mutex);
 }
 
+/**
+ *      tty_ldisc_open          -       open a line discipline
+ *      @tty: tty we are opening the ldisc on
+ *      @ld: discipline to open
+ *
+ *      A helper opening method. Also a convenient debugging and check
+ *      point.
+ */
+
+static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
+{
+        WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
+        if (ld->ops->open)
+                return ld->ops->open(tty);
+        return 0;
+}
+
+/**
+ *      tty_ldisc_close         -       close a line discipline
+ *      @tty: tty we are opening the ldisc on
+ *      @ld: discipline to close
+ *
+ *      A helper close method. Also a convenient debugging and check
+ *      point.
+ */
+
+static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
+{
+        WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
+        clear_bit(TTY_LDISC_OPEN, &tty->flags);
+        if (ld->ops->close)
+                ld->ops->close(tty);
+}
 
 /**
  *      tty_ldisc_restore       -       helper for tty ldisc change
@@ -420,66 +480,136 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
 static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 {
         char buf[64];
-        struct tty_ldisc new_ldisc;
+        struct tty_ldisc *new_ldisc;
+        int r;
 
         /* There is an outstanding reference here so this is safe */
-        tty_ldisc_get(old->ops->num, old);
+        old = tty_ldisc_get(old->ops->num);
+        WARN_ON(IS_ERR(old));
         tty_ldisc_assign(tty, old);
         tty_set_termios_ldisc(tty, old->ops->num);
-        if (old->ops->open && (old->ops->open(tty) < 0)) {
-                tty_ldisc_put(old->ops);
+        if (tty_ldisc_open(tty, old) < 0) {
+                tty_ldisc_put(old);
                 /* This driver is always present */
-                if (tty_ldisc_get(N_TTY, &new_ldisc) < 0)
+                new_ldisc = tty_ldisc_get(N_TTY);
+                if (IS_ERR(new_ldisc))
                         panic("n_tty: get");
-                tty_ldisc_assign(tty, &new_ldisc);
+                tty_ldisc_assign(tty, new_ldisc);
                 tty_set_termios_ldisc(tty, N_TTY);
-                if (new_ldisc.ops->open) {
-                        int r = new_ldisc.ops->open(tty);
-                                if (r < 0)
-                                panic("Couldn't open N_TTY ldisc for "
-                                      "%s --- error %d.",
-                                      tty_name(tty, buf), r);
-                }
+                r = tty_ldisc_open(tty, new_ldisc);
+                if (r < 0)
+                        panic("Couldn't open N_TTY ldisc for "
+                              "%s --- error %d.",
+                              tty_name(tty, buf), r);
         }
 }
 
 /**
+ *      tty_ldisc_halt          -       shut down the line discipline
+ *      @tty: tty device
+ *
+ *      Shut down the line discipline and work queue for this tty device.
+ *      The TTY_LDISC flag being cleared ensures no further references can
+ *      be obtained while the delayed work queue halt ensures that no more
+ *      data is fed to the ldisc.
+ *
+ *      In order to wait for any existing references to complete see
+ *      tty_ldisc_wait_idle.
+ */
+
+static int tty_ldisc_halt(struct tty_struct *tty)
+{
+        clear_bit(TTY_LDISC, &tty->flags);
+        return cancel_delayed_work(&tty->buf.work);
+}
+
+/**
+ *      tty_ldisc_wait_idle     -       wait for the ldisc to become idle
+ *      @tty: tty to wait for
+ *
+ *      Wait for the line discipline to become idle. The discipline must
+ *      have been halted for this to guarantee it remains idle.
+ *
+ *      tty_ldisc_lock protects the ref counts currently.
+ */
+
+static int tty_ldisc_wait_idle(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty_ldisc_lock, flags);
+        while (tty->ldisc->refcount) {
+                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+                if (wait_event_timeout(tty_ldisc_wait,
+                                tty->ldisc->refcount == 0, 5 * HZ) == 0)
+                        return -EBUSY;
+                spin_lock_irqsave(&tty_ldisc_lock, flags);
+        }
+        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+        return 0;
+}
+
+/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
  *
  *      Set the discipline of a tty line. Must be called from a process
- *      context.
+ *      context. The ldisc change logic has to protect itself against any
+ *      overlapping ldisc change (including on the other end of pty pairs),
+ *      the close of one side of a tty/pty pair, and eventually hangup.
  *
- *      Locking: takes tty_ldisc_lock.
- *               called functions take termios_mutex
+ *      Locking: takes tty_ldisc_lock, termios_mutex
  */
 
 int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 {
         int retval;
-        struct tty_ldisc o_ldisc, new_ldisc;
-        int work;
-        unsigned long flags;
+        struct tty_ldisc *o_ldisc, *new_ldisc;
+        int work, o_work = 0;
         struct tty_struct *o_tty;
 
-restart:
-        /* This is a bit ugly for now but means we can break the 'ldisc
-           is part of the tty struct' assumption later */
-        retval = tty_ldisc_get(ldisc, &new_ldisc);
-        if (retval)
-                return retval;
+        new_ldisc = tty_ldisc_get(ldisc);
+        if (IS_ERR(new_ldisc))
+                return PTR_ERR(new_ldisc);
+
+        /*
+         *      We need to look at the tty locking here for pty/tty pairs
+         *      when both sides try to change in parallel.
+         */
+
+        o_tty = tty->link;      /* o_tty is the pty side or NULL */
+
+
+        /*
+         *      Check the no-op case
+         */
+
+        if (tty->ldisc->ops->num == ldisc) {
+                tty_ldisc_put(new_ldisc);
+                return 0;
+        }
 
         /*
          *      Problem: What do we do if this blocks ?
+         *      We could deadlock here
          */
 
         tty_wait_until_sent(tty, 0);
 
-        if (tty->ldisc.ops->num == ldisc) {
-                tty_ldisc_put(new_ldisc.ops);
-                return 0;
+        mutex_lock(&tty->ldisc_mutex);
+
+        /*
+         *      We could be midstream of another ldisc change which has
+         *      dropped the lock during processing. If so we need to wait.
+         */
+
+        while (test_bit(TTY_LDISC_CHANGING, &tty->flags)) {
+                mutex_unlock(&tty->ldisc_mutex);
+                wait_event(tty_ldisc_wait,
+                        test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
+                mutex_lock(&tty->ldisc_mutex);
         }
+        set_bit(TTY_LDISC_CHANGING, &tty->flags);
 
         /*
          *      No more input please, we are switching. The new ldisc
@@ -489,8 +619,6 @@ restart:
         tty->receive_room = 0;
 
         o_ldisc = tty->ldisc;
-        o_tty = tty->link;
-
         /*
          *      Make sure we don't change while someone holds a
          *      reference to the line discipline. The TTY_LDISC bit
@@ -501,108 +629,183 @@ restart:
          *      with a userspace app continually trying to use the tty in
          *      parallel to the change and re-referencing the tty.
          */
-        clear_bit(TTY_LDISC, &tty->flags);
-        if (o_tty)
-                clear_bit(TTY_LDISC, &o_tty->flags);
 
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
-                if (tty->ldisc.refcount) {
-                        /* Free the new ldisc we grabbed. Must drop the lock
-                           first. */
-                        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                        tty_ldisc_put(o_ldisc.ops);
-                        /*
-                         * There are several reasons we may be busy, including
-                         * random momentary I/O traffic. We must therefore
-                         * retry. We could distinguish between blocking ops
-                         * and retries if we made tty_ldisc_wait() smarter.
-                         * That is up for discussion.
-                         */
-                        if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
-                                return -ERESTARTSYS;
-                        goto restart;
-                }
-                if (o_tty && o_tty->ldisc.refcount) {
-                        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                        tty_ldisc_put(o_tty->ldisc.ops);
-                        if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
-                                return -ERESTARTSYS;
-                        goto restart;
-                }
-        }
-        /*
-         *      If the TTY_LDISC bit is set, then we are racing against
-         *      another ldisc change
-         */
-        if (test_bit(TTY_LDISC_CHANGING, &tty->flags)) {
-                struct tty_ldisc *ld;
-                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                tty_ldisc_put(new_ldisc.ops);
-                ld = tty_ldisc_ref_wait(tty);
-                tty_ldisc_deref(ld);
-                goto restart;
-        }
-        /*
-         *      This flag is used to avoid two parallel ldisc changes. Once
-         *      open and close are fine grained locked this may work better
-         *      as a mutex shared with the open/close/hup paths
-         */
-        set_bit(TTY_LDISC_CHANGING, &tty->flags);
+        work = tty_ldisc_halt(tty);
         if (o_tty)
-                set_bit(TTY_LDISC_CHANGING, &o_tty->flags);
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        
-        /*
-         *      From this point on we know nobody has an ldisc
-         *      usage reference, nor can they obtain one until
-         *      we say so later on.
-         */
+                o_work = tty_ldisc_halt(o_tty);
 
-        work = cancel_delayed_work(&tty->buf.work);
         /*
-         * Wait for ->hangup_work and ->buf.work handlers to terminate
-         * MUST NOT hold locks here.
+         * Wait for ->hangup_work and ->buf.work handlers to terminate.
+         * We must drop the mutex here in case a hangup is also in process.
          */
+
+        mutex_unlock(&tty->ldisc_mutex);
+
         flush_scheduled_work();
+
+        /* Let any existing reference holders finish */
+        retval = tty_ldisc_wait_idle(tty);
+        if (retval < 0) {
+                clear_bit(TTY_LDISC_CHANGING, &tty->flags);
+                tty_ldisc_put(new_ldisc);
+                return retval;
+        }
+
+        mutex_lock(&tty->ldisc_mutex);
+        if (test_bit(TTY_HUPPED, &tty->flags)) {
+                /* We were raced by the hangup method. It will have stomped
+                   the ldisc data and closed the ldisc down */
+                clear_bit(TTY_LDISC_CHANGING, &tty->flags);
+                mutex_unlock(&tty->ldisc_mutex);
+                tty_ldisc_put(new_ldisc);
+                return -EIO;
+        }
+
         /* Shutdown the current discipline. */
-        if (o_ldisc.ops->close)
-                (o_ldisc.ops->close)(tty);
+        tty_ldisc_close(tty, o_ldisc);
 
         /* Now set up the new line discipline. */
-        tty_ldisc_assign(tty, &new_ldisc);
+        tty_ldisc_assign(tty, new_ldisc);
         tty_set_termios_ldisc(tty, ldisc);
-        if (new_ldisc.ops->open)
-                retval = (new_ldisc.ops->open)(tty);
+
+        retval = tty_ldisc_open(tty, new_ldisc);
         if (retval < 0) {
-                tty_ldisc_put(new_ldisc.ops);
-                tty_ldisc_restore(tty, &o_ldisc);
+                /* Back to the old one or N_TTY if we can't */
+                tty_ldisc_put(new_ldisc);
+                tty_ldisc_restore(tty, o_ldisc);
         }
+
         /* At this point we hold a reference to the new ldisc and a
            a reference to the old ldisc. If we ended up flipping back
            to the existing ldisc we have two references to it */
 
-        if (tty->ldisc.ops->num != o_ldisc.ops->num && tty->ops->set_ldisc)
+        if (tty->ldisc->ops->num != o_ldisc->ops->num && tty->ops->set_ldisc)
                 tty->ops->set_ldisc(tty);
 
-        tty_ldisc_put(o_ldisc.ops);
+        tty_ldisc_put(o_ldisc);
 
         /*
-         *      Allow ldisc referencing to occur as soon as the driver
-         *      ldisc callback completes.
+         *      Allow ldisc referencing to occur again
          */
 
         tty_ldisc_enable(tty);
         if (o_tty)
                 tty_ldisc_enable(o_tty);
 
-        /* Restart it in case no characters kick it off. Safe if
+        /* Restart the work queue in case no characters kick it off. Safe if
            already running */
         if (work)
                 schedule_delayed_work(&tty->buf.work, 1);
+        if (o_work)
+                schedule_delayed_work(&o_tty->buf.work, 1);
+        mutex_unlock(&tty->ldisc_mutex);
         return retval;
 }
 
+/**
+ *      tty_reset_termios       -       reset terminal state
+ *      @tty: tty to reset
+ *
+ *      Restore a terminal to the driver default state.
+ */
+
+static void tty_reset_termios(struct tty_struct *tty)
+{
+        mutex_lock(&tty->termios_mutex);
+        *tty->termios = tty->driver->init_termios;
+        tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
+        tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
+        mutex_unlock(&tty->termios_mutex);
+}
+
+
+/**
+ *      tty_ldisc_reinit        -       reinitialise the tty ldisc
+ *      @tty: tty to reinit
+ *
+ *      Switch the tty back to N_TTY line discipline and leave the
+ *      ldisc state closed
+ */
+
+static void tty_ldisc_reinit(struct tty_struct *tty)
+{
+        struct tty_ldisc *ld;
+
+        tty_ldisc_close(tty, tty->ldisc);
+        tty_ldisc_put(tty->ldisc);
+        tty->ldisc = NULL;
+        /*
+         *      Switch the line discipline back
+         */
+        ld = tty_ldisc_get(N_TTY);
+        BUG_ON(IS_ERR(ld));
+        tty_ldisc_assign(tty, ld);
+        tty_set_termios_ldisc(tty, N_TTY);
+}
+
+/**
+ *      tty_ldisc_hangup                -       hangup ldisc reset
+ *      @tty: tty being hung up
+ *
+ *      Some tty devices reset their termios when they receive a hangup
+ *      event. In that situation we must also switch back to N_TTY properly
+ *      before we reset the termios data.
+ *
+ *      Locking: We can take the ldisc mutex as the rest of the code is
+ *      careful to allow for this.
+ *
+ *      In the pty pair case this occurs in the close() path of the
+ *      tty itself so we must be careful about locking rules.
+ */
+
+void tty_ldisc_hangup(struct tty_struct *tty)
+{
+        struct tty_ldisc *ld;
+
+        /*
+         * FIXME! What are the locking issues here? This may me overdoing
+         * things... This question is especially important now that we've
+         * removed the irqlock.
+         */
+        ld = tty_ldisc_ref(tty);
+        if (ld != NULL) {
+                /* We may have no line discipline at this point */
+                if (ld->ops->flush_buffer)
+                        ld->ops->flush_buffer(tty);
+                tty_driver_flush_buffer(tty);
+                if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
+                    ld->ops->write_wakeup)
+                        ld->ops->write_wakeup(tty);
+                if (ld->ops->hangup)
+                        ld->ops->hangup(tty);
+                tty_ldisc_deref(ld);
+        }
+        /*
+         * FIXME: Once we trust the LDISC code better we can wait here for
+         * ldisc completion and fix the driver call race
+         */
+        wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
+        wake_up_interruptible_poll(&tty->read_wait, POLLIN);
+        /*
+         * Shutdown the current line discipline, and reset it to
+         * N_TTY.
+         */
+        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
+                /* Avoid racing set_ldisc */
+                mutex_lock(&tty->ldisc_mutex);
+                /* Switch back to N_TTY */
+                tty_ldisc_halt(tty);
+                tty_ldisc_wait_idle(tty);
+                tty_ldisc_reinit(tty);
+                /* At this point we have a closed ldisc and we want to
+                   reopen it. We could defer this to the next open but
+                   it means auditing a lot of other paths so this is a FIXME */
+                WARN_ON(tty_ldisc_open(tty, tty->ldisc));
+                tty_ldisc_enable(tty);
+                mutex_unlock(&tty->ldisc_mutex);
+                tty_reset_termios(tty);
+        }
+}
 
 /**
  *      tty_ldisc_setup                 -       open line discipline
@@ -610,24 +813,23 @@ restart:
  *      @o_tty: pair tty for pty/tty pairs
  *
  *      Called during the initial open of a tty/pty pair in order to set up the
- *      line discplines and bind them to the tty.
+ *      line disciplines and bind them to the tty. This has no locking issues
+ *      as the device isn't yet active.
  */
 
 int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
 {
-        struct tty_ldisc *ld = &tty->ldisc;
+        struct tty_ldisc *ld = tty->ldisc;
         int retval;
 
-        if (ld->ops->open) {
-                retval = (ld->ops->open)(tty);
-                if (retval)
-                        return retval;
-        }
-        if (o_tty && o_tty->ldisc.ops->open) {
-                retval = (o_tty->ldisc.ops->open)(o_tty);
+        retval = tty_ldisc_open(tty, ld);
+        if (retval)
+                return retval;
+
+        if (o_tty) {
+                retval = tty_ldisc_open(o_tty, o_tty->ldisc);
                 if (retval) {
-                        if (ld->ops->close)
-                                (ld->ops->close)(tty);
+                        tty_ldisc_close(tty, ld);
                         return retval;
                 }
                 tty_ldisc_enable(o_tty);
@@ -635,32 +837,25 @@ int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
         tty_ldisc_enable(tty);
         return 0;
 }
-
 /**
  *      tty_ldisc_release               -       release line discipline
  *      @tty: tty being shut down
  *      @o_tty: pair tty for pty/tty pairs
  *
- *      Called during the final close of a tty/pty pair in order to shut down the
- *      line discpline layer.
+ *      Called during the final close of a tty/pty pair in order to shut down
+ *      the line discpline layer. On exit the ldisc assigned is N_TTY and the
+ *      ldisc has not been opened.
  */
 
 void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
 {
-        unsigned long flags;
-        struct tty_ldisc ld;
         /*
          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
          * kill any delayed work. As this is the final close it does not
          * race with the set_ldisc code path.
          */
-        clear_bit(TTY_LDISC, &tty->flags);
-        cancel_delayed_work(&tty->buf.work);
-
-        /*
-         * Wait for ->hangup_work and ->buf.work handlers to terminate
-         */
 
+        tty_ldisc_halt(tty);
         flush_scheduled_work();
 
         /*
@@ -668,38 +863,19 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
          * side waiters as the file is closing so user count on the file
          * side is zero.
          */
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        while (tty->ldisc.refcount) {
-                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
-                spin_lock_irqsave(&tty_ldisc_lock, flags);
-        }
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+
+        tty_ldisc_wait_idle(tty);
+
         /*
          * Shutdown the current line discipline, and reset it to N_TTY.
          *
          * FIXME: this MUST get fixed for the new reflocking
          */
-        if (tty->ldisc.ops->close)
-                (tty->ldisc.ops->close)(tty);
-        tty_ldisc_put(tty->ldisc.ops);
 
-        /*
-         *      Switch the line discipline back
-         */
-        WARN_ON(tty_ldisc_get(N_TTY, &ld));
-        tty_ldisc_assign(tty, &ld);
-        tty_set_termios_ldisc(tty, N_TTY);
-        if (o_tty) {
-                /* FIXME: could o_tty be in setldisc here ? */
-                clear_bit(TTY_LDISC, &o_tty->flags);
-                if (o_tty->ldisc.ops->close)
-                        (o_tty->ldisc.ops->close)(o_tty);
-                tty_ldisc_put(o_tty->ldisc.ops);
-                WARN_ON(tty_ldisc_get(N_TTY, &ld));
-                tty_ldisc_assign(o_tty, &ld);
-                tty_set_termios_ldisc(o_tty, N_TTY);
-        }
+        tty_ldisc_reinit(tty);
+        /* This will need doing differently if we need to lock */
+        if (o_tty)
+                tty_ldisc_release(o_tty, NULL);
 }
 
 /**
@@ -712,10 +888,10 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
 
 void tty_ldisc_init(struct tty_struct *tty)
 {
-        struct tty_ldisc ld;
-        if (tty_ldisc_get(N_TTY, &ld) < 0)
+        struct tty_ldisc *ld = tty_ldisc_get(N_TTY);
+        if (IS_ERR(ld))
                 panic("n_tty: init_tty");
-        tty_ldisc_assign(tty, &ld);
+        tty_ldisc_assign(tty, ld);
 }
 
 void tty_ldisc_begin(void)
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 9b8004c72686..4e862a75f7ff 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -137,7 +137,7 @@ int tty_port_carrier_raised(struct tty_port *port)
 EXPORT_SYMBOL(tty_port_carrier_raised);
 
 /**
- *      tty_port_raise_dtr_rts  -       Riase DTR/RTS
+ *      tty_port_raise_dtr_rts  -       Raise DTR/RTS
  *      @port: tty port
  *
  *      Wrapper for the DTR/RTS raise logic. For the moment this is used
@@ -147,12 +147,28 @@ EXPORT_SYMBOL(tty_port_carrier_raised);
 
 void tty_port_raise_dtr_rts(struct tty_port *port)
 {
-        if (port->ops->raise_dtr_rts)
-                port->ops->raise_dtr_rts(port);
+        if (port->ops->dtr_rts)
+                port->ops->dtr_rts(port, 1);
 }
 EXPORT_SYMBOL(tty_port_raise_dtr_rts);
 
 /**
+ *      tty_port_lower_dtr_rts  -       Lower DTR/RTS
+ *      @port: tty port
+ *
+ *      Wrapper for the DTR/RTS raise logic. For the moment this is used
+ *      to hide some internal details. This will eventually become entirely
+ *      internal to the tty port.
+ */
+
+void tty_port_lower_dtr_rts(struct tty_port *port)
+{
+        if (port->ops->dtr_rts)
+                port->ops->dtr_rts(port, 0);
+}
+EXPORT_SYMBOL(tty_port_lower_dtr_rts);
+
+/**
  *      tty_port_block_til_ready        -       Waiting logic for tty open
  *      @port: the tty port being opened
  *      @tty: the tty device being bound
@@ -167,7 +183,7 @@ EXPORT_SYMBOL(tty_port_raise_dtr_rts);
  *              - port flags and counts
  *
  *      The passed tty_port must implement the carrier_raised method if it can
- *      do carrier detect and the raise_dtr_rts method if it supports software
+ *      do carrier detect and the dtr_rts method if it supports software
  *      management of these lines. Note that the dtr/rts raise is done each
  *      iteration as a hangup may have previously dropped them while we wait.
  */
@@ -177,12 +193,13 @@ int tty_port_block_til_ready(struct tty_port *port,
 {
         int do_clocal = 0, retval;
         unsigned long flags;
-        DECLARE_WAITQUEUE(wait, current);
+        DEFINE_WAIT(wait);
         int cd;
 
         /* block if port is in the process of being closed */
         if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
-                interruptible_sleep_on(&port->close_wait);
+                wait_event_interruptible(port->close_wait,
+                                !(port->flags & ASYNC_CLOSING));
                 if (port->flags & ASYNC_HUP_NOTIFY)
                         return -EAGAIN;
                 else
@@ -205,7 +222,6 @@ int tty_port_block_til_ready(struct tty_port *port,
            before the next open may complete */
 
         retval = 0;
-        add_wait_queue(&port->open_wait, &wait);
 
         /* The port lock protects the port counts */
         spin_lock_irqsave(&port->lock, flags);
@@ -219,7 +235,7 @@ int tty_port_block_til_ready(struct tty_port *port,
                 if (tty->termios->c_cflag & CBAUD)
                         tty_port_raise_dtr_rts(port);
 
-                set_current_state(TASK_INTERRUPTIBLE);
+                prepare_to_wait(&port->open_wait, &wait, TASK_INTERRUPTIBLE);
                 /* Check for a hangup or uninitialised port. Return accordingly */
                 if (tty_hung_up_p(filp) || !(port->flags & ASYNC_INITIALIZED)) {
                         if (port->flags & ASYNC_HUP_NOTIFY)
@@ -240,8 +256,7 @@ int tty_port_block_til_ready(struct tty_port *port,
                 }
                 schedule();
         }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&port->open_wait, &wait);
+        finish_wait(&port->open_wait, &wait);
 
         /* Update counts. A parallel hangup will have set count to zero and
            we must not mess that up further */
@@ -292,6 +307,17 @@ int tty_port_close_start(struct tty_port *port, struct tty_struct *tty, struct f
         if (port->flags & ASYNC_INITIALIZED &&
                         port->closing_wait != ASYNC_CLOSING_WAIT_NONE)
                 tty_wait_until_sent(tty, port->closing_wait);
+        if (port->drain_delay) {
+                unsigned int bps = tty_get_baud_rate(tty);
+                long timeout;
+
+                if (bps > 1200)
+                        timeout = max_t(long, (HZ * 10 * port->drain_delay) / bps,
+                                                                HZ / 10);
+                else
+                        timeout = 2 * HZ;
+                schedule_timeout_interruptible(timeout);
+        }
         return 1;
 }
 EXPORT_SYMBOL(tty_port_close_start);
@@ -302,6 +328,9 @@ void tty_port_close_end(struct tty_port *port, struct tty_struct *tty)
 
         tty_ldisc_flush(tty);
 
+        if (tty->termios->c_cflag & HUPCL)
+                tty_port_lower_dtr_rts(port);
+
         spin_lock_irqsave(&port->lock, flags);
         tty->closing = 0;
 
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index ffc9254f7e02..042c8149a6d1 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -867,7 +867,7 @@ static int viotape_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         int j;
         struct device_node *node = vdev->dev.archdata.of_node;
 
-        if (i > VIOTAPE_MAX_TAPE)
+        if (i >= VIOTAPE_MAX_TAPE)
                 return -ENODEV;
         if (!node)
                 return -ENODEV;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index ff6f5a4b58fb..c74dacfa6795 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -188,6 +188,9 @@ static void hvc_handle_input(struct virtqueue *vq)
  * Finally we put our input buffer in the input queue, ready to receive. */
 static int __devinit virtcons_probe(struct virtio_device *dev)
 {
+        vq_callback_t *callbacks[] = { hvc_handle_input, NULL};
+        const char *names[] = { "input", "output" };
+        struct virtqueue *vqs[2];
         int err;
 
         vdev = dev;
@@ -199,20 +202,15 @@ static int __devinit virtcons_probe(struct virtio_device *dev)
                 goto fail;
         }
 
-        /* Find the input queue. */
+        /* Find the queues. */
         /* FIXME: This is why we want to wean off hvc: we do nothing
          * when input comes in. */
-        in_vq = vdev->config->find_vq(vdev, 0, hvc_handle_input);
-        if (IS_ERR(in_vq)) {
-                err = PTR_ERR(in_vq);
+        err = vdev->config->find_vqs(vdev, 2, vqs, callbacks, names);
+        if (err)
                 goto free;
-        }
 
-        out_vq = vdev->config->find_vq(vdev, 1, NULL);
-        if (IS_ERR(out_vq)) {
-                err = PTR_ERR(out_vq);
-                goto free_in_vq;
-        }
+        in_vq = vqs[0];
+        out_vq = vqs[1];
 
         /* Start using the new console output. */
         virtio_cons.get_chars = get_chars;
@@ -233,17 +231,15 @@ static int __devinit virtcons_probe(struct virtio_device *dev)
         hvc = hvc_alloc(0, 0, &virtio_cons, PAGE_SIZE);
         if (IS_ERR(hvc)) {
                 err = PTR_ERR(hvc);
-                goto free_out_vq;
+                goto free_vqs;
         }
 
         /* Register the input buffer the first time. */
         add_inbuf();
         return 0;
 
-free_out_vq:
-        vdev->config->del_vq(out_vq);
-free_in_vq:
-        vdev->config->del_vq(in_vq);
+free_vqs:
+        vdev->config->del_vqs(vdev);
 free:
         kfree(inbuf);
 fail:
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 08151d4de489..d9113b4c76e3 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -95,7 +95,6 @@
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/workqueue.h>
-#include <linux/bootmem.h>
 #include <linux/pm.h>
 #include <linux/font.h>
 #include <linux/bitops.h>
@@ -172,8 +171,9 @@ int do_poke_blanked_console;
 int console_blanked;
 
 static int vesa_blank_mode; /* 0:none 1:suspendV 2:suspendH 3:powerdown */
-static int blankinterval = 10*60*HZ;
 static int vesa_off_interval;
+static int blankinterval = 10*60;
+core_param(consoleblank, blankinterval, int, 0444);
 
 static DECLARE_WORK(console_work, console_callback);
 
@@ -1486,7 +1486,7 @@ static void setterm_command(struct vc_data *vc)
                         update_attr(vc);
                         break;
                 case 9: /* set blanking interval */
-                        blankinterval = ((vc->vc_par[1] < 60) ? vc->vc_par[1] : 60) * 60 * HZ;
+                        blankinterval = ((vc->vc_par[1] < 60) ? vc->vc_par[1] : 60) * 60;
                         poke_blanked_console();
                         break;
                 case 10: /* set bell frequency in Hz */
@@ -2872,17 +2872,14 @@ static int __init con_init(void)
 
         if (blankinterval) {
                 blank_state = blank_normal_wait;
-                mod_timer(&console_timer, jiffies + blankinterval);
+                mod_timer(&console_timer, jiffies + (blankinterval * HZ));
         }
 
-        /*
-         * kmalloc is not running yet - we use the bootmem allocator.
-         */
         for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
-                vc_cons[currcons].d = vc = alloc_bootmem(sizeof(struct vc_data));
+                vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT);
                 INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
                 visual_init(vc, currcons, 1);
-                vc->vc_screenbuf = (unsigned short *)alloc_bootmem(vc->vc_screenbuf_size);
+                vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
                 vc->vc_kmalloced = 0;
                 vc_init(vc, vc->vc_rows, vc->vc_cols,
                         currcons || !vc->vc_sw->con_save_screen);
@@ -3681,7 +3678,7 @@ void do_unblank_screen(int leaving_gfx)
                 return; /* but leave console_blanked != 0 */
 
         if (blankinterval) {
-                mod_timer(&console_timer, jiffies + blankinterval);
+                mod_timer(&console_timer, jiffies + (blankinterval * HZ));
                 blank_state = blank_normal_wait;
         }
 
@@ -3715,7 +3712,7 @@ void unblank_screen(void)
 static void blank_screen_t(unsigned long dummy)
 {
         if (unlikely(!keventd_up())) {
-                mod_timer(&console_timer, jiffies + blankinterval);
+                mod_timer(&console_timer, jiffies + (blankinterval * HZ));
                 return;
         }
         blank_timer_expired = 1;
@@ -3745,7 +3742,7 @@ void poke_blanked_console(void)
         if (console_blanked)
                 unblank_screen();
         else if (blankinterval) {
-                mod_timer(&console_timer, jiffies + blankinterval);
+                mod_timer(&console_timer, jiffies + (blankinterval * HZ));
                 blank_state = blank_normal_wait;
         }
 }
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index e6ce632a393e..7539bed0f7e0 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -396,7 +396,8 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         kbd = kbd_table + console;
         switch (cmd) {
         case TIOCLINUX:
-                return tioclinux(tty, arg);
+                ret = tioclinux(tty, arg);
+                break;
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;