249 files changed, 6439 insertions, 8056 deletions
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 73060819ed99..438277800103 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -159,8 +159,6 @@ hayes-esp.txt
        - info on using the Hayes ESP serial driver.
 highuid.txt
        - notes on the change from 16 bit to 32 bit user/group IDs.
-hpet.txt
-        - High Precision Event Timer Driver for Linux.
 timers/
        - info on the timer related topics
 hw_random.txt
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 3d2d0c29f027..cc8093c15cf5 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -287,14 +287,6 @@ Who:	Glauber Costa <gcosta@redhat.com>
 ---------------------------
-What:   old style serial driver for ColdFire (CONFIG_SERIAL_COLDFIRE)
-When:   2.6.28
-Why:    This driver still uses the old interface and has been replaced
-        by CONFIG_SERIAL_MCF.
-Who:    Sebastian Siewior <sebastian@breakpoint.cc>
---------------------------
 What:   /sys/o2cb symlink
 When:   January 2010
 Why:    /sys/fs/o2cb is the proper location for this information - /sys/o2cb
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
index 74484e696405..eb154ef36c2a 100644
--- a/Documentation/filesystems/ext4.txt
+++ b/Documentation/filesystems/ext4.txt
@@ -223,6 +223,11 @@ errors=remount-ro(*)	Remount the filesystem read-only on an error.
 errors=continue         Keep going on a filesystem error.
 errors=panic            Panic and halt the machine if an error occurs.
+data_err=ignore(*)      Just print an error message if an error occurs
+                        in a file data buffer in ordered mode.
+data_err=abort          Abort the journal if an error occurs in a file
+                        data buffer in ordered mode.
 grpid                   Give objects the same group ID as their creator.
 bsdgroups
diff --git a/Documentation/timers/00-INDEX b/Documentation/timers/00-INDEX
new file mode 100644
index 000000000000..397dc35e1323
--- /dev/null
+++ b/Documentation/timers/00-INDEX
@@ -0,0 +1,10 @@
+00-INDEX
+        - this file
+highres.txt
+        - High resolution timers and dynamic ticks design notes
+hpet.txt
+        - High Precision Event Timer Driver for Linux
+hrtimers.txt
+        - subsystem for high-resolution kernel timers
+timer_stats.txt
+        - timer usage statistics
diff --git a/Documentation/hpet.txt b/Documentation/timers/hpet.txt
index 6ad52d9dad6c..e7c09abcfab4 100644
--- a/Documentation/hpet.txt
+++ b/Documentation/timers/hpet.txt
@@ -1,21 +1,32 @@
                High Precision Event Timer Driver for Linux
-The High Precision Event Timer (HPET) hardware is the future replacement
+The High Precision Event Timer (HPET) hardware follows a specification
-for the 8254 and Real Time Clock (RTC) periodic timer functionality.
+by Intel and Microsoft which can be found at
-Each HPET can have up to 32 timers.  It is possible to configure the
-first two timers as legacy replacements for 8254 and RTC periodic timers.
+        http://www.intel.com/technology/architecture/hpetspec.htm
-A specification done by Intel and Microsoft can be found at
-<http://www.intel.com/technology/architecture/hpetspec.htm>.
+Each HPET has one fixed-rate counter (at 10+ MHz, hence "High Precision")
+and up to 32 comparators.  Normally three or more comparators are provided,
+each of which can generate oneshot interupts and at least one of which has
+additional hardware to support periodic interrupts.  The comparators are
+also called "timers", which can be misleading since usually timers are
+independent of each other ... these share a counter, complicating resets.
+HPET devices can support two interrupt routing modes.  In one mode, the
+comparators are additional interrupt sources with no particular system
+role.  Many x86 BIOS writers don't route HPET interrupts at all, which
+prevents use of that mode.  They support the other "legacy replacement"
+mode where the first two comparators block interrupts from 8254 timers
+and from the RTC.
 The driver supports detection of HPET driver allocation and initialization
 of the HPET before the driver module_init routine is called.  This enables
 platform code which uses timer 0 or 1 as the main timer to intercept HPET
 initialization.  An example of this initialization can be found in
-arch/i386/kernel/time_hpet.c.
+arch/x86/kernel/hpet.c.
-The driver provides two APIs which are very similar to the API found in
+The driver provides a userspace API which resembles the API found in the
-the rtc.c driver.  There is a user space API and a kernel space API.
+RTC driver framework.  An example user space program is provided below.
-An example user space program is provided below.
 #include <stdio.h>
 #include <stdlib.h>
@@ -286,15 +297,3 @@ out:
        return;
 }
-The kernel API has three interfaces exported from the driver:
-        hpet_register(struct hpet_task *tp, int periodic)
-        hpet_unregister(struct hpet_task *tp)
-        hpet_control(struct hpet_task *tp, unsigned int cmd, unsigned long arg)
-The kernel module using this interface fills in the ht_func and ht_data
-members of the hpet_task structure before calling hpet_register.
-hpet_control simply vectors to the hpet_ioctl routine and has the same
-commands and respective arguments as the user API.  hpet_unregister
-is used to terminate usage of the HPET timer reserved by hpet_register.
diff --git a/MAINTAINERS b/MAINTAINERS
index 8bf72d378332..74b808205312 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -73,6 +73,7 @@ L: Mailing list that is relevant to this area
 W: Web-page with status/info
 T: SCM tree type and location.  Type is one of: git, hg, quilt.
 S: Status, one of the following:
+F: Applicable files and/or directories
        Supported:      Someone is actually paid to look after this.
        Maintained:     Someone actually looks after it.
@@ -102,14 +103,14 @@ M:	dave@thedillows.org
 L:      netdev@vger.kernel.org
 S:      Maintained
-3W-XXXX ATA-RAID CONTROLLER DRIVER
+3W-9XXX SATA-RAID CONTROLLER DRIVER
 P:      Adam Radford
 M:      linuxraid@amcc.com
 L:      linux-scsi@vger.kernel.org
 W:      http://www.amcc.com
 S:      Supported
-3W-9XXX SATA-RAID CONTROLLER DRIVER
+3W-XXXX ATA-RAID CONTROLLER DRIVER
 P:      Adam Radford
 M:      linuxraid@amcc.com
 L:      linux-scsi@vger.kernel.org
@@ -163,16 +164,11 @@ M:	A2232@gmx.net
 L:      linux-m68k@lists.linux-m68k.org
 S:      Maintained
-AFS FILESYSTEM & AF_RXRPC SOCKET DOMAIN
+AACRAID SCSI RAID DRIVER
-P:      David Howells
+P:      Adaptec OEM Raid Solutions
-M:      dhowells@redhat.com
+M:      aacraid@adaptec.com
-L:      linux-afs@lists.infradead.org
+L:      linux-scsi@vger.kernel.org
-S:      Supported
+W:      http://www.adaptec.com/
-AIO
-P:      Benjamin LaHaise
-M:      bcrl@kvack.org
-L:      linux-aio@kvack.org
 S:      Supported
 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
@@ -193,27 +189,6 @@ M:	jes@trained-monkey.org
 L:      linux-acenic@sunsite.dk
 S:      Maintained
-IPS SCSI RAID DRIVER
-P:      Adaptec OEM Raid Solutions
-M:      aacraid@adaptec.com
-L:      linux-scsi@vger.kernel.org
-W:      http://www.adaptec.com/
-S:      Maintained
-DPT_I2O SCSI RAID DRIVER
-P:      Adaptec OEM Raid Solutions
-M:      aacraid@adaptec.com
-L:      linux-scsi@vger.kernel.org
-W:      http://www.adaptec.com/
-S:      Maintained
-AACRAID SCSI RAID DRIVER
-P:      Adaptec OEM Raid Solutions
-M:      aacraid@adaptec.com
-L:      linux-scsi@vger.kernel.org
-W:      http://www.adaptec.com/
-S:      Supported
 ACER WMI LAPTOP EXTRAS
 P:      Carlos Corbacho
 M:      carlos@strangeworlds.co.uk
@@ -327,6 +302,12 @@ P:	Roman Zippel
 M:      zippel@linux-m68k.org
 S:      Maintained
+AFS FILESYSTEM & AF_RXRPC SOCKET DOMAIN
+P:      David Howells
+M:      dhowells@redhat.com
+L:      linux-afs@lists.infradead.org
+S:      Supported
 AGPGART DRIVER
 P:      David Airlie
 M:      airlied@linux.ie
@@ -345,6 +326,12 @@ M:	hare@suse.de
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
+AIO
+P:      Benjamin LaHaise
+M:      bcrl@kvack.org
+L:      linux-aio@kvack.org
+S:      Supported
 ALCATEL SPEEDTOUCH USB DRIVER
 P:      Duncan Sands
 M:      duncan.sands@free.fr
@@ -737,7 +724,7 @@ L:	linux-kernel@vger.kernel.org
 W:      http://sourceforge.net/projects/xscaleiop
 S:      Supported
-ATA OVER ETHERNET DRIVER
+ATA OVER ETHERNET (AOE) DRIVER
 P:      Ed L. Cashin
 M:      ecashin@coraid.com
 W:      http://www.coraid.com/support/linux
@@ -870,11 +857,48 @@ L:	linux-hams@vger.kernel.org
 W:      http://www.linux-ax25.org/
 S:      Maintained
+B43 WIRELESS DRIVER
+P:      Michael Buesch
+M:      mb@bu3sch.de
+P:      Stefano Brivio
+M:      stefano.brivio@polimi.it
+L:      linux-wireless@vger.kernel.org
+W:      http://linuxwireless.org/en/users/Drivers/b43
+S:      Maintained
+B43LEGACY WIRELESS DRIVER
+P:      Larry Finger
+M:      Larry.Finger@lwfinger.net
+P:      Stefano Brivio
+M:      stefano.brivio@polimi.it
+L:      linux-wireless@vger.kernel.org
+W:      http://linuxwireless.org/en/users/Drivers/b43
+S:      Maintained
 BACKLIGHT CLASS/SUBSYSTEM
 P:      Richard Purdie
 M:      rpurdie@rpsys.net
 S:      Maintained
+BAYCOM/HDLCDRV DRIVERS FOR AX.25
+P:      Thomas Sailer
+M:      t.sailer@alumni.ethz.ch
+L:      linux-hams@vger.kernel.org
+W:      http://www.baycom.org/~tom/ham/ham.html
+S:      Maintained
+BEFS FILE SYSTEM
+P:      Sergey S. Kostyliov
+M:      rathamahata@php4.ru
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+BFS FILE SYSTEM
+P:      Tigran A. Aivazian
+M:      tigran@aivazian.fsnet.co.uk
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
 BLACKFIN ARCHITECTURE
 P:      Bryan Wu
 M:      cooloney@kernel.org
@@ -910,43 +934,6 @@ L:	uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
 W:      http://blackfin.uclinux.org
 S:      Supported
-BAYCOM/HDLCDRV DRIVERS FOR AX.25
-P:      Thomas Sailer
-M:      t.sailer@alumni.ethz.ch
-L:      linux-hams@vger.kernel.org
-W:      http://www.baycom.org/~tom/ham/ham.html
-S:      Maintained
-B43 WIRELESS DRIVER
-P:      Michael Buesch
-M:      mb@bu3sch.de
-P:      Stefano Brivio
-M:      stefano.brivio@polimi.it
-L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/en/users/Drivers/b43
-S:      Maintained
-B43LEGACY WIRELESS DRIVER
-P:      Larry Finger
-M:      Larry.Finger@lwfinger.net
-P:      Stefano Brivio
-M:      stefano.brivio@polimi.it
-L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/en/users/Drivers/b43
-S:      Maintained
-BEFS FILE SYSTEM
-P:      Sergey S. Kostyliov
-M:      rathamahata@php4.ru
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
-BFS FILE SYSTEM
-P:      Tigran A. Aivazian
-M:      tigran@aivazian.fsnet.co.uk
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
 BLACKFIN I2C TWI DRIVER
 P:      Sonic Zhang
 M:      sonic.zhang@analog.com
@@ -1040,15 +1027,6 @@ M:	corbet@lwn.net
 L:      video4linux-list@redhat.com
 S:      Maintained
-CAN NETWORK LAYER
-P:      Urs Thuermann
-M:      urs.thuermann@volkswagen.de
-P:      Oliver Hartkopp
-M:      oliver.hartkopp@volkswagen.de
-L:      socketcan-core@lists.berlios.de (subscribers-only)
-W:      http://developer.berlios.de/projects/socketcan/
-S:      Maintained
 CALGARY x86-64 IOMMU
 P:      Muli Ben-Yehuda
 M:      muli@il.ibm.com
@@ -1058,6 +1036,15 @@ L:	linux-kernel@vger.kernel.org
 L:      discuss@x86-64.org
 S:      Maintained
+CAN NETWORK LAYER
+P:      Urs Thuermann
+M:      urs.thuermann@volkswagen.de
+P:      Oliver Hartkopp
+M:      oliver.hartkopp@volkswagen.de
+L:      socketcan-core@lists.berlios.de (subscribers-only)
+W:      http://developer.berlios.de/projects/socketcan/
+S:      Maintained
 CELL BROADBAND ENGINE ARCHITECTURE
 P:      Arnd Bergmann
 M:      arnd@arndb.de
@@ -1066,13 +1053,6 @@ L:	cbe-oss-dev@ozlabs.org
 W:      http://www.ibm.com/developerworks/power/cell/
 S:      Supported
-CISCO 10G ETHERNET DRIVER
-P:      Scott Feldman
-M:      scofeldm@cisco.com
-P:      Joe Eykholt
-M:      jeykholt@cisco.com
-S:      Supported
 CFAG12864B LCD DRIVER
 P:      Miguel Ojeda Sandonis
 M:      miguel.ojeda.sandonis@gmail.com
@@ -1104,19 +1084,11 @@ P:	Joel Schopp
 M:      jschopp@austin.ibm.com
 S:      Supported
-COMMON INTERNET FILE SYSTEM (CIFS)
+CISCO 10G ETHERNET DRIVER
-P:      Steve French
+P:      Scott Feldman
-M:      sfrench@samba.org
+M:      scofeldm@cisco.com
-L:      linux-cifs-client@lists.samba.org
+P:      Joe Eykholt
-L:      samba-technical@lists.samba.org
+M:      jeykholt@cisco.com
-W:      http://linux-cifs.samba.org/
-T:      git kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6.git
-S:      Supported
-CONFIGFS
-P:      Joel Becker
-M:      joel.becker@oracle.com
-L:      linux-kernel@vger.kernel.org
 S:      Supported
 CIRRUS LOGIC EP93XX ETHERNET DRIVER
@@ -1152,6 +1124,15 @@ L:	codalist@coda.cs.cmu.edu
 W:      http://www.coda.cs.cmu.edu/
 S:      Maintained
+COMMON INTERNET FILE SYSTEM (CIFS)
+P:      Steve French
+M:      sfrench@samba.org
+L:      linux-cifs-client@lists.samba.org
+L:      samba-technical@lists.samba.org
+W:      http://linux-cifs.samba.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6.git
+S:      Supported
 COMPACTPCI HOTPLUG CORE
 P:      Scott Murray
 M:      scottm@somanetworks.com
@@ -1191,6 +1172,12 @@ L:	accessrunner-general@lists.sourceforge.net
 W:      http://accessrunner.sourceforge.net/
 S:      Maintained
+CONFIGFS
+P:      Joel Becker
+M:      joel.becker@oracle.com
+L:      linux-kernel@vger.kernel.org
+S:      Supported
 CONTROL GROUPS (CGROUPS)
 P:      Paul Menage
 M:      menage@google.com
@@ -1314,6 +1301,20 @@ W:	http://www.qsl.net/dl1bke/
 L:      linux-hams@vger.kernel.org
 S:      Maintained
+DAVICOM FAST ETHERNET (DMFE) NETWORK DRIVER
+P:      Tobias Ringstrom
+M:      tori@unhappy.mine.nu
+L:      netdev@vger.kernel.org
+S:      Maintained
+DC390/AM53C974 SCSI driver
+P:      Kurt Garloff
+M:      garloff@suse.de
+W:      http://www.garloff.de/kurt/linux/dc390/
+P:      Guennadi Liakhovetski
+M:      g.liakhovetski@gmx.de
+S:      Maintained
 DC395x SCSI driver
 P:      Oliver Neukum
 M:      oliver@neukum.name
@@ -1326,14 +1327,6 @@ L:	dc395x@twibble.org
 L:      http://lists.twibble.org/mailman/listinfo/dc395x/
 S:      Maintained
-DC390/AM53C974 SCSI driver
-P:      Kurt Garloff
-M:      garloff@suse.de
-W:      http://www.garloff.de/kurt/linux/dc390/
-P:      Guennadi Liakhovetski
-M:      g.liakhovetski@gmx.de
-S:      Maintained
 DCCP PROTOCOL
 P:      Arnaldo Carvalho de Melo
 M:      acme@ghostprotocols.net
@@ -1364,12 +1357,6 @@ P:	Doug Warzecha
 M:      Douglas_Warzecha@dell.com
 S:      Maintained
-DEVICE-MAPPER  (LVM)
-P:      Alasdair Kergon
-L:      dm-devel@redhat.com
-W:      http://sources.redhat.com/dm
-S:      Maintained
 DEVICE NUMBER REGISTRY
 P:      Torben Mathiasen
 M:      device@lanana.org
@@ -1377,6 +1364,12 @@ W:	http://lanana.org/docs/device-list/index.html
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
+DEVICE-MAPPER  (LVM)
+P:      Alasdair Kergon
+L:      dm-devel@redhat.com
+W:      http://sources.redhat.com/dm
+S:      Maintained
 DIGI INTL. EPCA DRIVER
 P:      Digi International, Inc
 M:      Eng.Linux@digi.com
@@ -1384,7 +1377,7 @@ L:	Eng.Linux@digi.com
 W:      http://www.digi.com
 S:      Orphan
-DIRECTORY NOTIFICATION
+DIRECTORY NOTIFICATION (DNOTIFY)
 P:      Stephen Rothwell
 M:      sfr@canb.auug.org.au
 L:      linux-kernel@vger.kernel.org
@@ -1398,13 +1391,13 @@ W:	http://www.win.tue.nl/~aeb/linux/zip/zip-1.html
 W:      http://www.win.tue.nl/~aeb/partitions/partition_types-1.html
 S:      Maintained
-DISKQUOTA:
+DISKQUOTA
 P:      Jan Kara
 M:      jack@suse.cz
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
-DISTRIBUTED LOCK MANAGER
+DISTRIBUTED LOCK MANAGER (DLM)
 P:      Christine Caulfield
 M:      ccaulfie@redhat.com
 P:      David Teigland
@@ -1414,12 +1407,6 @@ W:	http://sources.redhat.com/cluster/
 T:      git kernel.org:/pub/scm/linux/kernel/git/teigland/dlm.git
 S:      Supported
-DAVICOM FAST ETHERNET (DMFE) NETWORK DRIVER
-P:      Tobias Ringstrom
-M:      tori@unhappy.mine.nu
-L:      netdev@vger.kernel.org
-S:      Maintained
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 P:      Maciej Sosnowski
 M:      maciej.sosnowski@intel.com
@@ -1459,6 +1446,13 @@ M:	jrv@vanzandt.mv.com
 L:      blinux-list@redhat.com
 S:      Maintained
+DPT_I2O SCSI RAID DRIVER
+P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
 DRIVER CORE, KOBJECTS, AND SYSFS
 P:      Greg Kroah-Hartman
 M:      gregkh@suse.de
@@ -1607,7 +1601,7 @@ EFS FILESYSTEM
 W:      http://aeschi.ch.eu.org/efs/
 S:      Orphan
-EHCA (IBM GX bus InfiniBand adapter) DRIVER:
+EHCA (IBM GX bus InfiniBand adapter) DRIVER
 P:      Hoang-Nam Nguyen
 M:      hnguyen@de.ibm.com
 P:      Christoph Raisch
@@ -1687,6 +1681,42 @@ P:	Akinobu Mita
 M:      akinobu.mita@gmail.com
 S:      Supported
+FILE LOCKING (flock() and fcntl()/lockf())
+P:      Matthew Wilcox
+M:      matthew@wil.cx
+L:      linux-fsdevel@vger.kernel.org
+S:      Maintained
+FILESYSTEMS (VFS and infrastructure)
+P:      Alexander Viro
+M:      viro@zeniv.linux.org.uk
+L:      linux-fsdevel@vger.kernel.org
+S:      Maintained
+FIREWIRE SUBSYSTEM (drivers/firewire, <linux/firewire*.h>)
+P:      Kristian Hoegsberg, Stefan Richter
+M:      krh@redhat.com, stefanr@s5r6.in-berlin.de
+L:      linux1394-devel@lists.sourceforge.net
+W:      http://www.linux1394.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git
+S:      Maintained
+FIRMWARE LOADER (request_firmware)
+L:      linux-kernel@vger.kernel.org
+S:      Orphan
+FPU EMULATOR
+P:      Bill Metzenthen
+M:      billm@suburbia.net
+W:      http://suburbia.net/~billm/floating-point/emulator/
+S:      Maintained
+FRAME RELAY DLCI/FRAD (Sangoma drivers too)
+P:      Mike McLagan
+M:      mike.mclagan@linux.org
+L:      netdev@vger.kernel.org
+S:      Maintained
 FRAMEBUFFER LAYER
 P:      Antonino Daplas
 M:      adaplas@gmail.com
@@ -1752,42 +1782,6 @@ L:	alsa-devel@alsa-project.org
 L:      linuxppc-dev@ozlabs.org
 S:      Supported
-FILE LOCKING (flock() and fcntl()/lockf())
-P:      Matthew Wilcox
-M:      matthew@wil.cx
-L:      linux-fsdevel@vger.kernel.org
-S:      Maintained
-FILESYSTEMS (VFS and infrastructure)
-P:      Alexander Viro
-M:      viro@zeniv.linux.org.uk
-L:      linux-fsdevel@vger.kernel.org
-S:      Maintained
-FIREWIRE SUBSYSTEM (drivers/firewire, <linux/firewire*.h>)
-P:      Kristian Hoegsberg, Stefan Richter
-M:      krh@redhat.com, stefanr@s5r6.in-berlin.de
-L:      linux1394-devel@lists.sourceforge.net
-W:      http://www.linux1394.org/
-T:      git kernel.org:/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git
-S:      Maintained
-FIRMWARE LOADER (request_firmware)
-L:      linux-kernel@vger.kernel.org
-S:      Orphan
-FPU EMULATOR
-P:      Bill Metzenthen
-M:      billm@suburbia.net
-W:      http://suburbia.net/~billm/floating-point/emulator/
-S:      Maintained
-FRAME RELAY DLCI/FRAD (Sangoma drivers too)
-P:      Mike McLagan
-M:      mike.mclagan@linux.org
-L:      netdev@vger.kernel.org
-S:      Maintained
 FREEVXFS FILESYSTEM
 P:      Christoph Hellwig
 M:      hch@infradead.org
@@ -1859,6 +1853,13 @@ L:	gigaset307x-common@lists.sourceforge.net
 W:      http://gigaset307x.sourceforge.net/
 S:      Maintained
+HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
+P:      Robert Love
+M:      rlove@rlove.org
+M:      linux-kernel@vger.kernel.org
+W:      http://www.kernel.org/pub/linux/kernel/people/rml/hdaps/
+S:      Maintained
 HARDWARE MONITORING
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
@@ -1867,13 +1868,6 @@ S:	Orphan
 HARDWARE RANDOM NUMBER GENERATOR CORE
 S:      Orphan
-HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
-P:      Robert Love
-M:      rlove@rlove.org
-M:      linux-kernel@vger.kernel.org
-W:      http://www.kernel.org/pub/linux/kernel/people/rml/hdaps/
-S:      Maintained
 HARMONY SOUND DRIVER
 P:      Kyle McMartin
 M:      kyle@mcmartin.ca
@@ -1887,6 +1881,24 @@ L:	linux-kernel@vger.kernel.org
 W:      http://www.nyx.net/~arobinso
 S:      Maintained
+HEWLETT-PACKARD FIBRE CHANNEL 64-bit/66MHz PCI non-intelligent HBA
+P:      Chirag Kantharia
+M:      chirag.kantharia@hp.com
+L:      iss_storagedev@hp.com
+S:      Maintained
+HEWLETT-PACKARD SMART2 RAID DRIVER
+P:      Chirag Kantharia
+M:      chirag.kantharia@hp.com
+L:      iss_storagedev@hp.com
+S:      Maintained
+HEWLETT-PACKARD SMART CISS RAID DRIVER (cciss)
+P:      Mike Miller
+M:      mike.miller@hp.com
+L:      iss_storagedev@hp.com
+S:      Supported
 HFS FILESYSTEM
 P:      Roman Zippel
 M:      zippel@linux-m68k.org
@@ -1900,6 +1912,14 @@ L:	linux-nvidia@lists.surfsouth.com
 W:      http://drama.obuda.kando.hu/~fero/cgi-bin/hgafb.shtml
 S:      Maintained
+HIBERNATION (aka Software Suspend, aka swsusp)
+P:      Pavel Machek
+M:      pavel@suse.cz
+P:      Rafael J. Wysocki
+M:      rjw@sisk.pl
+L:      linux-pm@lists.linux-foundation.org
+S:      Supported
 HID CORE LAYER
 P:      Jiri Kosina
 M:      jkosina@suse.cz
@@ -1932,24 +1952,6 @@ M:	jes@trained-monkey.org
 L:      linux-hippi@sunsite.dk
 S:      Maintained
-HEWLETT-PACKARD FIBRE CHANNEL 64-bit/66MHz PCI non-intelligent HBA
-P:      Chirag Kantharia
-M:      chirag.kantharia@hp.com
-L:      iss_storagedev@hp.com
-S:      Maintained
-HEWLETT-PACKARD SMART2 RAID DRIVER
-P:      Chirag Kantharia
-M:      chirag.kantharia@hp.com
-L:      iss_storagedev@hp.com
-S:      Maintained
-HEWLETT-PACKARD SMART CISS RAID DRIVER (cciss)
-P:      Mike Miller
-M:      mike.miller@hp.com
-L:      iss_storagedev@hp.com
-S:      Supported
 HOST AP DRIVER
 P:      Jouni Malinen
 M:      j@w1.fi
@@ -1958,16 +1960,16 @@ L:	linux-wireless@vger.kernel.org
 W:      http://hostap.epitest.fi/
 S:      Maintained
-HP100:  Driver for HP 10/100 Mbit/s Voice Grade Network Adapter Series
-P:      Jaroslav Kysela
-M:      perex@perex.cz
-S:      Maintained
 HP COMPAQ TC1100 TABLET WMI EXTRAS DRIVER
 P:      Carlos Corbacho
 M:      carlos@strangeworlds.co.uk
 S:      Odd Fixes
+HP100:  Driver for HP 10/100 Mbit/s Voice Grade Network Adapter Series
+P:      Jaroslav Kysela
+M:      perex@perex.cz
+S:      Maintained
 HPET:   High Precision Event Timers driver (drivers/char/hpet.c)
 P:      Clemens Ladisch
 M:      clemens@ladisch.de
@@ -2047,14 +2049,6 @@ W:	http://www.ia64-linux.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/aegl/linux-2.6.git
 S:      Maintained
-SN-IA64 (Itanium) SUB-PLATFORM
-P:      Jes Sorensen
-M:      jes@sgi.com
-L:      linux-altix@sgi.com
-L:      linux-ia64@vger.kernel.org
-W:      http://www.sgi.com/altix
-S:      Maintained
 IBM MCA SCSI SUBSYSTEM DRIVER
 P:      Michael Lang
 M:      langa2@kph.uni-mainz.de
@@ -2138,14 +2132,6 @@ W:	http://www.openib.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/roland/infiniband.git
 S:      Supported
-INPUT (KEYBOARD, MOUSE, JOYSTICK, TOUCHSCREEN) DRIVERS
-P:      Dmitry Torokhov
-M:      dmitry.torokhov@gmail.com
-M:      dtor@mail.ru
-L:      linux-input@vger.kernel.org
-T:      git kernel.org:/pub/scm/linux/kernel/git/dtor/input.git
-S:      Maintained
 INOTIFY
 P:      John McCutchan
 M:      ttb@tentacle.dhs.org
@@ -2154,6 +2140,14 @@ M:	rml@novell.com
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
+INPUT (KEYBOARD, MOUSE, JOYSTICK, TOUCHSCREEN) DRIVERS
+P:      Dmitry Torokhov
+M:      dmitry.torokhov@gmail.com
+M:      dtor@mail.ru
+L:      linux-input@vger.kernel.org
+T:      git kernel.org:/pub/scm/linux/kernel/git/dtor/input.git
+S:      Maintained
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
 P:      Sylvain Meyer
 M:      sylvain.meyer@worldonline.fr
@@ -2258,7 +2252,7 @@ M:	pfg@sgi.com
 L:      linux-mips@linux-mips.org
 S:      Maintained
-IP MASQUERADING:
+IP MASQUERADING
 P:      Juanjo Ciarlante
 M:      jjciarla@raiz.uncu.edu.ar
 S:      Maintained
@@ -2273,7 +2267,7 @@ M:	jesse@icplus.com.tw
 L:      netdev@vger.kernel.org
 S:      Maintained
-IPATH DRIVER:
+IPATH DRIVER
 P:      Ralph Campbell
 M:      infinipath@qlogic.com
 L:      general@lists.openfabrics.org
@@ -2287,13 +2281,25 @@ L:	openipmi-developer@lists.sourceforge.net
 W:      http://openipmi.sourceforge.net/
 S:      Supported
-IPX NETWORK LAYER
+IPS SCSI RAID DRIVER
-P:      Arnaldo Carvalho de Melo
+P:      Adaptec OEM Raid Solutions
-M:      acme@ghostprotocols.net
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
+IPVS
+P:      Wensong Zhang
+M:      wensong@linux-vs.org
+P:      Simon Horman
+M:      horms@verge.net.au
+P:      Julian Anastasov
+M:      ja@ssi.bg
 L:      netdev@vger.kernel.org
+L:      lvs-devel@vger.kernel.org
 S:      Maintained
-IPWIRELES DRIVER
+IPWIRELESS DRIVER
 P:      Jiri Kosina
 M:      jkosina@suse.cz
 P:      David Sterba
@@ -2301,6 +2307,12 @@ M:	dsterba@suse.cz
 S:      Maintained
 T:      git://git.kernel.org/pub/scm/linux/kernel/git/jikos/ipwireless_cs.git
+IPX NETWORK LAYER
+P:      Arnaldo Carvalho de Melo
+M:      acme@ghostprotocols.net
+L:      netdev@vger.kernel.org
+S:      Maintained
 IRDA SUBSYSTEM
 P:      Samuel Ortiz
 M:      samuel@sortiz.org
@@ -2308,6 +2320,11 @@ L:	irda-users@lists.sourceforge.net (subscribers-only)
 W:      http://irda.sourceforge.net/
 S:      Maintained
+ISAPNP
+P:      Jaroslav Kysela
+M:      perex@perex.cz
+S:      Maintained
 ISCSI
 P:      Mike Christie
 M:      michaelc@cs.wisc.edu
@@ -2316,11 +2333,6 @@ W:	www.open-iscsi.org
 T:      git kernel.org:/pub/scm/linux/kernel/mnc/linux-2.6-iscsi.git
 S:      Maintained
-ISAPNP
-P:      Jaroslav Kysela
-M:      perex@perex.cz
-S:      Maintained
 ISDN SUBSYSTEM
 P:      Karsten Keil
 M:      kkeil@suse.de
@@ -2345,6 +2357,14 @@ L:	video4linux-list@redhat.com
 W:      http://www.ivtvdriver.org
 S:      Maintained
+JFS FILESYSTEM
+P:      Dave Kleikamp
+M:      shaggy@austin.ibm.com
+L:      jfs-discussion@lists.sourceforge.net
+W:      http://jfs.sourceforge.net/
+T:      git kernel.org:/pub/scm/linux/kernel/git/shaggy/jfs-2.6.git
+S:      Supported
 JME NETWORK DRIVER
 P:      Guo-Fu Tseng
 M:      cooldavid@cooldavid.org
@@ -2358,24 +2378,6 @@ L:	linux-mtd@lists.infradead.org
 W:      http://www.linux-mtd.infradead.org/doc/jffs2.html
 S:      Maintained
-UBI FILE SYSTEM (UBIFS)
-P:      Artem Bityutskiy
-M:      dedekind@infradead.org
-P:      Adrian Hunter
-M:      ext-adrian.hunter@nokia.com
-L:      linux-mtd@lists.infradead.org
-T:      git git://git.infradead.org/~dedekind/ubifs-2.6.git
-W:      http://www.linux-mtd.infradead.org/doc/ubifs.html
-S:      Maintained
-JFS FILESYSTEM
-P:      Dave Kleikamp
-M:      shaggy@austin.ibm.com
-L:      jfs-discussion@lists.sourceforge.net
-W:      http://jfs.sourceforge.net/
-T:      git kernel.org:/pub/scm/linux/kernel/git/shaggy/jfs-2.6.git
-S:      Supported
 JOURNALLING LAYER FOR BLOCK DEVICES (JBD)
 P:      Stephen Tweedie, Andrew Morton
 M:      sct@redhat.com, akpm@linux-foundation.org
@@ -2612,11 +2614,6 @@ W:	http://www.pasemi.com/
 L:      linuxppc-dev@ozlabs.org
 S:      Supported
-LLC (802.2)
-P:      Arnaldo Carvalho de Melo
-M:      acme@ghostprotocols.net
-S:      Maintained
 LINUX SECURITY MODULE (LSM) FRAMEWORK
 P:      Chris Wright
 M:      chrisw@sous-sol.org
@@ -2624,6 +2621,11 @@ L:	linux-security-module@vger.kernel.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/chrisw/lsm-2.6.git
 S:      Supported
+LLC (802.2)
+P:      Arnaldo Carvalho de Melo
+M:      acme@ghostprotocols.net
+S:      Maintained
 LM83 HARDWARE MONITOR DRIVER
 P:      Jean Delvare
 M:      khali@linux-fr.org
@@ -2724,14 +2726,6 @@ M:	kaber@trash.net
 L:      netdev@vger.kernel.org
 S:      Maintained
-MARVELL YUKON / SYSKONNECT DRIVER
-P:      Mirko Lindner
-M:      mlindner@syskonnect.de
-P:      Ralph Roesler
-M:      rroesler@syskonnect.de
-W:      http://www.syskonnect.com
-S:      Supported
 MAN-PAGES: MANUAL PAGES FOR LINUX -- Sections 2, 3, 4, 5, and 7
 P:      Michael Kerrisk
 M:      mtk.manpages@gmail.com
@@ -2751,6 +2745,14 @@ M:	buytenh@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
+MARVELL YUKON / SYSKONNECT DRIVER
+P:      Mirko Lindner
+M:      mlindner@syskonnect.de
+P:      Ralph Roesler
+M:      rroesler@syskonnect.de
+W:      http://www.syskonnect.com
+S:      Supported
 MATROX FRAMEBUFFER DRIVER
 P:      Petr Vandrovec
 M:      vandrove@vc.cvut.cz
@@ -2787,15 +2789,6 @@ L:	linux-mm@kvack.org
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
-MEI MN10300/AM33 PORT
-P:      David Howells
-M:      dhowells@redhat.com
-P:      Koichi Yasutake
-M:      yasutake.koichi@jp.panasonic.com
-L:      linux-am33-list@redhat.com (moderated for non-subscribers)
-W:      ftp://ftp.redhat.com/pub/redhat/gnupro/AM33/
-S:      Maintained
 MEMORY TECHNOLOGY DEVICES (MTD)
 P:      David Woodhouse
 M:      dwmw2@infradead.org
@@ -2804,14 +2797,6 @@ L:	linux-mtd@lists.infradead.org
 T:      git git://git.infradead.org/mtd-2.6.git
 S:      Maintained
-UNSORTED BLOCK IMAGES (UBI)
-P:      Artem Bityutskiy
-M:      dedekind@infradead.org
-W:      http://www.linux-mtd.infradead.org/
-L:      linux-mtd@lists.infradead.org
-T:      git git://git.infradead.org/~dedekind/ubi-2.6.git
-S:      Maintained
 MICROTEK X6 SCANNER
 P:      Oliver Neukum
 M:      oliver@neukum.name
@@ -3043,17 +3028,6 @@ L:	netdev@vger.kernel.org
 W:      http://www.netxen.com
 S:      Supported
-IPVS
-P:      Wensong Zhang
-M:      wensong@linux-vs.org
-P:      Simon Horman
-M:      horms@verge.net.au
-P:      Julian Anastasov
-M:      ja@ssi.bg
-L:      netdev@vger.kernel.org
-L:      lvs-devel@vger.kernel.org
-S:      Maintained
 NFS, SUNRPC, AND LOCKD CLIENTS
 P:      Trond Myklebust
 M:      Trond.Myklebust@netapp.com
@@ -3099,22 +3073,6 @@ M:	adaplas@gmail.com
 L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
 S:      Maintained
-OPENCORES I2C BUS DRIVER
-P:      Peter Korsgaard
-M:      jacmet@sunsite.dk
-L:      i2c@lm-sensors.org
-S:      Maintained
-ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
-P:      Mark Fasheh
-M:      mfasheh@suse.com
-P:      Joel Becker
-M:      joel.becker@oracle.com
-L:      ocfs2-devel@oss.oracle.com (moderated for non-subscribers)
-W:      http://oss.oracle.com/projects/ocfs2/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2.git
-S:      Supported
 OMFS FILESYSTEM
 P:      Bob Copeland
 M:      me@bobcopeland.com
@@ -3150,12 +3108,28 @@ L:	osst-users@lists.sourceforge.net
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
+OPENCORES I2C BUS DRIVER
+P:      Peter Korsgaard
+M:      jacmet@sunsite.dk
+L:      i2c@lm-sensors.org
+S:      Maintained
 OPROFILE
 P:      Robert Richter
 M:      robert.richter@amd.com
 L:      oprofile-list@lists.sf.net
 S:      Maintained
+ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
+P:      Mark Fasheh
+M:      mfasheh@suse.com
+P:      Joel Becker
+M:      joel.becker@oracle.com
+L:      ocfs2-devel@oss.oracle.com (moderated for non-subscribers)
+W:      http://oss.oracle.com/projects/ocfs2/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2.git
+S:      Supported
 ORINOCO DRIVER
 P:      Pavel Roskin
 M:      proski@gnu.org
@@ -3167,6 +3141,14 @@ L:	orinoco-devel@lists.sourceforge.net
 W:      http://www.nongnu.org/orinoco/
 S:      Maintained
+P54 WIRELESS DRIVER
+P:      Michael Wu
+M:      flamingice@sourmilk.net
+L:      linux-wireless@vger.kernel.org
+W:      http://prism54.org
+T:      git kernel.org:/pub/scm/linux/kernel/git/mwu/mac80211-drivers.git
+S:      Maintained
 PA SEMI ETHERNET DRIVER
 P:      Olof Johansson
 M:      olof@lixom.net
@@ -3179,10 +3161,32 @@ M:	olof@lixom.net
 L:      i2c@lm-sensors.org
 S:      Maintained
+PANASONIC MN10300/AM33 PORT
+P:      David Howells
+M:      dhowells@redhat.com
+P:      Koichi Yasutake
+M:      yasutake.koichi@jp.panasonic.com
+L:      linux-am33-list@redhat.com (moderated for non-subscribers)
+W:      ftp://ftp.redhat.com/pub/redhat/gnupro/AM33/
+S:      Maintained
 PARALLEL PORT SUPPORT
 L:      linux-parport@lists.infradead.org (subscribers-only)
 S:      Orphan
+PARAVIRT_OPS INTERFACE
+P:      Jeremy Fitzhardinge
+M:      jeremy@xensource.com
+P:      Chris Wright
+M:      chrisw@sous-sol.org
+P:      Zachary Amsden
+M:      zach@vmware.com
+P:      Rusty Russell
+M:      rusty@rustcorp.com.au
+L:      virtualization@lists.osdl.org
+L:      linux-kernel@vger.kernel.org
+S:      Supported
 PARIDE DRIVERS FOR PARALLEL PORT IDE DEVICES
 P:      Tim Waugh
 M:      tim@cyberelk.net
@@ -3202,19 +3206,6 @@ W:	http://www.parisc-linux.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/kyle/parisc-2.6.git
 S:      Maintained
-PARAVIRT_OPS INTERFACE
-P:      Jeremy Fitzhardinge
-M:      jeremy@xensource.com
-P:      Chris Wright
-M:      chrisw@sous-sol.org
-P:      Zachary Amsden
-M:      zach@vmware.com
-P:      Rusty Russell
-M:      rusty@rustcorp.com.au
-L:      virtualization@lists.osdl.org
-L:      linux-kernel@vger.kernel.org
-S:      Supported
 PC87360 HARDWARE MONITORING DRIVER
 P:      Jim Cromie
 M:      jim.cromie@gmail.com
@@ -3344,14 +3335,6 @@ L:	kpreempt-tech@lists.sourceforge.net
 W:      ftp://ftp.kernel.org/pub/linux/kernel/people/rml/preempt-kernel
 S:      Supported
-P54 WIRELESS DRIVER
-P:      Michael Wu
-M:      flamingice@sourmilk.net
-L:      linux-wireless@vger.kernel.org
-W:      http://prism54.org
-T:      git kernel.org:/pub/scm/linux/kernel/git/mwu/mac80211-drivers.git
-S:      Maintained
 PRISM54 WIRELESS DRIVER
 P:      Luis R. Rodriguez
 M:      mcgrof@gmail.com
@@ -3442,13 +3425,7 @@ M:	paulus@samba.org
 L:      linux-fbdev-devel@lists.sourceforge.net (moderated for non-subscribers)
 S:      Maintained
-RAYLINK/WEBGEAR 802.11 WIRELESS LAN DRIVER
+RALINK RT2X00 WIRELESS LAN DRIVER
-P:      Corey Thomas
-M:      coreythomas@charter.net
-L:      linux-wireless@vger.kernel.org
-S:      Maintained
-RALINK RT2X00 WLAN DRIVER
 P:      rt2x00 project
 L:      linux-wireless@vger.kernel.org
 L:      rt2400-devel@lists.sourceforge.net
@@ -3473,6 +3450,18 @@ M:	mporter@kernel.crashing.org
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
+RAYLINK/WEBGEAR 802.11 WIRELESS LAN DRIVER
+P:      Corey Thomas
+M:      coreythomas@charter.net
+L:      linux-wireless@vger.kernel.org
+S:      Maintained
+RCUTORTURE MODULE
+P:      Josh Triplett
+M:      josh@freedesktop.org
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
 RDC R-321X SoC
 P:      Florian Fainelli
 M:      florian.fainelli@telecomint.eu
@@ -3492,12 +3481,6 @@ W:	http://www.rdrop.com/users/paulmck/rclock/
 L:      linux-kernel@vger.kernel.org
 S:      Supported
-RCUTORTURE MODULE
-P:      Josh Triplett
-M:      josh@freedesktop.org
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
 REAL TIME CLOCK DRIVER
 P:      Paul Gortmaker
 M:      p_gortmaker@yahoo.com
@@ -3521,6 +3504,9 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      net/rfkill
+RISCOM8 DRIVER
+S:      Orphan
 ROCKETPORT DRIVER
 P:      Comtrol Corp.
 W:      http://www.comtrol.com
@@ -3533,9 +3519,6 @@ L:	linux-hams@vger.kernel.org
 W:      http://www.linux-ax25.org/
 S:      Maintained
-RISCOM8 DRIVER
-S:      Orphan
 RTL818X WIRELESS DRIVER
 P:      Michael Wu
 M:      flamingice@sourmilk.net
@@ -3675,6 +3658,12 @@ M:	saschasommer@freenet.de
 L:      sdricohcs-devel@lists.sourceforge.net (subscribers-only)
 S:      Maintained
+SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) DRIVER
+P:      Pierre Ossman
+M:      drzeus-sdhci@drzeus.cx
+L:      sdhci-devel@list.drzeus.cx
+S:      Maintained
 SECURITY CONTACT
 P:      Security Officers
 M:      security@kernel.org
@@ -3698,19 +3687,13 @@ P:	Jiri Slaby
 M:      jirislaby@gmail.com
 S:      Maintained
-SERIAL ATA (SATA) SUBSYSTEM:
+SERIAL ATA (SATA) SUBSYSTEM
 P:      Jeff Garzik
 M:      jgarzik@pobox.com
 L:      linux-ide@vger.kernel.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev.git
 S:      Supported
-SGI SN-IA64 (Altix) SERIAL CONSOLE DRIVER
-P:      Pat Gefre
-M:      pfg@sgi.com
-L:      linux-ia64@vger.kernel.org
-S:      Supported
 SFC NETWORK DRIVER
 P:      Steve Hodgson
 P:      Ben Hutchings
@@ -3718,6 +3701,17 @@ P:	Robert Stonehouse
 M:      linux-net-drivers@solarflare.com
 S:      Supported
+SGI GRU DRIVER
+P:      Jack Steiner
+M:      steiner@sgi.com
+S:      Maintained
+SGI SN-IA64 (Altix) SERIAL CONSOLE DRIVER
+P:      Pat Gefre
+M:      pfg@sgi.com
+L:      linux-ia64@vger.kernel.org
+S:      Supported
 SGI VISUAL WORKSTATION 320 AND 540
 P:      Andrey Panin
 M:      pazke@donpac.ru
@@ -3725,16 +3719,24 @@ L:	linux-visws-devel@lists.sf.net
 W:      http://linux-visws.sf.net
 S:      Maintained for 2.6.
-SGI GRU DRIVER
-P:      Jack Steiner
-M:      steiner@sgi.com
-S:      Maintained
 SGI XP/XPC/XPNET DRIVER
 P:      Dean Nelson
 M:      dcn@sgi.com
 S:      Maintained
+SHARP LH SUPPORT (LH7952X & LH7A40X)
+P:      Marc Singer
+M:      elf@buici.com
+W:      http://projects.buici.com/arm
+L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
+S:      Maintained
+SHPC HOTPLUG DRIVER
+P:      Kristen Carlson Accardi
+M:      kristen.c.accardi@intel.com
+L:      linux-pci@vger.kernel.org
+S:      Supported
 SIMTEC EB110ATX (Chalice CATS)
 P:      Ben Dooks
 P:      Vincent Sanders
@@ -3780,6 +3782,12 @@ M:	thomas@winischhofer.net
 W:      http://www.winischhofer.at/linuxsisusbvga.shtml
 S:      Maintained
+SKGE, SKY2 10/100/1000 GIGABIT ETHERNET DRIVERS
+P:      Stephen Hemminger
+M:      shemminger@linux-foundation.org
+L:      netdev@vger.kernel.org
+S:      Maintained
 SLAB ALLOCATOR
 P:      Christoph Lameter
 M:      cl@linux-foundation.org
@@ -3806,12 +3814,25 @@ P:	Ben Nizette
 M:      bn@niasdigital.com
 S:      Maintained
+SN-IA64 (Itanium) SUB-PLATFORM
+P:      Jes Sorensen
+M:      jes@sgi.com
+L:      linux-altix@sgi.com
+L:      linux-ia64@vger.kernel.org
+W:      http://www.sgi.com/altix
+S:      Maintained
 SOC-CAMERA V4L2 SUBSYSTEM
 P:      Guennadi Liakhovetski
 M:      g.liakhovetski@gmx.de
 L:      video4linux-list@redhat.com
 S:      Maintained
+SOEKRIS NET48XX LED SUPPORT
+P:      Chris Boot
+M:      bootc@bootc.net
+S:      Maintained
 SOFTWARE RAID (Multiple Disks) SUPPORT
 P:      Ingo Molnar
 M:      mingo@redhat.com
@@ -3820,24 +3841,6 @@ M:	neilb@suse.de
 L:      linux-raid@vger.kernel.org
 S:      Supported
-HIBERNATION (aka Software Suspend, aka swsusp):
-P:      Pavel Machek
-M:      pavel@suse.cz
-P:      Rafael J. Wysocki
-M:      rjw@sisk.pl
-L:      linux-pm@lists.linux-foundation.org
-S:      Supported
-SUSPEND TO RAM:
-P:      Len Brown
-M:      len.brown@intel.com
-P:      Pavel Machek
-M:      pavel@suse.cz
-P:      Rafael J. Wysocki
-M:      rjw@sisk.pl
-L:      linux-pm@lists.linux-foundation.org
-S:      Supported
 SONIC NETWORK DRIVER
 P:      Thomas Bogendoerfer
 M:      tsbogend@alpha.franken.de
@@ -3882,59 +3885,7 @@ L:	alsa-devel@alsa-project.org (subscribers-only)
 W:      http://alsa-project.org/main/index.php/ASoC
 S:      Supported
-SPI SUBSYSTEM
+SPARC (sparc32)
-P:      David Brownell
-M:      dbrownell@users.sourceforge.net
-L:      spi-devel-general@lists.sourceforge.net
-S:      Maintained
-SPU FILE SYSTEM
-P:      Jeremy Kerr
-M:      jk@ozlabs.org
-L:      linuxppc-dev@ozlabs.org
-L:      cbe-oss-dev@ozlabs.org
-W:      http://www.ibm.com/developerworks/power/cell/
-S:      Supported
-STABLE BRANCH:
-P:      Greg Kroah-Hartman
-M:      greg@kroah.com
-P:      Chris Wright
-M:      chrisw@sous-sol.org
-L:      stable@kernel.org
-S:      Maintained
-SHARP LH SUPPORT (LH7952X & LH7A40X)
-P:      Marc Singer
-M:      elf@buici.com
-W:      http://projects.buici.com/arm
-L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
-SHPC HOTPLUG DRIVER
-P:      Kristen Carlson Accardi
-M:      kristen.c.accardi@intel.com
-L:      linux-pci@vger.kernel.org
-S:      Supported
-SECURE DIGITAL HOST CONTROLLER INTERFACE DRIVER
-P:      Pierre Ossman
-M:      drzeus-sdhci@drzeus.cx
-L:      sdhci-devel@list.drzeus.cx
-S:      Maintained
-SKGE, SKY2 10/100/1000 GIGABIT ETHERNET DRIVERS
-P:      Stephen Hemminger
-M:      shemminger@linux-foundation.org
-L:      netdev@vger.kernel.org
-S:      Maintained
-SOEKRIS NET48XX LED SUPPORT
-P:      Chris Boot
-M:      bootc@bootc.net
-S:      Maintained
-SPARC (sparc32):
 P:      William L. Irwin
 M:      wli@holomorphy.com
 L:      sparclinux@vger.kernel.org
@@ -3946,6 +3897,12 @@ M:	R.E.Wolff@BitWizard.nl
 L:      linux-kernel@vger.kernel.org ?
 S:      Supported
+SPI SUBSYSTEM
+P:      David Brownell
+M:      dbrownell@users.sourceforge.net
+L:      spi-devel-general@lists.sourceforge.net
+S:      Maintained
 SPIDERNET NETWORK DRIVER for CELL
 P:      Ishizaki Kou
 M:      kou.ishizaki@toshiba.co.jp
@@ -3954,12 +3911,28 @@ M:	jens@de.ibm.com
 L:      netdev@vger.kernel.org
 S:      Supported
+SPU FILE SYSTEM
+P:      Jeremy Kerr
+M:      jk@ozlabs.org
+L:      linuxppc-dev@ozlabs.org
+L:      cbe-oss-dev@ozlabs.org
+W:      http://www.ibm.com/developerworks/power/cell/
+S:      Supported
 SRM (Alpha) environment access
 P:      Jan-Benedict Glaw
 M:      jbglaw@lug-owl.de
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
+STABLE BRANCH:
+P:      Greg Kroah-Hartman
+M:      greg@kroah.com
+P:      Chris Wright
+M:      chrisw@sous-sol.org
+L:      stable@kernel.org
+S:      Maintained
 STARFIRE/DURALAN NETWORK DRIVER
 P:      Ion Badulescu
 M:      ionut@cs.columbia.edu
@@ -3975,6 +3948,12 @@ M:	laredo@gnu.org
 W:      http://www.stradis.com/
 S:      Maintained
+SUN3/3X
+P:      Sam Creasey
+M:      sammy@sammy.net
+W:      http://sammy.net/sun3/
+S:      Maintained
 SUPERH
 P:      Paul Mundt
 M:      lethal@linux-sh.org
@@ -3983,11 +3962,15 @@ W:	http://www.linux-sh.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6.git
 S:      Supported
-SUN3/3X
+SUSPEND TO RAM
-P:      Sam Creasey
+P:      Len Brown
-M:      sammy@sammy.net
+M:      len.brown@intel.com
-W:      http://sammy.net/sun3/
+P:      Pavel Machek
-S:      Maintained
+M:      pavel@suse.cz
+P:      Rafael J. Wysocki
+M:      rjw@sisk.pl
+L:      linux-pm@lists.linux-foundation.org
+S:      Supported
 SVGA HANDLING
 P:      Martin Mares
@@ -4033,7 +4016,7 @@ P:	Mark Gross
 M:      mark.gross@intel.com
 S:      Supported
-TENSILICA XTENSA PORT (xtensa):
+TENSILICA XTENSA PORT (xtensa)
 P:      Chris Zankel
 M:      chris@zankel.net
 S:      Maintained
@@ -4147,6 +4130,16 @@ M:	ballabio_dario@emc.com
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
+UBI FILE SYSTEM (UBIFS)
+P:      Artem Bityutskiy
+M:      dedekind@infradead.org
+P:      Adrian Hunter
+M:      ext-adrian.hunter@nokia.com
+L:      linux-mtd@lists.infradead.org
+T:      git git://git.infradead.org/~dedekind/ubifs-2.6.git
+W:      http://www.linux-mtd.infradead.org/doc/ubifs.html
+S:      Maintained
 UCLINUX (AND M68KNOMMU)
 P:      Greg Ungerer
 M:      gerg@uclinux.org
@@ -4172,7 +4165,7 @@ M:	dushistov@mail.ru
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
-UltraSPARC (sparc64):
+UltraSPARC (sparc64)
 P:      David S. Miller
 M:      davem@davemloft.net
 L:      sparclinux@vger.kernel.org
@@ -4186,6 +4179,14 @@ L:	linux-kernel@vger.kernel.org
 W:      http://www.kernel.dk
 S:      Maintained
+UNSORTED BLOCK IMAGES (UBI)
+P:      Artem Bityutskiy
+M:      dedekind@infradead.org
+W:      http://www.linux-mtd.infradead.org/
+L:      linux-mtd@lists.infradead.org
+T:      git git://git.infradead.org/~dedekind/ubi-2.6.git
+S:      Maintained
 USB ACM DRIVER
 P:      Oliver Neukum
 M:      oliver@neukum.name
@@ -4455,7 +4456,7 @@ L:	video4linux-list@redhat.com
 W:      http://royale.zerezo.com/zr364xx/
 S:      Maintained
-USER-MODE LINUX
+USER-MODE LINUX (UML)
 P:      Jeff Dike
 M:      jdike@addtoit.com
 L:      user-mode-linux-devel@lists.sourceforge.net
@@ -4479,7 +4480,7 @@ W:	http://kernel.org/~kzak/util-linux-ng/
 T:      git://git.kernel.org/pub/scm/utils/util-linux-ng/util-linux-ng.git
 S:      Maintained
-VFAT/FAT/MSDOS FILESYSTEM:
+VFAT/FAT/MSDOS FILESYSTEM
 P:      OGAWA Hirofumi
 M:      hirofumi@mail.parknet.co.jp
 L:      linux-kernel@vger.kernel.org
@@ -4502,7 +4503,7 @@ M:	romieu@fr.zoreil.com
 L:      netdev@vger.kernel.org
 S:      Maintained
-VIDEO FOR LINUX
+VIDEO FOR LINUX (V4L)
 P:      Mauro Carvalho Chehab
 M:      mchehab@infradead.org
 M:      v4l-dvb-maintainer@linuxtv.org
@@ -4608,6 +4609,17 @@ M:	eis@baty.hanse.de
 L:      linux-x25@vger.kernel.org
 S:      Maintained
+X86 ARCHITECTURE (32-BIT AND 64-BIT)
+P:      Thomas Gleixner
+M:      tglx@linutronix.de
+P:      Ingo Molnar
+M:      mingo@redhat.com
+P:      H. Peter Anvin
+M:      hpa@zytor.com
+L:      linux-kernel@vger.kernel.org
+T:      git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86.git
+S:      Maintained
 XEN HYPERVISOR INTERFACE
 P:      Jeremy Fitzhardinge
 M:      jeremy@xensource.com
@@ -4639,17 +4651,6 @@ M:	jacmet@sunsite.dk
 L:      linux-serial@vger.kernel.org
 S:      Maintained
-X86 ARCHITECTURE (32-BIT AND 64-BIT)
-P:      Thomas Gleixner
-M:      tglx@linutronix.de
-P:      Ingo Molnar
-M:      mingo@redhat.com
-P:      H. Peter Anvin
-M:      hpa@zytor.com
-L:      linux-kernel@vger.kernel.org
-T:      git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86.git
-S:      Maintained
 YAM DRIVER FOR AX.25
 P:      Jean-Paul Roubelat
 M:      jpr@f6fbb.org
diff --git a/arch/Kconfig b/arch/Kconfig
index 364c6dadde0a..0267babe5eb9 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -13,6 +13,20 @@ config OPROFILE
          If unsure, say N.
+config OPROFILE_IBS
+        bool "OProfile AMD IBS support (EXPERIMENTAL)"
+        default n
+        depends on OPROFILE && SMP && X86
+        help
+          Instruction-Based Sampling (IBS) is a new profiling
+          technique that provides rich, precise program performance
+          information. IBS is introduced by AMD Family10h processors
+          (AMD Opteron Quad-Core processor “Barcelona”) to overcome
+          the limitations of conventional performance counter
+          sampling.
+          If unsure, say N.
 config HAVE_OPROFILE
        def_bool n
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 1bec55d63ef6..ee35226c44e9 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -5,6 +5,7 @@
 config ALPHA
        bool
        default y
+        select HAVE_AOUT
        select HAVE_IDE
        select HAVE_OPROFILE
        help
@@ -68,9 +69,6 @@ config AUTO_IRQ_AFFINITY
        depends on SMP
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 source "init/Kconfig"
diff --git a/arch/alpha/include/asm/statfs.h b/arch/alpha/include/asm/statfs.h
index ad15830baefe..de35cd438a10 100644
--- a/arch/alpha/include/asm/statfs.h
+++ b/arch/alpha/include/asm/statfs.h
@@ -1,6 +1,10 @@
 #ifndef _ALPHA_STATFS_H
 #define _ALPHA_STATFS_H
+/* Alpha is the only 64-bit platform with 32-bit statfs. And doesn't
+   even seem to implement statfs64 */
+#define __statfs_word __u32
 #include <asm-generic/statfs.h>
 #endif
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index efeed65b4a66..4853f9df37bd 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -8,6 +8,7 @@ mainmenu "Linux Kernel Configuration"
 config ARM
        bool
        default y
+        select HAVE_AOUT
        select HAVE_IDE
        select RTC_LIB
        select SYS_SUPPORTS_APM_EMULATION
@@ -140,9 +141,6 @@ config GENERIC_CALIBRATE_DELAY
        bool
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 config ARCH_MAY_HAVE_PC_FDC
        bool
diff --git a/arch/arm/include/asm/statfs.h b/arch/arm/include/asm/statfs.h
index a02e6a8c3d70..079447c05ba7 100644
--- a/arch/arm/include/asm/statfs.h
+++ b/arch/arm/include/asm/statfs.h
@@ -1,42 +1,12 @@
 #ifndef _ASMARM_STATFS_H
 #define _ASMARM_STATFS_H
-#ifndef __KERNEL_STRICT_NAMES
-# include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
-struct statfs {
-        __u32 f_type;
-        __u32 f_bsize;
-        __u32 f_blocks;
-        __u32 f_bfree;
-        __u32 f_bavail;
-        __u32 f_files;
-        __u32 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-};
 /*
 * With EABI there is 4 bytes of padding added to this structure.
 * Let's pack it so the padding goes away to simplify dual ABI support.
 * Note that user space does NOT have to pack this structure.
 */
-struct statfs64 {
+#define ARCH_PACK_STATFS64 __attribute__((packed,aligned(4)))
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-} __attribute__ ((packed,aligned(4)));
+#include <asm-generic/statfs.h>
 #endif
diff --git a/arch/avr32/include/asm/a.out.h b/arch/avr32/include/asm/a.out.h
deleted file mode 100644
index e46375a34a72..000000000000
--- a/arch/avr32/include/asm/a.out.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef __ASM_AVR32_A_OUT_H
-#define __ASM_AVR32_A_OUT_H
-struct exec
-{
-  unsigned long a_info;         /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;              /* length of text, in bytes */
-  unsigned a_data;              /* length of data, in bytes */
-  unsigned a_bss;               /* length of uninitialized data area for file, in bytes */
-  unsigned a_syms;              /* length of symbol table data in file, in bytes */
-  unsigned a_entry;             /* start address */
-  unsigned a_trsize;            /* length of relocation info for text, in bytes */
-  unsigned a_drsize;            /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* __ASM_AVR32_A_OUT_H */
diff --git a/arch/blackfin/include/asm/a.out.h b/arch/blackfin/include/asm/a.out.h
deleted file mode 100644
index 6c3d652ebd33..000000000000
--- a/arch/blackfin/include/asm/a.out.h
+++ /dev/null
@@ -1,19 +0,0 @@
-#ifndef __BFIN_A_OUT_H__
-#define __BFIN_A_OUT_H__
-struct exec {
-        unsigned long a_info;   /* Use macros N_MAGIC, etc for access */
-        unsigned a_text;        /* length of text, in bytes */
-        unsigned a_data;        /* length of data, in bytes */
-        unsigned a_bss;         /* length of uninitialized data area for file, in bytes */
-        unsigned a_syms;        /* length of symbol table data in file, in bytes */
-        unsigned a_entry;       /* start address */
-        unsigned a_trsize;      /* length of relocation info for text, in bytes */
-        unsigned a_drsize;      /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif                          /* __BFIN_A_OUT_H__ */
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 93229b3d6e3e..339293d677cc 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -117,15 +117,14 @@ int request_dma(unsigned int channel, char *device_id)
 #ifdef CONFIG_BF54x
        if (channel >= CH_UART2_RX && channel <= CH_UART3_TX) {
-                if (strncmp(device_id, "BFIN_UART", 9) == 0) {
+                unsigned int per_map;
-                        dma_ch[channel].regs->peripheral_map &= 0x0FFF;
+                per_map = dma_ch[channel].regs->peripheral_map & 0xFFF;
-                        dma_ch[channel].regs->peripheral_map |=
+                if (strncmp(device_id, "BFIN_UART", 9) == 0)
+                        dma_ch[channel].regs->peripheral_map = per_map |
                                ((channel - CH_UART2_RX + 0xC)<<12);
-                } else {
+                else
-                        dma_ch[channel].regs->peripheral_map &= 0x0FFF;
+                        dma_ch[channel].regs->peripheral_map = per_map |
-                        dma_ch[channel].regs->peripheral_map |=
                                ((channel - CH_UART2_RX + 0x6)<<12);
-                }
        }
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
index 2526b6ed6faa..75722d6008b0 100644
--- a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
@@ -78,6 +78,9 @@
 #  define CONFIG_UART1_RTS_PIN -1
 # endif
 #endif
+#define BFIN_UART_TX_FIFO_SIZE  2
 /*
 * The pin configuration is different from schematic
 */
@@ -119,7 +122,6 @@ static inline void UART_CLEAR_LSR(struct bfin_serial_port *uart)
        bfin_write16(uart->port.membase + OFFSET_LSR, -1);
 }
-struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
 struct bfin_serial_res {
        unsigned long uart_base_addr;
        int uart_irq;
@@ -164,8 +166,6 @@ struct bfin_serial_res bfin_serial_resource[] = {
 #endif
 };
-int nr_ports = ARRAY_SIZE(bfin_serial_resource);
 #define DRIVER_NAME "bfin-uart"
 static void bfin_serial_hw_init(struct bfin_serial_port *uart)
diff --git a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
index ebf592b59aab..815bfe5dd1a9 100644
--- a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
@@ -69,6 +69,8 @@
 # endif
 #endif
+#define BFIN_UART_TX_FIFO_SIZE  2
 struct bfin_serial_port {
        struct uart_port        port;
        unsigned int            old_status;
@@ -111,7 +113,6 @@ static inline void UART_CLEAR_LSR(struct bfin_serial_port *uart)
        bfin_write16(uart->port.membase + OFFSET_LSR, -1);
 }
-struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
 struct bfin_serial_res {
        unsigned long   uart_base_addr;
        int             uart_irq;
@@ -142,7 +143,6 @@ struct bfin_serial_res bfin_serial_resource[] = {
 #define DRIVER_NAME "bfin-uart"
-int nr_ports = BFIN_UART_NR_PORTS;
 static void bfin_serial_hw_init(struct bfin_serial_port *uart)
 {
diff --git a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
index 1bf56ffa22f9..b3f87e1d16a2 100644
--- a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
@@ -78,6 +78,9 @@
 #  define CONFIG_UART1_RTS_PIN -1
 # endif
 #endif
+#define BFIN_UART_TX_FIFO_SIZE  2
 /*
 * The pin configuration is different from schematic
 */
@@ -119,7 +122,6 @@ static inline void UART_CLEAR_LSR(struct bfin_serial_port *uart)
        bfin_write16(uart->port.membase + OFFSET_LSR, -1);
 }
-struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
 struct bfin_serial_res {
        unsigned long   uart_base_addr;
        int             uart_irq;
@@ -164,8 +166,6 @@ struct bfin_serial_res bfin_serial_resource[] = {
 #endif
 };
-int nr_ports = ARRAY_SIZE(bfin_serial_resource);
 #define DRIVER_NAME "bfin-uart"
 static void bfin_serial_hw_init(struct bfin_serial_port *uart)
diff --git a/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
index 5e29446a8e03..e4cf35e7ab9f 100644
--- a/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
@@ -82,6 +82,9 @@
 #  define CONFIG_UART1_RTS_PIN -1
 # endif
 #endif
+#define BFIN_UART_TX_FIFO_SIZE  2
 /*
 * The pin configuration is different from schematic
 */
@@ -105,7 +108,6 @@ struct bfin_serial_port {
 #endif
 };
-struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
 struct bfin_serial_res {
        unsigned long   uart_base_addr;
        int             uart_irq;
@@ -170,8 +172,6 @@ struct bfin_serial_res bfin_serial_resource[] = {
 #endif
 };
-int nr_ports = ARRAY_SIZE(bfin_serial_resource);
 #define DRIVER_NAME "bfin-uart"
 static void bfin_serial_hw_init(struct bfin_serial_port *uart)
diff --git a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
index 8aa02780e642..e0ce0c1843d4 100644
--- a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
@@ -69,6 +69,8 @@
 # endif
 #endif
+#define BFIN_UART_TX_FIFO_SIZE  2
 struct bfin_serial_port {
        struct uart_port        port;
        unsigned int            old_status;
@@ -111,7 +113,6 @@ static inline void UART_CLEAR_LSR(struct bfin_serial_port *uart)
        bfin_write16(uart->port.membase + OFFSET_LSR, -1);
 }
-struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
 struct bfin_serial_res {
        unsigned long   uart_base_addr;
        int             uart_irq;
@@ -142,7 +143,6 @@ struct bfin_serial_res bfin_serial_resource[] = {
 #define DRIVER_NAME "bfin-uart"
-int nr_ports = BFIN_UART_NR_PORTS;
 static void bfin_serial_hw_init(struct bfin_serial_port *uart)
 {
diff --git a/arch/cris/arch-v10/boot/tools/build.c b/arch/cris/arch-v10/boot/tools/build.c
index 2f9bbb26d603..c8adef364160 100644
--- a/arch/cris/arch-v10/boot/tools/build.c
+++ b/arch/cris/arch-v10/boot/tools/build.c
@@ -30,7 +30,6 @@
 #include <sys/sysmacros.h>
 #include <unistd.h>     /* contains read/write */
 #include <fcntl.h>
-#include <linux/a.out.h>
 #include <errno.h>
 #define MINIX_HEADER 32
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 396ab059efa3..107cb5bb9f39 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -66,9 +66,6 @@ config TIME_LOW_RES
        bool
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 config NO_IOPORT
        def_bool y
diff --git a/arch/h8300/include/asm/a.out.h b/arch/h8300/include/asm/a.out.h
deleted file mode 100644
index ded780f0a492..000000000000
--- a/arch/h8300/include/asm/a.out.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef __H8300_A_OUT_H__
-#define __H8300_A_OUT_H__
-struct exec
-{
-  unsigned long a_info;         /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;              /* length of text, in bytes */
-  unsigned a_data;              /* length of data, in bytes */
-  unsigned a_bss;               /* length of uninitialized data area for file, in bytes */
-  unsigned a_syms;              /* length of symbol table data in file, in bytes */
-  unsigned a_entry;             /* start address */
-  unsigned a_trsize;            /* length of relocation info for text, in bytes */
-  unsigned a_drsize;            /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* __H8300_A_OUT_H__ */
diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c
index dfbe7ab9ffe2..a8ef654a5a0b 100644
--- a/arch/h8300/kernel/process.c
+++ b/arch/h8300/kernel/process.c
@@ -34,7 +34,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/interrupt.h>
 #include <linux/reboot.h>
 #include <linux/fs.h>
diff --git a/arch/ia64/include/asm/a.out.h b/arch/ia64/include/asm/a.out.h
deleted file mode 100644
index 193dcfb67596..000000000000
--- a/arch/ia64/include/asm/a.out.h
+++ /dev/null
@@ -1,32 +0,0 @@
-#ifndef _ASM_IA64_A_OUT_H
-#define _ASM_IA64_A_OUT_H
-/*
- * No a.out format has been (or should be) defined so this file is
- * just a dummy that allows us to get binfmt_elf compiled.  It
- * probably would be better to clean up binfmt_elf.c so it does not
- * necessarily depend on there being a.out support.
- *
- * Modified 1998-2002
- *      David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co.
- */
-#include <linux/types.h>
-struct exec {
-        unsigned long a_info;
-        unsigned long a_text;
-        unsigned long a_data;
-        unsigned long a_bss;
-        unsigned long a_entry;
-};
-#define N_TXTADDR(x)    0
-#define N_DATADDR(x)    0
-#define N_BSSADDR(x)    0
-#define N_DRSIZE(x)     0
-#define N_TRSIZE(x)     0
-#define N_SYMSIZE(x)    0
-#define N_TXTOFF(x)     0
-#endif /* _ASM_IA64_A_OUT_H */
diff --git a/arch/ia64/include/asm/statfs.h b/arch/ia64/include/asm/statfs.h
index 811097974f31..1e589669de56 100644
--- a/arch/ia64/include/asm/statfs.h
+++ b/arch/ia64/include/asm/statfs.h
@@ -8,55 +8,13 @@
 *      David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co
 */
-#ifndef __KERNEL_STRICT_NAMES
-# include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
 /*
- * This is ugly --- we're already 64-bit, so just duplicate the definitions
+ * We need compat_statfs64 to be packed, because the i386 ABI won't
+ * add padding at the end to bring it to a multiple of 8 bytes, but
+ * the IA64 ABI will.
 */
-struct statfs {
+#define ARCH_PACK_COMPAT_STATFS64 __attribute__((packed,aligned(4)))
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct statfs64 {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct compat_statfs64 {
+#include <asm-generic/statfs.h>
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-} __attribute__((packed));
 #endif /* _ASM_IA64_STATFS_H */
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index 200100ea7610..f482a9098e32 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -21,7 +21,6 @@
 #include <linux/bitops.h>
 #include <linux/kexec.h>
-#include <asm/a.out.h>
 #include <asm/dma.h>
 #include <asm/ia32.h>
 #include <asm/io.h>
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index f57113f1f892..00289c178f89 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -36,9 +36,6 @@ config NO_IOPORT
 config NO_DMA
        def_bool y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 config HZ
        int
        default 100
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 8c5e1de68fcb..41e5bf02e230 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -5,6 +5,7 @@
 config M68K
        bool
        default y
+        select HAVE_AOUT
        select HAVE_IDE
 config MMU
@@ -53,9 +54,6 @@ config NO_IOPORT
 config NO_DMA
        def_bool SUN3
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 config HZ
        int
        default 100
diff --git a/arch/m68knommu/Kconfig b/arch/m68knommu/Kconfig
index 2e7515e8db98..0a8998315e5e 100644
--- a/arch/m68knommu/Kconfig
+++ b/arch/m68knommu/Kconfig
@@ -73,9 +73,6 @@ config GENERIC_CLOCKEVENTS
 config NO_IOPORT
        def_bool y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 source "init/Kconfig"
 menu "Processor type and features"
diff --git a/arch/m68knommu/include/asm/a.out.h b/arch/m68knommu/include/asm/a.out.h
deleted file mode 100644
index ce18ef99de04..000000000000
--- a/arch/m68knommu/include/asm/a.out.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-m68k/a.out.h>
diff --git a/arch/m68knommu/kernel/process.c b/arch/m68knommu/kernel/process.c
index 47502d5ec19f..3f2d7745f31e 100644
--- a/arch/m68knommu/kernel/process.c
+++ b/arch/m68knommu/kernel/process.c
@@ -25,7 +25,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/interrupt.h>
 #include <linux/reboot.h>
 #include <linux/fs.h>
diff --git a/arch/m68knommu/kernel/traps.c b/arch/m68knommu/kernel/traps.c
index 46f8f9d0c408..5d5d56bcd0ef 100644
--- a/arch/m68knommu/kernel/traps.c
+++ b/arch/m68knommu/kernel/traps.c
@@ -22,7 +22,6 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/types.h>
-#include <linux/a.out.h>
 #include <linux/user.h>
 #include <linux/string.h>
 #include <linux/linkage.h>
diff --git a/arch/mips/include/asm/a.out.h b/arch/mips/include/asm/a.out.h
deleted file mode 100644
index cad8371422ab..000000000000
--- a/arch/mips/include/asm/a.out.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 1994 - 1999, 2003 by Ralf Baechle
- */
-#ifndef _ASM_A_OUT_H
-#define _ASM_A_OUT_H
-#ifdef __KERNEL__
-#endif
-struct exec
-{
-        unsigned long a_info;   /* Use macros N_MAGIC, etc for access */
-        unsigned a_text;        /* length of text, in bytes */
-        unsigned a_data;        /* length of data, in bytes */
-        unsigned a_bss;         /* length of uninitialized data area for
-                                    file, in bytes */
-        unsigned a_syms;        /* length of symbol table data in file,
-                                   in bytes */
-        unsigned a_entry;       /* start address */
-        unsigned a_trsize;      /* length of relocation info for text, in
-                                    bytes */
-        unsigned a_drsize;      /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* _ASM_A_OUT_H */
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 22fc19bbe87f..ca2e4026ad20 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -22,7 +22,6 @@
 #include <linux/personality.h>
 #include <linux/sys.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/init.h>
 #include <linux/completion.h>
 #include <linux/kallsyms.h>
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 343015a2f418..37970d9b2186 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -7,7 +7,6 @@
 * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
 * Copyright (C) 2001 MIPS Technologies, Inc.
 */
-#include <linux/a.out.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/linkage.h>
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index e856218da90d..dd557c9cf001 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -53,9 +53,6 @@ config QUICKLIST
 config ARCH_HAS_ILOG2_U32
        def_bool y
-config ARCH_SUPPORTS_AOUT
-        def_bool n
 # Use the generic interrupt handling code in kernel/irq/
 config GENERIC_HARDIRQS
        def_bool y
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index a7d4fd353c2b..8313fccced5e 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -76,9 +76,6 @@ config IRQ_PER_CPU
        bool
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 # unless you want to implement ACPI on PA-RISC ... ;-)
 config PM
        bool
diff --git a/arch/powerpc/include/asm/a.out.h b/arch/powerpc/include/asm/a.out.h
deleted file mode 100644
index 89cead6b176e..000000000000
--- a/arch/powerpc/include/asm/a.out.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef _ASM_POWERPC_A_OUT_H
-#define _ASM_POWERPC_A_OUT_H
-struct exec
-{
-        unsigned long a_info;   /* Use macros N_MAGIC, etc for access */
-        unsigned a_text;        /* length of text, in bytes */
-        unsigned a_data;        /* length of data, in bytes */
-        unsigned a_bss;         /* length of uninitialized data area for file, in bytes */
-        unsigned a_syms;        /* length of symbol table data in file, in bytes */
-        unsigned a_entry;       /* start address */
-        unsigned a_trsize;      /* length of relocation info for text, in bytes */
-        unsigned a_drsize;      /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* _ASM_POWERPC_A_OUT_H */
diff --git a/arch/powerpc/include/asm/statfs.h b/arch/powerpc/include/asm/statfs.h
index 67024026c10d..5244834583a4 100644
--- a/arch/powerpc/include/asm/statfs.h
+++ b/arch/powerpc/include/asm/statfs.h
@@ -1,60 +1,6 @@
 #ifndef _ASM_POWERPC_STATFS_H
 #define _ASM_POWERPC_STATFS_H
-/* For ppc32 we just use the generic definitions, not so simple on ppc64 */
-#ifndef __powerpc64__
 #include <asm-generic/statfs.h>
-#else
-#ifndef __KERNEL_STRICT_NAMES
-#include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
-/*
- * We're already 64-bit, so duplicate the definition
- */
-struct statfs {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct statfs64 {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct compat_statfs64 {
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-};
-#endif /* ! __powerpc64__ */
 #endif
diff --git a/arch/powerpc/kernel/softemu8xx.c b/arch/powerpc/kernel/softemu8xx.c
index c906c4bf6835..23c8c5e7dc4d 100644
--- a/arch/powerpc/kernel/softemu8xx.c
+++ b/arch/powerpc/kernel/softemu8xx.c
@@ -23,7 +23,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/interrupt.h>
 #include <asm/pgtable.h>
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 81ccb8dd1a54..f5def6cf5cd6 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -23,7 +23,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
 #include <linux/module.h>
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 1ba7ce5aafae..272d79a8d289 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -17,7 +17,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/tty.h>
 #include <linux/major.h>
 #include <linux/interrupt.h>
diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
index 364714757cf1..d4c61c3c9669 100644
--- a/arch/powerpc/platforms/maple/setup.c
+++ b/arch/powerpc/platforms/maple/setup.c
@@ -23,7 +23,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/tty.h>
 #include <linux/string.h>
 #include <linux/delay.h>
diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
index 88ccf3a08a9c..82c14d203d8b 100644
--- a/arch/powerpc/platforms/powermac/setup.c
+++ b/arch/powerpc/platforms/powermac/setup.c
@@ -33,7 +33,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/tty.h>
 #include <linux/string.h>
 #include <linux/delay.h>
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 7b01d67b4e48..ec341707e41b 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -25,7 +25,6 @@
 #include <linux/unistd.h>
 #include <linux/slab.h>
 #include <linux/user.h>
-#include <linux/a.out.h>
 #include <linux/tty.h>
 #include <linux/major.h>
 #include <linux/interrupt.h>
diff --git a/arch/s390/include/asm/statfs.h b/arch/s390/include/asm/statfs.h
index 099a45579190..06cc70307ece 100644
--- a/arch/s390/include/asm/statfs.h
+++ b/arch/s390/include/asm/statfs.h
@@ -12,19 +12,16 @@
 #ifndef __s390x__
 #include <asm-generic/statfs.h>
 #else
+/*
+ * We can't use <asm-generic/statfs.h> because in 64-bit mode
+ * we mix ints of different sizes in our struct statfs.
+ */
 #ifndef __KERNEL_STRICT_NAMES
 #include <linux/types.h>
 typedef __kernel_fsid_t fsid_t;
 #endif
-/*
- * This is ugly -- we're already 64-bit clean, so just duplicate the 
- * definitions.
- */
 struct statfs {
        int  f_type;
        int  f_bsize;
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index 2ba7183bc1f0..2d2769d766ec 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -15,8 +15,6 @@ header-y += signal_32.h
 header-y += signal_64.h
 header-y += stat_32.h
 header-y += stat_64.h
-header-y += statfs_32.h
-header-y += statfs_64.h
 header-y += unistd_32.h
 header-y += unistd_64.h
diff --git a/arch/sparc/include/asm/serial.h b/arch/sparc/include/asm/serial.h
new file mode 100644
index 000000000000..f90d61c28059
--- /dev/null
+++ b/arch/sparc/include/asm/serial.h
@@ -0,0 +1,6 @@
+#ifndef __SPARC_SERIAL_H
+#define __SPARC_SERIAL_H
+#define BASE_BAUD ( 1843200 / 16 )
+#endif /* __SPARC_SERIAL_H */
diff --git a/arch/sparc/include/asm/statfs.h b/arch/sparc/include/asm/statfs.h
index 5e937a73743d..55e607ad461d 100644
--- a/arch/sparc/include/asm/statfs.h
+++ b/arch/sparc/include/asm/statfs.h
@@ -1,8 +1,6 @@
 #ifndef ___ASM_SPARC_STATFS_H
 #define ___ASM_SPARC_STATFS_H
-#if defined(__sparc__) && defined(__arch64__)
-#include <asm/statfs_64.h>
+#include <asm-generic/statfs.h>
-#else
-#include <asm/statfs_32.h>
-#endif
 #endif
diff --git a/arch/sparc/include/asm/statfs_32.h b/arch/sparc/include/asm/statfs_32.h
deleted file mode 100644
index 304520fa8863..000000000000
--- a/arch/sparc/include/asm/statfs_32.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _SPARC_STATFS_H
-#define _SPARC_STATFS_H
-#include <asm-generic/statfs.h>
-#endif
diff --git a/arch/sparc/include/asm/statfs_64.h b/arch/sparc/include/asm/statfs_64.h
deleted file mode 100644
index 79b3c890a5fa..000000000000
--- a/arch/sparc/include/asm/statfs_64.h
+++ /dev/null
@@ -1,54 +0,0 @@
-#ifndef _SPARC64_STATFS_H
-#define _SPARC64_STATFS_H
-#ifndef __KERNEL_STRICT_NAMES
-#include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
-struct statfs {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct statfs64 {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct compat_statfs64 {
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-};
-#endif
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index e09edfa560da..1f57c113df6d 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -9,8 +9,9 @@ config UML_X86
        default y
 config X86_32
-       bool
+        bool
-       default y
+        default y
+        select HAVE_AOUT
 config RWSEM_XCHGADD_ALGORITHM
        def_bool y
@@ -42,6 +43,3 @@ config ARCH_REUSE_HOST_VSYSCALL_AREA
 config GENERIC_HWEIGHT
        bool
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
diff --git a/arch/um/Kconfig.x86_64 b/arch/um/Kconfig.x86_64
index 5696e7b374b3..40b3407cfe16 100644
--- a/arch/um/Kconfig.x86_64
+++ b/arch/um/Kconfig.x86_64
@@ -37,6 +37,3 @@ config SMP_BROKEN
 config GENERIC_HWEIGHT
        bool
        default y
-config ARCH_SUPPORTS_AOUT
-        def_bool y
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index d741f35d7b3a..14a102e877d6 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -275,6 +275,8 @@ int line_ioctl(struct tty_struct *tty, struct file * file,
        case TIOCGLTC:
        case TIOCSLTC:
 #endif
+        /* Note: these are out of date as we now have TCGETS2 etc but this
+           whole lot should probably go away */
        case TCGETS:
        case TCSETSF:
        case TCSETSW:
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index fc8351f374fd..f65c2744d573 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -18,6 +18,7 @@ config X86_64
 ### Arch settings
 config X86
        def_bool y
+        select HAVE_AOUT if X86_32
        select HAVE_UNSTABLE_SCHED_CLOCK
        select HAVE_IDE
        select HAVE_OPROFILE
@@ -152,9 +153,6 @@ config AUDIT_ARCH
        bool
        default X86_64
-config ARCH_SUPPORTS_AOUT
-        def_bool y
 config ARCH_SUPPORTS_OPTIMIZED_INLINING
        def_bool y
@@ -1885,7 +1883,7 @@ config IA32_EMULATION
 config IA32_AOUT
       tristate "IA32 a.out support"
-       depends on IA32_EMULATION && ARCH_SUPPORTS_AOUT
+       depends on IA32_EMULATION
       help
         Support old a.out binaries in the 32bit emulation.
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index c5f101360520..0b7c4a3f0651 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -38,8 +38,7 @@ config M386
          - "Crusoe" for the Transmeta Crusoe series.
          - "Efficeon" for the Transmeta Efficeon series.
          - "Winchip-C6" for original IDT Winchip.
-          - "Winchip-2" for IDT Winchip 2.
+          - "Winchip-2" for IDT Winchips with 3dNow! capabilities.
-          - "Winchip-2A" for IDT Winchips with 3dNow! capabilities.
          - "GeodeGX1" for Geode GX1 (Cyrix MediaGX).
          - "Geode GX/LX" For AMD Geode GX and LX processors.
          - "CyrixIII/VIA C3" for VIA Cyrix III or VIA C3.
@@ -194,19 +193,11 @@ config MWINCHIPC6
          treat this chip as a 586TSC with some extended instructions
          and alignment requirements.
-config MWINCHIP2
-        bool "Winchip-2"
-        depends on X86_32
-        help
-          Select this for an IDT Winchip-2.  Linux and GCC
-          treat this chip as a 586TSC with some extended instructions
-          and alignment requirements.
 config MWINCHIP3D
-        bool "Winchip-2A/Winchip-3"
+        bool "Winchip-2/Winchip-2A/Winchip-3"
        depends on X86_32
        help
-          Select this for an IDT Winchip-2A or 3.  Linux and GCC
+          Select this for an IDT Winchip-2, 2A or 3.  Linux and GCC
          treat this chip as a 586TSC with some extended instructions
          and alignment requirements.  Also enable out of order memory
          stores for this CPU, which can increase performance of some
@@ -318,7 +309,7 @@ config X86_L1_CACHE_SHIFT
        int
        default "7" if MPENTIUM4 || X86_GENERIC || GENERIC_CPU || MPSC
        default "4" if X86_ELAN || M486 || M386 || MGEODEGX1
-        default "5" if MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+        default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
        default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MVIAC7
 config X86_XADD
@@ -360,7 +351,7 @@ config X86_POPAD_OK
 config X86_ALIGNMENT_16
        def_bool y
-        depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+        depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
 config X86_INTEL_USERCOPY
        def_bool y
@@ -368,7 +359,7 @@ config X86_INTEL_USERCOPY
 config X86_USE_PPRO_CHECKSUM
        def_bool y
-        depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MEFFICEON || MGEODE_LX || MCORE2
+        depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MEFFICEON || MGEODE_LX || MCORE2
 config X86_USE_3DNOW
        def_bool y
@@ -376,7 +367,7 @@ config X86_USE_3DNOW
 config X86_OOSTORE
        def_bool y
-        depends on (MWINCHIP3D || MWINCHIP2 || MWINCHIPC6) && MTRR
+        depends on (MWINCHIP3D || MWINCHIPC6) && MTRR
 #
 # P6_NOPs are a relatively minor optimization that require a family >=
@@ -396,7 +387,7 @@ config X86_P6_NOP
 config X86_TSC
        def_bool y
-        depends on ((MWINCHIP3D || MWINCHIP2 || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2) && !X86_NUMAQ) || X86_64
+        depends on ((MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2) && !X86_NUMAQ) || X86_64
 config X86_CMPXCHG64
        def_bool y
@@ -406,7 +397,7 @@ config X86_CMPXCHG64
 # generates cmov.
 config X86_CMOV
        def_bool y
-        depends on (MK7 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || X86_64)
+        depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64)
 config X86_MINIMUM_CPU_FAMILY
        int
@@ -417,7 +408,7 @@ config X86_MINIMUM_CPU_FAMILY
 config X86_DEBUGCTLMSR
        def_bool y
-        depends on !(MK6 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MCYRIXIII || M586MMX || M586TSC || M586 || M486 || M386)
+        depends on !(MK6 || MWINCHIPC6 || MWINCHIP3D || MCYRIXIII || M586MMX || M586TSC || M586 || M486 || M386)
 menuconfig PROCESSOR_SELECT
        bool "Supported processor vendors" if EMBEDDED
diff --git a/arch/x86/Makefile_32.cpu b/arch/x86/Makefile_32.cpu
index b72b4f753113..80177ec052f0 100644
--- a/arch/x86/Makefile_32.cpu
+++ b/arch/x86/Makefile_32.cpu
@@ -28,7 +28,6 @@ cflags-$(CONFIG_MK8)		+= $(call cc-option,-march=k8,-march=athlon)
 cflags-$(CONFIG_MCRUSOE)        += -march=i686 $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
 cflags-$(CONFIG_MEFFICEON)      += -march=i686 $(call tune,pentium3) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
 cflags-$(CONFIG_MWINCHIPC6)     += $(call cc-option,-march=winchip-c6,-march=i586)
-cflags-$(CONFIG_MWINCHIP2)      += $(call cc-option,-march=winchip2,-march=i586)
 cflags-$(CONFIG_MWINCHIP3D)     += $(call cc-option,-march=winchip2,-march=i586)
 cflags-$(CONFIG_MCYRIXIII)      += $(call cc-option,-march=c3,-march=i486) $(align)-functions=0 $(align)-jumps=0 $(align)-loops=0
 cflags-$(CONFIG_MVIAC3_2)       += $(call cc-option,-march=c3-2,-march=i686)
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index ca226ca31288..52d0359719d7 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -213,7 +213,6 @@ CONFIG_M686=y
 # CONFIG_MCRUSOE is not set
 # CONFIG_MEFFICEON is not set
 # CONFIG_MWINCHIPC6 is not set
-# CONFIG_MWINCHIP2 is not set
 # CONFIG_MWINCHIP3D is not set
 # CONFIG_MGEODEGX1 is not set
 # CONFIG_MGEODE_LX is not set
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 2c4b1c771e28..f0a03d7a7d63 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -210,7 +210,6 @@ CONFIG_X86_PC=y
 # CONFIG_MCRUSOE is not set
 # CONFIG_MEFFICEON is not set
 # CONFIG_MWINCHIPC6 is not set
-# CONFIG_MWINCHIP2 is not set
 # CONFIG_MWINCHIP3D is not set
 # CONFIG_MGEODEGX1 is not set
 # CONFIG_MGEODE_LX is not set
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index ffc1bb4fed7d..eb4314768bf7 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -39,11 +39,11 @@
        .endm 
        /* clobbers %eax */     
-        .macro  CLEAR_RREGS
+        .macro  CLEAR_RREGS _r9=rax
        xorl    %eax,%eax
        movq    %rax,R11(%rsp)
        movq    %rax,R10(%rsp)
-        movq    %rax,R9(%rsp)
+        movq    %\_r9,R9(%rsp)
        movq    %rax,R8(%rsp)
        .endm
@@ -52,11 +52,10 @@
         * We don't reload %eax because syscall_trace_enter() returned
         * the value it wants us to use in the table lookup.
         */
-        .macro LOAD_ARGS32 offset
+        .macro LOAD_ARGS32 offset, _r9=0
-        movl \offset(%rsp),%r11d
+        .if \_r9
-        movl \offset+8(%rsp),%r10d
        movl \offset+16(%rsp),%r9d
-        movl \offset+24(%rsp),%r8d
+        .endif
        movl \offset+40(%rsp),%ecx
        movl \offset+48(%rsp),%edx
        movl \offset+56(%rsp),%esi
@@ -145,7 +144,7 @@ ENTRY(ia32_sysenter_target)
        SAVE_ARGS 0,0,1
        /* no need to do an access_ok check here because rbp has been
           32bit zero extended */ 
-1:      movl    (%rbp),%r9d
+1:      movl    (%rbp),%ebp
        .section __ex_table,"a"
        .quad 1b,ia32_badarg
        .previous       
@@ -157,7 +156,7 @@ ENTRY(ia32_sysenter_target)
        cmpl    $(IA32_NR_syscalls-1),%eax
        ja      ia32_badsys
 sysenter_do_call:
-        IA32_ARG_FIXUP 1
+        IA32_ARG_FIXUP
 sysenter_dispatch:
        call    *ia32_sys_call_table(,%rax,8)
        movq    %rax,RAX-ARGOFFSET(%rsp)
@@ -234,20 +233,17 @@ sysexit_audit:
 #endif
 sysenter_tracesys:
-        xchgl   %r9d,%ebp
 #ifdef CONFIG_AUDITSYSCALL
        testl   $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
        jz      sysenter_auditsys
 #endif
        SAVE_REST
        CLEAR_RREGS
-        movq    %r9,R9(%rsp)
        movq    $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
        movq    %rsp,%rdi        /* &pt_regs -> arg1 */
        call    syscall_trace_enter
        LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
        RESTORE_REST
-        xchgl   %ebp,%r9d
        cmpl    $(IA32_NR_syscalls-1),%eax
        ja      int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
        jmp     sysenter_do_call
@@ -314,9 +310,9 @@ ENTRY(ia32_cstar_target)
        testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
        CFI_REMEMBER_STATE
        jnz   cstar_tracesys
-cstar_do_call:  
        cmpl $IA32_NR_syscalls-1,%eax
        ja  ia32_badsys
+cstar_do_call:
        IA32_ARG_FIXUP 1
 cstar_dispatch:
        call *ia32_sys_call_table(,%rax,8)
@@ -357,15 +353,13 @@ cstar_tracesys:
 #endif
        xchgl %r9d,%ebp
        SAVE_REST
-        CLEAR_RREGS
+        CLEAR_RREGS r9
-        movq %r9,R9(%rsp)
        movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
        movq %rsp,%rdi        /* &pt_regs -> arg1 */
        call syscall_trace_enter
-        LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
+        LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */
        RESTORE_REST
        xchgl %ebp,%r9d
-        movl RSP-ARGOFFSET(%rsp), %r8d
        cmpl $(IA32_NR_syscalls-1),%eax
        ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
        jmp cstar_do_call
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 5098585f87ce..0d41f0343dc0 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -23,7 +23,7 @@ CFLAGS_hpet.o		:= $(nostackp)
 CFLAGS_tsc.o            := $(nostackp)
 obj-y                   := process_$(BITS).o signal_$(BITS).o entry_$(BITS).o
-obj-y                   += traps_$(BITS).o irq_$(BITS).o
+obj-y                   += traps.o irq_$(BITS).o dumpstack_$(BITS).o
 obj-y                   += time_$(BITS).o ioport.o ldt.o
 obj-y                   += setup.o i8259.o irqinit_$(BITS).o setup_percpu.o
 obj-$(CONFIG_X86_VISWS) += visws_quirks.o
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index fb04e49776ba..a84ac7b570e6 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -444,7 +444,7 @@ void __init alternative_instructions(void)
                                            _text, _etext);
                /* Only switch to UP mode if we don't immediately boot others */
-                if (num_possible_cpus() == 1 || setup_max_cpus <= 1)
+                if (num_present_cpus() == 1 || setup_max_cpus <= 1)
                        alternatives_smp_switch(0);
        }
 #endif
diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
index a91c57cb666a..21c831d96af3 100644
--- a/arch/x86/kernel/apic_32.c
+++ b/arch/x86/kernel/apic_32.c
@@ -295,6 +295,9 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
 *
 * Vector mappings are hard coded. On K8 only offset 0 (APIC500) and
 * MCE interrupts are supported. Thus MCE offset must be set to 0.
+ *
+ * If mask=1, the LVT entry does not generate interrupts while mask=0
+ * enables the vector. See also the BKDGs.
 */
 #define APIC_EILVT_LVTOFF_MCE 0
@@ -319,6 +322,7 @@ u8 setup_APIC_eilvt_ibs(u8 vector, u8 msg_type, u8 mask)
        setup_APIC_eilvt(APIC_EILVT_LVTOFF_IBS, vector, msg_type, mask);
        return APIC_EILVT_LVTOFF_IBS;
 }
+EXPORT_SYMBOL_GPL(setup_APIC_eilvt_ibs);
 /*
 * Program the next event, relative to now
diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
index 53898b65a6ae..94ddb69ae15e 100644
--- a/arch/x86/kernel/apic_64.c
+++ b/arch/x86/kernel/apic_64.c
@@ -307,6 +307,9 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
 *
 * Vector mappings are hard coded. On K8 only offset 0 (APIC500) and
 * MCE interrupts are supported. Thus MCE offset must be set to 0.
+ *
+ * If mask=1, the LVT entry does not generate interrupts while mask=0
+ * enables the vector. See also the BKDGs.
 */
 #define APIC_EILVT_LVTOFF_MCE 0
@@ -331,6 +334,7 @@ u8 setup_APIC_eilvt_ibs(u8 vector, u8 msg_type, u8 mask)
        setup_APIC_eilvt(APIC_EILVT_LVTOFF_IBS, vector, msg_type, mask);
        return APIC_EILVT_LVTOFF_IBS;
 }
+EXPORT_SYMBOL_GPL(setup_APIC_eilvt_ibs);
 /*
 * Program the next event, relative to now
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index fb789dd9e691..25581dcb280e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -124,18 +124,25 @@ static inline int flag_is_changeable_p(u32 flag)
 {
        u32 f1, f2;
-        asm("pushfl\n\t"
+        /*
-            "pushfl\n\t"
+         * Cyrix and IDT cpus allow disabling of CPUID
-            "popl %0\n\t"
+         * so the code below may return different results
-            "movl %0,%1\n\t"
+         * when it is executed before and after enabling
-            "xorl %2,%0\n\t"
+         * the CPUID. Add "volatile" to not allow gcc to
-            "pushl %0\n\t"
+         * optimize the subsequent calls to this function.
-            "popfl\n\t"
+         */
-            "pushfl\n\t"
+        asm volatile ("pushfl\n\t"
-            "popl %0\n\t"
+                      "pushfl\n\t"
-            "popfl\n\t"
+                      "popl %0\n\t"
-            : "=&r" (f1), "=&r" (f2)
+                      "movl %0,%1\n\t"
-            : "ir" (flag));
+                      "xorl %2,%0\n\t"
+                      "pushl %0\n\t"
+                      "popfl\n\t"
+                      "pushfl\n\t"
+                      "popl %0\n\t"
+                      "popfl\n\t"
+                      : "=&r" (f1), "=&r" (f2)
+                      : "ir" (flag));
        return ((f1^f2) & flag) != 0;
 }
@@ -719,12 +726,24 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
 #endif
 }
+#ifdef CONFIG_X86_64
+static void vgetcpu_set_mode(void)
+{
+        if (cpu_has(&boot_cpu_data, X86_FEATURE_RDTSCP))
+                vgetcpu_mode = VGETCPU_RDTSCP;
+        else
+                vgetcpu_mode = VGETCPU_LSL;
+}
+#endif
 void __init identify_boot_cpu(void)
 {
        identify_cpu(&boot_cpu_data);
 #ifdef CONFIG_X86_32
        sysenter_setup();
        enable_sep_cpu();
+#else
+        vgetcpu_set_mode();
 #endif
 }
@@ -797,7 +816,7 @@ void __cpuinit print_cpu_info(struct cpuinfo_x86 *c)
        else if (c->cpuid_level >= 0)
                vendor = c->x86_vendor_id;
-        if (vendor && strncmp(c->x86_model_id, vendor, strlen(vendor)))
+        if (vendor && !strstr(c->x86_model_id, vendor))
                printk(KERN_CONT "%s ", vendor);
        if (c->x86_model_id[0])
diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
index 395acb12b0d1..b4f14c6c09d9 100644
--- a/arch/x86/kernel/doublefault_32.c
+++ b/arch/x86/kernel/doublefault_32.c
@@ -66,6 +66,6 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
                .ds             = __USER_DS,
                .fs             = __KERNEL_PERCPU,
-                .__cr3          = __phys_addr_const((unsigned long)swapper_pg_dir)
+                .__cr3          = __pa_nodebug(swapper_pg_dir),
        }
 };
diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
new file mode 100644
index 000000000000..201ee359a1a9
--- /dev/null
+++ b/arch/x86/kernel/dumpstack_32.c
@@ -0,0 +1,447 @@
+/*
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *  Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
+ */
+#include <linux/kallsyms.h>
+#include <linux/kprobes.h>
+#include <linux/uaccess.h>
+#include <linux/utsname.h>
+#include <linux/hardirq.h>
+#include <linux/kdebug.h>
+#include <linux/module.h>
+#include <linux/ptrace.h>
+#include <linux/kexec.h>
+#include <linux/bug.h>
+#include <linux/nmi.h>
+#include <asm/stacktrace.h>
+#define STACKSLOTS_PER_LINE 8
+#define get_bp(bp) asm("movl %%ebp, %0" : "=r" (bp) :)
+int panic_on_unrecovered_nmi;
+int kstack_depth_to_print = 3 * STACKSLOTS_PER_LINE;
+static unsigned int code_bytes = 64;
+static int die_counter;
+void printk_address(unsigned long address, int reliable)
+{
+        printk(" [<%p>] %s%pS\n", (void *) address,
+                        reliable ? "" : "? ", (void *) address);
+}
+static inline int valid_stack_ptr(struct thread_info *tinfo,
+                        void *p, unsigned int size, void *end)
+{
+        void *t = tinfo;
+        if (end) {
+                if (p < end && p >= (end-THREAD_SIZE))
+                        return 1;
+                else
+                        return 0;
+        }
+        return p > t && p < t + THREAD_SIZE - size;
+}
+/* The form of the top of the frame on the stack */
+struct stack_frame {
+        struct stack_frame *next_frame;
+        unsigned long return_address;
+};
+static inline unsigned long
+print_context_stack(struct thread_info *tinfo,
+                unsigned long *stack, unsigned long bp,
+                const struct stacktrace_ops *ops, void *data,
+                unsigned long *end)
+{
+        struct stack_frame *frame = (struct stack_frame *)bp;
+        while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
+                unsigned long addr;
+                addr = *stack;
+                if (__kernel_text_address(addr)) {
+                        if ((unsigned long) stack == bp + sizeof(long)) {
+                                ops->address(data, addr, 1);
+                                frame = frame->next_frame;
+                                bp = (unsigned long) frame;
+                        } else {
+                                ops->address(data, addr, bp == 0);
+                        }
+                }
+                stack++;
+        }
+        return bp;
+}
+void dump_trace(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp,
+                const struct stacktrace_ops *ops, void *data)
+{
+        if (!task)
+                task = current;
+        if (!stack) {
+                unsigned long dummy;
+                stack = &dummy;
+                if (task && task != current)
+                        stack = (unsigned long *)task->thread.sp;
+        }
+#ifdef CONFIG_FRAME_POINTER
+        if (!bp) {
+                if (task == current) {
+                        /* Grab bp right from our regs */
+                        get_bp(bp);
+                } else {
+                        /* bp is the last reg pushed by switch_to */
+                        bp = *(unsigned long *) task->thread.sp;
+                }
+        }
+#endif
+        for (;;) {
+                struct thread_info *context;
+                context = (struct thread_info *)
+                        ((unsigned long)stack & (~(THREAD_SIZE - 1)));
+                bp = print_context_stack(context, stack, bp, ops, data, NULL);
+                stack = (unsigned long *)context->previous_esp;
+                if (!stack)
+                        break;
+                if (ops->stack(data, "IRQ") < 0)
+                        break;
+                touch_nmi_watchdog();
+        }
+}
+EXPORT_SYMBOL(dump_trace);
+static void
+print_trace_warning_symbol(void *data, char *msg, unsigned long symbol)
+{
+        printk(data);
+        print_symbol(msg, symbol);
+        printk("\n");
+}
+static void print_trace_warning(void *data, char *msg)
+{
+        printk("%s%s\n", (char *)data, msg);
+}
+static int print_trace_stack(void *data, char *name)
+{
+        printk("%s <%s> ", (char *)data, name);
+        return 0;
+}
+/*
+ * Print one address/symbol entries per line.
+ */
+static void print_trace_address(void *data, unsigned long addr, int reliable)
+{
+        touch_nmi_watchdog();
+        printk(data);
+        printk_address(addr, reliable);
+}
+static const struct stacktrace_ops print_trace_ops = {
+        .warning = print_trace_warning,
+        .warning_symbol = print_trace_warning_symbol,
+        .stack = print_trace_stack,
+        .address = print_trace_address,
+};
+static void
+show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp, char *log_lvl)
+{
+        printk("%sCall Trace:\n", log_lvl);
+        dump_trace(task, regs, stack, bp, &print_trace_ops, log_lvl);
+}
+void show_trace(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp)
+{
+        show_trace_log_lvl(task, regs, stack, bp, "");
+}
+static void
+show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *sp, unsigned long bp, char *log_lvl)
+{
+        unsigned long *stack;
+        int i;
+        if (sp == NULL) {
+                if (task)
+                        sp = (unsigned long *)task->thread.sp;
+                else
+                        sp = (unsigned long *)&sp;
+        }
+        stack = sp;
+        for (i = 0; i < kstack_depth_to_print; i++) {
+                if (kstack_end(stack))
+                        break;
+                if (i && ((i % STACKSLOTS_PER_LINE) == 0))
+                        printk("\n%s", log_lvl);
+                printk(" %08lx", *stack++);
+                touch_nmi_watchdog();
+        }
+        printk("\n");
+        show_trace_log_lvl(task, regs, sp, bp, log_lvl);
+}
+void show_stack(struct task_struct *task, unsigned long *sp)
+{
+        show_stack_log_lvl(task, NULL, sp, 0, "");
+}
+/*
+ * The architecture-independent dump_stack generator
+ */
+void dump_stack(void)
+{
+        unsigned long bp = 0;
+        unsigned long stack;
+#ifdef CONFIG_FRAME_POINTER
+        if (!bp)
+                get_bp(bp);
+#endif
+        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+                current->pid, current->comm, print_tainted(),
+                init_utsname()->release,
+                (int)strcspn(init_utsname()->version, " "),
+                init_utsname()->version);
+        show_trace(NULL, NULL, &stack, bp);
+}
+EXPORT_SYMBOL(dump_stack);
+void show_registers(struct pt_regs *regs)
+{
+        int i;
+        print_modules();
+        __show_regs(regs, 0);
+        printk(KERN_EMERG "Process %.*s (pid: %d, ti=%p task=%p task.ti=%p)\n",
+                TASK_COMM_LEN, current->comm, task_pid_nr(current),
+                current_thread_info(), current, task_thread_info(current));
+        /*
+         * When in-kernel, we also print out the stack and code at the
+         * time of the fault..
+         */
+        if (!user_mode_vm(regs)) {
+                unsigned int code_prologue = code_bytes * 43 / 64;
+                unsigned int code_len = code_bytes;
+                unsigned char c;
+                u8 *ip;
+                printk(KERN_EMERG "Stack:\n");
+                show_stack_log_lvl(NULL, regs, &regs->sp,
+                                0, KERN_EMERG);
+                printk(KERN_EMERG "Code: ");
+                ip = (u8 *)regs->ip - code_prologue;
+                if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
+                        /* try starting at IP */
+                        ip = (u8 *)regs->ip;
+                        code_len = code_len - code_prologue + 1;
+                }
+                for (i = 0; i < code_len; i++, ip++) {
+                        if (ip < (u8 *)PAGE_OFFSET ||
+                                        probe_kernel_address(ip, c)) {
+                                printk(" Bad EIP value.");
+                                break;
+                        }
+                        if (ip == (u8 *)regs->ip)
+                                printk("<%02x> ", c);
+                        else
+                                printk("%02x ", c);
+                }
+        }
+        printk("\n");
+}
+int is_valid_bugaddr(unsigned long ip)
+{
+        unsigned short ud2;
+        if (ip < PAGE_OFFSET)
+                return 0;
+        if (probe_kernel_address((unsigned short *)ip, ud2))
+                return 0;
+        return ud2 == 0x0b0f;
+}
+static raw_spinlock_t die_lock = __RAW_SPIN_LOCK_UNLOCKED;
+static int die_owner = -1;
+static unsigned int die_nest_count;
+unsigned __kprobes long oops_begin(void)
+{
+        unsigned long flags;
+        oops_enter();
+        if (die_owner != raw_smp_processor_id()) {
+                console_verbose();
+                raw_local_irq_save(flags);
+                __raw_spin_lock(&die_lock);
+                die_owner = smp_processor_id();
+                die_nest_count = 0;
+                bust_spinlocks(1);
+        } else {
+                raw_local_irq_save(flags);
+        }
+        die_nest_count++;
+        return flags;
+}
+void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+{
+        bust_spinlocks(0);
+        die_owner = -1;
+        add_taint(TAINT_DIE);
+        __raw_spin_unlock(&die_lock);
+        raw_local_irq_restore(flags);
+        if (!regs)
+                return;
+        if (kexec_should_crash(current))
+                crash_kexec(regs);
+        if (in_interrupt())
+                panic("Fatal exception in interrupt");
+        if (panic_on_oops)
+                panic("Fatal exception");
+        oops_exit();
+        do_exit(signr);
+}
+int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+{
+        unsigned short ss;
+        unsigned long sp;
+        printk(KERN_EMERG "%s: %04lx [#%d] ", str, err & 0xffff, ++die_counter);
+#ifdef CONFIG_PREEMPT
+        printk("PREEMPT ");
+#endif
+#ifdef CONFIG_SMP
+        printk("SMP ");
+#endif
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        printk("DEBUG_PAGEALLOC");
+#endif
+        printk("\n");
+        if (notify_die(DIE_OOPS, str, regs, err,
+                        current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
+                return 1;
+        show_registers(regs);
+        /* Executive summary in case the oops scrolled away */
+        sp = (unsigned long) (&regs->sp);
+        savesegment(ss, ss);
+        if (user_mode(regs)) {
+                sp = regs->sp;
+                ss = regs->ss & 0xffff;
+        }
+        printk(KERN_EMERG "EIP: [<%08lx>] ", regs->ip);
+        print_symbol("%s", regs->ip);
+        printk(" SS:ESP %04x:%08lx\n", ss, sp);
+        return 0;
+}
+/*
+ * This is gone through when something in the kernel has done something bad
+ * and is about to be terminated:
+ */
+void die(const char *str, struct pt_regs *regs, long err)
+{
+        unsigned long flags = oops_begin();
+        if (die_nest_count < 3) {
+                report_bug(regs->ip, regs);
+                if (__die(str, regs, err))
+                        regs = NULL;
+        } else {
+                printk(KERN_EMERG "Recursive die() failure, output suppressed\n");
+        }
+        oops_end(flags, regs, SIGSEGV);
+}
+static DEFINE_SPINLOCK(nmi_print_lock);
+void notrace __kprobes
+die_nmi(char *str, struct pt_regs *regs, int do_panic)
+{
+        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0, 2, SIGINT) == NOTIFY_STOP)
+                return;
+        spin_lock(&nmi_print_lock);
+        /*
+        * We are in trouble anyway, lets at least try
+        * to get a message out:
+        */
+        bust_spinlocks(1);
+        printk(KERN_EMERG "%s", str);
+        printk(" on CPU%d, ip %08lx, registers:\n",
+                smp_processor_id(), regs->ip);
+        show_registers(regs);
+        if (do_panic)
+                panic("Non maskable interrupt");
+        console_silent();
+        spin_unlock(&nmi_print_lock);
+        bust_spinlocks(0);
+        /*
+         * If we are in kernel we are probably nested up pretty bad
+         * and might aswell get out now while we still can:
+         */
+        if (!user_mode_vm(regs)) {
+                current->thread.trap_no = 2;
+                crash_kexec(regs);
+        }
+        do_exit(SIGSEGV);
+}
+static int __init oops_setup(char *s)
+{
+        if (!s)
+                return -EINVAL;
+        if (!strcmp(s, "panic"))
+                panic_on_oops = 1;
+        return 0;
+}
+early_param("oops", oops_setup);
+static int __init kstack_setup(char *s)
+{
+        if (!s)
+                return -EINVAL;
+        kstack_depth_to_print = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("kstack", kstack_setup);
+static int __init code_bytes_setup(char *s)
+{
+        code_bytes = simple_strtoul(s, NULL, 0);
+        if (code_bytes > 8192)
+                code_bytes = 8192;
+        return 1;
+}
+__setup("code_bytes=", code_bytes_setup);
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
new file mode 100644
index 000000000000..086cc8118e39
--- /dev/null
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -0,0 +1,573 @@
+/*
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *  Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
+ */
+#include <linux/kallsyms.h>
+#include <linux/kprobes.h>
+#include <linux/uaccess.h>
+#include <linux/utsname.h>
+#include <linux/hardirq.h>
+#include <linux/kdebug.h>
+#include <linux/module.h>
+#include <linux/ptrace.h>
+#include <linux/kexec.h>
+#include <linux/bug.h>
+#include <linux/nmi.h>
+#include <asm/stacktrace.h>
+#define STACKSLOTS_PER_LINE 4
+#define get_bp(bp) asm("movq %%rbp, %0" : "=r" (bp) :)
+int panic_on_unrecovered_nmi;
+int kstack_depth_to_print = 3 * STACKSLOTS_PER_LINE;
+static unsigned int code_bytes = 64;
+static int die_counter;
+void printk_address(unsigned long address, int reliable)
+{
+        printk(" [<%p>] %s%pS\n", (void *) address,
+                        reliable ? "" : "? ", (void *) address);
+}
+static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
+                                        unsigned *usedp, char **idp)
+{
+        static char ids[][8] = {
+                [DEBUG_STACK - 1] = "#DB",
+                [NMI_STACK - 1] = "NMI",
+                [DOUBLEFAULT_STACK - 1] = "#DF",
+                [STACKFAULT_STACK - 1] = "#SS",
+                [MCE_STACK - 1] = "#MC",
+#if DEBUG_STKSZ > EXCEPTION_STKSZ
+                [N_EXCEPTION_STACKS ...
+                        N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
+#endif
+        };
+        unsigned k;
+        /*
+         * Iterate over all exception stacks, and figure out whether
+         * 'stack' is in one of them:
+         */
+        for (k = 0; k < N_EXCEPTION_STACKS; k++) {
+                unsigned long end = per_cpu(orig_ist, cpu).ist[k];
+                /*
+                 * Is 'stack' above this exception frame's end?
+                 * If yes then skip to the next frame.
+                 */
+                if (stack >= end)
+                        continue;
+                /*
+                 * Is 'stack' above this exception frame's start address?
+                 * If yes then we found the right frame.
+                 */
+                if (stack >= end - EXCEPTION_STKSZ) {
+                        /*
+                         * Make sure we only iterate through an exception
+                         * stack once. If it comes up for the second time
+                         * then there's something wrong going on - just
+                         * break out and return NULL:
+                         */
+                        if (*usedp & (1U << k))
+                                break;
+                        *usedp |= 1U << k;
+                        *idp = ids[k];
+                        return (unsigned long *)end;
+                }
+                /*
+                 * If this is a debug stack, and if it has a larger size than
+                 * the usual exception stacks, then 'stack' might still
+                 * be within the lower portion of the debug stack:
+                 */
+#if DEBUG_STKSZ > EXCEPTION_STKSZ
+                if (k == DEBUG_STACK - 1 && stack >= end - DEBUG_STKSZ) {
+                        unsigned j = N_EXCEPTION_STACKS - 1;
+                        /*
+                         * Black magic. A large debug stack is composed of
+                         * multiple exception stack entries, which we
+                         * iterate through now. Dont look:
+                         */
+                        do {
+                                ++j;
+                                end -= EXCEPTION_STKSZ;
+                                ids[j][4] = '1' + (j - N_EXCEPTION_STACKS);
+                        } while (stack < end - EXCEPTION_STKSZ);
+                        if (*usedp & (1U << j))
+                                break;
+                        *usedp |= 1U << j;
+                        *idp = ids[j];
+                        return (unsigned long *)end;
+                }
+#endif
+        }
+        return NULL;
+}
+/*
+ * x86-64 can have up to three kernel stacks:
+ * process stack
+ * interrupt stack
+ * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
+ */
+static inline int valid_stack_ptr(struct thread_info *tinfo,
+                        void *p, unsigned int size, void *end)
+{
+        void *t = tinfo;
+        if (end) {
+                if (p < end && p >= (end-THREAD_SIZE))
+                        return 1;
+                else
+                        return 0;
+        }
+        return p > t && p < t + THREAD_SIZE - size;
+}
+/* The form of the top of the frame on the stack */
+struct stack_frame {
+        struct stack_frame *next_frame;
+        unsigned long return_address;
+};
+static inline unsigned long
+print_context_stack(struct thread_info *tinfo,
+                unsigned long *stack, unsigned long bp,
+                const struct stacktrace_ops *ops, void *data,
+                unsigned long *end)
+{
+        struct stack_frame *frame = (struct stack_frame *)bp;
+        while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
+                unsigned long addr;
+                addr = *stack;
+                if (__kernel_text_address(addr)) {
+                        if ((unsigned long) stack == bp + sizeof(long)) {
+                                ops->address(data, addr, 1);
+                                frame = frame->next_frame;
+                                bp = (unsigned long) frame;
+                        } else {
+                                ops->address(data, addr, bp == 0);
+                        }
+                }
+                stack++;
+        }
+        return bp;
+}
+void dump_trace(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp,
+                const struct stacktrace_ops *ops, void *data)
+{
+        const unsigned cpu = get_cpu();
+        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
+        unsigned used = 0;
+        struct thread_info *tinfo;
+        if (!task)
+                task = current;
+        if (!stack) {
+                unsigned long dummy;
+                stack = &dummy;
+                if (task && task != current)
+                        stack = (unsigned long *)task->thread.sp;
+        }
+#ifdef CONFIG_FRAME_POINTER
+        if (!bp) {
+                if (task == current) {
+                        /* Grab bp right from our regs */
+                        get_bp(bp);
+                } else {
+                        /* bp is the last reg pushed by switch_to */
+                        bp = *(unsigned long *) task->thread.sp;
+                }
+        }
+#endif
+        /*
+         * Print function call entries in all stacks, starting at the
+         * current stack address. If the stacks consist of nested
+         * exceptions
+         */
+        tinfo = task_thread_info(task);
+        for (;;) {
+                char *id;
+                unsigned long *estack_end;
+                estack_end = in_exception_stack(cpu, (unsigned long)stack,
+                                                &used, &id);
+                if (estack_end) {
+                        if (ops->stack(data, id) < 0)
+                                break;
+                        bp = print_context_stack(tinfo, stack, bp, ops,
+                                                        data, estack_end);
+                        ops->stack(data, "<EOE>");
+                        /*
+                         * We link to the next stack via the
+                         * second-to-last pointer (index -2 to end) in the
+                         * exception stack:
+                         */
+                        stack = (unsigned long *) estack_end[-2];
+                        continue;
+                }
+                if (irqstack_end) {
+                        unsigned long *irqstack;
+                        irqstack = irqstack_end -
+                                (IRQSTACKSIZE - 64) / sizeof(*irqstack);
+                        if (stack >= irqstack && stack < irqstack_end) {
+                                if (ops->stack(data, "IRQ") < 0)
+                                        break;
+                                bp = print_context_stack(tinfo, stack, bp,
+                                                ops, data, irqstack_end);
+                                /*
+                                 * We link to the next stack (which would be
+                                 * the process stack normally) the last
+                                 * pointer (index -1 to end) in the IRQ stack:
+                                 */
+                                stack = (unsigned long *) (irqstack_end[-1]);
+                                irqstack_end = NULL;
+                                ops->stack(data, "EOI");
+                                continue;
+                        }
+                }
+                break;
+        }
+        /*
+         * This handles the process stack:
+         */
+        bp = print_context_stack(tinfo, stack, bp, ops, data, NULL);
+        put_cpu();
+}
+EXPORT_SYMBOL(dump_trace);
+static void
+print_trace_warning_symbol(void *data, char *msg, unsigned long symbol)
+{
+        printk(data);
+        print_symbol(msg, symbol);
+        printk("\n");
+}
+static void print_trace_warning(void *data, char *msg)
+{
+        printk("%s%s\n", (char *)data, msg);
+}
+static int print_trace_stack(void *data, char *name)
+{
+        printk("%s <%s> ", (char *)data, name);
+        return 0;
+}
+/*
+ * Print one address/symbol entries per line.
+ */
+static void print_trace_address(void *data, unsigned long addr, int reliable)
+{
+        touch_nmi_watchdog();
+        printk(data);
+        printk_address(addr, reliable);
+}
+static const struct stacktrace_ops print_trace_ops = {
+        .warning = print_trace_warning,
+        .warning_symbol = print_trace_warning_symbol,
+        .stack = print_trace_stack,
+        .address = print_trace_address,
+};
+static void
+show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp, char *log_lvl)
+{
+        printk("%sCall Trace:\n", log_lvl);
+        dump_trace(task, regs, stack, bp, &print_trace_ops, log_lvl);
+}
+void show_trace(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *stack, unsigned long bp)
+{
+        show_trace_log_lvl(task, regs, stack, bp, "");
+}
+static void
+show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
+                unsigned long *sp, unsigned long bp, char *log_lvl)
+{
+        unsigned long *stack;
+        int i;
+        const int cpu = smp_processor_id();
+        unsigned long *irqstack_end =
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr);
+        unsigned long *irqstack =
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
+        /*
+         * debugging aid: "show_stack(NULL, NULL);" prints the
+         * back trace for this cpu.
+         */
+        if (sp == NULL) {
+                if (task)
+                        sp = (unsigned long *)task->thread.sp;
+                else
+                        sp = (unsigned long *)&sp;
+        }
+        stack = sp;
+        for (i = 0; i < kstack_depth_to_print; i++) {
+                if (stack >= irqstack && stack <= irqstack_end) {
+                        if (stack == irqstack_end) {
+                                stack = (unsigned long *) (irqstack_end[-1]);
+                                printk(" <EOI> ");
+                        }
+                } else {
+                if (((long) stack & (THREAD_SIZE-1)) == 0)
+                        break;
+                }
+                if (i && ((i % STACKSLOTS_PER_LINE) == 0))
+                        printk("\n%s", log_lvl);
+                printk(" %016lx", *stack++);
+                touch_nmi_watchdog();
+        }
+        printk("\n");
+        show_trace_log_lvl(task, regs, sp, bp, log_lvl);
+}
+void show_stack(struct task_struct *task, unsigned long *sp)
+{
+        show_stack_log_lvl(task, NULL, sp, 0, "");
+}
+/*
+ * The architecture-independent dump_stack generator
+ */
+void dump_stack(void)
+{
+        unsigned long bp = 0;
+        unsigned long stack;
+#ifdef CONFIG_FRAME_POINTER
+        if (!bp)
+                get_bp(bp);
+#endif
+        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+                current->pid, current->comm, print_tainted(),
+                init_utsname()->release,
+                (int)strcspn(init_utsname()->version, " "),
+                init_utsname()->version);
+        show_trace(NULL, NULL, &stack, bp);
+}
+EXPORT_SYMBOL(dump_stack);
+void show_registers(struct pt_regs *regs)
+{
+        int i;
+        unsigned long sp;
+        const int cpu = smp_processor_id();
+        struct task_struct *cur = cpu_pda(cpu)->pcurrent;
+        sp = regs->sp;
+        printk("CPU %d ", cpu);
+        __show_regs(regs, 1);
+        printk("Process %s (pid: %d, threadinfo %p, task %p)\n",
+                cur->comm, cur->pid, task_thread_info(cur), cur);
+        /*
+         * When in-kernel, we also print out the stack and code at the
+         * time of the fault..
+         */
+        if (!user_mode(regs)) {
+                unsigned int code_prologue = code_bytes * 43 / 64;
+                unsigned int code_len = code_bytes;
+                unsigned char c;
+                u8 *ip;
+                printk(KERN_EMERG "Stack:\n");
+                show_stack_log_lvl(NULL, regs, (unsigned long *)sp,
+                                regs->bp, KERN_EMERG);
+                printk(KERN_EMERG "Code: ");
+                ip = (u8 *)regs->ip - code_prologue;
+                if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
+                        /* try starting at IP */
+                        ip = (u8 *)regs->ip;
+                        code_len = code_len - code_prologue + 1;
+                }
+                for (i = 0; i < code_len; i++, ip++) {
+                        if (ip < (u8 *)PAGE_OFFSET ||
+                                        probe_kernel_address(ip, c)) {
+                                printk(" Bad RIP value.");
+                                break;
+                        }
+                        if (ip == (u8 *)regs->ip)
+                                printk("<%02x> ", c);
+                        else
+                                printk("%02x ", c);
+                }
+        }
+        printk("\n");
+}
+int is_valid_bugaddr(unsigned long ip)
+{
+        unsigned short ud2;
+        if (__copy_from_user(&ud2, (const void __user *) ip, sizeof(ud2)))
+                return 0;
+        return ud2 == 0x0b0f;
+}
+static raw_spinlock_t die_lock = __RAW_SPIN_LOCK_UNLOCKED;
+static int die_owner = -1;
+static unsigned int die_nest_count;
+unsigned __kprobes long oops_begin(void)
+{
+        int cpu;
+        unsigned long flags;
+        oops_enter();
+        /* racy, but better than risking deadlock. */
+        raw_local_irq_save(flags);
+        cpu = smp_processor_id();
+        if (!__raw_spin_trylock(&die_lock)) {
+                if (cpu == die_owner)
+                        /* nested oops. should stop eventually */;
+                else
+                        __raw_spin_lock(&die_lock);
+        }
+        die_nest_count++;
+        die_owner = cpu;
+        console_verbose();
+        bust_spinlocks(1);
+        return flags;
+}
+void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+{
+        die_owner = -1;
+        bust_spinlocks(0);
+        die_nest_count--;
+        if (!die_nest_count)
+                /* Nest count reaches zero, release the lock. */
+                __raw_spin_unlock(&die_lock);
+        raw_local_irq_restore(flags);
+        if (!regs) {
+                oops_exit();
+                return;
+        }
+        if (in_interrupt())
+                panic("Fatal exception in interrupt");
+        if (panic_on_oops)
+                panic("Fatal exception");
+        oops_exit();
+        do_exit(signr);
+}
+int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+{
+        printk(KERN_EMERG "%s: %04lx [#%d] ", str, err & 0xffff, ++die_counter);
+#ifdef CONFIG_PREEMPT
+        printk("PREEMPT ");
+#endif
+#ifdef CONFIG_SMP
+        printk("SMP ");
+#endif
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        printk("DEBUG_PAGEALLOC");
+#endif
+        printk("\n");
+        if (notify_die(DIE_OOPS, str, regs, err,
+                        current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
+                return 1;
+        show_registers(regs);
+        add_taint(TAINT_DIE);
+        /* Executive summary in case the oops scrolled away */
+        printk(KERN_ALERT "RIP ");
+        printk_address(regs->ip, 1);
+        printk(" RSP <%016lx>\n", regs->sp);
+        if (kexec_should_crash(current))
+                crash_kexec(regs);
+        return 0;
+}
+void die(const char *str, struct pt_regs *regs, long err)
+{
+        unsigned long flags = oops_begin();
+        if (!user_mode(regs))
+                report_bug(regs->ip, regs);
+        if (__die(str, regs, err))
+                regs = NULL;
+        oops_end(flags, regs, SIGSEGV);
+}
+notrace __kprobes void
+die_nmi(char *str, struct pt_regs *regs, int do_panic)
+{
+        unsigned long flags;
+        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0, 2, SIGINT) == NOTIFY_STOP)
+                return;
+        flags = oops_begin();
+        /*
+         * We are in trouble anyway, lets at least try
+         * to get a message out.
+         */
+        printk(KERN_EMERG "%s", str);
+        printk(" on CPU%d, ip %08lx, registers:\n",
+                smp_processor_id(), regs->ip);
+        show_registers(regs);
+        if (kexec_should_crash(current))
+                crash_kexec(regs);
+        if (do_panic || panic_on_oops)
+                panic("Non maskable interrupt");
+        oops_end(flags, NULL, SIGBUS);
+        nmi_exit();
+        local_irq_enable();
+        do_exit(SIGBUS);
+}
+static int __init oops_setup(char *s)
+{
+        if (!s)
+                return -EINVAL;
+        if (!strcmp(s, "panic"))
+                panic_on_oops = 1;
+        return 0;
+}
+early_param("oops", oops_setup);
+static int __init kstack_setup(char *s)
+{
+        if (!s)
+                return -EINVAL;
+        kstack_depth_to_print = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("kstack", kstack_setup);
+static int __init code_bytes_setup(char *s)
+{
+        code_bytes = simple_strtoul(s, NULL, 0);
+        if (code_bytes > 8192)
+                code_bytes = 8192;
+        return 1;
+}
+__setup("code_bytes=", code_bytes_setup);
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 109792bc7cfa..b21fbfaffe39 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -730,6 +730,7 @@ error_code:
        movl $(__USER_DS), %ecx
        movl %ecx, %ds
        movl %ecx, %es
+        TRACE_IRQS_OFF
        movl %esp,%eax                  # pt_regs pointer
        call *%edi
        jmp ret_from_exception
@@ -760,20 +761,9 @@ ENTRY(device_not_available)
        RING0_INT_FRAME
        pushl $-1                       # mark this as an int
        CFI_ADJUST_CFA_OFFSET 4
-        SAVE_ALL
+        pushl $do_device_not_available
-        GET_CR0_INTO_EAX
-        testl $0x4, %eax                # EM (math emulation bit)
-        jne device_not_available_emulate
-        preempt_stop(CLBR_ANY)
-        call math_state_restore
-        jmp ret_from_exception
-device_not_available_emulate:
-        pushl $0                        # temporary storage for ORIG_EIP
        CFI_ADJUST_CFA_OFFSET 4
-        call math_emulate
+        jmp error_code
-        addl $4, %esp
-        CFI_ADJUST_CFA_OFFSET -4
-        jmp ret_from_exception
        CFI_ENDPROC
 END(device_not_available)
@@ -814,6 +804,7 @@ debug_stack_correct:
        pushl $-1                       # mark this as an int
        CFI_ADJUST_CFA_OFFSET 4
        SAVE_ALL
+        TRACE_IRQS_OFF
        xorl %edx,%edx                  # error code 0
        movl %esp,%eax                  # pt_regs pointer
        call do_debug
@@ -858,6 +849,7 @@ nmi_stack_correct:
        pushl %eax
        CFI_ADJUST_CFA_OFFSET 4
        SAVE_ALL
+        TRACE_IRQS_OFF
        xorl %edx,%edx          # zero error code
        movl %esp,%eax          # pt_regs pointer
        call do_nmi
@@ -898,6 +890,7 @@ nmi_espfix_stack:
        pushl %eax
        CFI_ADJUST_CFA_OFFSET 4
        SAVE_ALL
+        TRACE_IRQS_OFF
        FIXUP_ESPFIX_STACK              # %eax == %esp
        xorl %edx,%edx                  # zero error code
        call do_nmi
@@ -928,6 +921,7 @@ KPROBE_ENTRY(int3)
        pushl $-1                       # mark this as an int
        CFI_ADJUST_CFA_OFFSET 4
        SAVE_ALL
+        TRACE_IRQS_OFF
        xorl %edx,%edx          # zero error code
        movl %esp,%eax          # pt_regs pointer
        call do_int3
@@ -1030,7 +1024,7 @@ ENTRY(machine_check)
        RING0_INT_FRAME
        pushl $0
        CFI_ADJUST_CFA_OFFSET 4
-        pushl machine_check_vector
+        pushl $do_machine_check
        CFI_ADJUST_CFA_OFFSET 4
        jmp error_code
        CFI_ENDPROC
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index cf3a0b2d0059..1db6ce4314e1 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -667,6 +667,13 @@ END(stub_rt_sigreturn)
        SAVE_ARGS
        leaq -ARGOFFSET(%rsp),%rdi      # arg1 for handler
        pushq %rbp
+        /*
+         * Save rbp twice: One is for marking the stack frame, as usual, and the
+         * other, to fill pt_regs properly. This is because bx comes right
+         * before the last saved register in that structure, and not bp. If the
+         * base pointer were in the place bx is today, this would not be needed.
+         */
+        movq %rbp, -8(%rsp)
        CFI_ADJUST_CFA_OFFSET   8
        CFI_REL_OFFSET          rbp, 0
        movq %rsp,%rbp
@@ -932,6 +939,9 @@ END(spurious_interrupt)
        .if \ist
        movq    %gs:pda_data_offset, %rbp
        .endif
+        .if \irqtrace
+        TRACE_IRQS_OFF
+        .endif
        movq %rsp,%rdi
        movq ORIG_RAX(%rsp),%rsi
        movq $-1,ORIG_RAX(%rsp)
@@ -1058,7 +1068,8 @@ KPROBE_ENTRY(error_entry)
        je  error_kernelspace
 error_swapgs:   
        SWAPGS
-error_sti:      
+error_sti:
+        TRACE_IRQS_OFF
        movq %rdi,RDI(%rsp)     
        CFI_REL_OFFSET  rdi,RDI
        movq %rsp,%rdi
@@ -1232,7 +1243,7 @@ ENTRY(simd_coprocessor_error)
 END(simd_coprocessor_error)
 ENTRY(device_not_available)
-        zeroentry math_state_restore
+        zeroentry do_device_not_available
 END(device_not_available)
        /* runs on exception stack */
diff --git a/arch/x86/kernel/es7000_32.c b/arch/x86/kernel/es7000_32.c
index 849e5cd485b8..f454c78fcef6 100644
--- a/arch/x86/kernel/es7000_32.c
+++ b/arch/x86/kernel/es7000_32.c
@@ -109,6 +109,7 @@ struct oem_table {
 };
 extern int find_unisys_acpi_oem_table(unsigned long *oem_addr);
+extern void unmap_unisys_acpi_oem_table(unsigned long oem_addr);
 #endif
 struct mip_reg {
@@ -243,21 +244,38 @@ parse_unisys_oem (char *oemptr)
 }
 #ifdef CONFIG_ACPI
-int __init
+static unsigned long oem_addrX;
-find_unisys_acpi_oem_table(unsigned long *oem_addr)
+static unsigned long oem_size;
+int __init find_unisys_acpi_oem_table(unsigned long *oem_addr)
 {
        struct acpi_table_header *header = NULL;
        int i = 0;
-        while (ACPI_SUCCESS(acpi_get_table("OEM1", i++, &header))) {
+        acpi_size tbl_size;
+        while (ACPI_SUCCESS(acpi_get_table_with_size("OEM1", i++, &header, &tbl_size))) {
                if (!memcmp((char *) &header->oem_id, "UNISYS", 6)) {
                        struct oem_table *t = (struct oem_table *)header;
-                        *oem_addr = (unsigned long)__acpi_map_table(t->OEMTableAddr,
-                                                                    t->OEMTableSize);
+                        oem_addrX = t->OEMTableAddr;
+                        oem_size = t->OEMTableSize;
+                        early_acpi_os_unmap_memory(header, tbl_size);
+                        *oem_addr = (unsigned long)__acpi_map_table(oem_addrX,
+                                                                    oem_size);
                        return 0;
                }
+                early_acpi_os_unmap_memory(header, tbl_size);
        }
        return -1;
 }
+void __init unmap_unisys_acpi_oem_table(unsigned long oem_addr)
+{
+        if (!oem_addr)
+                return;
+        __acpi_unmap_table((char *)oem_addr, oem_size);
+}
 #endif
 static void
diff --git a/arch/x86/kernel/genx2apic_uv_x.c b/arch/x86/kernel/genx2apic_uv_x.c
index ae2ffc8a400c..33581d94a90e 100644
--- a/arch/x86/kernel/genx2apic_uv_x.c
+++ b/arch/x86/kernel/genx2apic_uv_x.c
@@ -114,7 +114,7 @@ static void uv_send_IPI_one(int cpu, int vector)
        unsigned long val, apicid, lapicid;
        int pnode;
-        apicid = per_cpu(x86_cpu_to_apicid, cpu); /* ZZZ - cache node-local ? */
+        apicid = per_cpu(x86_cpu_to_apicid, cpu);
        lapicid = apicid & 0x3f;                /* ZZZ macro needed */
        pnode = uv_apicid_to_pnode(apicid);
        val =
@@ -202,12 +202,10 @@ static unsigned int phys_pkg_id(int index_msb)
        return uv_read_apic_id() >> index_msb;
 }
-#ifdef ZZZ              /* Needs x2apic patch */
 static void uv_send_IPI_self(int vector)
 {
        apic_write(APIC_SELF_IPI, vector);
 }
-#endif
 struct genapic apic_x2apic_uv_x = {
        .name = "UV large system",
@@ -215,15 +213,15 @@ struct genapic apic_x2apic_uv_x = {
        .int_delivery_mode = dest_Fixed,
        .int_dest_mode = (APIC_DEST_PHYSICAL != 0),
        .target_cpus = uv_target_cpus,
-        .vector_allocation_domain = uv_vector_allocation_domain,/* Fixme ZZZ */
+        .vector_allocation_domain = uv_vector_allocation_domain,
        .apic_id_registered = uv_apic_id_registered,
        .init_apic_ldr = uv_init_apic_ldr,
        .send_IPI_all = uv_send_IPI_all,
        .send_IPI_allbutself = uv_send_IPI_allbutself,
        .send_IPI_mask = uv_send_IPI_mask,
-        /* ZZZ.send_IPI_self = uv_send_IPI_self, */
+        .send_IPI_self = uv_send_IPI_self,
        .cpu_mask_to_apicid = uv_cpu_mask_to_apicid,
-        .phys_pkg_id = phys_pkg_id,     /* Fixme ZZZ */
+        .phys_pkg_id = phys_pkg_id,
        .get_apic_id = get_apic_id,
        .set_apic_id = set_apic_id,
        .apic_id_mask = (0xFFFFFFFFu),
@@ -286,12 +284,13 @@ static __init void map_low_mmrs(void)
 enum map_type {map_wb, map_uc};
-static __init void map_high(char *id, unsigned long base, int shift, enum map_type map_type)
+static __init void map_high(char *id, unsigned long base, int shift,
+                            int max_pnode, enum map_type map_type)
 {
        unsigned long bytes, paddr;
        paddr = base << shift;
-        bytes = (1UL << shift);
+        bytes = (1UL << shift) * (max_pnode + 1);
        printk(KERN_INFO "UV: Map %s_HI 0x%lx - 0x%lx\n", id, paddr,
                                                paddr + bytes);
        if (map_type == map_uc)
@@ -307,7 +306,7 @@ static __init void map_gru_high(int max_pnode)
        gru.v = uv_read_local_mmr(UVH_RH_GAM_GRU_OVERLAY_CONFIG_MMR);
        if (gru.s.enable)
-                map_high("GRU", gru.s.base, shift, map_wb);
+                map_high("GRU", gru.s.base, shift, max_pnode, map_wb);
 }
 static __init void map_config_high(int max_pnode)
@@ -317,7 +316,7 @@ static __init void map_config_high(int max_pnode)
        cfg.v = uv_read_local_mmr(UVH_RH_GAM_CFG_OVERLAY_CONFIG_MMR);
        if (cfg.s.enable)
-                map_high("CONFIG", cfg.s.base, shift, map_uc);
+                map_high("CONFIG", cfg.s.base, shift, max_pnode, map_uc);
 }
 static __init void map_mmr_high(int max_pnode)
@@ -327,7 +326,7 @@ static __init void map_mmr_high(int max_pnode)
        mmr.v = uv_read_local_mmr(UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR);
        if (mmr.s.enable)
-                map_high("MMR", mmr.s.base, shift, map_uc);
+                map_high("MMR", mmr.s.base, shift, max_pnode, map_uc);
 }
 static __init void map_mmioh_high(int max_pnode)
@@ -337,7 +336,7 @@ static __init void map_mmioh_high(int max_pnode)
        mmioh.v = uv_read_local_mmr(UVH_RH_GAM_MMIOH_OVERLAY_CONFIG_MMR);
        if (mmioh.s.enable)
-                map_high("MMIOH", mmioh.s.base, shift, map_uc);
+                map_high("MMIOH", mmioh.s.base, shift, max_pnode, map_uc);
 }
 static __init void uv_rtc_init(void)
diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
index 3e66bd364a9d..1dcb0f13897e 100644
--- a/arch/x86/kernel/head.c
+++ b/arch/x86/kernel/head.c
@@ -35,6 +35,7 @@ void __init reserve_ebda_region(void)
        /* start of EBDA area */
        ebda_addr = get_bios_ebda();
+        printk(KERN_INFO "BIOS EBDA/lowmem at: %08x/%08x\n", ebda_addr, lowmem);
        /* Fixup: bios puts an EBDA in the top 64K segment */
        /* of conventional memory, but does not adjust lowmem. */
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 73deaffadd03..acf62fc233da 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -115,13 +115,17 @@ static void hpet_reserve_platform_timers(unsigned long id)
        hd.hd_phys_address = hpet_address;
        hd.hd_address = hpet;
        hd.hd_nirqs = nrtimers;
-        hd.hd_flags = HPET_DATA_PLATFORM;
        hpet_reserve_timer(&hd, 0);
 #ifdef CONFIG_HPET_EMULATE_RTC
        hpet_reserve_timer(&hd, 1);
 #endif
+        /*
+         * NOTE that hd_irq[] reflects IOAPIC input pins (LEGACY_8254
+         * is wrong for i8259!) not the output IRQ.  Many BIOS writers
+         * don't bother configuring *any* comparator interrupts.
+         */
        hd.hd_irq[0] = HPET_LEGACY_8254;
        hd.hd_irq[1] = HPET_LEGACY_RTC;
diff --git a/arch/x86/kernel/irqinit_64.c b/arch/x86/kernel/irqinit_64.c
index 1f26fd9ec4f4..5b5be9d43c2a 100644
--- a/arch/x86/kernel/irqinit_64.c
+++ b/arch/x86/kernel/irqinit_64.c
@@ -135,7 +135,7 @@ DEFINE_PER_CPU(vector_irq_t, vector_irq) = {
        [IRQ15_VECTOR + 1 ... NR_VECTORS - 1] = -1
 };
-static void __init init_ISA_irqs (void)
+void __init init_ISA_irqs(void)
 {
        int i;
@@ -164,22 +164,8 @@ static void __init init_ISA_irqs (void)
 void init_IRQ(void) __attribute__((weak, alias("native_init_IRQ")));
-void __init native_init_IRQ(void)
+static void __init smp_intr_init(void)
 {
-        int i;
-        init_ISA_irqs();
-        /*
-         * Cover the whole vector space, no vector can escape
-         * us. (some of these will be overridden and become
-         * 'special' SMP interrupts)
-         */
-        for (i = 0; i < (NR_VECTORS - FIRST_EXTERNAL_VECTOR); i++) {
-                int vector = FIRST_EXTERNAL_VECTOR + i;
-                if (vector != IA32_SYSCALL_VECTOR)
-                        set_intr_gate(vector, interrupt[i]);
-        }
 #ifdef CONFIG_SMP
        /*
         * The reschedule interrupt is a CPU-to-CPU reschedule-helper
@@ -207,6 +193,12 @@ void __init native_init_IRQ(void)
        /* Low priority IPI to cleanup after moving an irq */
        set_intr_gate(IRQ_MOVE_CLEANUP_VECTOR, irq_move_cleanup_interrupt);
 #endif
+}
+static void __init apic_intr_init(void)
+{
+        smp_intr_init();
        alloc_intr_gate(THERMAL_APIC_VECTOR, thermal_interrupt);
        alloc_intr_gate(THRESHOLD_APIC_VECTOR, threshold_interrupt);
@@ -216,6 +208,25 @@ void __init native_init_IRQ(void)
        /* IPI vectors for APIC spurious and error interrupts */
        alloc_intr_gate(SPURIOUS_APIC_VECTOR, spurious_interrupt);
        alloc_intr_gate(ERROR_APIC_VECTOR, error_interrupt);
+}
+void __init native_init_IRQ(void)
+{
+        int i;
+        init_ISA_irqs();
+        /*
+         * Cover the whole vector space, no vector can escape
+         * us. (some of these will be overridden and become
+         * 'special' SMP interrupts)
+         */
+        for (i = 0; i < (NR_VECTORS - FIRST_EXTERNAL_VECTOR); i++) {
+                int vector = FIRST_EXTERNAL_VECTOR + i;
+                if (vector != IA32_SYSCALL_VECTOR)
+                        set_intr_gate(vector, interrupt[i]);
+        }
+        apic_intr_init();
        if (!acpi_ioapic)
                setup_irq(2, &irq2);
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 922c14058f97..0a1302fe6d45 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -123,7 +123,7 @@ void cpu_idle(void)
        }
 }
-void __show_registers(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, int all)
 {
        unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
        unsigned long d0, d1, d2, d3, d6, d7;
@@ -189,7 +189,7 @@ void __show_registers(struct pt_regs *regs, int all)
 void show_regs(struct pt_regs *regs)
 {
-        __show_registers(regs, 1);
+        __show_regs(regs, 1);
        show_trace(NULL, regs, &regs->sp, regs->bp);
 }
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index ca80394ef5b8..cd8c0ed02b7e 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -136,7 +136,7 @@ void cpu_idle(void)
 }
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs *regs)
+void __show_regs(struct pt_regs *regs, int all)
 {
        unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
        unsigned long d0, d1, d2, d3, d6, d7;
@@ -175,6 +175,9 @@ void __show_regs(struct pt_regs *regs)
        rdmsrl(MSR_GS_BASE, gs);
        rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
+        if (!all)
+                return;
        cr0 = read_cr0();
        cr2 = read_cr2();
        cr3 = read_cr3();
@@ -200,7 +203,7 @@ void __show_regs(struct pt_regs *regs)
 void show_regs(struct pt_regs *regs)
 {
        printk(KERN_INFO "CPU %d:", smp_processor_id());
-        __show_regs(regs);
+        __show_regs(regs, 1);
        show_trace(NULL, regs, (void *)(regs + 1), regs->bp);
 }
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index d13858818100..f6a11b9b1f98 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -354,9 +354,27 @@ static void ati_force_hpet_resume(void)
        printk(KERN_DEBUG "Force enabled HPET at resume\n");
 }
+static u32 ati_ixp4x0_rev(struct pci_dev *dev)
+{
+        u32 d;
+        u8  b;
+        pci_read_config_byte(dev, 0xac, &b);
+        b &= ~(1<<5);
+        pci_write_config_byte(dev, 0xac, b);
+        pci_read_config_dword(dev, 0x70, &d);
+        d |= 1<<8;
+        pci_write_config_dword(dev, 0x70, d);
+        pci_read_config_dword(dev, 0x8, &d);
+        d &= 0xff;
+        dev_printk(KERN_DEBUG, &dev->dev, "SB4X0 revision 0x%x\n", d);
+        return d;
+}
 static void ati_force_enable_hpet(struct pci_dev *dev)
 {
-        u32 uninitialized_var(val);
+        u32 d, val;
+        u8  b;
        if (hpet_address || force_hpet_address)
                return;
@@ -366,14 +384,33 @@ static void ati_force_enable_hpet(struct pci_dev *dev)
                return;
        }
+        d = ati_ixp4x0_rev(dev);
+        if (d  < 0x82)
+                return;
+        /* base address */
        pci_write_config_dword(dev, 0x14, 0xfed00000);
        pci_read_config_dword(dev, 0x14, &val);
+        /* enable interrupt */
+        outb(0x72, 0xcd6); b = inb(0xcd7);
+        b |= 0x1;
+        outb(0x72, 0xcd6); outb(b, 0xcd7);
+        outb(0x72, 0xcd6); b = inb(0xcd7);
+        if (!(b & 0x1))
+                return;
+        pci_read_config_dword(dev, 0x64, &d);
+        d |= (1<<10);
+        pci_write_config_dword(dev, 0x64, d);
+        pci_read_config_dword(dev, 0x64, &d);
+        if (!(d & (1<<10)))
+                return;
        force_hpet_address = val;
        force_hpet_resume_type = ATI_FORCE_HPET_RESUME;
        dev_printk(KERN_DEBUG, &dev->dev, "Force enabled HPET at 0x%lx\n",
                   force_hpet_address);
        cached_dev = dev;
-        return;
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS,
                         ati_force_enable_hpet);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 21b8e0a59780..2255782e8d4b 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -302,7 +302,7 @@ static void __init relocate_initrd(void)
                if (clen > MAX_MAP_CHUNK-slop)
                        clen = MAX_MAP_CHUNK-slop;
                mapaddr = ramdisk_image & PAGE_MASK;
-                p = early_ioremap(mapaddr, clen+slop);
+                p = early_memremap(mapaddr, clen+slop);
                memcpy(q, p+slop, clen);
                early_iounmap(p, clen+slop);
                q += clen;
@@ -379,7 +379,7 @@ static void __init parse_setup_data(void)
                return;
        pa_data = boot_params.hdr.setup_data;
        while (pa_data) {
-                data = early_ioremap(pa_data, PAGE_SIZE);
+                data = early_memremap(pa_data, PAGE_SIZE);
                switch (data->type) {
                case SETUP_E820_EXT:
                        parse_e820_ext(data, pa_data);
@@ -402,7 +402,7 @@ static void __init e820_reserve_setup_data(void)
                return;
        pa_data = boot_params.hdr.setup_data;
        while (pa_data) {
-                data = early_ioremap(pa_data, sizeof(*data));
+                data = early_memremap(pa_data, sizeof(*data));
                e820_update_range(pa_data, sizeof(*data)+data->len,
                         E820_RAM, E820_RESERVED_KERN);
                found = 1;
@@ -428,7 +428,7 @@ static void __init reserve_early_setup_data(void)
                return;
        pa_data = boot_params.hdr.setup_data;
        while (pa_data) {
-                data = early_ioremap(pa_data, sizeof(*data));
+                data = early_memremap(pa_data, sizeof(*data));
                sprintf(buf, "setup data %x", data->type);
                reserve_early(pa_data, pa_data+sizeof(*data)+data->len, buf);
                pa_data = data->next;
@@ -998,6 +998,8 @@ void __init setup_arch(char **cmdline_p)
         */
        acpi_boot_table_init();
+        early_acpi_boot_init();
 #ifdef CONFIG_ACPI_NUMA
        /*
         * Parse SRAT to discover nodes.
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 76b6f50978f7..8c3aca7cb343 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -334,14 +334,17 @@ static void __cpuinit start_secondary(void *unused)
         * does not change while we are assigning vectors to cpus.  Holding
         * this lock ensures we don't half assign or remove an irq from a cpu.
         */
-        ipi_call_lock_irq();
+        ipi_call_lock();
        lock_vector_lock();
        __setup_vector_irq(smp_processor_id());
        cpu_set(smp_processor_id(), cpu_online_map);
        unlock_vector_lock();
-        ipi_call_unlock_irq();
+        ipi_call_unlock();
        per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
+        /* enable local interrupts */
+        local_irq_enable();
        setup_secondary_clock();
        wmb();
@@ -596,10 +599,12 @@ wakeup_secondary_cpu(int logical_apicid, unsigned long start_eip)
         * Give the other CPU some time to accept the IPI.
         */
        udelay(200);
-        maxlvt = lapic_get_maxlvt();
+        if (APIC_INTEGRATED(apic_version[phys_apicid])) {
-        if (maxlvt > 3)                 /* Due to the Pentium erratum 3AP.  */
+                maxlvt = lapic_get_maxlvt();
-                apic_write(APIC_ESR, 0);
+                if (maxlvt > 3)                 /* Due to the Pentium erratum 3AP.  */
-        accept_status = (apic_read(APIC_ESR) & 0xEF);
+                        apic_write(APIC_ESR, 0);
+                accept_status = (apic_read(APIC_ESR) & 0xEF);
+        }
        pr_debug("NMI sent.\n");
        if (send_status)
@@ -1256,39 +1261,6 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
        check_nmi_watchdog();
 }
-#ifdef CONFIG_HOTPLUG_CPU
-static void remove_siblinginfo(int cpu)
-{
-        int sibling;
-        struct cpuinfo_x86 *c = &cpu_data(cpu);
-        for_each_cpu_mask_nr(sibling, per_cpu(cpu_core_map, cpu)) {
-                cpu_clear(cpu, per_cpu(cpu_core_map, sibling));
-                /*/
-                 * last thread sibling in this cpu core going down
-                 */
-                if (cpus_weight(per_cpu(cpu_sibling_map, cpu)) == 1)
-                        cpu_data(sibling).booted_cores--;
-        }
-        for_each_cpu_mask_nr(sibling, per_cpu(cpu_sibling_map, cpu))
-                cpu_clear(cpu, per_cpu(cpu_sibling_map, sibling));
-        cpus_clear(per_cpu(cpu_sibling_map, cpu));
-        cpus_clear(per_cpu(cpu_core_map, cpu));
-        c->phys_proc_id = 0;
-        c->cpu_core_id = 0;
-        cpu_clear(cpu, cpu_sibling_setup_map);
-}
-static int additional_cpus __initdata = -1;
-static __init int setup_additional_cpus(char *s)
-{
-        return s && get_option(&s, &additional_cpus) ? 0 : -EINVAL;
-}
-early_param("additional_cpus", setup_additional_cpus);
 /*
 * cpu_possible_map should be static, it cannot change as cpu's
 * are onlined, or offlined. The reason is per-cpu data-structures
@@ -1308,21 +1280,13 @@ early_param("additional_cpus", setup_additional_cpus);
 */
 __init void prefill_possible_map(void)
 {
-        int i;
+        int i, possible;
-        int possible;
        /* no processor from mptable or madt */
        if (!num_processors)
                num_processors = 1;
-        if (additional_cpus == -1) {
+        possible = num_processors + disabled_cpus;
-                if (disabled_cpus > 0)
-                        additional_cpus = disabled_cpus;
-                else
-                        additional_cpus = 0;
-        }
-        possible = num_processors + additional_cpus;
        if (possible > NR_CPUS)
                possible = NR_CPUS;
@@ -1335,6 +1299,31 @@ __init void prefill_possible_map(void)
        nr_cpu_ids = possible;
 }
+#ifdef CONFIG_HOTPLUG_CPU
+static void remove_siblinginfo(int cpu)
+{
+        int sibling;
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
+        for_each_cpu_mask_nr(sibling, per_cpu(cpu_core_map, cpu)) {
+                cpu_clear(cpu, per_cpu(cpu_core_map, sibling));
+                /*/
+                 * last thread sibling in this cpu core going down
+                 */
+                if (cpus_weight(per_cpu(cpu_sibling_map, cpu)) == 1)
+                        cpu_data(sibling).booted_cores--;
+        }
+        for_each_cpu_mask_nr(sibling, per_cpu(cpu_sibling_map, cpu))
+                cpu_clear(cpu, per_cpu(cpu_sibling_map, sibling));
+        cpus_clear(per_cpu(cpu_sibling_map, cpu));
+        cpus_clear(per_cpu(cpu_core_map, cpu));
+        c->phys_proc_id = 0;
+        c->cpu_core_id = 0;
+        cpu_clear(cpu, cpu_sibling_setup_map);
+}
 static void __ref remove_cpu_from_maps(int cpu)
 {
        cpu_clear(cpu, cpu_online_map);
diff --git a/arch/x86/kernel/time_32.c b/arch/x86/kernel/time_32.c
index bbecf8b6bf96..77b400f06ea2 100644
--- a/arch/x86/kernel/time_32.c
+++ b/arch/x86/kernel/time_32.c
@@ -47,10 +47,9 @@ unsigned long profile_pc(struct pt_regs *regs)
        unsigned long pc = instruction_pointer(regs);
 #ifdef CONFIG_SMP
-        if (!v8086_mode(regs) && SEGMENT_IS_KERNEL_CODE(regs->cs) &&
+        if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-            in_lock_functions(pc)) {
 #ifdef CONFIG_FRAME_POINTER
-                return *(unsigned long *)(regs->bp + 4);
+                return *(unsigned long *)(regs->bp + sizeof(long));
 #else
                unsigned long *sp = (unsigned long *)&regs->sp;
@@ -95,6 +94,7 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
        do_timer_interrupt_hook();
+#ifdef CONFIG_MCA
        if (MCA_bus) {
                /* The PS/2 uses level-triggered interrupts.  You can't
                turn them off, nor would you want to (any attempt to
@@ -108,6 +108,7 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
                u8 irq_v = inb_p( 0x61 );       /* read the current state */
                outb_p( irq_v|0x80, 0x61 );     /* reset the IRQ */
        }
+#endif
        return IRQ_HANDLED;
 }
diff --git a/arch/x86/kernel/time_64.c b/arch/x86/kernel/time_64.c
index e3d49c553af2..cb19d650c216 100644
--- a/arch/x86/kernel/time_64.c
+++ b/arch/x86/kernel/time_64.c
@@ -16,6 +16,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/time.h>
+#include <linux/mca.h>
 #include <asm/i8253.h>
 #include <asm/hpet.h>
@@ -33,23 +34,34 @@ unsigned long profile_pc(struct pt_regs *regs)
        /* Assume the lock function has either no stack frame or a copy
           of flags from PUSHF
           Eflags always has bits 22 and up cleared unlike kernel addresses. */
-        if (!user_mode(regs) && in_lock_functions(pc)) {
+        if (!user_mode_vm(regs) && in_lock_functions(pc)) {
+#ifdef CONFIG_FRAME_POINTER
+                return *(unsigned long *)(regs->bp + sizeof(long));
+#else
                unsigned long *sp = (unsigned long *)regs->sp;
                if (sp[0] >> 22)
                        return sp[0];
                if (sp[1] >> 22)
                        return sp[1];
+#endif
        }
        return pc;
 }
 EXPORT_SYMBOL(profile_pc);
-static irqreturn_t timer_event_interrupt(int irq, void *dev_id)
+irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
        add_pda(irq0_irqs, 1);
        global_clock_event->event_handler(global_clock_event);
+#ifdef CONFIG_MCA
+        if (MCA_bus) {
+                u8 irq_v = inb_p(0x61);       /* read the current state */
+                outb_p(irq_v|0x80, 0x61);     /* reset the IRQ */
+        }
+#endif
        return IRQ_HANDLED;
 }
@@ -100,7 +112,7 @@ unsigned long __init calibrate_cpu(void)
 }
 static struct irqaction irq0 = {
-        .handler        = timer_event_interrupt,
+        .handler        = timer_interrupt,
        .flags          = IRQF_DISABLED | IRQF_IRQPOLL | IRQF_NOBALANCING,
        .mask           = CPU_MASK_NONE,
        .name           = "timer"
@@ -111,16 +123,13 @@ void __init hpet_time_init(void)
        if (!hpet_enable())
                setup_pit_timer();
+        irq0.mask = cpumask_of_cpu(0);
        setup_irq(0, &irq0);
 }
 void __init time_init(void)
 {
        tsc_init();
-        if (cpu_has(&boot_cpu_data, X86_FEATURE_RDTSCP))
-                vgetcpu_mode = VGETCPU_RDTSCP;
-        else
-                vgetcpu_mode = VGETCPU_LSL;
        late_time_init = choose_time_init();
 }
diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps.c
index 0429c5de5ea9..e062974cce34 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps.c
@@ -7,13 +7,11 @@
 */
 /*
- * 'Traps.c' handles hardware traps and faults after we have saved some
+ * Handle hardware traps and faults.
- * state in 'asm.s'.
 */
 #include <linux/interrupt.h>
 #include <linux/kallsyms.h>
 #include <linux/spinlock.h>
-#include <linux/highmem.h>
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
 #include <linux/utsname.h>
@@ -32,6 +30,8 @@
 #include <linux/bug.h>
 #include <linux/nmi.h>
 #include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/io.h>
 #ifdef CONFIG_EISA
 #include <linux/ioport.h>
@@ -46,21 +46,31 @@
 #include <linux/edac.h>
 #endif
-#include <asm/arch_hooks.h>
 #include <asm/stacktrace.h>
 #include <asm/processor.h>
 #include <asm/debugreg.h>
 #include <asm/atomic.h>
 #include <asm/system.h>
 #include <asm/unwind.h>
+#include <asm/traps.h>
 #include <asm/desc.h>
 #include <asm/i387.h>
+#include <mach_traps.h>
+#ifdef CONFIG_X86_64
+#include <asm/pgalloc.h>
+#include <asm/proto.h>
+#include <asm/pda.h>
+#else
+#include <asm/processor-flags.h>
+#include <asm/arch_hooks.h>
 #include <asm/nmi.h>
 #include <asm/smp.h>
 #include <asm/io.h>
 #include <asm/traps.h>
-#include "mach_traps.h"
+#include "cpu/mcheck/mce.h"
 DECLARE_BITMAP(used_vectors, NR_VECTORS);
 EXPORT_SYMBOL_GPL(used_vectors);
@@ -77,418 +87,104 @@ char ignore_fpu_irq;
 */
 gate_desc idt_table[256]
        __attribute__((__section__(".data.idt"))) = { { { { 0, 0 } } }, };
-int panic_on_unrecovered_nmi;
-int kstack_depth_to_print = 24;
-static unsigned int code_bytes = 64;
-static int ignore_nmis;
-static int die_counter;
-void printk_address(unsigned long address, int reliable)
-{
-#ifdef CONFIG_KALLSYMS
-        unsigned long offset = 0;
-        unsigned long symsize;
-        const char *symname;
-        char *modname;
-        char *delim = ":";
-        char namebuf[KSYM_NAME_LEN];
-        char reliab[4] = "";
-        symname = kallsyms_lookup(address, &symsize, &offset,
-                                        &modname, namebuf);
-        if (!symname) {
-                printk(" [<%08lx>]\n", address);
-                return;
-        }
-        if (!reliable)
-                strcpy(reliab, "? ");
-        if (!modname)
-                modname = delim = "";
-        printk(" [<%08lx>] %s%s%s%s%s+0x%lx/0x%lx\n",
-                address, reliab, delim, modname, delim, symname, offset, symsize);
-#else
-        printk(" [<%08lx>]\n", address);
 #endif
-}
-static inline int valid_stack_ptr(struct thread_info *tinfo,
-                        void *p, unsigned int size)
-{
-        void *t = tinfo;
-        return  p > t && p <= t + THREAD_SIZE - size;
-}
-/* The form of the top of the frame on the stack */
-struct stack_frame {
-        struct stack_frame *next_frame;
-        unsigned long return_address;
-};
-static inline unsigned long
-print_context_stack(struct thread_info *tinfo,
-                unsigned long *stack, unsigned long bp,
-                const struct stacktrace_ops *ops, void *data)
-{
-        struct stack_frame *frame = (struct stack_frame *)bp;
-        while (valid_stack_ptr(tinfo, stack, sizeof(*stack))) {
-                unsigned long addr;
-                addr = *stack;
-                if (__kernel_text_address(addr)) {
-                        if ((unsigned long) stack == bp + 4) {
-                                ops->address(data, addr, 1);
-                                frame = frame->next_frame;
-                                bp = (unsigned long) frame;
-                        } else {
-                                ops->address(data, addr, bp == 0);
-                        }
-                }
-                stack++;
-        }
-        return bp;
-}
-void dump_trace(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *stack, unsigned long bp,
-                const struct stacktrace_ops *ops, void *data)
-{
-        if (!task)
-                task = current;
-        if (!stack) {
-                unsigned long dummy;
-                stack = &dummy;
-                if (task != current)
-                        stack = (unsigned long *)task->thread.sp;
-        }
-#ifdef CONFIG_FRAME_POINTER
-        if (!bp) {
-                if (task == current) {
-                        /* Grab bp right from our regs */
-                        asm("movl %%ebp, %0" : "=r" (bp) :);
-                } else {
-                        /* bp is the last reg pushed by switch_to */
-                        bp = *(unsigned long *) task->thread.sp;
-                }
-        }
-#endif
-        for (;;) {
-                struct thread_info *context;
-                context = (struct thread_info *)
-                        ((unsigned long)stack & (~(THREAD_SIZE - 1)));
-                bp = print_context_stack(context, stack, bp, ops, data);
-                /*
-                 * Should be after the line below, but somewhere
-                 * in early boot context comes out corrupted and we
-                 * can't reference it:
-                 */
-                if (ops->stack(data, "IRQ") < 0)
-                        break;
-                stack = (unsigned long *)context->previous_esp;
-                if (!stack)
-                        break;
-                touch_nmi_watchdog();
-        }
-}
-EXPORT_SYMBOL(dump_trace);
-static void
-print_trace_warning_symbol(void *data, char *msg, unsigned long symbol)
-{
-        printk(data);
-        print_symbol(msg, symbol);
-        printk("\n");
-}
-static void print_trace_warning(void *data, char *msg)
-{
-        printk("%s%s\n", (char *)data, msg);
-}
-static int print_trace_stack(void *data, char *name)
+static int ignore_nmis;
-{
-        return 0;
-}
-/*
- * Print one address/symbol entries per line.
- */
-static void print_trace_address(void *data, unsigned long addr, int reliable)
-{
-        printk("%s [<%08lx>] ", (char *)data, addr);
-        if (!reliable)
-                printk("? ");
-        print_symbol("%s\n", addr);
-        touch_nmi_watchdog();
-}
-static const struct stacktrace_ops print_trace_ops = {
-        .warning = print_trace_warning,
-        .warning_symbol = print_trace_warning_symbol,
-        .stack = print_trace_stack,
-        .address = print_trace_address,
-};
-static void
+static inline void conditional_sti(struct pt_regs *regs)
-show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *stack, unsigned long bp, char *log_lvl)
 {
-        dump_trace(task, regs, stack, bp, &print_trace_ops, log_lvl);
+        if (regs->flags & X86_EFLAGS_IF)
-        printk("%s =======================\n", log_lvl);
+                local_irq_enable();
 }
-void show_trace(struct task_struct *task, struct pt_regs *regs,
+static inline void preempt_conditional_sti(struct pt_regs *regs)
-                unsigned long *stack, unsigned long bp)
 {
-        show_trace_log_lvl(task, regs, stack, bp, "");
+        inc_preempt_count();
+        if (regs->flags & X86_EFLAGS_IF)
+                local_irq_enable();
 }
-static void
+static inline void preempt_conditional_cli(struct pt_regs *regs)
-show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
-                   unsigned long *sp, unsigned long bp, char *log_lvl)
 {
-        unsigned long *stack;
+        if (regs->flags & X86_EFLAGS_IF)
-        int i;
+                local_irq_disable();
+        dec_preempt_count();
-        if (sp == NULL) {
-                if (task)
-                        sp = (unsigned long *)task->thread.sp;
-                else
-                        sp = (unsigned long *)&sp;
-        }
-        stack = sp;
-        for (i = 0; i < kstack_depth_to_print; i++) {
-                if (kstack_end(stack))
-                        break;
-                if (i && ((i % 8) == 0))
-                        printk("\n%s       ", log_lvl);
-                printk("%08lx ", *stack++);
-        }
-        printk("\n%sCall Trace:\n", log_lvl);
-        show_trace_log_lvl(task, regs, sp, bp, log_lvl);
 }
-void show_stack(struct task_struct *task, unsigned long *sp)
+#ifdef CONFIG_X86_32
+static inline void
+die_if_kernel(const char *str, struct pt_regs *regs, long err)
 {
-        printk("       ");
+        if (!user_mode_vm(regs))
-        show_stack_log_lvl(task, NULL, sp, 0, "");
+                die(str, regs, err);
 }
 /*
- * The architecture-independent dump_stack generator
+ * Perform the lazy TSS's I/O bitmap copy. If the TSS has an
+ * invalid offset set (the LAZY one) and the faulting thread has
+ * a valid I/O bitmap pointer, we copy the I/O bitmap in the TSS,
+ * we set the offset field correctly and return 1.
 */
-void dump_stack(void)
+static int lazy_iobitmap_copy(void)
 {
-        unsigned long bp = 0;
+        struct thread_struct *thread;
-        unsigned long stack;
+        struct tss_struct *tss;
+        int cpu;
-#ifdef CONFIG_FRAME_POINTER
-        if (!bp)
-                asm("movl %%ebp, %0" : "=r" (bp):);
-#endif
-        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-                current->pid, current->comm, print_tainted(),
-                init_utsname()->release,
-                (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
-        show_trace(current, NULL, &stack, bp);
-}
-EXPORT_SYMBOL(dump_stack);
-void show_registers(struct pt_regs *regs)
-{
-        int i;
-        print_modules();
+        cpu = get_cpu();
-        __show_registers(regs, 0);
+        tss = &per_cpu(init_tss, cpu);
+        thread = &current->thread;
-        printk(KERN_EMERG "Process %.*s (pid: %d, ti=%p task=%p task.ti=%p)",
+        if (tss->x86_tss.io_bitmap_base == INVALID_IO_BITMAP_OFFSET_LAZY &&
-                TASK_COMM_LEN, current->comm, task_pid_nr(current),
+            thread->io_bitmap_ptr) {
-                current_thread_info(), current, task_thread_info(current));
+                memcpy(tss->io_bitmap, thread->io_bitmap_ptr,
-        /*
+                       thread->io_bitmap_max);
-         * When in-kernel, we also print out the stack and code at the
+                /*
-         * time of the fault..
+                 * If the previously set map was extending to higher ports
-         */
+                 * than the current one, pad extra space with 0xff (no access).
-        if (!user_mode_vm(regs)) {
+                 */
-                unsigned int code_prologue = code_bytes * 43 / 64;
+                if (thread->io_bitmap_max < tss->io_bitmap_max) {
-                unsigned int code_len = code_bytes;
+                        memset((char *) tss->io_bitmap +
-                unsigned char c;
+                                thread->io_bitmap_max, 0xff,
-                u8 *ip;
+                                tss->io_bitmap_max - thread->io_bitmap_max);
-                printk("\n" KERN_EMERG "Stack: ");
-                show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
-                printk(KERN_EMERG "Code: ");
-                ip = (u8 *)regs->ip - code_prologue;
-                if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
-                        /* try starting at EIP */
-                        ip = (u8 *)regs->ip;
-                        code_len = code_len - code_prologue + 1;
-                }
-                for (i = 0; i < code_len; i++, ip++) {
-                        if (ip < (u8 *)PAGE_OFFSET ||
-                                        probe_kernel_address(ip, c)) {
-                                printk(" Bad EIP value.");
-                                break;
-                        }
-                        if (ip == (u8 *)regs->ip)
-                                printk("<%02x> ", c);
-                        else
-                                printk("%02x ", c);
                }
-        }
+                tss->io_bitmap_max = thread->io_bitmap_max;
-        printk("\n");
+                tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
-}
+                tss->io_bitmap_owner = thread;
+                put_cpu();
-int is_valid_bugaddr(unsigned long ip)
-{
-        unsigned short ud2;
-        if (ip < PAGE_OFFSET)
-                return 0;
-        if (probe_kernel_address((unsigned short *)ip, ud2))
-                return 0;
-        return ud2 == 0x0b0f;
-}
-static raw_spinlock_t die_lock = __RAW_SPIN_LOCK_UNLOCKED;
-static int die_owner = -1;
-static unsigned int die_nest_count;
-unsigned __kprobes long oops_begin(void)
-{
-        unsigned long flags;
-        oops_enter();
-        if (die_owner != raw_smp_processor_id()) {
-                console_verbose();
-                raw_local_irq_save(flags);
-                __raw_spin_lock(&die_lock);
-                die_owner = smp_processor_id();
-                die_nest_count = 0;
-                bust_spinlocks(1);
-        } else {
-                raw_local_irq_save(flags);
-        }
-        die_nest_count++;
-        return flags;
-}
-void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
-{
-        bust_spinlocks(0);
-        die_owner = -1;
-        add_taint(TAINT_DIE);
-        __raw_spin_unlock(&die_lock);
-        raw_local_irq_restore(flags);
-        if (!regs)
-                return;
-        if (kexec_should_crash(current))
-                crash_kexec(regs);
-        if (in_interrupt())
-                panic("Fatal exception in interrupt");
-        if (panic_on_oops)
-                panic("Fatal exception");
-        oops_exit();
-        do_exit(signr);
-}
-int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-{
-        unsigned short ss;
-        unsigned long sp;
-        printk(KERN_EMERG "%s: %04lx [#%d] ", str, err & 0xffff, ++die_counter);
-#ifdef CONFIG_PREEMPT
-        printk("PREEMPT ");
-#endif
-#ifdef CONFIG_SMP
-        printk("SMP ");
-#endif
-#ifdef CONFIG_DEBUG_PAGEALLOC
-        printk("DEBUG_PAGEALLOC");
-#endif
-        printk("\n");
-        if (notify_die(DIE_OOPS, str, regs, err,
-                        current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
                return 1;
-        show_registers(regs);
-        /* Executive summary in case the oops scrolled away */
-        sp = (unsigned long) (&regs->sp);
-        savesegment(ss, ss);
-        if (user_mode(regs)) {
-                sp = regs->sp;
-                ss = regs->ss & 0xffff;
        }
-        printk(KERN_EMERG "EIP: [<%08lx>] ", regs->ip);
+        put_cpu();
-        print_symbol("%s", regs->ip);
-        printk(" SS:ESP %04x:%08lx\n", ss, sp);
-        return 0;
-}
-/*
- * This is gone through when something in the kernel has done something bad
- * and is about to be terminated:
- */
-void die(const char *str, struct pt_regs *regs, long err)
-{
-        unsigned long flags = oops_begin();
-        if (die_nest_count < 3) {
-                report_bug(regs->ip, regs);
-                if (__die(str, regs, err))
-                        regs = NULL;
-        } else {
-                printk(KERN_EMERG "Recursive die() failure, output suppressed\n");
-        }
-        oops_end(flags, regs, SIGSEGV);
-}
-static inline void
+        return 0;
-die_if_kernel(const char *str, struct pt_regs *regs, long err)
-{
-        if (!user_mode_vm(regs))
-                die(str, regs, err);
 }
+#endif
 static void __kprobes
-do_trap(int trapnr, int signr, char *str, int vm86, struct pt_regs *regs,
+do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
        long error_code, siginfo_t *info)
 {
        struct task_struct *tsk = current;
+#ifdef CONFIG_X86_32
        if (regs->flags & X86_VM_MASK) {
-                if (vm86)
+                /*
+                 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
+                 * On nmi (interrupt 2), do_trap should not be called.
+                 */
+                if (trapnr < 6)
                        goto vm86_trap;
                goto trap_signal;
        }
+#endif
        if (!user_mode(regs))
                goto kernel_trap;
+#ifdef CONFIG_X86_32
 trap_signal:
+#endif
        /*
         * We want error_code and trap_no set for userspace faults and
         * kernelspace faults which result in die(), but not
@@ -501,6 +197,18 @@ trap_signal:
        tsk->thread.error_code = error_code;
        tsk->thread.trap_no = trapnr;
+#ifdef CONFIG_X86_64
+        if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
+            printk_ratelimit()) {
+                printk(KERN_INFO
+                       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
+                       tsk->comm, tsk->pid, str,
+                       regs->ip, regs->sp, error_code);
+                print_vma_addr(" in ", regs->ip);
+                printk("\n");
+        }
+#endif
        if (info)
                force_sig_info(signr, info, tsk);
        else
@@ -515,29 +223,29 @@ kernel_trap:
        }
        return;
+#ifdef CONFIG_X86_32
 vm86_trap:
        if (handle_vm86_trap((struct kernel_vm86_regs *) regs,
                                                error_code, trapnr))
                goto trap_signal;
        return;
+#endif
 }
 #define DO_ERROR(trapnr, signr, str, name)                              \
-void do_##name(struct pt_regs *regs, long error_code)                   \
+dotraplinkage void do_##name(struct pt_regs *regs, long error_code)     \
 {                                                                       \
-        trace_hardirqs_fixup();                                         \
        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
                                                        == NOTIFY_STOP) \
                return;                                                 \
-        do_trap(trapnr, signr, str, 0, regs, error_code, NULL);         \
+        conditional_sti(regs);                                          \
+        do_trap(trapnr, signr, str, regs, error_code, NULL);            \
 }
-#define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr, irq)    \
+#define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)         \
-void do_##name(struct pt_regs *regs, long error_code)                   \
+dotraplinkage void do_##name(struct pt_regs *regs, long error_code)     \
 {                                                                       \
        siginfo_t info;                                                 \
-        if (irq)                                                        \
-                local_irq_enable();                                     \
        info.si_signo = signr;                                          \
        info.si_errno = 0;                                              \
        info.si_code = sicode;                                          \
@@ -545,90 +253,68 @@ void do_##name(struct pt_regs *regs, long error_code)			\
        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
                                                        == NOTIFY_STOP) \
                return;                                                 \
-        do_trap(trapnr, signr, str, 0, regs, error_code, &info);        \
+        conditional_sti(regs);                                          \
+        do_trap(trapnr, signr, str, regs, error_code, &info);           \
 }
-#define DO_VM86_ERROR(trapnr, signr, str, name)                         \
+DO_ERROR_INFO(0, SIGFPE, "divide error", divide_error, FPE_INTDIV, regs->ip)
-void do_##name(struct pt_regs *regs, long error_code)                   \
+DO_ERROR(4, SIGSEGV, "overflow", overflow)
-{                                                                       \
+DO_ERROR(5, SIGSEGV, "bounds", bounds)
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
+DO_ERROR_INFO(6, SIGILL, "invalid opcode", invalid_op, ILL_ILLOPN, regs->ip)
-                                                        == NOTIFY_STOP) \
-                return;                                                 \
-        do_trap(trapnr, signr, str, 1, regs, error_code, NULL);         \
-}
-#define DO_VM86_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)    \
-void do_##name(struct pt_regs *regs, long error_code)                   \
-{                                                                       \
-        siginfo_t info;                                                 \
-        info.si_signo = signr;                                          \
-        info.si_errno = 0;                                              \
-        info.si_code = sicode;                                          \
-        info.si_addr = (void __user *)siaddr;                           \
-        trace_hardirqs_fixup();                                         \
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
-                                                        == NOTIFY_STOP) \
-                return;                                                 \
-        do_trap(trapnr, signr, str, 1, regs, error_code, &info);        \
-}
-DO_VM86_ERROR_INFO(0, SIGFPE, "divide error", divide_error, FPE_INTDIV, regs->ip)
-#ifndef CONFIG_KPROBES
-DO_VM86_ERROR(3, SIGTRAP, "int3", int3)
-#endif
-DO_VM86_ERROR(4, SIGSEGV, "overflow", overflow)
-DO_VM86_ERROR(5, SIGSEGV, "bounds", bounds)
-DO_ERROR_INFO(6, SIGILL, "invalid opcode", invalid_op, ILL_ILLOPN, regs->ip, 0)
 DO_ERROR(9, SIGFPE, "coprocessor segment overrun", coprocessor_segment_overrun)
 DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
 DO_ERROR(11, SIGBUS, "segment not present", segment_not_present)
+#ifdef CONFIG_X86_32
 DO_ERROR(12, SIGBUS, "stack segment", stack_segment)
-DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0, 0)
+#endif
-DO_ERROR_INFO(32, SIGILL, "iret exception", iret_error, ILL_BADSTK, 0, 1)
+DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
+#ifdef CONFIG_X86_64
+/* Runs on IST stack */
+dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
+{
+        if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
+                        12, SIGBUS) == NOTIFY_STOP)
+                return;
+        preempt_conditional_sti(regs);
+        do_trap(12, SIGBUS, "stack segment", regs, error_code, NULL);
+        preempt_conditional_cli(regs);
+}
+dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+{
+        static const char str[] = "double fault";
+        struct task_struct *tsk = current;
+        /* Return not checked because double check cannot be ignored */
+        notify_die(DIE_TRAP, str, regs, error_code, 8, SIGSEGV);
-void __kprobes
+        tsk->thread.error_code = error_code;
+        tsk->thread.trap_no = 8;
+        /* This is always a kernel trap and never fixable (and thus must
+           never return). */
+        for (;;)
+                die(str, regs, error_code);
+}
+#endif
+dotraplinkage void __kprobes
 do_general_protection(struct pt_regs *regs, long error_code)
 {
        struct task_struct *tsk;
-        struct thread_struct *thread;
-        struct tss_struct *tss;
-        int cpu;
-        cpu = get_cpu();
+        conditional_sti(regs);
-        tss = &per_cpu(init_tss, cpu);
-        thread = &current->thread;
-        /*
-         * Perform the lazy TSS's I/O bitmap copy. If the TSS has an
-         * invalid offset set (the LAZY one) and the faulting thread has
-         * a valid I/O bitmap pointer, we copy the I/O bitmap in the TSS
-         * and we set the offset field correctly. Then we let the CPU to
-         * restart the faulting instruction.
-         */
-        if (tss->x86_tss.io_bitmap_base == INVALID_IO_BITMAP_OFFSET_LAZY &&
-            thread->io_bitmap_ptr) {
-                memcpy(tss->io_bitmap, thread->io_bitmap_ptr,
-                       thread->io_bitmap_max);
-                /*
-                 * If the previously set map was extending to higher ports
-                 * than the current one, pad extra space with 0xff (no access).
-                 */
-                if (thread->io_bitmap_max < tss->io_bitmap_max) {
-                        memset((char *) tss->io_bitmap +
-                                thread->io_bitmap_max, 0xff,
-                                tss->io_bitmap_max - thread->io_bitmap_max);
-                }
-                tss->io_bitmap_max = thread->io_bitmap_max;
-                tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
-                tss->io_bitmap_owner = thread;
-                put_cpu();
+#ifdef CONFIG_X86_32
+        if (lazy_iobitmap_copy()) {
+                /* restart the faulting instruction */
                return;
        }
-        put_cpu();
        if (regs->flags & X86_VM_MASK)
                goto gp_in_vm86;
+#endif
        tsk = current;
        if (!user_mode(regs))
@@ -650,10 +336,12 @@ do_general_protection(struct pt_regs *regs, long error_code)
        force_sig(SIGSEGV, tsk);
        return;
+#ifdef CONFIG_X86_32
 gp_in_vm86:
        local_irq_enable();
        handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
        return;
+#endif
 gp_in_kernel:
        if (fixup_exception(regs))
@@ -690,7 +378,8 @@ mem_parity_error(unsigned char reason, struct pt_regs *regs)
        printk(KERN_EMERG "Dazed and confused, but trying to continue\n");
        /* Clear and disable the memory parity error line. */
-        clear_mem_error(reason);
+        reason = (reason & 0xf) | 4;
+        outb(reason, 0x61);
 }
 static notrace __kprobes void
@@ -716,7 +405,8 @@ io_check_error(unsigned char reason, struct pt_regs *regs)
 static notrace __kprobes void
 unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
 {
-        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
+        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) ==
+                        NOTIFY_STOP)
                return;
 #ifdef CONFIG_MCA
        /*
@@ -739,41 +429,6 @@ unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
        printk(KERN_EMERG "Dazed and confused, but trying to continue\n");
 }
-static DEFINE_SPINLOCK(nmi_print_lock);
-void notrace __kprobes die_nmi(char *str, struct pt_regs *regs, int do_panic)
-{
-        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0, 2, SIGINT) == NOTIFY_STOP)
-                return;
-        spin_lock(&nmi_print_lock);
-        /*
-        * We are in trouble anyway, lets at least try
-        * to get a message out:
-        */
-        bust_spinlocks(1);
-        printk(KERN_EMERG "%s", str);
-        printk(" on CPU%d, ip %08lx, registers:\n",
-                smp_processor_id(), regs->ip);
-        show_registers(regs);
-        if (do_panic)
-                panic("Non maskable interrupt");
-        console_silent();
-        spin_unlock(&nmi_print_lock);
-        bust_spinlocks(0);
-        /*
-         * If we are in kernel we are probably nested up pretty bad
-         * and might aswell get out now while we still can:
-         */
-        if (!user_mode_vm(regs)) {
-                current->thread.trap_no = 2;
-                crash_kexec(regs);
-        }
-        do_exit(SIGSEGV);
-}
 static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
 {
        unsigned char reason = 0;
@@ -812,22 +467,25 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
                mem_parity_error(reason, regs);
        if (reason & 0x40)
                io_check_error(reason, regs);
+#ifdef CONFIG_X86_32
        /*
         * Reassert NMI in case it became active meanwhile
         * as it's edge-triggered:
         */
        reassert_nmi();
+#endif
 }
-notrace __kprobes void do_nmi(struct pt_regs *regs, long error_code)
+dotraplinkage notrace __kprobes void
+do_nmi(struct pt_regs *regs, long error_code)
 {
-        int cpu;
        nmi_enter();
-        cpu = smp_processor_id();
+#ifdef CONFIG_X86_32
+        { int cpu; cpu = smp_processor_id(); ++nmi_count(cpu); }
-        ++nmi_count(cpu);
+#else
+        add_pda(__nmi_count, 1);
+#endif
        if (!ignore_nmis)
                default_do_nmi(regs);
@@ -847,21 +505,44 @@ void restart_nmi(void)
        acpi_nmi_enable();
 }
-#ifdef CONFIG_KPROBES
+/* May run on IST stack. */
-void __kprobes do_int3(struct pt_regs *regs, long error_code)
+dotraplinkage void __kprobes do_int3(struct pt_regs *regs, long error_code)
 {
-        trace_hardirqs_fixup();
+#ifdef CONFIG_KPROBES
        if (notify_die(DIE_INT3, "int3", regs, error_code, 3, SIGTRAP)
                        == NOTIFY_STOP)
                return;
-        /*
+#else
-         * This is an interrupt gate, because kprobes wants interrupts
+        if (notify_die(DIE_TRAP, "int3", regs, error_code, 3, SIGTRAP)
-         * disabled. Normal trap handlers don't.
+                        == NOTIFY_STOP)
-         */
+                return;
-        restore_interrupts(regs);
+#endif
+        preempt_conditional_sti(regs);
+        do_trap(3, SIGTRAP, "int3", regs, error_code, NULL);
+        preempt_conditional_cli(regs);
+}
-        do_trap(3, SIGTRAP, "int3", 1, regs, error_code, NULL);
+#ifdef CONFIG_X86_64
+/* Help handler running on IST stack to switch back to user stack
+   for scheduling or signal handling. The actual stack switch is done in
+   entry.S */
+asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
+{
+        struct pt_regs *regs = eregs;
+        /* Did already sync */
+        if (eregs == (struct pt_regs *)eregs->sp)
+                ;
+        /* Exception from user space */
+        else if (user_mode(eregs))
+                regs = task_pt_regs(current);
+        /* Exception from kernel and interrupts are enabled. Move to
+           kernel process stack. */
+        else if (eregs->flags & X86_EFLAGS_IF)
+                regs = (struct pt_regs *)(eregs->sp -= sizeof(struct pt_regs));
+        if (eregs != regs)
+                *regs = *eregs;
+        return regs;
 }
 #endif
@@ -886,15 +567,15 @@ void __kprobes do_int3(struct pt_regs *regs, long error_code)
 * about restoring all the debug state, and ptrace doesn't have to
 * find every occurrence of the TF bit that could be saved away even
 * by user code)
+ *
+ * May run on IST stack.
 */
-void __kprobes do_debug(struct pt_regs *regs, long error_code)
+dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
 {
        struct task_struct *tsk = current;
-        unsigned int condition;
+        unsigned long condition;
        int si_code;
-        trace_hardirqs_fixup();
        get_debugreg(condition, 6);
        /*
@@ -906,9 +587,9 @@ void __kprobes do_debug(struct pt_regs *regs, long error_code)
        if (notify_die(DIE_DEBUG, "debug", regs, condition, error_code,
                                                SIGTRAP) == NOTIFY_STOP)
                return;
        /* It's safe to allow irq's after DR6 has been saved */
-        if (regs->flags & X86_EFLAGS_IF)
+        preempt_conditional_sti(regs);
-                local_irq_enable();
        /* Mask out spurious debug traps due to lazy DR7 setting */
        if (condition & (DR_TRAP0|DR_TRAP1|DR_TRAP2|DR_TRAP3)) {
@@ -916,8 +597,10 @@ void __kprobes do_debug(struct pt_regs *regs, long error_code)
                        goto clear_dr7;
        }
+#ifdef CONFIG_X86_32
        if (regs->flags & X86_VM_MASK)
                goto debug_vm86;
+#endif
        /* Save debug status register where ptrace can see it */
        tsk->thread.debugreg6 = condition;
@@ -927,16 +610,11 @@ void __kprobes do_debug(struct pt_regs *regs, long error_code)
         * kernel space (but re-enable TF when returning to user mode).
         */
        if (condition & DR_STEP) {
-                /*
-                 * We already checked v86 mode above, so we can
-                 * check for kernel mode by just checking the CPL
-                 * of CS.
-                 */
                if (!user_mode(regs))
                        goto clear_TF_reenable;
        }
-        si_code = get_si_code((unsigned long)condition);
+        si_code = get_si_code(condition);
        /* Ok, finally something we can handle */
        send_sigtrap(tsk, regs, error_code, si_code);
@@ -946,18 +624,37 @@ void __kprobes do_debug(struct pt_regs *regs, long error_code)
         */
 clear_dr7:
        set_debugreg(0, 7);
+        preempt_conditional_cli(regs);
        return;
+#ifdef CONFIG_X86_32
 debug_vm86:
        handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code, 1);
+        preempt_conditional_cli(regs);
        return;
+#endif
 clear_TF_reenable:
        set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
        regs->flags &= ~X86_EFLAGS_TF;
+        preempt_conditional_cli(regs);
        return;
 }
+#ifdef CONFIG_X86_64
+static int kernel_math_error(struct pt_regs *regs, const char *str, int trapnr)
+{
+        if (fixup_exception(regs))
+                return 1;
+        notify_die(DIE_GPF, str, regs, 0, trapnr, SIGFPE);
+        /* Illegal floating point operation in the kernel */
+        current->thread.trap_no = trapnr;
+        die(str, regs, 0);
+        return 0;
+}
+#endif
 /*
 * Note that we play around with the 'TS' bit in an attempt to get
 * the correct behaviour even in the presence of the asynchronous
@@ -994,7 +691,9 @@ void math_error(void __user *ip)
        swd = get_fpu_swd(task);
        switch (swd & ~cwd & 0x3f) {
        case 0x000: /* No unmasked exception */
+#ifdef CONFIG_X86_32
                return;
+#endif
        default: /* Multiple exceptions */
                break;
        case 0x001: /* Invalid Op */
@@ -1022,9 +721,18 @@ void math_error(void __user *ip)
        force_sig_info(SIGFPE, &info, task);
 }
-void do_coprocessor_error(struct pt_regs *regs, long error_code)
+dotraplinkage void do_coprocessor_error(struct pt_regs *regs, long error_code)
 {
+        conditional_sti(regs);
+#ifdef CONFIG_X86_32
        ignore_fpu_irq = 1;
+#else
+        if (!user_mode(regs) &&
+            kernel_math_error(regs, "kernel x87 math error", 16))
+                return;
+#endif
        math_error((void __user *)regs->ip);
 }
@@ -1076,8 +784,12 @@ static void simd_math_error(void __user *ip)
        force_sig_info(SIGFPE, &info, task);
 }
-void do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
+dotraplinkage void
+do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
 {
+        conditional_sti(regs);
+#ifdef CONFIG_X86_32
        if (cpu_has_xmm) {
                /* Handle SIMD FPU exceptions on PIII+ processors. */
                ignore_fpu_irq = 1;
@@ -1096,16 +808,25 @@ void do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
        current->thread.error_code = error_code;
        die_if_kernel("cache flush denied", regs, error_code);
        force_sig(SIGSEGV, current);
+#else
+        if (!user_mode(regs) &&
+                        kernel_math_error(regs, "kernel simd math error", 19))
+                return;
+        simd_math_error((void __user *)regs->ip);
+#endif
 }
-void do_spurious_interrupt_bug(struct pt_regs *regs, long error_code)
+dotraplinkage void
+do_spurious_interrupt_bug(struct pt_regs *regs, long error_code)
 {
+        conditional_sti(regs);
 #if 0
        /* No need to warn about this any longer. */
        printk(KERN_INFO "Ignoring P6 Local APIC Spurious Interrupt Bug...\n");
 #endif
 }
+#ifdef CONFIG_X86_32
 unsigned long patch_espfix_desc(unsigned long uesp, unsigned long kesp)
 {
        struct desc_struct *gdt = get_cpu_gdt_table(smp_processor_id());
@@ -1124,6 +845,15 @@ unsigned long patch_espfix_desc(unsigned long uesp, unsigned long kesp)
        return new_kesp;
 }
+#else
+asmlinkage void __attribute__((weak)) smp_thermal_interrupt(void)
+{
+}
+asmlinkage void __attribute__((weak)) mce_threshold_interrupt(void)
+{
+}
+#endif
 /*
 * 'math_state_restore()' saves the current math information in the
@@ -1156,14 +886,24 @@ asmlinkage void math_state_restore(void)
        }
        clts();                         /* Allow maths ops (or we recurse) */
+#ifdef CONFIG_X86_32
        restore_fpu(tsk);
+#else
+        /*
+         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
+         */
+        if (unlikely(restore_fpu_checking(tsk))) {
+                stts();
+                force_sig(SIGSEGV, tsk);
+                return;
+        }
+#endif
        thread->status |= TS_USEDFPU;   /* So we fnsave on switch_to() */
        tsk->fpu_counter++;
 }
 EXPORT_SYMBOL_GPL(math_state_restore);
 #ifndef CONFIG_MATH_EMULATION
 asmlinkage void math_emulate(long arg)
 {
        printk(KERN_EMERG
@@ -1172,12 +912,54 @@ asmlinkage void math_emulate(long arg)
        force_sig(SIGFPE, current);
        schedule();
 }
 #endif /* CONFIG_MATH_EMULATION */
+dotraplinkage void __kprobes
+do_device_not_available(struct pt_regs *regs, long error)
+{
+#ifdef CONFIG_X86_32
+        if (read_cr0() & X86_CR0_EM) {
+                conditional_sti(regs);
+                math_emulate(0);
+        } else {
+                math_state_restore(); /* interrupts still off */
+                conditional_sti(regs);
+        }
+#else
+        math_state_restore();
+#endif
+}
+#ifdef CONFIG_X86_32
+#ifdef CONFIG_X86_MCE
+dotraplinkage void __kprobes do_machine_check(struct pt_regs *regs, long error)
+{
+        conditional_sti(regs);
+        machine_check_vector(regs, error);
+}
+#endif
+dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
+{
+        siginfo_t info;
+        local_irq_enable();
+        info.si_signo = SIGILL;
+        info.si_errno = 0;
+        info.si_code = ILL_BADSTK;
+        info.si_addr = 0;
+        if (notify_die(DIE_TRAP, "iret exception",
+                        regs, error_code, 32, SIGILL) == NOTIFY_STOP)
+                return;
+        do_trap(32, SIGILL, "iret exception", regs, error_code, &info);
+}
+#endif
 void __init trap_init(void)
 {
+#ifdef CONFIG_X86_32
        int i;
+#endif
 #ifdef CONFIG_EISA
        void __iomem *p = early_ioremap(0x0FFFD9, 4);
@@ -1187,29 +969,40 @@ void __init trap_init(void)
        early_iounmap(p, 4);
 #endif
-        set_trap_gate(0, &divide_error);
+        set_intr_gate(0, &divide_error);
-        set_intr_gate(1, &debug);
+        set_intr_gate_ist(1, &debug, DEBUG_STACK);
-        set_intr_gate(2, &nmi);
+        set_intr_gate_ist(2, &nmi, NMI_STACK);
-        set_system_intr_gate(3, &int3); /* int3 can be called from all */
+        /* int3 can be called from all */
-        set_system_gate(4, &overflow); /* int4 can be called from all */
+        set_system_intr_gate_ist(3, &int3, DEBUG_STACK);
-        set_trap_gate(5, &bounds);
+        /* int4 can be called from all */
-        set_trap_gate(6, &invalid_op);
+        set_system_intr_gate(4, &overflow);
-        set_trap_gate(7, &device_not_available);
+        set_intr_gate(5, &bounds);
+        set_intr_gate(6, &invalid_op);
+        set_intr_gate(7, &device_not_available);
+#ifdef CONFIG_X86_32
        set_task_gate(8, GDT_ENTRY_DOUBLEFAULT_TSS);
-        set_trap_gate(9, &coprocessor_segment_overrun);
+#else
-        set_trap_gate(10, &invalid_TSS);
+        set_intr_gate_ist(8, &double_fault, DOUBLEFAULT_STACK);
-        set_trap_gate(11, &segment_not_present);
+#endif
-        set_trap_gate(12, &stack_segment);
+        set_intr_gate(9, &coprocessor_segment_overrun);
-        set_trap_gate(13, &general_protection);
+        set_intr_gate(10, &invalid_TSS);
+        set_intr_gate(11, &segment_not_present);
+        set_intr_gate_ist(12, &stack_segment, STACKFAULT_STACK);
+        set_intr_gate(13, &general_protection);
        set_intr_gate(14, &page_fault);
-        set_trap_gate(15, &spurious_interrupt_bug);
+        set_intr_gate(15, &spurious_interrupt_bug);
-        set_trap_gate(16, &coprocessor_error);
+        set_intr_gate(16, &coprocessor_error);
-        set_trap_gate(17, &alignment_check);
+        set_intr_gate(17, &alignment_check);
 #ifdef CONFIG_X86_MCE
-        set_trap_gate(18, &machine_check);
+        set_intr_gate_ist(18, &machine_check, MCE_STACK);
 #endif
-        set_trap_gate(19, &simd_coprocessor_error);
+        set_intr_gate(19, &simd_coprocessor_error);
+#ifdef CONFIG_IA32_EMULATION
+        set_system_intr_gate(IA32_SYSCALL_VECTOR, ia32_syscall);
+#endif
+#ifdef CONFIG_X86_32
        if (cpu_has_fxsr) {
                printk(KERN_INFO "Enabling fast FPU save and restore... ");
                set_in_cr4(X86_CR4_OSFXSR);
@@ -1222,36 +1015,20 @@ void __init trap_init(void)
                printk("done.\n");
        }
-        set_system_gate(SYSCALL_VECTOR, &system_call);
+        set_system_trap_gate(SYSCALL_VECTOR, &system_call);
        /* Reserve all the builtin and the syscall vector: */
        for (i = 0; i < FIRST_EXTERNAL_VECTOR; i++)
                set_bit(i, used_vectors);
        set_bit(SYSCALL_VECTOR, used_vectors);
+#endif
        /*
         * Should be a barrier for any external CPU state:
         */
        cpu_init();
+#ifdef CONFIG_X86_32
        trap_init_hook();
+#endif
 }
-static int __init kstack_setup(char *s)
-{
-        kstack_depth_to_print = simple_strtoul(s, NULL, 0);
-        return 1;
-}
-__setup("kstack=", kstack_setup);
-static int __init code_bytes_setup(char *s)
-{
-        code_bytes = simple_strtoul(s, NULL, 0);
-        if (code_bytes > 8192)
-                code_bytes = 8192;
-        return 1;
-}
-__setup("code_bytes=", code_bytes_setup);
diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
deleted file mode 100644
index 9c0ac0cab013..000000000000
--- a/arch/x86/kernel/traps_64.c
+++ /dev/null
@@ -1,1214 +0,0 @@
-/*
- *  Copyright (C) 1991, 1992  Linus Torvalds
- *  Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
- *
- *  Pentium III FXSR, SSE support
- *      Gareth Hughes <gareth@valinux.com>, May 2000
- */
-/*
- * 'Traps.c' handles hardware traps and faults after we have saved some
- * state in 'entry.S'.
- */
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
-#include <linux/kallsyms.h>
-#include <linux/spinlock.h>
-#include <linux/kprobes.h>
-#include <linux/uaccess.h>
-#include <linux/utsname.h>
-#include <linux/kdebug.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/ptrace.h>
-#include <linux/string.h>
-#include <linux/unwind.h>
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <linux/kexec.h>
-#include <linux/sched.h>
-#include <linux/timer.h>
-#include <linux/init.h>
-#include <linux/bug.h>
-#include <linux/nmi.h>
-#include <linux/mm.h>
-#include <linux/smp.h>
-#include <linux/io.h>
-#if defined(CONFIG_EDAC)
-#include <linux/edac.h>
-#endif
-#include <asm/stacktrace.h>
-#include <asm/processor.h>
-#include <asm/debugreg.h>
-#include <asm/atomic.h>
-#include <asm/system.h>
-#include <asm/unwind.h>
-#include <asm/desc.h>
-#include <asm/i387.h>
-#include <asm/pgalloc.h>
-#include <asm/proto.h>
-#include <asm/pda.h>
-#include <asm/traps.h>
-#include <mach_traps.h>
-int panic_on_unrecovered_nmi;
-int kstack_depth_to_print = 12;
-static unsigned int code_bytes = 64;
-static int ignore_nmis;
-static int die_counter;
-static inline void conditional_sti(struct pt_regs *regs)
-{
-        if (regs->flags & X86_EFLAGS_IF)
-                local_irq_enable();
-}
-static inline void preempt_conditional_sti(struct pt_regs *regs)
-{
-        inc_preempt_count();
-        if (regs->flags & X86_EFLAGS_IF)
-                local_irq_enable();
-}
-static inline void preempt_conditional_cli(struct pt_regs *regs)
-{
-        if (regs->flags & X86_EFLAGS_IF)
-                local_irq_disable();
-        /* Make sure to not schedule here because we could be running
-           on an exception stack. */
-        dec_preempt_count();
-}
-void printk_address(unsigned long address, int reliable)
-{
-        printk(" [<%016lx>] %s%pS\n",
-                        address, reliable ?     "" : "? ", (void *) address);
-}
-static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
-                                        unsigned *usedp, char **idp)
-{
-        static char ids[][8] = {
-                [DEBUG_STACK - 1] = "#DB",
-                [NMI_STACK - 1] = "NMI",
-                [DOUBLEFAULT_STACK - 1] = "#DF",
-                [STACKFAULT_STACK - 1] = "#SS",
-                [MCE_STACK - 1] = "#MC",
-#if DEBUG_STKSZ > EXCEPTION_STKSZ
-                [N_EXCEPTION_STACKS ...
-                        N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
-#endif
-        };
-        unsigned k;
-        /*
-         * Iterate over all exception stacks, and figure out whether
-         * 'stack' is in one of them:
-         */
-        for (k = 0; k < N_EXCEPTION_STACKS; k++) {
-                unsigned long end = per_cpu(orig_ist, cpu).ist[k];
-                /*
-                 * Is 'stack' above this exception frame's end?
-                 * If yes then skip to the next frame.
-                 */
-                if (stack >= end)
-                        continue;
-                /*
-                 * Is 'stack' above this exception frame's start address?
-                 * If yes then we found the right frame.
-                 */
-                if (stack >= end - EXCEPTION_STKSZ) {
-                        /*
-                         * Make sure we only iterate through an exception
-                         * stack once. If it comes up for the second time
-                         * then there's something wrong going on - just
-                         * break out and return NULL:
-                         */
-                        if (*usedp & (1U << k))
-                                break;
-                        *usedp |= 1U << k;
-                        *idp = ids[k];
-                        return (unsigned long *)end;
-                }
-                /*
-                 * If this is a debug stack, and if it has a larger size than
-                 * the usual exception stacks, then 'stack' might still
-                 * be within the lower portion of the debug stack:
-                 */
-#if DEBUG_STKSZ > EXCEPTION_STKSZ
-                if (k == DEBUG_STACK - 1 && stack >= end - DEBUG_STKSZ) {
-                        unsigned j = N_EXCEPTION_STACKS - 1;
-                        /*
-                         * Black magic. A large debug stack is composed of
-                         * multiple exception stack entries, which we
-                         * iterate through now. Dont look:
-                         */
-                        do {
-                                ++j;
-                                end -= EXCEPTION_STKSZ;
-                                ids[j][4] = '1' + (j - N_EXCEPTION_STACKS);
-                        } while (stack < end - EXCEPTION_STKSZ);
-                        if (*usedp & (1U << j))
-                                break;
-                        *usedp |= 1U << j;
-                        *idp = ids[j];
-                        return (unsigned long *)end;
-                }
-#endif
-        }
-        return NULL;
-}
-/*
- * x86-64 can have up to three kernel stacks:
- * process stack
- * interrupt stack
- * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
- */
-static inline int valid_stack_ptr(struct thread_info *tinfo,
-                        void *p, unsigned int size, void *end)
-{
-        void *t = tinfo;
-        if (end) {
-                if (p < end && p >= (end-THREAD_SIZE))
-                        return 1;
-                else
-                        return 0;
-        }
-        return p > t && p < t + THREAD_SIZE - size;
-}
-/* The form of the top of the frame on the stack */
-struct stack_frame {
-        struct stack_frame *next_frame;
-        unsigned long return_address;
-};
-static inline unsigned long
-print_context_stack(struct thread_info *tinfo,
-                unsigned long *stack, unsigned long bp,
-                const struct stacktrace_ops *ops, void *data,
-                unsigned long *end)
-{
-        struct stack_frame *frame = (struct stack_frame *)bp;
-        while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
-                unsigned long addr;
-                addr = *stack;
-                if (__kernel_text_address(addr)) {
-                        if ((unsigned long) stack == bp + 8) {
-                                ops->address(data, addr, 1);
-                                frame = frame->next_frame;
-                                bp = (unsigned long) frame;
-                        } else {
-                                ops->address(data, addr, bp == 0);
-                        }
-                }
-                stack++;
-        }
-        return bp;
-}
-void dump_trace(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *stack, unsigned long bp,
-                const struct stacktrace_ops *ops, void *data)
-{
-        const unsigned cpu = get_cpu();
-        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
-        unsigned used = 0;
-        struct thread_info *tinfo;
-        if (!task)
-                task = current;
-        if (!stack) {
-                unsigned long dummy;
-                stack = &dummy;
-                if (task && task != current)
-                        stack = (unsigned long *)task->thread.sp;
-        }
-#ifdef CONFIG_FRAME_POINTER
-        if (!bp) {
-                if (task == current) {
-                        /* Grab bp right from our regs */
-                        asm("movq %%rbp, %0" : "=r" (bp) : );
-                } else {
-                        /* bp is the last reg pushed by switch_to */
-                        bp = *(unsigned long *) task->thread.sp;
-                }
-        }
-#endif
-        /*
-         * Print function call entries in all stacks, starting at the
-         * current stack address. If the stacks consist of nested
-         * exceptions
-         */
-        tinfo = task_thread_info(task);
-        for (;;) {
-                char *id;
-                unsigned long *estack_end;
-                estack_end = in_exception_stack(cpu, (unsigned long)stack,
-                                                &used, &id);
-                if (estack_end) {
-                        if (ops->stack(data, id) < 0)
-                                break;
-                        bp = print_context_stack(tinfo, stack, bp, ops,
-                                                        data, estack_end);
-                        ops->stack(data, "<EOE>");
-                        /*
-                         * We link to the next stack via the
-                         * second-to-last pointer (index -2 to end) in the
-                         * exception stack:
-                         */
-                        stack = (unsigned long *) estack_end[-2];
-                        continue;
-                }
-                if (irqstack_end) {
-                        unsigned long *irqstack;
-                        irqstack = irqstack_end -
-                                (IRQSTACKSIZE - 64) / sizeof(*irqstack);
-                        if (stack >= irqstack && stack < irqstack_end) {
-                                if (ops->stack(data, "IRQ") < 0)
-                                        break;
-                                bp = print_context_stack(tinfo, stack, bp,
-                                                ops, data, irqstack_end);
-                                /*
-                                 * We link to the next stack (which would be
-                                 * the process stack normally) the last
-                                 * pointer (index -1 to end) in the IRQ stack:
-                                 */
-                                stack = (unsigned long *) (irqstack_end[-1]);
-                                irqstack_end = NULL;
-                                ops->stack(data, "EOI");
-                                continue;
-                        }
-                }
-                break;
-        }
-        /*
-         * This handles the process stack:
-         */
-        bp = print_context_stack(tinfo, stack, bp, ops, data, NULL);
-        put_cpu();
-}
-EXPORT_SYMBOL(dump_trace);
-static void
-print_trace_warning_symbol(void *data, char *msg, unsigned long symbol)
-{
-        print_symbol(msg, symbol);
-        printk("\n");
-}
-static void print_trace_warning(void *data, char *msg)
-{
-        printk("%s\n", msg);
-}
-static int print_trace_stack(void *data, char *name)
-{
-        printk(" <%s> ", name);
-        return 0;
-}
-static void print_trace_address(void *data, unsigned long addr, int reliable)
-{
-        touch_nmi_watchdog();
-        printk_address(addr, reliable);
-}
-static const struct stacktrace_ops print_trace_ops = {
-        .warning = print_trace_warning,
-        .warning_symbol = print_trace_warning_symbol,
-        .stack = print_trace_stack,
-        .address = print_trace_address,
-};
-static void
-show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *stack, unsigned long bp, char *log_lvl)
-{
-        printk("Call Trace:\n");
-        dump_trace(task, regs, stack, bp, &print_trace_ops, log_lvl);
-}
-void show_trace(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *stack, unsigned long bp)
-{
-        show_trace_log_lvl(task, regs, stack, bp, "");
-}
-static void
-show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
-                unsigned long *sp, unsigned long bp, char *log_lvl)
-{
-        unsigned long *stack;
-        int i;
-        const int cpu = smp_processor_id();
-        unsigned long *irqstack_end =
-                (unsigned long *) (cpu_pda(cpu)->irqstackptr);
-        unsigned long *irqstack =
-                (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
-        /*
-         * debugging aid: "show_stack(NULL, NULL);" prints the
-         * back trace for this cpu.
-         */
-        if (sp == NULL) {
-                if (task)
-                        sp = (unsigned long *)task->thread.sp;
-                else
-                        sp = (unsigned long *)&sp;
-        }
-        stack = sp;
-        for (i = 0; i < kstack_depth_to_print; i++) {
-                if (stack >= irqstack && stack <= irqstack_end) {
-                        if (stack == irqstack_end) {
-                                stack = (unsigned long *) (irqstack_end[-1]);
-                                printk(" <EOI> ");
-                        }
-                } else {
-                if (((long) stack & (THREAD_SIZE-1)) == 0)
-                        break;
-                }
-                if (i && ((i % 4) == 0))
-                        printk("\n");
-                printk(" %016lx", *stack++);
-                touch_nmi_watchdog();
-        }
-        printk("\n");
-        show_trace_log_lvl(task, regs, sp, bp, log_lvl);
-}
-void show_stack(struct task_struct *task, unsigned long *sp)
-{
-        show_stack_log_lvl(task, NULL, sp, 0, "");
-}
-/*
- * The architecture-independent dump_stack generator
- */
-void dump_stack(void)
-{
-        unsigned long bp = 0;
-        unsigned long stack;
-#ifdef CONFIG_FRAME_POINTER
-        if (!bp)
-                asm("movq %%rbp, %0" : "=r" (bp) : );
-#endif
-        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-                current->pid, current->comm, print_tainted(),
-                init_utsname()->release,
-                (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
-        show_trace(NULL, NULL, &stack, bp);
-}
-EXPORT_SYMBOL(dump_stack);
-void show_registers(struct pt_regs *regs)
-{
-        int i;
-        unsigned long sp;
-        const int cpu = smp_processor_id();
-        struct task_struct *cur = cpu_pda(cpu)->pcurrent;
-        sp = regs->sp;
-        printk("CPU %d ", cpu);
-        __show_regs(regs);
-        printk("Process %s (pid: %d, threadinfo %p, task %p)\n",
-                cur->comm, cur->pid, task_thread_info(cur), cur);
-        /*
-         * When in-kernel, we also print out the stack and code at the
-         * time of the fault..
-         */
-        if (!user_mode(regs)) {
-                unsigned int code_prologue = code_bytes * 43 / 64;
-                unsigned int code_len = code_bytes;
-                unsigned char c;
-                u8 *ip;
-                printk("Stack: ");
-                show_stack_log_lvl(NULL, regs, (unsigned long *)sp,
-                                regs->bp, "");
-                printk(KERN_EMERG "Code: ");
-                ip = (u8 *)regs->ip - code_prologue;
-                if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
-                        /* try starting at RIP */
-                        ip = (u8 *)regs->ip;
-                        code_len = code_len - code_prologue + 1;
-                }
-                for (i = 0; i < code_len; i++, ip++) {
-                        if (ip < (u8 *)PAGE_OFFSET ||
-                                        probe_kernel_address(ip, c)) {
-                                printk(" Bad RIP value.");
-                                break;
-                        }
-                        if (ip == (u8 *)regs->ip)
-                                printk("<%02x> ", c);
-                        else
-                                printk("%02x ", c);
-                }
-        }
-        printk("\n");
-}
-int is_valid_bugaddr(unsigned long ip)
-{
-        unsigned short ud2;
-        if (__copy_from_user(&ud2, (const void __user *) ip, sizeof(ud2)))
-                return 0;
-        return ud2 == 0x0b0f;
-}
-static raw_spinlock_t die_lock = __RAW_SPIN_LOCK_UNLOCKED;
-static int die_owner = -1;
-static unsigned int die_nest_count;
-unsigned __kprobes long oops_begin(void)
-{
-        int cpu;
-        unsigned long flags;
-        oops_enter();
-        /* racy, but better than risking deadlock. */
-        raw_local_irq_save(flags);
-        cpu = smp_processor_id();
-        if (!__raw_spin_trylock(&die_lock)) {
-                if (cpu == die_owner)
-                        /* nested oops. should stop eventually */;
-                else
-                        __raw_spin_lock(&die_lock);
-        }
-        die_nest_count++;
-        die_owner = cpu;
-        console_verbose();
-        bust_spinlocks(1);
-        return flags;
-}
-void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
-{
-        die_owner = -1;
-        bust_spinlocks(0);
-        die_nest_count--;
-        if (!die_nest_count)
-                /* Nest count reaches zero, release the lock. */
-                __raw_spin_unlock(&die_lock);
-        raw_local_irq_restore(flags);
-        if (!regs) {
-                oops_exit();
-                return;
-        }
-        if (panic_on_oops)
-                panic("Fatal exception");
-        oops_exit();
-        do_exit(signr);
-}
-int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-{
-        printk(KERN_EMERG "%s: %04lx [%u] ", str, err & 0xffff, ++die_counter);
-#ifdef CONFIG_PREEMPT
-        printk("PREEMPT ");
-#endif
-#ifdef CONFIG_SMP
-        printk("SMP ");
-#endif
-#ifdef CONFIG_DEBUG_PAGEALLOC
-        printk("DEBUG_PAGEALLOC");
-#endif
-        printk("\n");
-        if (notify_die(DIE_OOPS, str, regs, err,
-                        current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
-                return 1;
-        show_registers(regs);
-        add_taint(TAINT_DIE);
-        /* Executive summary in case the oops scrolled away */
-        printk(KERN_ALERT "RIP ");
-        printk_address(regs->ip, 1);
-        printk(" RSP <%016lx>\n", regs->sp);
-        if (kexec_should_crash(current))
-                crash_kexec(regs);
-        return 0;
-}
-void die(const char *str, struct pt_regs *regs, long err)
-{
-        unsigned long flags = oops_begin();
-        if (!user_mode(regs))
-                report_bug(regs->ip, regs);
-        if (__die(str, regs, err))
-                regs = NULL;
-        oops_end(flags, regs, SIGSEGV);
-}
-notrace __kprobes void
-die_nmi(char *str, struct pt_regs *regs, int do_panic)
-{
-        unsigned long flags;
-        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0, 2, SIGINT) == NOTIFY_STOP)
-                return;
-        flags = oops_begin();
-        /*
-         * We are in trouble anyway, lets at least try
-         * to get a message out.
-         */
-        printk(KERN_EMERG "%s", str);
-        printk(" on CPU%d, ip %08lx, registers:\n",
-                smp_processor_id(), regs->ip);
-        show_registers(regs);
-        if (kexec_should_crash(current))
-                crash_kexec(regs);
-        if (do_panic || panic_on_oops)
-                panic("Non maskable interrupt");
-        oops_end(flags, NULL, SIGBUS);
-        nmi_exit();
-        local_irq_enable();
-        do_exit(SIGBUS);
-}
-static void __kprobes
-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-        long error_code, siginfo_t *info)
-{
-        struct task_struct *tsk = current;
-        if (!user_mode(regs))
-                goto kernel_trap;
-        /*
-         * We want error_code and trap_no set for userspace faults and
-         * kernelspace faults which result in die(), but not
-         * kernelspace faults which are fixed up.  die() gives the
-         * process no chance to handle the signal and notice the
-         * kernel fault information, so that won't result in polluting
-         * the information about previously queued, but not yet
-         * delivered, faults.  See also do_general_protection below.
-         */
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_no = trapnr;
-        if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
-            printk_ratelimit()) {
-                printk(KERN_INFO
-                       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
-                       tsk->comm, tsk->pid, str,
-                       regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
-                printk("\n");
-        }
-        if (info)
-                force_sig_info(signr, info, tsk);
-        else
-                force_sig(signr, tsk);
-        return;
-kernel_trap:
-        if (!fixup_exception(regs)) {
-                tsk->thread.error_code = error_code;
-                tsk->thread.trap_no = trapnr;
-                die(str, regs, error_code);
-        }
-        return;
-}
-#define DO_ERROR(trapnr, signr, str, name) \
-asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
-{                                                                       \
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
-                                                        == NOTIFY_STOP) \
-                return;                                                 \
-        conditional_sti(regs);                                          \
-        do_trap(trapnr, signr, str, regs, error_code, NULL);            \
-}
-#define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)         \
-asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
-{                                                                       \
-        siginfo_t info;                                                 \
-        info.si_signo = signr;                                          \
-        info.si_errno = 0;                                              \
-        info.si_code = sicode;                                          \
-        info.si_addr = (void __user *)siaddr;                           \
-        trace_hardirqs_fixup();                                         \
-        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
-                                                        == NOTIFY_STOP) \
-                return;                                                 \
-        conditional_sti(regs);                                          \
-        do_trap(trapnr, signr, str, regs, error_code, &info);           \
-}
-DO_ERROR_INFO(0, SIGFPE, "divide error", divide_error, FPE_INTDIV, regs->ip)
-DO_ERROR(4, SIGSEGV, "overflow", overflow)
-DO_ERROR(5, SIGSEGV, "bounds", bounds)
-DO_ERROR_INFO(6, SIGILL, "invalid opcode", invalid_op, ILL_ILLOPN, regs->ip)
-DO_ERROR(9, SIGFPE, "coprocessor segment overrun", coprocessor_segment_overrun)
-DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
-DO_ERROR(11, SIGBUS, "segment not present", segment_not_present)
-DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
-/* Runs on IST stack */
-asmlinkage void do_stack_segment(struct pt_regs *regs, long error_code)
-{
-        if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
-                        12, SIGBUS) == NOTIFY_STOP)
-                return;
-        preempt_conditional_sti(regs);
-        do_trap(12, SIGBUS, "stack segment", regs, error_code, NULL);
-        preempt_conditional_cli(regs);
-}
-asmlinkage void do_double_fault(struct pt_regs *regs, long error_code)
-{
-        static const char str[] = "double fault";
-        struct task_struct *tsk = current;
-        /* Return not checked because double check cannot be ignored */
-        notify_die(DIE_TRAP, str, regs, error_code, 8, SIGSEGV);
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_no = 8;
-        /* This is always a kernel trap and never fixable (and thus must
-           never return). */
-        for (;;)
-                die(str, regs, error_code);
-}
-asmlinkage void __kprobes
-do_general_protection(struct pt_regs *regs, long error_code)
-{
-        struct task_struct *tsk;
-        conditional_sti(regs);
-        tsk = current;
-        if (!user_mode(regs))
-                goto gp_in_kernel;
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_no = 13;
-        if (show_unhandled_signals && unhandled_signal(tsk, SIGSEGV) &&
-                        printk_ratelimit()) {
-                printk(KERN_INFO
-                        "%s[%d] general protection ip:%lx sp:%lx error:%lx",
-                        tsk->comm, tsk->pid,
-                        regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
-                printk("\n");
-        }
-        force_sig(SIGSEGV, tsk);
-        return;
-gp_in_kernel:
-        if (fixup_exception(regs))
-                return;
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_no = 13;
-        if (notify_die(DIE_GPF, "general protection fault", regs,
-                                error_code, 13, SIGSEGV) == NOTIFY_STOP)
-                return;
-        die("general protection fault", regs, error_code);
-}
-static notrace __kprobes void
-mem_parity_error(unsigned char reason, struct pt_regs *regs)
-{
-        printk(KERN_EMERG "Uhhuh. NMI received for unknown reason %02x.\n",
-                reason);
-        printk(KERN_EMERG "You have some hardware problem, likely on the PCI bus.\n");
-#if defined(CONFIG_EDAC)
-        if (edac_handler_set()) {
-                edac_atomic_assert_error();
-                return;
-        }
-#endif
-        if (panic_on_unrecovered_nmi)
-                panic("NMI: Not continuing");
-        printk(KERN_EMERG "Dazed and confused, but trying to continue\n");
-        /* Clear and disable the memory parity error line. */
-        reason = (reason & 0xf) | 4;
-        outb(reason, 0x61);
-}
-static notrace __kprobes void
-io_check_error(unsigned char reason, struct pt_regs *regs)
-{
-        printk("NMI: IOCK error (debug interrupt?)\n");
-        show_registers(regs);
-        /* Re-enable the IOCK line, wait for a few seconds */
-        reason = (reason & 0xf) | 8;
-        outb(reason, 0x61);
-        mdelay(2000);
-        reason &= ~8;
-        outb(reason, 0x61);
-}
-static notrace __kprobes void
-unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
-{
-        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) ==
-                        NOTIFY_STOP)
-                return;
-        printk(KERN_EMERG "Uhhuh. NMI received for unknown reason %02x.\n",
-                reason);
-        printk(KERN_EMERG "Do you have a strange power saving mode enabled?\n");
-        if (panic_on_unrecovered_nmi)
-                panic("NMI: Not continuing");
-        printk(KERN_EMERG "Dazed and confused, but trying to continue\n");
-}
-/* Runs on IST stack. This code must keep interrupts off all the time.
-   Nested NMIs are prevented by the CPU. */
-asmlinkage notrace __kprobes void default_do_nmi(struct pt_regs *regs)
-{
-        unsigned char reason = 0;
-        int cpu;
-        cpu = smp_processor_id();
-        /* Only the BSP gets external NMIs from the system. */
-        if (!cpu)
-                reason = get_nmi_reason();
-        if (!(reason & 0xc0)) {
-                if (notify_die(DIE_NMI_IPI, "nmi_ipi", regs, reason, 2, SIGINT)
-                                                                == NOTIFY_STOP)
-                        return;
-                /*
-                 * Ok, so this is none of the documented NMI sources,
-                 * so it must be the NMI watchdog.
-                 */
-                if (nmi_watchdog_tick(regs, reason))
-                        return;
-                if (!do_nmi_callback(regs, cpu))
-                        unknown_nmi_error(reason, regs);
-                return;
-        }
-        if (notify_die(DIE_NMI, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
-                return;
-        /* AK: following checks seem to be broken on modern chipsets. FIXME */
-        if (reason & 0x80)
-                mem_parity_error(reason, regs);
-        if (reason & 0x40)
-                io_check_error(reason, regs);
-}
-asmlinkage notrace __kprobes void
-do_nmi(struct pt_regs *regs, long error_code)
-{
-        nmi_enter();
-        add_pda(__nmi_count, 1);
-        if (!ignore_nmis)
-                default_do_nmi(regs);
-        nmi_exit();
-}
-void stop_nmi(void)
-{
-        acpi_nmi_disable();
-        ignore_nmis++;
-}
-void restart_nmi(void)
-{
-        ignore_nmis--;
-        acpi_nmi_enable();
-}
-/* runs on IST stack. */
-asmlinkage void __kprobes do_int3(struct pt_regs *regs, long error_code)
-{
-        trace_hardirqs_fixup();
-        if (notify_die(DIE_INT3, "int3", regs, error_code, 3, SIGTRAP)
-                        == NOTIFY_STOP)
-                return;
-        preempt_conditional_sti(regs);
-        do_trap(3, SIGTRAP, "int3", regs, error_code, NULL);
-        preempt_conditional_cli(regs);
-}
-/* Help handler running on IST stack to switch back to user stack
-   for scheduling or signal handling. The actual stack switch is done in
-   entry.S */
-asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
-{
-        struct pt_regs *regs = eregs;
-        /* Did already sync */
-        if (eregs == (struct pt_regs *)eregs->sp)
-                ;
-        /* Exception from user space */
-        else if (user_mode(eregs))
-                regs = task_pt_regs(current);
-        /* Exception from kernel and interrupts are enabled. Move to
-           kernel process stack. */
-        else if (eregs->flags & X86_EFLAGS_IF)
-                regs = (struct pt_regs *)(eregs->sp -= sizeof(struct pt_regs));
-        if (eregs != regs)
-                *regs = *eregs;
-        return regs;
-}
-/* runs on IST stack. */
-asmlinkage void __kprobes do_debug(struct pt_regs *regs,
-                                   unsigned long error_code)
-{
-        struct task_struct *tsk = current;
-        unsigned long condition;
-        siginfo_t info;
-        trace_hardirqs_fixup();
-        get_debugreg(condition, 6);
-        /*
-         * The processor cleared BTF, so don't mark that we need it set.
-         */
-        clear_tsk_thread_flag(tsk, TIF_DEBUGCTLMSR);
-        tsk->thread.debugctlmsr = 0;
-        if (notify_die(DIE_DEBUG, "debug", regs, condition, error_code,
-                                                SIGTRAP) == NOTIFY_STOP)
-                return;
-        preempt_conditional_sti(regs);
-        /* Mask out spurious debug traps due to lazy DR7 setting */
-        if (condition & (DR_TRAP0|DR_TRAP1|DR_TRAP2|DR_TRAP3)) {
-                if (!tsk->thread.debugreg7)
-                        goto clear_dr7;
-        }
-        tsk->thread.debugreg6 = condition;
-        /*
-         * Single-stepping through TF: make sure we ignore any events in
-         * kernel space (but re-enable TF when returning to user mode).
-         */
-        if (condition & DR_STEP) {
-                if (!user_mode(regs))
-                        goto clear_TF_reenable;
-        }
-        /* Ok, finally something we can handle */
-        tsk->thread.trap_no = 1;
-        tsk->thread.error_code = error_code;
-        info.si_signo = SIGTRAP;
-        info.si_errno = 0;
-        info.si_code = get_si_code(condition);
-        info.si_addr = user_mode(regs) ? (void __user *)regs->ip : NULL;
-        force_sig_info(SIGTRAP, &info, tsk);
-clear_dr7:
-        set_debugreg(0, 7);
-        preempt_conditional_cli(regs);
-        return;
-clear_TF_reenable:
-        set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
-        regs->flags &= ~X86_EFLAGS_TF;
-        preempt_conditional_cli(regs);
-        return;
-}
-static int kernel_math_error(struct pt_regs *regs, const char *str, int trapnr)
-{
-        if (fixup_exception(regs))
-                return 1;
-        notify_die(DIE_GPF, str, regs, 0, trapnr, SIGFPE);
-        /* Illegal floating point operation in the kernel */
-        current->thread.trap_no = trapnr;
-        die(str, regs, 0);
-        return 0;
-}
-/*
- * Note that we play around with the 'TS' bit in an attempt to get
- * the correct behaviour even in the presence of the asynchronous
- * IRQ13 behaviour
- */
-asmlinkage void do_coprocessor_error(struct pt_regs *regs)
-{
-        void __user *ip = (void __user *)(regs->ip);
-        struct task_struct *task;
-        siginfo_t info;
-        unsigned short cwd, swd;
-        conditional_sti(regs);
-        if (!user_mode(regs) &&
-            kernel_math_error(regs, "kernel x87 math error", 16))
-                return;
-        /*
-         * Save the info for the exception handler and clear the error.
-         */
-        task = current;
-        save_init_fpu(task);
-        task->thread.trap_no = 16;
-        task->thread.error_code = 0;
-        info.si_signo = SIGFPE;
-        info.si_errno = 0;
-        info.si_code = __SI_FAULT;
-        info.si_addr = ip;
-        /*
-         * (~cwd & swd) will mask out exceptions that are not set to unmasked
-         * status.  0x3f is the exception bits in these regs, 0x200 is the
-         * C1 reg you need in case of a stack fault, 0x040 is the stack
-         * fault bit.  We should only be taking one exception at a time,
-         * so if this combination doesn't produce any single exception,
-         * then we have a bad program that isn't synchronizing its FPU usage
-         * and it will suffer the consequences since we won't be able to
-         * fully reproduce the context of the exception
-         */
-        cwd = get_fpu_cwd(task);
-        swd = get_fpu_swd(task);
-        switch (swd & ~cwd & 0x3f) {
-        case 0x000: /* No unmasked exception */
-        default: /* Multiple exceptions */
-                break;
-        case 0x001: /* Invalid Op */
-                /*
-                 * swd & 0x240 == 0x040: Stack Underflow
-                 * swd & 0x240 == 0x240: Stack Overflow
-                 * User must clear the SF bit (0x40) if set
-                 */
-                info.si_code = FPE_FLTINV;
-                break;
-        case 0x002: /* Denormalize */
-        case 0x010: /* Underflow */
-                info.si_code = FPE_FLTUND;
-                break;
-        case 0x004: /* Zero Divide */
-                info.si_code = FPE_FLTDIV;
-                break;
-        case 0x008: /* Overflow */
-                info.si_code = FPE_FLTOVF;
-                break;
-        case 0x020: /* Precision */
-                info.si_code = FPE_FLTRES;
-                break;
-        }
-        force_sig_info(SIGFPE, &info, task);
-}
-asmlinkage void bad_intr(void)
-{
-        printk("bad interrupt");
-}
-asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
-{
-        void __user *ip = (void __user *)(regs->ip);
-        struct task_struct *task;
-        siginfo_t info;
-        unsigned short mxcsr;
-        conditional_sti(regs);
-        if (!user_mode(regs) &&
-                        kernel_math_error(regs, "kernel simd math error", 19))
-                return;
-        /*
-         * Save the info for the exception handler and clear the error.
-         */
-        task = current;
-        save_init_fpu(task);
-        task->thread.trap_no = 19;
-        task->thread.error_code = 0;
-        info.si_signo = SIGFPE;
-        info.si_errno = 0;
-        info.si_code = __SI_FAULT;
-        info.si_addr = ip;
-        /*
-         * The SIMD FPU exceptions are handled a little differently, as there
-         * is only a single status/control register.  Thus, to determine which
-         * unmasked exception was caught we must mask the exception mask bits
-         * at 0x1f80, and then use these to mask the exception bits at 0x3f.
-         */
-        mxcsr = get_fpu_mxcsr(task);
-        switch (~((mxcsr & 0x1f80) >> 7) & (mxcsr & 0x3f)) {
-        case 0x000:
-        default:
-                break;
-        case 0x001: /* Invalid Op */
-                info.si_code = FPE_FLTINV;
-                break;
-        case 0x002: /* Denormalize */
-        case 0x010: /* Underflow */
-                info.si_code = FPE_FLTUND;
-                break;
-        case 0x004: /* Zero Divide */
-                info.si_code = FPE_FLTDIV;
-                break;
-        case 0x008: /* Overflow */
-                info.si_code = FPE_FLTOVF;
-                break;
-        case 0x020: /* Precision */
-                info.si_code = FPE_FLTRES;
-                break;
-        }
-        force_sig_info(SIGFPE, &info, task);
-}
-asmlinkage void do_spurious_interrupt_bug(struct pt_regs *regs)
-{
-}
-asmlinkage void __attribute__((weak)) smp_thermal_interrupt(void)
-{
-}
-asmlinkage void __attribute__((weak)) mce_threshold_interrupt(void)
-{
-}
-/*
- * 'math_state_restore()' saves the current math information in the
- * old math state array, and gets the new ones from the current task
- *
- * Careful.. There are problems with IBM-designed IRQ13 behaviour.
- * Don't touch unless you *really* know how it works.
- */
-asmlinkage void math_state_restore(void)
-{
-        struct task_struct *me = current;
-        if (!used_math()) {
-                local_irq_enable();
-                /*
-                 * does a slab alloc which can sleep
-                 */
-                if (init_fpu(me)) {
-                        /*
-                         * ran out of memory!
-                         */
-                        do_group_exit(SIGKILL);
-                        return;
-                }
-                local_irq_disable();
-        }
-        clts();                         /* Allow maths ops (or we recurse) */
-        /*
-         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-         */
-        if (unlikely(restore_fpu_checking(me))) {
-                stts();
-                force_sig(SIGSEGV, me);
-                return;
-        }
-        task_thread_info(me)->status |= TS_USEDFPU;
-        me->fpu_counter++;
-}
-EXPORT_SYMBOL_GPL(math_state_restore);
-void __init trap_init(void)
-{
-        set_intr_gate(0, &divide_error);
-        set_intr_gate_ist(1, &debug, DEBUG_STACK);
-        set_intr_gate_ist(2, &nmi, NMI_STACK);
-        /* int3 can be called from all */
-        set_system_gate_ist(3, &int3, DEBUG_STACK);
-        /* int4 can be called from all */
-        set_system_gate(4, &overflow);
-        set_intr_gate(5, &bounds);
-        set_intr_gate(6, &invalid_op);
-        set_intr_gate(7, &device_not_available);
-        set_intr_gate_ist(8, &double_fault, DOUBLEFAULT_STACK);
-        set_intr_gate(9, &coprocessor_segment_overrun);
-        set_intr_gate(10, &invalid_TSS);
-        set_intr_gate(11, &segment_not_present);
-        set_intr_gate_ist(12, &stack_segment, STACKFAULT_STACK);
-        set_intr_gate(13, &general_protection);
-        set_intr_gate(14, &page_fault);
-        set_intr_gate(15, &spurious_interrupt_bug);
-        set_intr_gate(16, &coprocessor_error);
-        set_intr_gate(17, &alignment_check);
-#ifdef CONFIG_X86_MCE
-        set_intr_gate_ist(18, &machine_check, MCE_STACK);
-#endif
-        set_intr_gate(19, &simd_coprocessor_error);
-#ifdef CONFIG_IA32_EMULATION
-        set_system_gate(IA32_SYSCALL_VECTOR, ia32_syscall);
-#endif
-        /*
-         * Should be a barrier for any external CPU state:
-         */
-        cpu_init();
-}
-static int __init oops_setup(char *s)
-{
-        if (!s)
-                return -EINVAL;
-        if (!strcmp(s, "panic"))
-                panic_on_oops = 1;
-        return 0;
-}
-early_param("oops", oops_setup);
-static int __init kstack_setup(char *s)
-{
-        if (!s)
-                return -EINVAL;
-        kstack_depth_to_print = simple_strtoul(s, NULL, 0);
-        return 0;
-}
-early_param("kstack", kstack_setup);
-static int __init code_bytes_setup(char *s)
-{
-        code_bytes = simple_strtoul(s, NULL, 0);
-        if (code_bytes > 8192)
-                code_bytes = 8192;
-        return 1;
-}
-__setup("code_bytes=", code_bytes_setup);
diff --git a/arch/x86/mach-generic/es7000.c b/arch/x86/mach-generic/es7000.c
index 520cca0ee04e..6513d41ea21e 100644
--- a/arch/x86/mach-generic/es7000.c
+++ b/arch/x86/mach-generic/es7000.c
@@ -47,16 +47,26 @@ static __init int mps_oem_check(struct mp_config_table *mpc, char *oem,
 /* Hook from generic ACPI tables.c */
 static int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
-        unsigned long oem_addr;
+        unsigned long oem_addr = 0;
+        int check_dsdt;
+        int ret = 0;
+        /* check dsdt at first to avoid clear fix_map for oem_addr */
+        check_dsdt = es7000_check_dsdt();
        if (!find_unisys_acpi_oem_table(&oem_addr)) {
-                if (es7000_check_dsdt())
+                if (check_dsdt)
-                        return parse_unisys_oem((char *)oem_addr);
+                        ret = parse_unisys_oem((char *)oem_addr);
                else {
                        setup_unisys();
-                        return 1;
+                        ret = 1;
                }
+                /*
+                 * we need to unmap it
+                 */
+                unmap_unisys_acpi_oem_table(oem_addr);
        }
-        return 0;
+        return ret;
 }
 #else
 static int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index dfb932dcf136..59f89b434b45 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -13,12 +13,8 @@ obj-$(CONFIG_MMIOTRACE)		+= mmiotrace.o
 mmiotrace-y                     := pf_in.o mmio-mod.o
 obj-$(CONFIG_MMIOTRACE_TEST)    += testmmiotrace.o
-ifeq ($(CONFIG_X86_32),y)
+obj-$(CONFIG_NUMA)              += numa_$(BITS).o
-obj-$(CONFIG_NUMA)              += discontig_32.o
-else
-obj-$(CONFIG_NUMA)              += numa_64.o
 obj-$(CONFIG_K8_NUMA)           += k8topology_64.o
-endif
 obj-$(CONFIG_ACPI_NUMA)         += srat_$(BITS).o
 obj-$(CONFIG_MEMTEST)           += memtest.o
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index a742d753d5b0..3f2b8962cbd0 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -592,11 +592,6 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
        unsigned long flags;
 #endif
-        /*
-         * We can fault from pretty much anywhere, with unknown IRQ state.
-         */
-        trace_hardirqs_fixup();
        tsk = current;
        mm = tsk->mm;
        prefetchw(&mm->mmap_sem);
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index 007bb06c7504..4ba373c5b8c8 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -82,7 +82,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                pte_t pte = gup_get_pte(ptep);
                struct page *page;
-                if ((pte_val(pte) & (mask | _PAGE_SPECIAL)) != mask) {
+                if ((pte_flags(pte) & (mask | _PAGE_SPECIAL)) != mask) {
                        pte_unmap(ptep);
                        return 0;
                }
@@ -116,10 +116,10 @@ static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr,
        mask = _PAGE_PRESENT|_PAGE_USER;
        if (write)
                mask |= _PAGE_RW;
-        if ((pte_val(pte) & mask) != mask)
+        if ((pte_flags(pte) & mask) != mask)
                return 0;
        /* hugepages are never "special" */
-        VM_BUG_ON(pte_val(pte) & _PAGE_SPECIAL);
+        VM_BUG_ON(pte_flags(pte) & _PAGE_SPECIAL);
        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
        refs = 0;
@@ -173,10 +173,10 @@ static noinline int gup_huge_pud(pud_t pud, unsigned long addr,
        mask = _PAGE_PRESENT|_PAGE_USER;
        if (write)
                mask |= _PAGE_RW;
-        if ((pte_val(pte) & mask) != mask)
+        if ((pte_flags(pte) & mask) != mask)
                return 0;
        /* hugepages are never "special" */
-        VM_BUG_ON(pte_val(pte) & _PAGE_SPECIAL);
+        VM_BUG_ON(pte_flags(pte) & _PAGE_SPECIAL);
        VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
        refs = 0;
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index bbe044dbe014..8396868e82c5 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -558,7 +558,7 @@ void zap_low_mappings(void)
 int nx_enabled;
-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL);
+pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
 EXPORT_SYMBOL_GPL(__supported_pte_mask);
 #ifdef CONFIG_X86_PAE
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 3e10054c5731..b8e461d49412 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -89,7 +89,7 @@ early_param("gbpages", parse_direct_gbpages_on);
 int after_bootmem;
-unsigned long __supported_pte_mask __read_mostly = ~0UL;
+pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
 EXPORT_SYMBOL_GPL(__supported_pte_mask);
 static int do_not_nx __cpuinitdata;
@@ -196,9 +196,6 @@ set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
        }
        pte = pte_offset_kernel(pmd, vaddr);
-        if (!pte_none(*pte) && pte_val(new_pte) &&
-            pte_val(*pte) != (pte_val(new_pte) & __supported_pte_mask))
-                pte_ERROR(*pte);
        set_pte(pte, new_pte);
        /*
@@ -313,7 +310,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
        if (pfn >= table_top)
                panic("alloc_low_page: ran out of memory");
-        adr = early_ioremap(pfn * PAGE_SIZE, PAGE_SIZE);
+        adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
        memset(adr, 0, PAGE_SIZE);
        *phys  = pfn * PAGE_SIZE;
        return adr;
@@ -749,7 +746,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
                old_start = mr[i].start;
                memmove(&mr[i], &mr[i+1],
                         (nr_range - 1 - i) * sizeof (struct map_range));
-                mr[i].start = old_start;
+                mr[i--].start = old_start;
                nr_range--;
        }
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 8cbeda15cd29..e4c43ec71b29 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -45,6 +45,27 @@ unsigned long __phys_addr(unsigned long x)
 }
 EXPORT_SYMBOL(__phys_addr);
+bool __virt_addr_valid(unsigned long x)
+{
+        if (x >= __START_KERNEL_map) {
+                x -= __START_KERNEL_map;
+                if (x >= KERNEL_IMAGE_SIZE)
+                        return false;
+                x += phys_base;
+        } else {
+                if (x < PAGE_OFFSET)
+                        return false;
+                x -= PAGE_OFFSET;
+                if (system_state == SYSTEM_BOOTING ?
+                                x > MAXMEM : !phys_addr_valid(x)) {
+                        return false;
+                }
+        }
+        return pfn_valid(x >> PAGE_SHIFT);
+}
+EXPORT_SYMBOL(__virt_addr_valid);
 #else
 static inline int phys_addr_valid(unsigned long addr)
@@ -56,13 +77,24 @@ static inline int phys_addr_valid(unsigned long addr)
 unsigned long __phys_addr(unsigned long x)
 {
        /* VMALLOC_* aren't constants; not available at the boot time */
-        VIRTUAL_BUG_ON(x < PAGE_OFFSET || (system_state != SYSTEM_BOOTING &&
+        VIRTUAL_BUG_ON(x < PAGE_OFFSET);
-                                        is_vmalloc_addr((void *)x)));
+        VIRTUAL_BUG_ON(system_state != SYSTEM_BOOTING &&
+                is_vmalloc_addr((void *) x));
        return x - PAGE_OFFSET;
 }
 EXPORT_SYMBOL(__phys_addr);
 #endif
+bool __virt_addr_valid(unsigned long x)
+{
+        if (x < PAGE_OFFSET)
+                return false;
+        if (system_state != SYSTEM_BOOTING && is_vmalloc_addr((void *) x))
+                return false;
+        return pfn_valid((x - PAGE_OFFSET) >> PAGE_SHIFT);
+}
+EXPORT_SYMBOL(__virt_addr_valid);
 #endif
 int page_is_ram(unsigned long pagenr)
@@ -242,16 +274,16 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
        switch (prot_val) {
        case _PAGE_CACHE_UC:
        default:
-                prot = PAGE_KERNEL_NOCACHE;
+                prot = PAGE_KERNEL_IO_NOCACHE;
                break;
        case _PAGE_CACHE_UC_MINUS:
-                prot = PAGE_KERNEL_UC_MINUS;
+                prot = PAGE_KERNEL_IO_UC_MINUS;
                break;
        case _PAGE_CACHE_WC:
-                prot = PAGE_KERNEL_WC;
+                prot = PAGE_KERNEL_IO_WC;
                break;
        case _PAGE_CACHE_WB:
-                prot = PAGE_KERNEL;
+                prot = PAGE_KERNEL_IO;
                break;
        }
@@ -568,12 +600,12 @@ static void __init __early_set_fixmap(enum fixed_addresses idx,
 }
 static inline void __init early_set_fixmap(enum fixed_addresses idx,
-                                        unsigned long phys)
+                                           unsigned long phys, pgprot_t prot)
 {
        if (after_paging_init)
-                set_fixmap(idx, phys);
+                __set_fixmap(idx, phys, prot);
        else
-                __early_set_fixmap(idx, phys, PAGE_KERNEL);
+                __early_set_fixmap(idx, phys, prot);
 }
 static inline void __init early_clear_fixmap(enum fixed_addresses idx)
@@ -584,16 +616,22 @@ static inline void __init early_clear_fixmap(enum fixed_addresses idx)
                __early_set_fixmap(idx, 0, __pgprot(0));
 }
+static void *prev_map[FIX_BTMAPS_SLOTS] __initdata;
-static int __initdata early_ioremap_nested;
+static unsigned long prev_size[FIX_BTMAPS_SLOTS] __initdata;
 static int __init check_early_ioremap_leak(void)
 {
-        if (!early_ioremap_nested)
+        int count = 0;
+        int i;
+        for (i = 0; i < FIX_BTMAPS_SLOTS; i++)
+                if (prev_map[i])
+                        count++;
+        if (!count)
                return 0;
        WARN(1, KERN_WARNING
               "Debug warning: early ioremap leak of %d areas detected.\n",
-                early_ioremap_nested);
+                count);
        printk(KERN_WARNING
                "please boot with early_ioremap_debug and report the dmesg.\n");
@@ -601,18 +639,33 @@ static int __init check_early_ioremap_leak(void)
 }
 late_initcall(check_early_ioremap_leak);
-void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
+static void __init *__early_ioremap(unsigned long phys_addr, unsigned long size, pgprot_t prot)
 {
        unsigned long offset, last_addr;
-        unsigned int nrpages, nesting;
+        unsigned int nrpages;
        enum fixed_addresses idx0, idx;
+        int i, slot;
        WARN_ON(system_state != SYSTEM_BOOTING);
-        nesting = early_ioremap_nested;
+        slot = -1;
+        for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
+                if (!prev_map[i]) {
+                        slot = i;
+                        break;
+                }
+        }
+        if (slot < 0) {
+                printk(KERN_INFO "early_iomap(%08lx, %08lx) not found slot\n",
+                         phys_addr, size);
+                WARN_ON(1);
+                return NULL;
+        }
        if (early_ioremap_debug) {
                printk(KERN_INFO "early_ioremap(%08lx, %08lx) [%d] => ",
-                       phys_addr, size, nesting);
+                       phys_addr, size, slot);
                dump_stack();
        }
@@ -623,11 +676,7 @@ void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
                return NULL;
        }
-        if (nesting >= FIX_BTMAPS_NESTING) {
+        prev_size[slot] = size;
-                WARN_ON(1);
-                return NULL;
-        }
-        early_ioremap_nested++;
        /*
         * Mappings have to be page-aligned
         */
@@ -647,10 +696,10 @@ void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
        /*
         * Ok, go for it..
         */
-        idx0 = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*nesting;
+        idx0 = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*slot;
        idx = idx0;
        while (nrpages > 0) {
-                early_set_fixmap(idx, phys_addr);
+                early_set_fixmap(idx, phys_addr, prot);
                phys_addr += PAGE_SIZE;
                --idx;
                --nrpages;
@@ -658,7 +707,20 @@ void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
        if (early_ioremap_debug)
                printk(KERN_CONT "%08lx + %08lx\n", offset, fix_to_virt(idx0));
-        return (void *) (offset + fix_to_virt(idx0));
+        prev_map[slot] = (void *) (offset + fix_to_virt(idx0));
+        return prev_map[slot];
+}
+/* Remap an IO device */
+void __init *early_ioremap(unsigned long phys_addr, unsigned long size)
+{
+        return __early_ioremap(phys_addr, size, PAGE_KERNEL_IO);
+}
+/* Remap memory */
+void __init *early_memremap(unsigned long phys_addr, unsigned long size)
+{
+        return __early_ioremap(phys_addr, size, PAGE_KERNEL);
 }
 void __init early_iounmap(void *addr, unsigned long size)
@@ -667,15 +729,33 @@ void __init early_iounmap(void *addr, unsigned long size)
        unsigned long offset;
        unsigned int nrpages;
        enum fixed_addresses idx;
-        int nesting;
+        int i, slot;
+        slot = -1;
+        for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
+                if (prev_map[i] == addr) {
+                        slot = i;
+                        break;
+                }
+        }
-        nesting = --early_ioremap_nested;
+        if (slot < 0) {
-        if (WARN_ON(nesting < 0))
+                printk(KERN_INFO "early_iounmap(%p, %08lx) not found slot\n",
+                         addr, size);
+                WARN_ON(1);
+                return;
+        }
+        if (prev_size[slot] != size) {
+                printk(KERN_INFO "early_iounmap(%p, %08lx) [%d] size not consistent %08lx\n",
+                         addr, size, slot, prev_size[slot]);
+                WARN_ON(1);
                return;
+        }
        if (early_ioremap_debug) {
                printk(KERN_INFO "early_iounmap(%p, %08lx) [%d]\n", addr,
-                       size, nesting);
+                       size, slot);
                dump_stack();
        }
@@ -687,12 +767,13 @@ void __init early_iounmap(void *addr, unsigned long size)
        offset = virt_addr & ~PAGE_MASK;
        nrpages = PAGE_ALIGN(offset + size - 1) >> PAGE_SHIFT;
-        idx = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*nesting;
+        idx = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*slot;
        while (nrpages > 0) {
                early_clear_fixmap(idx);
                --idx;
                --nrpages;
        }
+        prev_map[slot] = 0;
 }
 void __this_fixmap_does_not_exist(void)
diff --git a/arch/x86/mm/discontig_32.c b/arch/x86/mm/numa_32.c
index 847c164725f4..847c164725f4 100644
--- a/arch/x86/mm/discontig_32.c
+++ b/arch/x86/mm/numa_32.c
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 1b4763e26ea9..51c0a2fc14fe 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -138,7 +138,7 @@ acpi_numa_processor_affinity_init(struct acpi_srat_cpu_affinity *pa)
                return;
        }
-        if (is_uv_system())
+        if (get_uv_system_type() >= UV_X2APIC)
                apic_id = (pa->apic_id << 8) | pa->local_sapic_eid;
        else
                apic_id = pa->apic_id;
diff --git a/arch/x86/oprofile/Makefile b/arch/x86/oprofile/Makefile
index 30f3eb366667..446902b2a6b6 100644
--- a/arch/x86/oprofile/Makefile
+++ b/arch/x86/oprofile/Makefile
@@ -7,6 +7,6 @@ DRIVER_OBJS = $(addprefix ../../../drivers/oprofile/, \
                timer_int.o )
 oprofile-y                              := $(DRIVER_OBJS) init.o backtrace.o
-oprofile-$(CONFIG_X86_LOCAL_APIC)       += nmi_int.o op_model_athlon.o \
+oprofile-$(CONFIG_X86_LOCAL_APIC)       += nmi_int.o op_model_amd.o \
                                           op_model_ppro.o op_model_p4.o
 oprofile-$(CONFIG_X86_IO_APIC)          += nmi_timer_int.o
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 8a5f1614a3d5..57f6c9088081 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -1,10 +1,11 @@
 /**
 * @file nmi_int.c
 *
- * @remark Copyright 2002 OProfile authors
+ * @remark Copyright 2002-2008 OProfile authors
 * @remark Read the file COPYING
 *
 * @author John Levon <levon@movementarian.org>
+ * @author Robert Richter <robert.richter@amd.com>
 */
 #include <linux/init.h>
@@ -439,6 +440,7 @@ int __init op_nmi_init(struct oprofile_operations *ops)
        __u8 vendor = boot_cpu_data.x86_vendor;
        __u8 family = boot_cpu_data.x86;
        char *cpu_type;
+        int ret = 0;
        if (!cpu_has_apic)
                return -ENODEV;
@@ -451,19 +453,23 @@ int __init op_nmi_init(struct oprofile_operations *ops)
                default:
                        return -ENODEV;
                case 6:
-                        model = &op_athlon_spec;
+                        model = &op_amd_spec;
                        cpu_type = "i386/athlon";
                        break;
                case 0xf:
-                        model = &op_athlon_spec;
+                        model = &op_amd_spec;
                        /* Actually it could be i386/hammer too, but give
                         user space an consistent name. */
                        cpu_type = "x86-64/hammer";
                        break;
                case 0x10:
-                        model = &op_athlon_spec;
+                        model = &op_amd_spec;
                        cpu_type = "x86-64/family10";
                        break;
+                case 0x11:
+                        model = &op_amd_spec;
+                        cpu_type = "x86-64/family11h";
+                        break;
                }
                break;
@@ -490,17 +496,24 @@ int __init op_nmi_init(struct oprofile_operations *ops)
                return -ENODEV;
        }
-        init_sysfs();
 #ifdef CONFIG_SMP
        register_cpu_notifier(&oprofile_cpu_nb);
 #endif
-        using_nmi = 1;
+        /* default values, can be overwritten by model */
        ops->create_files = nmi_create_files;
        ops->setup = nmi_setup;
        ops->shutdown = nmi_shutdown;
        ops->start = nmi_start;
        ops->stop = nmi_stop;
        ops->cpu_type = cpu_type;
+        if (model->init)
+                ret = model->init(ops);
+        if (ret)
+                return ret;
+        init_sysfs();
+        using_nmi = 1;
        printk(KERN_INFO "oprofile: using NMI interrupt.\n");
        return 0;
 }
@@ -513,4 +526,6 @@ void op_nmi_exit(void)
                unregister_cpu_notifier(&oprofile_cpu_nb);
 #endif
        }
+        if (model->exit)
+                model->exit();
 }
diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
new file mode 100644
index 000000000000..d9faf607b3a6
--- /dev/null
+++ b/arch/x86/oprofile/op_model_amd.c
@@ -0,0 +1,543 @@
+/*
+ * @file op_model_amd.c
+ * athlon / K7 / K8 / Family 10h model-specific MSR operations
+ *
+ * @remark Copyright 2002-2008 OProfile authors
+ * @remark Read the file COPYING
+ *
+ * @author John Levon
+ * @author Philippe Elie
+ * @author Graydon Hoare
+ * @author Robert Richter <robert.richter@amd.com>
+ * @author Barry Kasindorf
+*/
+#include <linux/oprofile.h>
+#include <linux/device.h>
+#include <linux/pci.h>
+#include <asm/ptrace.h>
+#include <asm/msr.h>
+#include <asm/nmi.h>
+#include "op_x86_model.h"
+#include "op_counter.h"
+#define NUM_COUNTERS 4
+#define NUM_CONTROLS 4
+#define CTR_IS_RESERVED(msrs, c) (msrs->counters[(c)].addr ? 1 : 0)
+#define CTR_READ(l, h, msrs, c) do {rdmsr(msrs->counters[(c)].addr, (l), (h)); } while (0)
+#define CTR_WRITE(l, msrs, c) do {wrmsr(msrs->counters[(c)].addr, -(unsigned int)(l), -1); } while (0)
+#define CTR_OVERFLOWED(n) (!((n) & (1U<<31)))
+#define CTRL_IS_RESERVED(msrs, c) (msrs->controls[(c)].addr ? 1 : 0)
+#define CTRL_READ(l, h, msrs, c) do {rdmsr(msrs->controls[(c)].addr, (l), (h)); } while (0)
+#define CTRL_WRITE(l, h, msrs, c) do {wrmsr(msrs->controls[(c)].addr, (l), (h)); } while (0)
+#define CTRL_SET_ACTIVE(n) (n |= (1<<22))
+#define CTRL_SET_INACTIVE(n) (n &= ~(1<<22))
+#define CTRL_CLEAR_LO(x) (x &= (1<<21))
+#define CTRL_CLEAR_HI(x) (x &= 0xfffffcf0)
+#define CTRL_SET_ENABLE(val) (val |= 1<<20)
+#define CTRL_SET_USR(val, u) (val |= ((u & 1) << 16))
+#define CTRL_SET_KERN(val, k) (val |= ((k & 1) << 17))
+#define CTRL_SET_UM(val, m) (val |= (m << 8))
+#define CTRL_SET_EVENT_LOW(val, e) (val |= (e & 0xff))
+#define CTRL_SET_EVENT_HIGH(val, e) (val |= ((e >> 8) & 0xf))
+#define CTRL_SET_HOST_ONLY(val, h) (val |= ((h & 1) << 9))
+#define CTRL_SET_GUEST_ONLY(val, h) (val |= ((h & 1) << 8))
+static unsigned long reset_value[NUM_COUNTERS];
+#ifdef CONFIG_OPROFILE_IBS
+/* IbsFetchCtl bits/masks */
+#define IBS_FETCH_HIGH_VALID_BIT        (1UL << 17)     /* bit 49 */
+#define IBS_FETCH_HIGH_ENABLE           (1UL << 16)     /* bit 48 */
+#define IBS_FETCH_LOW_MAX_CNT_MASK      0x0000FFFFUL    /* MaxCnt mask */
+/*IbsOpCtl bits */
+#define IBS_OP_LOW_VALID_BIT            (1ULL<<18)      /* bit 18 */
+#define IBS_OP_LOW_ENABLE               (1ULL<<17)      /* bit 17 */
+/* Codes used in cpu_buffer.c */
+/* This produces duplicate code, need to be fixed */
+#define IBS_FETCH_BEGIN 3
+#define IBS_OP_BEGIN    4
+/* The function interface needs to be fixed, something like add
+   data. Should then be added to linux/oprofile.h. */
+extern void oprofile_add_ibs_sample(struct pt_regs *const regs,
+                                    unsigned int * const ibs_sample, u8 code);
+struct ibs_fetch_sample {
+        /* MSRC001_1031 IBS Fetch Linear Address Register */
+        unsigned int ibs_fetch_lin_addr_low;
+        unsigned int ibs_fetch_lin_addr_high;
+        /* MSRC001_1030 IBS Fetch Control Register */
+        unsigned int ibs_fetch_ctl_low;
+        unsigned int ibs_fetch_ctl_high;
+        /* MSRC001_1032 IBS Fetch Physical Address Register */
+        unsigned int ibs_fetch_phys_addr_low;
+        unsigned int ibs_fetch_phys_addr_high;
+};
+struct ibs_op_sample {
+        /* MSRC001_1034 IBS Op Logical Address Register (IbsRIP) */
+        unsigned int ibs_op_rip_low;
+        unsigned int ibs_op_rip_high;
+        /* MSRC001_1035 IBS Op Data Register */
+        unsigned int ibs_op_data1_low;
+        unsigned int ibs_op_data1_high;
+        /* MSRC001_1036 IBS Op Data 2 Register */
+        unsigned int ibs_op_data2_low;
+        unsigned int ibs_op_data2_high;
+        /* MSRC001_1037 IBS Op Data 3 Register */
+        unsigned int ibs_op_data3_low;
+        unsigned int ibs_op_data3_high;
+        /* MSRC001_1038 IBS DC Linear Address Register (IbsDcLinAd) */
+        unsigned int ibs_dc_linear_low;
+        unsigned int ibs_dc_linear_high;
+        /* MSRC001_1039 IBS DC Physical Address Register (IbsDcPhysAd) */
+        unsigned int ibs_dc_phys_low;
+        unsigned int ibs_dc_phys_high;
+};
+/*
+ * unitialize the APIC for the IBS interrupts if needed on AMD Family10h+
+*/
+static void clear_ibs_nmi(void);
+static int ibs_allowed; /* AMD Family10h and later */
+struct op_ibs_config {
+        unsigned long op_enabled;
+        unsigned long fetch_enabled;
+        unsigned long max_cnt_fetch;
+        unsigned long max_cnt_op;
+        unsigned long rand_en;
+        unsigned long dispatched_ops;
+};
+static struct op_ibs_config ibs_config;
+#endif
+/* functions for op_amd_spec */
+static void op_amd_fill_in_addresses(struct op_msrs * const msrs)
+{
+        int i;
+        for (i = 0; i < NUM_COUNTERS; i++) {
+                if (reserve_perfctr_nmi(MSR_K7_PERFCTR0 + i))
+                        msrs->counters[i].addr = MSR_K7_PERFCTR0 + i;
+                else
+                        msrs->counters[i].addr = 0;
+        }
+        for (i = 0; i < NUM_CONTROLS; i++) {
+                if (reserve_evntsel_nmi(MSR_K7_EVNTSEL0 + i))
+                        msrs->controls[i].addr = MSR_K7_EVNTSEL0 + i;
+                else
+                        msrs->controls[i].addr = 0;
+        }
+}
+static void op_amd_setup_ctrs(struct op_msrs const * const msrs)
+{
+        unsigned int low, high;
+        int i;
+        /* clear all counters */
+        for (i = 0 ; i < NUM_CONTROLS; ++i) {
+                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
+                        continue;
+                CTRL_READ(low, high, msrs, i);
+                CTRL_CLEAR_LO(low);
+                CTRL_CLEAR_HI(high);
+                CTRL_WRITE(low, high, msrs, i);
+        }
+        /* avoid a false detection of ctr overflows in NMI handler */
+        for (i = 0; i < NUM_COUNTERS; ++i) {
+                if (unlikely(!CTR_IS_RESERVED(msrs, i)))
+                        continue;
+                CTR_WRITE(1, msrs, i);
+        }
+        /* enable active counters */
+        for (i = 0; i < NUM_COUNTERS; ++i) {
+                if ((counter_config[i].enabled) && (CTR_IS_RESERVED(msrs, i))) {
+                        reset_value[i] = counter_config[i].count;
+                        CTR_WRITE(counter_config[i].count, msrs, i);
+                        CTRL_READ(low, high, msrs, i);
+                        CTRL_CLEAR_LO(low);
+                        CTRL_CLEAR_HI(high);
+                        CTRL_SET_ENABLE(low);
+                        CTRL_SET_USR(low, counter_config[i].user);
+                        CTRL_SET_KERN(low, counter_config[i].kernel);
+                        CTRL_SET_UM(low, counter_config[i].unit_mask);
+                        CTRL_SET_EVENT_LOW(low, counter_config[i].event);
+                        CTRL_SET_EVENT_HIGH(high, counter_config[i].event);
+                        CTRL_SET_HOST_ONLY(high, 0);
+                        CTRL_SET_GUEST_ONLY(high, 0);
+                        CTRL_WRITE(low, high, msrs, i);
+                } else {
+                        reset_value[i] = 0;
+                }
+        }
+}
+#ifdef CONFIG_OPROFILE_IBS
+static inline int
+op_amd_handle_ibs(struct pt_regs * const regs,
+                  struct op_msrs const * const msrs)
+{
+        unsigned int low, high;
+        struct ibs_fetch_sample ibs_fetch;
+        struct ibs_op_sample ibs_op;
+        if (!ibs_allowed)
+                return 1;
+        if (ibs_config.fetch_enabled) {
+                rdmsr(MSR_AMD64_IBSFETCHCTL, low, high);
+                if (high & IBS_FETCH_HIGH_VALID_BIT) {
+                        ibs_fetch.ibs_fetch_ctl_high = high;
+                        ibs_fetch.ibs_fetch_ctl_low = low;
+                        rdmsr(MSR_AMD64_IBSFETCHLINAD, low, high);
+                        ibs_fetch.ibs_fetch_lin_addr_high = high;
+                        ibs_fetch.ibs_fetch_lin_addr_low = low;
+                        rdmsr(MSR_AMD64_IBSFETCHPHYSAD, low, high);
+                        ibs_fetch.ibs_fetch_phys_addr_high = high;
+                        ibs_fetch.ibs_fetch_phys_addr_low = low;
+                        oprofile_add_ibs_sample(regs,
+                                                (unsigned int *)&ibs_fetch,
+                                                IBS_FETCH_BEGIN);
+                        /*reenable the IRQ */
+                        rdmsr(MSR_AMD64_IBSFETCHCTL, low, high);
+                        high &= ~IBS_FETCH_HIGH_VALID_BIT;
+                        high |= IBS_FETCH_HIGH_ENABLE;
+                        low &= IBS_FETCH_LOW_MAX_CNT_MASK;
+                        wrmsr(MSR_AMD64_IBSFETCHCTL, low, high);
+                }
+        }
+        if (ibs_config.op_enabled) {
+                rdmsr(MSR_AMD64_IBSOPCTL, low, high);
+                if (low & IBS_OP_LOW_VALID_BIT) {
+                        rdmsr(MSR_AMD64_IBSOPRIP, low, high);
+                        ibs_op.ibs_op_rip_low = low;
+                        ibs_op.ibs_op_rip_high = high;
+                        rdmsr(MSR_AMD64_IBSOPDATA, low, high);
+                        ibs_op.ibs_op_data1_low = low;
+                        ibs_op.ibs_op_data1_high = high;
+                        rdmsr(MSR_AMD64_IBSOPDATA2, low, high);
+                        ibs_op.ibs_op_data2_low = low;
+                        ibs_op.ibs_op_data2_high = high;
+                        rdmsr(MSR_AMD64_IBSOPDATA3, low, high);
+                        ibs_op.ibs_op_data3_low = low;
+                        ibs_op.ibs_op_data3_high = high;
+                        rdmsr(MSR_AMD64_IBSDCLINAD, low, high);
+                        ibs_op.ibs_dc_linear_low = low;
+                        ibs_op.ibs_dc_linear_high = high;
+                        rdmsr(MSR_AMD64_IBSDCPHYSAD, low, high);
+                        ibs_op.ibs_dc_phys_low = low;
+                        ibs_op.ibs_dc_phys_high = high;
+                        /* reenable the IRQ */
+                        oprofile_add_ibs_sample(regs,
+                                                (unsigned int *)&ibs_op,
+                                                IBS_OP_BEGIN);
+                        rdmsr(MSR_AMD64_IBSOPCTL, low, high);
+                        high = 0;
+                        low &= ~IBS_OP_LOW_VALID_BIT;
+                        low |= IBS_OP_LOW_ENABLE;
+                        wrmsr(MSR_AMD64_IBSOPCTL, low, high);
+                }
+        }
+        return 1;
+}
+#endif
+static int op_amd_check_ctrs(struct pt_regs * const regs,
+                             struct op_msrs const * const msrs)
+{
+        unsigned int low, high;
+        int i;
+        for (i = 0 ; i < NUM_COUNTERS; ++i) {
+                if (!reset_value[i])
+                        continue;
+                CTR_READ(low, high, msrs, i);
+                if (CTR_OVERFLOWED(low)) {
+                        oprofile_add_sample(regs, i);
+                        CTR_WRITE(reset_value[i], msrs, i);
+                }
+        }
+#ifdef CONFIG_OPROFILE_IBS
+        op_amd_handle_ibs(regs, msrs);
+#endif
+        /* See op_model_ppro.c */
+        return 1;
+}
+static void op_amd_start(struct op_msrs const * const msrs)
+{
+        unsigned int low, high;
+        int i;
+        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
+                if (reset_value[i]) {
+                        CTRL_READ(low, high, msrs, i);
+                        CTRL_SET_ACTIVE(low);
+                        CTRL_WRITE(low, high, msrs, i);
+                }
+        }
+#ifdef CONFIG_OPROFILE_IBS
+        if (ibs_allowed && ibs_config.fetch_enabled) {
+                low = (ibs_config.max_cnt_fetch >> 4) & 0xFFFF;
+                high = IBS_FETCH_HIGH_ENABLE;
+                wrmsr(MSR_AMD64_IBSFETCHCTL, low, high);
+        }
+        if (ibs_allowed && ibs_config.op_enabled) {
+                low = ((ibs_config.max_cnt_op >> 4) & 0xFFFF) + IBS_OP_LOW_ENABLE;
+                high = 0;
+                wrmsr(MSR_AMD64_IBSOPCTL, low, high);
+        }
+#endif
+}
+static void op_amd_stop(struct op_msrs const * const msrs)
+{
+        unsigned int low, high;
+        int i;
+        /* Subtle: stop on all counters to avoid race with
+         * setting our pm callback */
+        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
+                if (!reset_value[i])
+                        continue;
+                CTRL_READ(low, high, msrs, i);
+                CTRL_SET_INACTIVE(low);
+                CTRL_WRITE(low, high, msrs, i);
+        }
+#ifdef CONFIG_OPROFILE_IBS
+        if (ibs_allowed && ibs_config.fetch_enabled) {
+                low = 0;                /* clear max count and enable */
+                high = 0;
+                wrmsr(MSR_AMD64_IBSFETCHCTL, low, high);
+        }
+        if (ibs_allowed && ibs_config.op_enabled) {
+                low = 0;                /* clear max count and enable */
+                high = 0;
+                wrmsr(MSR_AMD64_IBSOPCTL, low, high);
+        }
+#endif
+}
+static void op_amd_shutdown(struct op_msrs const * const msrs)
+{
+        int i;
+        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
+                if (CTR_IS_RESERVED(msrs, i))
+                        release_perfctr_nmi(MSR_K7_PERFCTR0 + i);
+        }
+        for (i = 0 ; i < NUM_CONTROLS ; ++i) {
+                if (CTRL_IS_RESERVED(msrs, i))
+                        release_evntsel_nmi(MSR_K7_EVNTSEL0 + i);
+        }
+}
+#ifndef CONFIG_OPROFILE_IBS
+/* no IBS support */
+static int op_amd_init(struct oprofile_operations *ops)
+{
+        return 0;
+}
+static void op_amd_exit(void) {}
+#else
+static u8 ibs_eilvt_off;
+static inline void apic_init_ibs_nmi_per_cpu(void *arg)
+{
+        ibs_eilvt_off = setup_APIC_eilvt_ibs(0, APIC_EILVT_MSG_NMI, 0);
+}
+static inline void apic_clear_ibs_nmi_per_cpu(void *arg)
+{
+        setup_APIC_eilvt_ibs(0, APIC_EILVT_MSG_FIX, 1);
+}
+static int pfm_amd64_setup_eilvt(void)
+{
+#define IBSCTL_LVTOFFSETVAL             (1 << 8)
+#define IBSCTL                          0x1cc
+        struct pci_dev *cpu_cfg;
+        int nodes;
+        u32 value = 0;
+        /* per CPU setup */
+        on_each_cpu(apic_init_ibs_nmi_per_cpu, NULL, 1);
+        nodes = 0;
+        cpu_cfg = NULL;
+        do {
+                cpu_cfg = pci_get_device(PCI_VENDOR_ID_AMD,
+                                         PCI_DEVICE_ID_AMD_10H_NB_MISC,
+                                         cpu_cfg);
+                if (!cpu_cfg)
+                        break;
+                ++nodes;
+                pci_write_config_dword(cpu_cfg, IBSCTL, ibs_eilvt_off
+                                       | IBSCTL_LVTOFFSETVAL);
+                pci_read_config_dword(cpu_cfg, IBSCTL, &value);
+                if (value != (ibs_eilvt_off | IBSCTL_LVTOFFSETVAL)) {
+                        printk(KERN_DEBUG "Failed to setup IBS LVT offset, "
+                                "IBSCTL = 0x%08x", value);
+                        return 1;
+                }
+        } while (1);
+        if (!nodes) {
+                printk(KERN_DEBUG "No CPU node configured for IBS");
+                return 1;
+        }
+#ifdef CONFIG_NUMA
+        /* Sanity check */
+        /* Works only for 64bit with proper numa implementation. */
+        if (nodes != num_possible_nodes()) {
+                printk(KERN_DEBUG "Failed to setup CPU node(s) for IBS, "
+                        "found: %d, expected %d",
+                        nodes, num_possible_nodes());
+                return 1;
+        }
+#endif
+        return 0;
+}
+/*
+ * initialize the APIC for the IBS interrupts
+ * if available (AMD Family10h rev B0 and later)
+ */
+static void setup_ibs(void)
+{
+        ibs_allowed = boot_cpu_has(X86_FEATURE_IBS);
+        if (!ibs_allowed)
+                return;
+        if (pfm_amd64_setup_eilvt()) {
+                ibs_allowed = 0;
+                return;
+        }
+        printk(KERN_INFO "oprofile: AMD IBS detected\n");
+}
+/*
+ * unitialize the APIC for the IBS interrupts if needed on AMD Family10h
+ * rev B0 and later */
+static void clear_ibs_nmi(void)
+{
+        if (ibs_allowed)
+                on_each_cpu(apic_clear_ibs_nmi_per_cpu, NULL, 1);
+}
+static int (*create_arch_files)(struct super_block * sb, struct dentry * root);
+static int setup_ibs_files(struct super_block * sb, struct dentry * root)
+{
+        char buf[12];
+        struct dentry *dir;
+        int ret = 0;
+        /* architecture specific files */
+        if (create_arch_files)
+                ret = create_arch_files(sb, root);
+        if (ret)
+                return ret;
+        if (!ibs_allowed)
+                return ret;
+        /* model specific files */
+        /* setup some reasonable defaults */
+        ibs_config.max_cnt_fetch = 250000;
+        ibs_config.fetch_enabled = 0;
+        ibs_config.max_cnt_op = 250000;
+        ibs_config.op_enabled = 0;
+        ibs_config.dispatched_ops = 1;
+        snprintf(buf,  sizeof(buf), "ibs_fetch");
+        dir = oprofilefs_mkdir(sb, root, buf);
+        oprofilefs_create_ulong(sb, dir, "rand_enable",
+                                &ibs_config.rand_en);
+        oprofilefs_create_ulong(sb, dir, "enable",
+                &ibs_config.fetch_enabled);
+        oprofilefs_create_ulong(sb, dir, "max_count",
+                &ibs_config.max_cnt_fetch);
+        snprintf(buf,  sizeof(buf), "ibs_uops");
+        dir = oprofilefs_mkdir(sb, root, buf);
+        oprofilefs_create_ulong(sb, dir, "enable",
+                &ibs_config.op_enabled);
+        oprofilefs_create_ulong(sb, dir, "max_count",
+                &ibs_config.max_cnt_op);
+        oprofilefs_create_ulong(sb, dir, "dispatched_ops",
+                &ibs_config.dispatched_ops);
+        return 0;
+}
+static int op_amd_init(struct oprofile_operations *ops)
+{
+        setup_ibs();
+        create_arch_files = ops->create_files;
+        ops->create_files = setup_ibs_files;
+        return 0;
+}
+static void op_amd_exit(void)
+{
+        clear_ibs_nmi();
+}
+#endif
+struct op_x86_model_spec const op_amd_spec = {
+        .init = op_amd_init,
+        .exit = op_amd_exit,
+        .num_counters = NUM_COUNTERS,
+        .num_controls = NUM_CONTROLS,
+        .fill_in_addresses = &op_amd_fill_in_addresses,
+        .setup_ctrs = &op_amd_setup_ctrs,
+        .check_ctrs = &op_amd_check_ctrs,
+        .start = &op_amd_start,
+        .stop = &op_amd_stop,
+        .shutdown = &op_amd_shutdown
+};
diff --git a/arch/x86/oprofile/op_model_athlon.c b/arch/x86/oprofile/op_model_athlon.c
deleted file mode 100644
index 3d534879a9dc..000000000000
--- a/arch/x86/oprofile/op_model_athlon.c
+++ /dev/null
@@ -1,190 +0,0 @@
-/*
- * @file op_model_athlon.h
- * athlon / K7 / K8 / Family 10h model-specific MSR operations
- *
- * @remark Copyright 2002 OProfile authors
- * @remark Read the file COPYING
- *
- * @author John Levon
- * @author Philippe Elie
- * @author Graydon Hoare
- */
-#include <linux/oprofile.h>
-#include <asm/ptrace.h>
-#include <asm/msr.h>
-#include <asm/nmi.h>
-#include "op_x86_model.h"
-#include "op_counter.h"
-#define NUM_COUNTERS 4
-#define NUM_CONTROLS 4
-#define CTR_IS_RESERVED(msrs, c) (msrs->counters[(c)].addr ? 1 : 0)
-#define CTR_READ(l, h, msrs, c) do {rdmsr(msrs->counters[(c)].addr, (l), (h)); } while (0)
-#define CTR_WRITE(l, msrs, c) do {wrmsr(msrs->counters[(c)].addr, -(unsigned int)(l), -1); } while (0)
-#define CTR_OVERFLOWED(n) (!((n) & (1U<<31)))
-#define CTRL_IS_RESERVED(msrs, c) (msrs->controls[(c)].addr ? 1 : 0)
-#define CTRL_READ(l, h, msrs, c) do {rdmsr(msrs->controls[(c)].addr, (l), (h)); } while (0)
-#define CTRL_WRITE(l, h, msrs, c) do {wrmsr(msrs->controls[(c)].addr, (l), (h)); } while (0)
-#define CTRL_SET_ACTIVE(n) (n |= (1<<22))
-#define CTRL_SET_INACTIVE(n) (n &= ~(1<<22))
-#define CTRL_CLEAR_LO(x) (x &= (1<<21))
-#define CTRL_CLEAR_HI(x) (x &= 0xfffffcf0)
-#define CTRL_SET_ENABLE(val) (val |= 1<<20)
-#define CTRL_SET_USR(val, u) (val |= ((u & 1) << 16))
-#define CTRL_SET_KERN(val, k) (val |= ((k & 1) << 17))
-#define CTRL_SET_UM(val, m) (val |= (m << 8))
-#define CTRL_SET_EVENT_LOW(val, e) (val |= (e & 0xff))
-#define CTRL_SET_EVENT_HIGH(val, e) (val |= ((e >> 8) & 0xf))
-#define CTRL_SET_HOST_ONLY(val, h) (val |= ((h & 1) << 9))
-#define CTRL_SET_GUEST_ONLY(val, h) (val |= ((h & 1) << 8))
-static unsigned long reset_value[NUM_COUNTERS];
-static void athlon_fill_in_addresses(struct op_msrs * const msrs)
-{
-        int i;
-        for (i = 0; i < NUM_COUNTERS; i++) {
-                if (reserve_perfctr_nmi(MSR_K7_PERFCTR0 + i))
-                        msrs->counters[i].addr = MSR_K7_PERFCTR0 + i;
-                else
-                        msrs->counters[i].addr = 0;
-        }
-        for (i = 0; i < NUM_CONTROLS; i++) {
-                if (reserve_evntsel_nmi(MSR_K7_EVNTSEL0 + i))
-                        msrs->controls[i].addr = MSR_K7_EVNTSEL0 + i;
-                else
-                        msrs->controls[i].addr = 0;
-        }
-}
-static void athlon_setup_ctrs(struct op_msrs const * const msrs)
-{
-        unsigned int low, high;
-        int i;
-        /* clear all counters */
-        for (i = 0 ; i < NUM_CONTROLS; ++i) {
-                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
-                        continue;
-                CTRL_READ(low, high, msrs, i);
-                CTRL_CLEAR_LO(low);
-                CTRL_CLEAR_HI(high);
-                CTRL_WRITE(low, high, msrs, i);
-        }
-        /* avoid a false detection of ctr overflows in NMI handler */
-        for (i = 0; i < NUM_COUNTERS; ++i) {
-                if (unlikely(!CTR_IS_RESERVED(msrs, i)))
-                        continue;
-                CTR_WRITE(1, msrs, i);
-        }
-        /* enable active counters */
-        for (i = 0; i < NUM_COUNTERS; ++i) {
-                if ((counter_config[i].enabled) && (CTR_IS_RESERVED(msrs, i))) {
-                        reset_value[i] = counter_config[i].count;
-                        CTR_WRITE(counter_config[i].count, msrs, i);
-                        CTRL_READ(low, high, msrs, i);
-                        CTRL_CLEAR_LO(low);
-                        CTRL_CLEAR_HI(high);
-                        CTRL_SET_ENABLE(low);
-                        CTRL_SET_USR(low, counter_config[i].user);
-                        CTRL_SET_KERN(low, counter_config[i].kernel);
-                        CTRL_SET_UM(low, counter_config[i].unit_mask);
-                        CTRL_SET_EVENT_LOW(low, counter_config[i].event);
-                        CTRL_SET_EVENT_HIGH(high, counter_config[i].event);
-                        CTRL_SET_HOST_ONLY(high, 0);
-                        CTRL_SET_GUEST_ONLY(high, 0);
-                        CTRL_WRITE(low, high, msrs, i);
-                } else {
-                        reset_value[i] = 0;
-                }
-        }
-}
-static int athlon_check_ctrs(struct pt_regs * const regs,
-                             struct op_msrs const * const msrs)
-{
-        unsigned int low, high;
-        int i;
-        for (i = 0 ; i < NUM_COUNTERS; ++i) {
-                if (!reset_value[i])
-                        continue;
-                CTR_READ(low, high, msrs, i);
-                if (CTR_OVERFLOWED(low)) {
-                        oprofile_add_sample(regs, i);
-                        CTR_WRITE(reset_value[i], msrs, i);
-                }
-        }
-        /* See op_model_ppro.c */
-        return 1;
-}
-static void athlon_start(struct op_msrs const * const msrs)
-{
-        unsigned int low, high;
-        int i;
-        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
-                if (reset_value[i]) {
-                        CTRL_READ(low, high, msrs, i);
-                        CTRL_SET_ACTIVE(low);
-                        CTRL_WRITE(low, high, msrs, i);
-                }
-        }
-}
-static void athlon_stop(struct op_msrs const * const msrs)
-{
-        unsigned int low, high;
-        int i;
-        /* Subtle: stop on all counters to avoid race with
-         * setting our pm callback */
-        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
-                if (!reset_value[i])
-                        continue;
-                CTRL_READ(low, high, msrs, i);
-                CTRL_SET_INACTIVE(low);
-                CTRL_WRITE(low, high, msrs, i);
-        }
-}
-static void athlon_shutdown(struct op_msrs const * const msrs)
-{
-        int i;
-        for (i = 0 ; i < NUM_COUNTERS ; ++i) {
-                if (CTR_IS_RESERVED(msrs, i))
-                        release_perfctr_nmi(MSR_K7_PERFCTR0 + i);
-        }
-        for (i = 0 ; i < NUM_CONTROLS ; ++i) {
-                if (CTRL_IS_RESERVED(msrs, i))
-                        release_evntsel_nmi(MSR_K7_EVNTSEL0 + i);
-        }
-}
-struct op_x86_model_spec const op_athlon_spec = {
-        .num_counters = NUM_COUNTERS,
-        .num_controls = NUM_CONTROLS,
-        .fill_in_addresses = &athlon_fill_in_addresses,
-        .setup_ctrs = &athlon_setup_ctrs,
-        .check_ctrs = &athlon_check_ctrs,
-        .start = &athlon_start,
-        .stop = &athlon_stop,
-        .shutdown = &athlon_shutdown
-};
diff --git a/arch/x86/oprofile/op_x86_model.h b/arch/x86/oprofile/op_x86_model.h
index 45b605fa71d0..05a0261ba0c3 100644
--- a/arch/x86/oprofile/op_x86_model.h
+++ b/arch/x86/oprofile/op_x86_model.h
@@ -32,6 +32,8 @@ struct pt_regs;
 * various x86 CPU models' perfctr support.
 */
 struct op_x86_model_spec {
+        int (*init)(struct oprofile_operations *ops);
+        void (*exit)(void);
        unsigned int const num_counters;
        unsigned int const num_controls;
        void (*fill_in_addresses)(struct op_msrs * const msrs);
@@ -46,6 +48,6 @@ struct op_x86_model_spec {
 extern struct op_x86_model_spec const op_ppro_spec;
 extern struct op_x86_model_spec const op_p4_spec;
 extern struct op_x86_model_spec const op_p4_ht2_spec;
-extern struct op_x86_model_spec const op_athlon_spec;
+extern struct op_x86_model_spec const op_amd_spec;
 #endif /* OP_X86_MODEL_H */
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index 4bdaa590375d..3c27a809393b 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -511,3 +511,31 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, fam10h_pci_cfg_space_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, fam10h_pci_cfg_space_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, fam10h_pci_cfg_space_size);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, fam10h_pci_cfg_space_size);
+/*
+ * SB600: Disable BAR1 on device 14.0 to avoid HPET resources from
+ * confusing the PCI engine:
+ */
+static void sb600_disable_hpet_bar(struct pci_dev *dev)
+{
+        u8 val;
+        /*
+         * The SB600 and SB700 both share the same device
+         * ID, but the PM register 0x55 does something different
+         * for the SB700, so make sure we are dealing with the
+         * SB600 before touching the bit:
+         */
+        pci_read_config_byte(dev, 0x08, &val);
+        if (val < 0x2F) {
+                outb(0x55, 0xCD6);
+                val = inb(0xCD7);
+                /* Set bit 7 in PM register 0x55 */
+                outb(0x55, 0xCD6);
+                outb(val | 0x80, 0xCD7);
+        }
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ATI, 0x4385, sb600_disable_hpet_bar);
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 8dfcf77cb717..4426bb552bd9 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -484,7 +484,7 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
                return -EUNATCH;
        default:
-                err = n_tty_ioctl(tty, file, cmd, arg);
+                err = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
        };
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index caff85149b9d..700ff9679457 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -350,7 +350,7 @@ config STALDRV
 config STALLION
        tristate "Stallion EasyIO or EC8/32 support"
-        depends on STALDRV && BROKEN_ON_SMP && (ISA || EISA || PCI)
+        depends on STALDRV && (ISA || EISA || PCI)
        help
          If you have an EasyIO or EasyConnection 8/32 multiport Stallion
          card, then this is for you; say Y.  Make sure to read
@@ -361,7 +361,7 @@ config STALLION
 config ISTALLION
        tristate "Stallion EC8/64, ONboard, Brumby support"
-        depends on STALDRV && BROKEN_ON_SMP && (ISA || EISA || PCI)
+        depends on STALDRV && (ISA || EISA || PCI)
        help
          If you have an EasyConnection 8/64, ONboard, Brumby or Stallion
          serial multiport card, say Y here. Make sure to read
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 6850f6da7576..1a4247dccac4 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -7,7 +7,7 @@
 #
 FONTMAPFILE = cp437.uni
-obj-y    += mem.o random.o tty_io.o n_tty.o tty_ioctl.o tty_ldisc.o 
+obj-y    += mem.o random.o tty_io.o n_tty.o tty_ioctl.o tty_ldisc.o tty_buffer.o tty_port.o
 obj-$(CONFIG_LEGACY_PTYS)       += pty.o
 obj-$(CONFIG_UNIX98_PTYS)       += pty.o
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 6e763e3f5a81..98821f97583c 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -837,9 +837,6 @@ static int rs_put_char(struct tty_struct *tty, unsigned char ch)
        struct async_struct *info;
        unsigned long flags;
-        if (!tty)
-                return 0;
        info = tty->driver_data;
        if (serial_paranoia_check(info, tty->name, "rs_put_char"))
@@ -892,9 +889,6 @@ static int rs_write(struct tty_struct * tty, const unsigned char *buf, int count
        struct async_struct *info;
        unsigned long flags;
-        if (!tty)
-                return 0;
        info = tty->driver_data;
        if (serial_paranoia_check(info, tty->name, "rs_write"))
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 31d08b641f5b..b899d9182c7d 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
        
        IndexCard = adgl->num_card-1;
         
-        if(cmd != 0 && cmd != 6 &&
+        if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
-           ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
                static int warncount = 10;
                if (warncount) {
                        printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
                }
                break;
        default:
-                printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ;
+                ret = -ENOTTY;
-                ret = -EINVAL;
                break;
        }
        Dummy = readb(apbs[IndexCard].RamIO + VERS);
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index fe6d774fe2e4..5e5b1dc1a0a7 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -4993,12 +4993,14 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                        device_id == PCI_DEVICE_ID_CYCLOM_Y_Hi) {
                card_name = "Cyclom-Y";
-                addr0 = pci_iomap(pdev, 0, CyPCI_Yctl);
+                addr0 = ioremap_nocache(pci_resource_start(pdev, 0),
+                                CyPCI_Yctl);
                if (addr0 == NULL) {
                        dev_err(&pdev->dev, "can't remap ctl region\n");
                        goto err_reg;
                }
-                addr2 = pci_iomap(pdev, 2, CyPCI_Ywin);
+                addr2 = ioremap_nocache(pci_resource_start(pdev, 2),
+                                CyPCI_Ywin);
                if (addr2 == NULL) {
                        dev_err(&pdev->dev, "can't remap base region\n");
                        goto err_unmap;
@@ -5013,7 +5015,8 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
        } else if (device_id == PCI_DEVICE_ID_CYCLOM_Z_Hi) {
                struct RUNTIME_9060 __iomem *ctl_addr;
-                ctl_addr = addr0 = pci_iomap(pdev, 0, CyPCI_Zctl);
+                ctl_addr = addr0 = ioremap_nocache(pci_resource_start(pdev, 0),
+                                CyPCI_Zctl);
                if (addr0 == NULL) {
                        dev_err(&pdev->dev, "can't remap ctl region\n");
                        goto err_reg;
@@ -5026,8 +5029,8 @@ static int __devinit cy_pci_probe(struct pci_dev *pdev,
                mailbox = (u32)readl(&ctl_addr->mail_box_0);
-                addr2 = pci_iomap(pdev, 2, mailbox == ZE_V1 ?
+                addr2 = ioremap_nocache(pci_resource_start(pdev, 2),
-                                CyPCI_Ze_win : CyPCI_Zwin);
+                                mailbox == ZE_V1 ? CyPCI_Ze_win : CyPCI_Zwin);
                if (addr2 == NULL) {
                        dev_err(&pdev->dev, "can't remap base region\n");
                        goto err_unmap;
@@ -5159,9 +5162,9 @@ err_null:
        cy_card[card_no].base_addr = NULL;
        free_irq(irq, &cy_card[card_no]);
 err_unmap:
-        pci_iounmap(pdev, addr0);
+        iounmap(addr0);
        if (addr2)
-                pci_iounmap(pdev, addr2);
+                iounmap(addr2);
 err_reg:
        pci_release_regions(pdev);
 err_dis:
@@ -5186,9 +5189,9 @@ static void __devexit cy_pci_remove(struct pci_dev *pdev)
                cy_writew(cinfo->ctl_addr + 0x68,
                                readw(cinfo->ctl_addr + 0x68) & ~0x0900);
-        pci_iounmap(pdev, cinfo->base_addr);
+        iounmap(cinfo->base_addr);
        if (cinfo->ctl_addr)
-                pci_iounmap(pdev, cinfo->ctl_addr);
+                iounmap(cinfo->ctl_addr);
        if (cinfo->irq
 #ifndef CONFIG_CYZ_INTR
                && !IS_CYC_Z(*cinfo)
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 456e4ede049f..4998b2761e8f 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1376,6 +1376,7 @@ static void post_fep_init(unsigned int crd)
                unsigned long flags;
                u16 tseg, rseg;
+                tty_port_init(&ch->port);
                ch->brdchan = bc;
                ch->mailbox = gd;
                INIT_WORK(&ch->tqueue, do_softint);
@@ -1510,10 +1511,6 @@ static void post_fep_init(unsigned int crd)
                ch->fepstopca = 0;
                ch->close_delay = 50;
-                ch->port.count = 0;
-                ch->port.blocked_open = 0;
-                init_waitqueue_head(&ch->port.open_wait);
-                init_waitqueue_head(&ch->port.close_wait);
                spin_unlock_irqrestore(&epca_lock, flags);
        }
diff --git a/drivers/char/generic_serial.c b/drivers/char/generic_serial.c
index 19d3afb0e50c..c6090f84a2e4 100644
--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -54,8 +54,6 @@ int gs_put_char(struct tty_struct * tty, unsigned char ch)
        func_enter (); 
-        if (!tty) return 0;
        port = tty->driver_data;
        if (!port) return 0;
@@ -97,8 +95,6 @@ int gs_write(struct tty_struct * tty,
        func_enter ();
-        if (!tty) return 0;
        port = tty->driver_data;
        if (!port) return 0;
@@ -185,7 +181,6 @@ static int gs_real_chars_in_buffer(struct tty_struct *tty)
        struct gs_port *port;
        func_enter ();
-        if (!tty) return 0;
        port = tty->driver_data;
        if (!port->rd) return 0;
@@ -274,8 +269,6 @@ void gs_flush_buffer(struct tty_struct *tty)
        func_enter ();
-        if (!tty) return;
        port = tty->driver_data;
        if (!port) return;
@@ -296,8 +289,6 @@ void gs_flush_chars(struct tty_struct * tty)
        func_enter ();
-        if (!tty) return;
        port = tty->driver_data;
        if (!port) return;
@@ -321,8 +312,6 @@ void gs_stop(struct tty_struct * tty)
        func_enter ();
-        if (!tty) return;
        port = tty->driver_data;
        if (!port) return;
@@ -341,8 +330,6 @@ void gs_start(struct tty_struct * tty)
 {
        struct gs_port *port;
-        if (!tty) return;
        port = tty->driver_data;
        if (!port) return;
@@ -393,8 +380,6 @@ void gs_hangup(struct tty_struct *tty)
        func_enter ();
-        if (!tty) return;
        port = tty->driver_data;
        tty = port->port.tty;
        if (!tty) 
@@ -426,8 +411,6 @@ int gs_block_til_ready(void *port_, struct file * filp)
        tty = port->port.tty;
-        if (!tty) return 0;
        gs_dprintk (GS_DEBUG_BTR, "Entering gs_block_till_ready.\n"); 
        /*
         * If the device is in the middle of being closed, then block
@@ -523,8 +506,6 @@ void gs_close(struct tty_struct * tty, struct file * filp)
        
        func_enter ();
-        if (!tty) return;
        port = (struct gs_port *) tty->driver_data;
        if (!port) return;
@@ -621,8 +602,6 @@ void gs_set_termios (struct tty_struct * tty,
        func_enter();
-        if (!tty) return;
        port = tty->driver_data;
        if (!port) return;
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index b3f5dbc6d880..f3cfb4c76125 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -53,6 +53,11 @@
 #define HPET_RANGE_SIZE         1024    /* from HPET spec */
+/* WARNING -- don't get confused.  These macros are never used
+ * to write the (single) counter, and rarely to read it.
+ * They're badly named; to fix, someday.
+ */
 #if BITS_PER_LONG == 64
 #define write_counter(V, MC)    writeq(V, MC)
 #define read_counter(MC)        readq(MC)
@@ -77,7 +82,7 @@ static struct clocksource clocksource_hpet = {
        .rating         = 250,
        .read           = read_hpet,
        .mask           = CLOCKSOURCE_MASK(64),
-        .mult           = 0, /*to be caluclated*/
+        .mult           = 0, /* to be calculated */
        .shift          = 10,
        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
@@ -86,8 +91,6 @@ static struct clocksource *hpet_clocksource;
 /* A lock for concurrent access by app and isr hpet activity. */
 static DEFINE_SPINLOCK(hpet_lock);
-/* A lock for concurrent intermodule access to hpet and isr hpet activity. */
-static DEFINE_SPINLOCK(hpet_task_lock);
 #define HPET_DEV_NAME   (7)
@@ -99,7 +102,6 @@ struct hpet_dev {
        unsigned long hd_irqdata;
        wait_queue_head_t hd_waitqueue;
        struct fasync_struct *hd_async_queue;
-        struct hpet_task *hd_task;
        unsigned int hd_flags;
        unsigned int hd_irq;
        unsigned int hd_hdwirq;
@@ -173,11 +175,6 @@ static irqreturn_t hpet_interrupt(int irq, void *data)
                writel(isr, &devp->hd_hpet->hpet_isr);
        spin_unlock(&hpet_lock);
-        spin_lock(&hpet_task_lock);
-        if (devp->hd_task)
-                devp->hd_task->ht_func(devp->hd_task->ht_data);
-        spin_unlock(&hpet_task_lock);
        wake_up_interruptible(&devp->hd_waitqueue);
        kill_fasync(&devp->hd_async_queue, SIGIO, POLL_IN);
@@ -185,6 +182,67 @@ static irqreturn_t hpet_interrupt(int irq, void *data)
        return IRQ_HANDLED;
 }
+static void hpet_timer_set_irq(struct hpet_dev *devp)
+{
+        unsigned long v;
+        int irq, gsi;
+        struct hpet_timer __iomem *timer;
+        spin_lock_irq(&hpet_lock);
+        if (devp->hd_hdwirq) {
+                spin_unlock_irq(&hpet_lock);
+                return;
+        }
+        timer = devp->hd_timer;
+        /* we prefer level triggered mode */
+        v = readl(&timer->hpet_config);
+        if (!(v & Tn_INT_TYPE_CNF_MASK)) {
+                v |= Tn_INT_TYPE_CNF_MASK;
+                writel(v, &timer->hpet_config);
+        }
+        spin_unlock_irq(&hpet_lock);
+        v = (readq(&timer->hpet_config) & Tn_INT_ROUTE_CAP_MASK) >>
+                                 Tn_INT_ROUTE_CAP_SHIFT;
+        /*
+         * In PIC mode, skip IRQ0-4, IRQ6-9, IRQ12-15 which is always used by
+         * legacy device. In IO APIC mode, we skip all the legacy IRQS.
+         */
+        if (acpi_irq_model == ACPI_IRQ_MODEL_PIC)
+                v &= ~0xf3df;
+        else
+                v &= ~0xffff;
+        for (irq = find_first_bit(&v, HPET_MAX_IRQ); irq < HPET_MAX_IRQ;
+                irq = find_next_bit(&v, HPET_MAX_IRQ, 1 + irq)) {
+                if (irq >= NR_IRQS) {
+                        irq = HPET_MAX_IRQ;
+                        break;
+                }
+                gsi = acpi_register_gsi(irq, ACPI_LEVEL_SENSITIVE,
+                                        ACPI_ACTIVE_LOW);
+                if (gsi > 0)
+                        break;
+                /* FIXME: Setup interrupt source table */
+        }
+        if (irq < HPET_MAX_IRQ) {
+                spin_lock_irq(&hpet_lock);
+                v = readl(&timer->hpet_config);
+                v |= irq << Tn_INT_ROUTE_CNF_SHIFT;
+                writel(v, &timer->hpet_config);
+                devp->hd_hdwirq = gsi;
+                spin_unlock_irq(&hpet_lock);
+        }
+        return;
+}
 static int hpet_open(struct inode *inode, struct file *file)
 {
        struct hpet_dev *devp;
@@ -199,8 +257,7 @@ static int hpet_open(struct inode *inode, struct file *file)
        for (devp = NULL, hpetp = hpets; hpetp && !devp; hpetp = hpetp->hp_next)
                for (i = 0; i < hpetp->hp_ntimer; i++)
-                        if (hpetp->hp_dev[i].hd_flags & HPET_OPEN
+                        if (hpetp->hp_dev[i].hd_flags & HPET_OPEN)
-                            || hpetp->hp_dev[i].hd_task)
                                continue;
                        else {
                                devp = &hpetp->hp_dev[i];
@@ -219,6 +276,8 @@ static int hpet_open(struct inode *inode, struct file *file)
        spin_unlock_irq(&hpet_lock);
        unlock_kernel();
+        hpet_timer_set_irq(devp);
        return 0;
 }
@@ -441,7 +500,11 @@ static int hpet_ioctl_ieon(struct hpet_dev *devp)
        devp->hd_irq = irq;
        t = devp->hd_ireqfreq;
        v = readq(&timer->hpet_config);
-        g = v | Tn_INT_ENB_CNF_MASK;
+        /* 64-bit comparators are not yet supported through the ioctls,
+         * so force this into 32-bit mode if it supports both modes
+         */
+        g = v | Tn_32MODE_CNF_MASK | Tn_INT_ENB_CNF_MASK;
        if (devp->hd_flags & HPET_PERIODIC) {
                write_counter(t, &timer->hpet_compare);
@@ -451,6 +514,12 @@ static int hpet_ioctl_ieon(struct hpet_dev *devp)
                v |= Tn_VAL_SET_CNF_MASK;
                writeq(v, &timer->hpet_config);
                local_irq_save(flags);
+                /* NOTE:  what we modify here is a hidden accumulator
+                 * register supported by periodic-capable comparators.
+                 * We never want to modify the (single) counter; that
+                 * would affect all the comparators.
+                 */
                m = read_counter(&hpet->hpet_mc);
                write_counter(t + m + hpetp->hp_delta, &timer->hpet_compare);
        } else {
@@ -604,57 +673,6 @@ static int hpet_is_known(struct hpet_data *hdp)
        return 0;
 }
-static inline int hpet_tpcheck(struct hpet_task *tp)
-{
-        struct hpet_dev *devp;
-        struct hpets *hpetp;
-        devp = tp->ht_opaque;
-        if (!devp)
-                return -ENXIO;
-        for (hpetp = hpets; hpetp; hpetp = hpetp->hp_next)
-                if (devp >= hpetp->hp_dev
-                    && devp < (hpetp->hp_dev + hpetp->hp_ntimer)
-                    && devp->hd_hpet == hpetp->hp_hpet)
-                        return 0;
-        return -ENXIO;
-}
-#if 0
-int hpet_unregister(struct hpet_task *tp)
-{
-        struct hpet_dev *devp;
-        struct hpet_timer __iomem *timer;
-        int err;
-        if ((err = hpet_tpcheck(tp)))
-                return err;
-        spin_lock_irq(&hpet_task_lock);
-        spin_lock(&hpet_lock);
-        devp = tp->ht_opaque;
-        if (devp->hd_task != tp) {
-                spin_unlock(&hpet_lock);
-                spin_unlock_irq(&hpet_task_lock);
-                return -ENXIO;
-        }
-        timer = devp->hd_timer;
-        writeq((readq(&timer->hpet_config) & ~Tn_INT_ENB_CNF_MASK),
-               &timer->hpet_config);
-        devp->hd_flags &= ~(HPET_IE | HPET_PERIODIC);
-        devp->hd_task = NULL;
-        spin_unlock(&hpet_lock);
-        spin_unlock_irq(&hpet_task_lock);
-        return 0;
-}
-#endif  /*  0  */
 static ctl_table hpet_table[] = {
        {
         .ctl_name = CTL_UNNUMBERED,
@@ -746,6 +764,7 @@ int hpet_alloc(struct hpet_data *hdp)
        static struct hpets *last = NULL;
        unsigned long period;
        unsigned long long temp;
+        u32 remainder;
        /*
         * hpet_alloc can be called by platform dependent code.
@@ -809,9 +828,13 @@ int hpet_alloc(struct hpet_data *hdp)
                printk("%s %d", i > 0 ? "," : "", hdp->hd_irq[i]);
        printk("\n");
-        printk(KERN_INFO "hpet%u: %u %d-bit timers, %Lu Hz\n",
+        temp = hpetp->hp_tick_freq;
-               hpetp->hp_which, hpetp->hp_ntimer,
+        remainder = do_div(temp, 1000000);
-               cap & HPET_COUNTER_SIZE_MASK ? 64 : 32, hpetp->hp_tick_freq);
+        printk(KERN_INFO
+                "hpet%u: %u comparators, %d-bit %u.%06u MHz counter\n",
+                hpetp->hp_which, hpetp->hp_ntimer,
+                cap & HPET_COUNTER_SIZE_MASK ? 64 : 32,
+                (unsigned) temp, remainder);
        mcfg = readq(&hpet->hpet_config);
        if ((mcfg & HPET_ENABLE_CNF_MASK) == 0) {
@@ -874,8 +897,6 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
                hdp->hd_address = ioremap(addr.minimum, addr.address_length);
                if (hpet_is_known(hdp)) {
-                        printk(KERN_DEBUG "%s: 0x%lx is busy\n",
-                                __func__, hdp->hd_phys_address);
                        iounmap(hdp->hd_address);
                        return AE_ALREADY_EXISTS;
                }
@@ -891,8 +912,6 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
                                                HPET_RANGE_SIZE);
                if (hpet_is_known(hdp)) {
-                        printk(KERN_DEBUG "%s: 0x%lx is busy\n",
-                                __func__, hdp->hd_phys_address);
                        iounmap(hdp->hd_address);
                        return AE_ALREADY_EXISTS;
                }
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index fd64137b1ab9..ec7aded0a2df 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -819,11 +819,11 @@ static int hvc_init(void)
        hvc_driver = drv;
        return 0;
-put_tty:
-        put_tty_driver(hvc_driver);
 stop_thread:
        kthread_stop(hvc_task);
        hvc_task = NULL;
+put_tty:
+        put_tty_driver(drv);
 out:
        return err;
 }
diff --git a/drivers/char/ip2/Makefile b/drivers/char/ip2/Makefile
index 939618f62fe1..bc397d92b499 100644
--- a/drivers/char/ip2/Makefile
+++ b/drivers/char/ip2/Makefile
@@ -4,5 +4,5 @@
 obj-$(CONFIG_COMPUTONE)         += ip2.o
-ip2-objs                        := ip2base.o ip2main.o
+ip2-objs                        := ip2main.o
diff --git a/drivers/char/ip2/i2ellis.c b/drivers/char/ip2/i2ellis.c
index 3601017f58cf..29db44de399f 100644
--- a/drivers/char/ip2/i2ellis.c
+++ b/drivers/char/ip2/i2ellis.c
@@ -69,38 +69,6 @@ static DEFINE_RWLOCK(Dl_spinlock);
 //=======================================================
 //******************************************************************************
-// Function:   iiEllisInit()
-// Parameters: None
-//
-// Returns:    Nothing
-//
-// Description:
-//
-// This routine performs any required initialization of the iiEllis subsystem.
-//
-//******************************************************************************
-static void
-iiEllisInit(void)
-{
-}
-//******************************************************************************
-// Function:   iiEllisCleanup()
-// Parameters: None
-//
-// Returns:    Nothing
-//
-// Description:
-//
-// This routine performs any required cleanup of the iiEllis subsystem.
-//
-//******************************************************************************
-static void
-iiEllisCleanup(void)
-{
-}
-//******************************************************************************
 // Function:   iiSetAddress(pB, address, delay)
 // Parameters: pB      - pointer to the board structure
 //             address - the purported I/O address of the board
diff --git a/drivers/char/ip2/i2ellis.h b/drivers/char/ip2/i2ellis.h
index c88a64e527aa..fb6df2456018 100644
--- a/drivers/char/ip2/i2ellis.h
+++ b/drivers/char/ip2/i2ellis.h
@@ -511,7 +511,6 @@ typedef void (*delayFunc_t)(unsigned int);
 //
 // Initialization of a board & structure is in four (five!) parts:
 //
-// 0) iiEllisInit()  - Initialize iiEllis subsystem.
 // 1) iiSetAddress() - Define the board address & delay function for a board.
 // 2) iiReset()      - Reset the board   (provided it exists)
 //       -- Note you may do this to several boards --
@@ -523,7 +522,6 @@ typedef void (*delayFunc_t)(unsigned int);
 // loadware.  To change loadware, you must begin again with step 2, resetting
 // the board again (step 1 not needed).
-static void iiEllisInit(void);
 static int iiSetAddress(i2eBordStrPtr, int, delayFunc_t );
 static int iiReset(i2eBordStrPtr);
 static int iiResetDelay(i2eBordStrPtr);
diff --git a/drivers/char/ip2/ip2base.c b/drivers/char/ip2/ip2base.c
deleted file mode 100644
index 8155e247c04b..000000000000
--- a/drivers/char/ip2/ip2base.c
+++ /dev/null
@@ -1,108 +0,0 @@
-// ip2.c
-// This is a dummy module to make the firmware available when needed
-// and allows it to be unloaded when not. Rumor is the __initdata 
-// macro doesn't always works on all platforms so we use this kludge.
-// If not compiled as a module it just makes fip_firm avaliable then
-//  __initdata should work as advertized
-//
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/wait.h>
-#ifndef __init
-#define __init
-#endif
-#ifndef __initfunc
-#define __initfunc(a) a
-#endif
-#ifndef __initdata
-#define __initdata
-#endif
-#include "ip2types.h"           
-int
-ip2_loadmain(int *, int *); // ref into ip2main.c
-/* Note: Add compiled in defaults to these arrays, not to the structure
-        in ip2.h any longer.  That structure WILL get overridden
-        by these values, or command line values, or insmod values!!!  =mhw=
-*/
-static int io[IP2_MAX_BOARDS]= { 0, 0, 0, 0 };
-static int irq[IP2_MAX_BOARDS] = { -1, -1, -1, -1 }; 
-static int poll_only = 0;
-MODULE_AUTHOR("Doug McNash");
-MODULE_DESCRIPTION("Computone IntelliPort Plus Driver");
-module_param_array(irq, int, NULL, 0);
-MODULE_PARM_DESC(irq,"Interrupts for IntelliPort Cards");
-module_param_array(io, int, NULL, 0);
-MODULE_PARM_DESC(io,"I/O ports for IntelliPort Cards");
-module_param(poll_only, bool, 0);
-MODULE_PARM_DESC(poll_only,"Do not use card interrupts");
-static int __init ip2_init(void)
-{
-        if( poll_only ) {
-                /* Hard lock the interrupts to zero */
-                irq[0] = irq[1] = irq[2] = irq[3] = 0;
-        }
-        return ip2_loadmain(io, irq);
-}
-module_init(ip2_init);
-MODULE_LICENSE("GPL");
-#ifndef MODULE
-/******************************************************************************
- *      ip2_setup:
- *              str: kernel command line string
- *
- *      Can't autoprobe the boards so user must specify configuration on
- *      kernel command line.  Sane people build it modular but the others
- *      come here.
- *
- *      Alternating pairs of io,irq for up to 4 boards.
- *              ip2=io0,irq0,io1,irq1,io2,irq2,io3,irq3
- *
- *              io=0 => No board
- *              io=1 => PCI
- *              io=2 => EISA
- *              else => ISA I/O address
- *
- *              irq=0 or invalid for ISA will revert to polling mode
- *
- *              Any value = -1, do not overwrite compiled in value.
- *
- ******************************************************************************/
-static int __init ip2_setup(char *str)
-{
-        int     ints[10];       /* 4 boards, 2 parameters + 2 */
-        int     i, j;
-        str = get_options (str, ARRAY_SIZE(ints), ints);
-        for( i = 0, j = 1; i < 4; i++ ) {
-                if( j > ints[0] ) {
-                        break;
-                }
-                if( ints[j] >= 0 ) {
-                        io[i] = ints[j];
-                }
-                j++;
-                if( j > ints[0] ) {
-                        break;
-                }
-                if( ints[j] >= 0 ) {
-                        irq[i] = ints[j];
-                }
-                j++;
-        }
-        return 1;
-}
-__setup("ip2=", ip2_setup);
-#endif /* !MODULE */
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 689f9dcd3b86..6774572d3759 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -150,15 +150,12 @@ static int ip2_read_proc(char *, char **, off_t, int, int *, void * );
 /*************/
 /* String constants to identify ourselves */
-static char *pcName    = "Computone IntelliPort Plus multiport driver";
+static const char pcName[] = "Computone IntelliPort Plus multiport driver";
-static char *pcVersion = "1.2.14";
+static const char pcVersion[] = "1.2.14";
 /* String constants for port names */
-static char *pcDriver_name   = "ip2";
+static const char pcDriver_name[] = "ip2";
-static char *pcIpl               = "ip2ipl";
+static const char pcIpl[] = "ip2ipl";
-// cheezy kludge or genius - you decide?
-int ip2_loadmain(int *, int *);
 /***********************/
 /* Function Prototypes */
@@ -240,8 +237,8 @@ static const struct file_operations ip2_ipl = {
        .open           = ip2_ipl_open,
 }; 
-static unsigned long irq_counter = 0;
+static unsigned long irq_counter;
-static unsigned long bh_counter = 0;
+static unsigned long bh_counter;
 // Use immediate queue to service interrupts
 #define USE_IQI
@@ -252,7 +249,6 @@ static unsigned long bh_counter = 0;
 */
 #define  POLL_TIMEOUT   (jiffies + 1)
 static DEFINE_TIMER(PollTimer, ip2_poll, 0, 0);
-static char  TimerOn;
 #ifdef IP2DEBUG_TRACE
 /* Trace (debug) buffer data */
@@ -268,8 +264,8 @@ static int tracewrap;
 /**********/
 #if defined(MODULE) && defined(IP2DEBUG_OPEN)
-#define DBG_CNT(s) printk(KERN_DEBUG "(%s): [%x] refc=%d, ttyc=%d, modc=%x -> %s\n", \
+#define DBG_CNT(s) printk(KERN_DEBUG "(%s): [%x] ttyc=%d, modc=%x -> %s\n", \
-                    tty->name,(pCh->flags),ip2_tty_driver->refcount, \
+                    tty->name,(pCh->flags), \
                    tty->count,/*GET_USE_COUNT(module)*/0,s)
 #else
 #define DBG_CNT(s)
@@ -287,8 +283,9 @@ static int tracewrap;
 MODULE_AUTHOR("Doug McNash");
 MODULE_DESCRIPTION("Computone IntelliPort Plus Driver");
+MODULE_LICENSE("GPL");
-static int poll_only = 0;
+static int poll_only;
 static int Eisa_irq;
 static int Eisa_slot;
@@ -297,34 +294,46 @@ static int iindx;
 static char rirqs[IP2_MAX_BOARDS];
 static int Valid_Irqs[] = { 3, 4, 5, 7, 10, 11, 12, 15, 0};
+/* Note: Add compiled in defaults to these arrays, not to the structure
+        in ip2.h any longer.  That structure WILL get overridden
+        by these values, or command line values, or insmod values!!!  =mhw=
+*/
+static int io[IP2_MAX_BOARDS];
+static int irq[IP2_MAX_BOARDS] = { -1, -1, -1, -1 };
+MODULE_AUTHOR("Doug McNash");
+MODULE_DESCRIPTION("Computone IntelliPort Plus Driver");
+module_param_array(irq, int, NULL, 0);
+MODULE_PARM_DESC(irq, "Interrupts for IntelliPort Cards");
+module_param_array(io, int, NULL, 0);
+MODULE_PARM_DESC(io, "I/O ports for IntelliPort Cards");
+module_param(poll_only, bool, 0);
+MODULE_PARM_DESC(poll_only, "Do not use card interrupts");
 /* for sysfs class support */
 static struct class *ip2_class;
-// Some functions to keep track of what irq's we have
+/* Some functions to keep track of what irqs we have */
-static int
+static int __init is_valid_irq(int irq)
-is_valid_irq(int irq)
 {
        int *i = Valid_Irqs;
        
-        while ((*i != 0) && (*i != irq)) {
+        while (*i != 0 && *i != irq)
                i++;
-        }
-        return (*i);
+        return *i;
 }
-static void
+static void __init mark_requested_irq(char irq)
-mark_requested_irq( char irq )
 {
        rirqs[iindx++] = irq;
 }
-#ifdef MODULE
+static int __exit clear_requested_irq(char irq)
-static int
-clear_requested_irq( char irq )
 {
        int i;
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
                if (rirqs[i] == irq) {
                        rirqs[i] = 0;
                        return 1;
@@ -332,17 +341,15 @@ clear_requested_irq( char irq )
        }
        return 0;
 }
-#endif
-static int
+static int have_requested_irq(char irq)
-have_requested_irq( char irq )
 {
-        // array init to zeros so 0 irq will not be requested as a side effect
+        /* array init to zeros so 0 irq will not be requested as a side
+         * effect */
        int i;
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i)
                if (rirqs[i] == irq)
                        return 1;
-        }
        return 0;
 }
@@ -361,53 +368,45 @@ have_requested_irq( char irq )
 /* handle subsequent installations of the driver. All memory allocated by the */
 /* driver should be returned since it may be unloaded from memory.            */
 /******************************************************************************/
-#ifdef MODULE
+static void __exit ip2_cleanup_module(void)
-void __exit
-ip2_cleanup_module(void)
 {
        int err;
        int i;
-#ifdef IP2DEBUG_INIT
+        del_timer_sync(&PollTimer);
-        printk (KERN_DEBUG "Unloading %s: version %s\n", pcName, pcVersion );
-#endif
-        /* Stop poll timer if we had one. */
-        if ( TimerOn ) {
-                del_timer ( &PollTimer );
-                TimerOn = 0;
-        }
        /* Reset the boards we have. */
-        for( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; i++)
-                if ( i2BoardPtrTable[i] ) {
+                if (i2BoardPtrTable[i])
-                        iiReset( i2BoardPtrTable[i] );
+                        iiReset(i2BoardPtrTable[i]);
-                }
-        }
        /* The following is done at most once, if any boards were installed. */
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; i++) {
-                if ( i2BoardPtrTable[i] ) {
+                if (i2BoardPtrTable[i]) {
-                        iiResetDelay( i2BoardPtrTable[i] );
+                        iiResetDelay(i2BoardPtrTable[i]);
                        /* free io addresses and Tibet */
-                        release_region( ip2config.addr[i], 8 );
+                        release_region(ip2config.addr[i], 8);
                        device_destroy(ip2_class, MKDEV(IP2_IPL_MAJOR, 4 * i));
-                        device_destroy(ip2_class, MKDEV(IP2_IPL_MAJOR, 4 * i + 1));
+                        device_destroy(ip2_class, MKDEV(IP2_IPL_MAJOR,
+                                                4 * i + 1));
                }
                /* Disable and remove interrupt handler. */
-                if ( (ip2config.irq[i] > 0) && have_requested_irq(ip2config.irq[i]) ) { 
+                if (ip2config.irq[i] > 0 &&
-                        free_irq ( ip2config.irq[i], (void *)&pcName);
+                                have_requested_irq(ip2config.irq[i])) {
-                        clear_requested_irq( ip2config.irq[i]);
+                        free_irq(ip2config.irq[i], (void *)&pcName);
+                        clear_requested_irq(ip2config.irq[i]);
                }
        }
        class_destroy(ip2_class);
-        if ( ( err = tty_unregister_driver ( ip2_tty_driver ) ) ) {
+        err = tty_unregister_driver(ip2_tty_driver);
-                printk(KERN_ERR "IP2: failed to unregister tty driver (%d)\n", err);
+        if (err)
-        }
+                printk(KERN_ERR "IP2: failed to unregister tty driver (%d)\n",
+                                err);
        put_tty_driver(ip2_tty_driver);
        unregister_chrdev(IP2_IPL_MAJOR, pcIpl);
        remove_proc_entry("ip2mem", NULL);
-        // free memory
+        /* free memory */
        for (i = 0; i < IP2_MAX_BOARDS; i++) {
                void *pB;
 #ifdef CONFIG_PCI
@@ -417,24 +416,18 @@ ip2_cleanup_module(void)
                        ip2config.pci_dev[i] = NULL;
                }
 #endif
-                if ((pB = i2BoardPtrTable[i]) != 0 ) {
+                pB = i2BoardPtrTable[i];
-                        kfree ( pB );
+                if (pB != NULL) {
+                        kfree(pB);
                        i2BoardPtrTable[i] = NULL;
                }
-                if ((DevTableMem[i]) != NULL ) {
+                if (DevTableMem[i] != NULL) {
-                        kfree ( DevTableMem[i]  );
+                        kfree(DevTableMem[i]);
                        DevTableMem[i] = NULL;
                }
        }
-        /* Cleanup the iiEllis subsystem. */
-        iiEllisCleanup();
-#ifdef IP2DEBUG_INIT
-        printk (KERN_DEBUG "IP2 Unloaded\n" );
-#endif
 }
 module_exit(ip2_cleanup_module);
-#endif /* MODULE */
 static const struct tty_operations ip2_ops = {
        .open            = ip2_open,
@@ -494,139 +487,168 @@ static const struct firmware *ip2_request_firmware(void)
        return fw;
 }
-int
+#ifndef MODULE
-ip2_loadmain(int *iop, int *irqp)
+/******************************************************************************
+ *      ip2_setup:
+ *              str: kernel command line string
+ *
+ *      Can't autoprobe the boards so user must specify configuration on
+ *      kernel command line.  Sane people build it modular but the others
+ *      come here.
+ *
+ *      Alternating pairs of io,irq for up to 4 boards.
+ *              ip2=io0,irq0,io1,irq1,io2,irq2,io3,irq3
+ *
+ *              io=0 => No board
+ *              io=1 => PCI
+ *              io=2 => EISA
+ *              else => ISA I/O address
+ *
+ *              irq=0 or invalid for ISA will revert to polling mode
+ *
+ *              Any value = -1, do not overwrite compiled in value.
+ *
+ ******************************************************************************/
+static int __init ip2_setup(char *str)
+{
+        int j, ints[10];        /* 4 boards, 2 parameters + 2 */
+        unsigned int i;
+        str = get_options(str, ARRAY_SIZE(ints), ints);
+        for (i = 0, j = 1; i < 4; i++) {
+                if (j > ints[0])
+                        break;
+                if (ints[j] >= 0)
+                        io[i] = ints[j];
+                j++;
+                if (j > ints[0])
+                        break;
+                if (ints[j] >= 0)
+                        irq[i] = ints[j];
+                j++;
+        }
+        return 1;
+}
+__setup("ip2=", ip2_setup);
+#endif /* !MODULE */
+static int __init ip2_loadmain(void)
 {
        int i, j, box;
        int err = 0;
-        static int loaded;
        i2eBordStrPtr pB = NULL;
        int rc = -1;
-        static struct pci_dev *pci_dev_i = NULL;
+        struct pci_dev *pdev = NULL;
        const struct firmware *fw = NULL;
-        ip2trace (ITRC_NO_PORT, ITRC_INIT, ITRC_ENTER, 0 );
+        if (poll_only) {
+                /* Hard lock the interrupts to zero */
+                irq[0] = irq[1] = irq[2] = irq[3] = poll_only = 0;
+        }
+        ip2trace(ITRC_NO_PORT, ITRC_INIT, ITRC_ENTER, 0);
        /* process command line arguments to modprobe or
                insmod i.e. iop & irqp */
        /* irqp and iop should ALWAYS be specified now...  But we check
                them individually just to be sure, anyways... */
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
-                if (iop) {
+                ip2config.addr[i] = io[i];
-                        ip2config.addr[i] = iop[i];
+                if (irq[i] >= 0)
-                        if (irqp) {
+                        ip2config.irq[i] = irq[i];
-                                if( irqp[i] >= 0 ) {
+                else
-                                        ip2config.irq[i] = irqp[i];
+                        ip2config.irq[i] = 0;
-                                } else {
+        /* This is a little bit of a hack.  If poll_only=1 on command
-                                        ip2config.irq[i] = 0;
+           line back in ip2.c OR all IRQs on all specified boards are
-                                }
+           explicitly set to 0, then drop to poll only mode and override
-        // This is a little bit of a hack.  If poll_only=1 on command
+           PCI or EISA interrupts.  This superceeds the old hack of
-        // line back in ip2.c OR all IRQs on all specified boards are
+           triggering if all interrupts were zero (like da default).
-        // explicitly set to 0, then drop to poll only mode and override
+           Still a hack but less prone to random acts of terrorism.
-        // PCI or EISA interrupts.  This superceeds the old hack of
-        // triggering if all interrupts were zero (like da default).
+           What we really should do, now that the IRQ default is set
-        // Still a hack but less prone to random acts of terrorism.
+           to -1, is to use 0 as a hard coded, do not probe.
-        //
-        // What we really should do, now that the IRQ default is set
+                /\/\|=mhw=|\/\/
-        // to -1, is to use 0 as a hard coded, do not probe.
+        */
-        //
+                poll_only |= irq[i];
-        //      /\/\|=mhw=|\/\/
-                                poll_only |= irqp[i];
-                        }
-                }
        }
        poll_only = !poll_only;
        /* Announce our presence */
-        printk( KERN_INFO "%s version %s\n", pcName, pcVersion );
+        printk(KERN_INFO "%s version %s\n", pcName, pcVersion);
-        // ip2 can be unloaded and reloaded for no good reason
-        // we can't let that happen here or bad things happen
-        // second load hoses board but not system - fixme later
-        if (loaded) {
-                printk( KERN_INFO "Still loaded\n" );
-                return 0;
-        }
-        loaded++;
        ip2_tty_driver = alloc_tty_driver(IP2_MAX_PORTS);
        if (!ip2_tty_driver)
                return -ENOMEM;
-        /* Initialise the iiEllis subsystem. */
-        iiEllisInit();
-        /* Initialize arrays. */
-        memset( i2BoardPtrTable, 0, sizeof i2BoardPtrTable );
-        memset( DevTable, 0, sizeof DevTable );
        /* Initialise all the boards we can find (up to the maximum). */
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
-                switch ( ip2config.addr[i] ) { 
+                switch (ip2config.addr[i]) {
                case 0: /* skip this slot even if card is present */
                        break;
                default: /* ISA */
                   /* ISA address must be specified */
-                        if ( (ip2config.addr[i] < 0x100) || (ip2config.addr[i] > 0x3f8) ) {
+                        if (ip2config.addr[i] < 0x100 ||
-                                printk ( KERN_ERR "IP2: Bad ISA board %d address %x\n",
+                                        ip2config.addr[i] > 0x3f8) {
-                                                         i, ip2config.addr[i] );
+                                printk(KERN_ERR "IP2: Bad ISA board %d "
+                                                "address %x\n", i,
+                                                ip2config.addr[i]);
                                ip2config.addr[i] = 0;
-                        } else {
+                                break;
-                                ip2config.type[i] = ISA;
+                        }
+                        ip2config.type[i] = ISA;
-                                /* Check for valid irq argument, set for polling if invalid */
-                                if (ip2config.irq[i] && !is_valid_irq(ip2config.irq[i])) {
+                        /* Check for valid irq argument, set for polling if
-                                        printk(KERN_ERR "IP2: Bad IRQ(%d) specified\n",ip2config.irq[i]);
+                         * invalid */
-                                        ip2config.irq[i] = 0;// 0 is polling and is valid in that sense
+                        if (ip2config.irq[i] &&
-                                }
+                                        !is_valid_irq(ip2config.irq[i])) {
+                                printk(KERN_ERR "IP2: Bad IRQ(%d) specified\n",
+                                                ip2config.irq[i]);
+                                /* 0 is polling and is valid in that sense */
+                                ip2config.irq[i] = 0;
                        }
                        break;
                case PCI:
 #ifdef CONFIG_PCI
-                        {
+                {
-                                int status;
+                        u32 addr;
+                        int status;
-                                pci_dev_i = pci_get_device(PCI_VENDOR_ID_COMPUTONE,
+                        pdev = pci_get_device(PCI_VENDOR_ID_COMPUTONE,
-                                                          PCI_DEVICE_ID_COMPUTONE_IP2EX, pci_dev_i);
+                                        PCI_DEVICE_ID_COMPUTONE_IP2EX, pdev);
-                                if (pci_dev_i != NULL) {
+                        if (pdev == NULL) {
-                                        unsigned int addr;
+                                ip2config.addr[i] = 0;
+                                printk(KERN_ERR "IP2: PCI board %d not "
-                                        if (pci_enable_device(pci_dev_i)) {
+                                                "found\n", i);
-                                                printk( KERN_ERR "IP2: can't enable PCI device at %s\n",
+                                break;
-                                                        pci_name(pci_dev_i));
+                        }
-                                                break;
-                                        }
-                                        ip2config.type[i] = PCI;
-                                        ip2config.pci_dev[i] = pci_dev_get(pci_dev_i);
-                                        status =
-                                        pci_read_config_dword(pci_dev_i, PCI_BASE_ADDRESS_1, &addr);
-                                        if ( addr & 1 ) {
-                                                ip2config.addr[i]=(USHORT)(addr&0xfffe);
-                                        } else {
-                                                printk( KERN_ERR "IP2: PCI I/O address error\n");
-                                        }
-//              If the PCI BIOS assigned it, lets try and use it.  If we
+                        if (pci_enable_device(pdev)) {
-//              can't acquire it or it screws up, deal with it then.
+                                dev_err(&pdev->dev, "can't enable device\n");
+                                break;
-//                                      if (!is_valid_irq(pci_irq)) {
-//                                              printk( KERN_ERR "IP2: Bad PCI BIOS IRQ(%d)\n",pci_irq);
-//                                              pci_irq = 0;
-//                                      }
-                                        ip2config.irq[i] = pci_dev_i->irq;
-                                } else {        // ann error
-                                        ip2config.addr[i] = 0;
-                                        printk(KERN_ERR "IP2: PCI board %d not found\n", i);
-                                } 
                        }
+                        ip2config.type[i] = PCI;
+                        ip2config.pci_dev[i] = pci_dev_get(pdev);
+                        status = pci_read_config_dword(pdev, PCI_BASE_ADDRESS_1,
+                                        &addr);
+                        if (addr & 1)
+                                ip2config.addr[i] = (USHORT)(addr & 0xfffe);
+                        else
+                                dev_err(&pdev->dev, "I/O address error\n");
+                        ip2config.irq[i] = pdev->irq;
+                }
 #else
-                        printk( KERN_ERR "IP2: PCI card specified but PCI support not\n");
+                        printk(KERN_ERR "IP2: PCI card specified but PCI "
-                        printk( KERN_ERR "IP2: configured in this kernel.\n");
+                                        "support not enabled.\n");
-                        printk( KERN_ERR "IP2: Recompile kernel with CONFIG_PCI defined!\n");
+                        printk(KERN_ERR "IP2: Recompile kernel with CONFIG_PCI "
+                                        "defined!\n");
 #endif /* CONFIG_PCI */
                        break;
                case EISA:
-                        if ( (ip2config.addr[i] = find_eisa_board( Eisa_slot + 1 )) != 0) {
+                        ip2config.addr[i] = find_eisa_board(Eisa_slot + 1);
+                        if (ip2config.addr[i] != 0) {
                                /* Eisa_irq set as side effect, boo */
                                ip2config.type[i] = EISA;
                        } 
@@ -634,31 +656,32 @@ ip2_loadmain(int *iop, int *irqp)
                        break;
                }       /* switch */
        }       /* for */
-        if (pci_dev_i)
+        pci_dev_put(pdev);
-                pci_dev_put(pci_dev_i);
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
-                if ( ip2config.addr[i] ) {
+                if (ip2config.addr[i]) {
                        pB = kzalloc(sizeof(i2eBordStr), GFP_KERNEL);
                        if (pB) {
                                i2BoardPtrTable[i] = pB;
-                                iiSetAddress( pB, ip2config.addr[i], ii2DelayTimer );
+                                iiSetAddress(pB, ip2config.addr[i],
-                                iiReset( pB );
+                                                ii2DelayTimer);
-                        } else {
+                                iiReset(pB);
-                                printk(KERN_ERR "IP2: board memory allocation error\n");
+                        } else
-                        }
+                                printk(KERN_ERR "IP2: board memory allocation "
+                                                "error\n");
                }
        }
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
-                if ( ( pB = i2BoardPtrTable[i] ) != NULL ) {
+                pB = i2BoardPtrTable[i];
-                        iiResetDelay( pB );
+                if (pB != NULL) {
+                        iiResetDelay(pB);
                        break;
                }
        }
-        for ( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
                /* We don't want to request the firmware unless we have at
                   least one board */
-                if ( i2BoardPtrTable[i] != NULL ) {
+                if (i2BoardPtrTable[i] != NULL) {
                        if (!fw)
                                fw = ip2_request_firmware();
                        if (!fw)
@@ -669,7 +692,7 @@ ip2_loadmain(int *iop, int *irqp)
        if (fw)
                release_firmware(fw);
-        ip2trace (ITRC_NO_PORT, ITRC_INIT, 2, 0 );
+        ip2trace(ITRC_NO_PORT, ITRC_INIT, 2, 0);
        ip2_tty_driver->owner               = THIS_MODULE;
        ip2_tty_driver->name                 = "ttyF";
@@ -680,20 +703,23 @@ ip2_loadmain(int *iop, int *irqp)
        ip2_tty_driver->subtype              = SERIAL_TYPE_NORMAL;
        ip2_tty_driver->init_termios         = tty_std_termios;
        ip2_tty_driver->init_termios.c_cflag = B9600|CS8|CREAD|HUPCL|CLOCAL;
-        ip2_tty_driver->flags                = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
+        ip2_tty_driver->flags                = TTY_DRIVER_REAL_RAW |
+                TTY_DRIVER_DYNAMIC_DEV;
        tty_set_operations(ip2_tty_driver, &ip2_ops);
-        ip2trace (ITRC_NO_PORT, ITRC_INIT, 3, 0 );
+        ip2trace(ITRC_NO_PORT, ITRC_INIT, 3, 0);
-        /* Register the tty devices. */
+        err = tty_register_driver(ip2_tty_driver);
-        if ( ( err = tty_register_driver ( ip2_tty_driver ) ) ) {
+        if (err) {
-                printk(KERN_ERR "IP2: failed to register tty driver (%d)\n", err);
+                printk(KERN_ERR "IP2: failed to register tty driver\n");
                put_tty_driver(ip2_tty_driver);
-                return -EINVAL;
+                return err; /* leaking resources */
-        } else
+        }
-        /* Register the IPL driver. */
-        if ( ( err = register_chrdev ( IP2_IPL_MAJOR, pcIpl, &ip2_ipl ) ) ) {
+        err = register_chrdev(IP2_IPL_MAJOR, pcIpl, &ip2_ipl);
-                printk(KERN_ERR "IP2: failed to register IPL device (%d)\n", err );
+        if (err) {
+                printk(KERN_ERR "IP2: failed to register IPL device (%d)\n",
+                                err);
        } else {
                /* create the sysfs class */
                ip2_class = class_create(THIS_MODULE, "ip2");
@@ -705,84 +731,86 @@ ip2_loadmain(int *iop, int *irqp)
        /* Register the read_procmem thing */
        if (!proc_create("ip2mem",0,NULL,&ip2mem_proc_fops)) {
                printk(KERN_ERR "IP2: failed to register read_procmem\n");
-        } else {
+                return -EIO; /* leaking resources */
+        }
-        ip2trace (ITRC_NO_PORT, ITRC_INIT, 4, 0 );
+        ip2trace(ITRC_NO_PORT, ITRC_INIT, 4, 0);
-                /* Register the interrupt handler or poll handler, depending upon the
+        /* Register the interrupt handler or poll handler, depending upon the
-                 * specified interrupt.
+         * specified interrupt.
-                 */
+         */
-                for( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
-                        if ( 0 == ip2config.addr[i] ) {
+                if (ip2config.addr[i] == 0)
-                                continue;
+                        continue;
-                        }
-                        if ( NULL != ( pB = i2BoardPtrTable[i] ) ) {
+                pB = i2BoardPtrTable[i];
-                                device_create_drvdata(ip2_class, NULL,
+                if (pB != NULL) {
-                                                      MKDEV(IP2_IPL_MAJOR, 4 * i),
+                        device_create_drvdata(ip2_class, NULL,
-                                                      NULL, "ipl%d", i);
+                                              MKDEV(IP2_IPL_MAJOR, 4 * i),
-                                device_create_drvdata(ip2_class, NULL,
+                                              NULL, "ipl%d", i);
-                                                      MKDEV(IP2_IPL_MAJOR, 4 * i + 1),
+                        device_create_drvdata(ip2_class, NULL,
-                                                      NULL, "stat%d", i);
+                                              MKDEV(IP2_IPL_MAJOR, 4 * i + 1),
+                                              NULL, "stat%d", i);
-                            for ( box = 0; box < ABS_MAX_BOXES; ++box )
-                            {
+                        for (box = 0; box < ABS_MAX_BOXES; box++)
-                                for ( j = 0; j < ABS_BIGGEST_BOX; ++j )
+                                for (j = 0; j < ABS_BIGGEST_BOX; j++)
-                                {
+                                        if (pB->i2eChannelMap[box] & (1 << j))
-                                    if ( pB->i2eChannelMap[box] & (1 << j) )
+                                                tty_register_device(
-                                    {
+                                                        ip2_tty_driver,
-                                        tty_register_device(ip2_tty_driver,
+                                                        j + ABS_BIGGEST_BOX *
-                                            j + ABS_BIGGEST_BOX *
+                                                        (box+i*ABS_MAX_BOXES),
-                                                    (box+i*ABS_MAX_BOXES), NULL);
+                                                        NULL);
-                                    }
+                }
-                                }
-                            }
-                        }
-                        if (poll_only) {
+                if (poll_only) {
-//              Poll only forces driver to only use polling and
+                        /* Poll only forces driver to only use polling and
-//              to ignore the probed PCI or EISA interrupts.
+                           to ignore the probed PCI or EISA interrupts. */
-                                ip2config.irq[i] = CIR_POLL;
+                        ip2config.irq[i] = CIR_POLL;
-                        }
+                }
-                        if ( ip2config.irq[i] == CIR_POLL ) {
+                if (ip2config.irq[i] == CIR_POLL) {
 retry:
-                                if (!TimerOn) {
+                        if (!timer_pending(&PollTimer)) {
-                                        PollTimer.expires = POLL_TIMEOUT;
+                                mod_timer(&PollTimer, POLL_TIMEOUT);
-                                        add_timer ( &PollTimer );
+                                printk(KERN_INFO "IP2: polling\n");
-                                        TimerOn = 1;
-                                        printk( KERN_INFO "IP2: polling\n");
-                                }
-                        } else {
-                                if (have_requested_irq(ip2config.irq[i]))
-                                        continue;
-                                rc = request_irq( ip2config.irq[i], ip2_interrupt,
-                                        IP2_SA_FLAGS | (ip2config.type[i] == PCI ? IRQF_SHARED : 0),
-                                        pcName, i2BoardPtrTable[i]);
-                                if (rc) {
-                                        printk(KERN_ERR "IP2: an request_irq failed: error %d\n",rc);
-                                        ip2config.irq[i] = CIR_POLL;
-                                        printk( KERN_INFO "IP2: Polling %ld/sec.\n",
-                                                        (POLL_TIMEOUT - jiffies));
-                                        goto retry;
-                                } 
-                                mark_requested_irq(ip2config.irq[i]);
-                                /* Initialise the interrupt handler bottom half (aka slih). */
                        }
-                }
+                } else {
-                for( i = 0; i < IP2_MAX_BOARDS; ++i ) {
+                        if (have_requested_irq(ip2config.irq[i]))
-                        if ( i2BoardPtrTable[i] ) {
+                                continue;
-                                set_irq( i, ip2config.irq[i] ); /* set and enable board interrupt */
+                        rc = request_irq(ip2config.irq[i], ip2_interrupt,
+                                IP2_SA_FLAGS |
+                                (ip2config.type[i] == PCI ? IRQF_SHARED : 0),
+                                pcName, i2BoardPtrTable[i]);
+                        if (rc) {
+                                printk(KERN_ERR "IP2: request_irq failed: "
+                                                "error %d\n", rc);
+                                ip2config.irq[i] = CIR_POLL;
+                                printk(KERN_INFO "IP2: Polling %ld/sec.\n",
+                                                (POLL_TIMEOUT - jiffies));
+                                goto retry;
                        }
+                        mark_requested_irq(ip2config.irq[i]);
+                        /* Initialise the interrupt handler bottom half
+                         * (aka slih). */
                }
        }
-        ip2trace (ITRC_NO_PORT, ITRC_INIT, ITRC_RETURN, 0 );
-        goto out;
+        for (i = 0; i < IP2_MAX_BOARDS; ++i) {
+                if (i2BoardPtrTable[i]) {
+                        /* set and enable board interrupt */
+                        set_irq(i, ip2config.irq[i]);
+                }
+        }
+        ip2trace(ITRC_NO_PORT, ITRC_INIT, ITRC_RETURN, 0);
+        return 0;
 out_chrdev:
        unregister_chrdev(IP2_IPL_MAJOR, "ip2");
-out:
+        /* unregister and put tty here */
        return err;
 }
+module_init(ip2_loadmain);
 /******************************************************************************/
 /* Function:   ip2_init_board()                                               */
@@ -1199,9 +1227,8 @@ ip2_polled_interrupt(void)
 {
        int i;
        i2eBordStrPtr  pB;
-        const int irq = 0;
-        ip2trace (ITRC_NO_PORT, ITRC_INTR, 99, 1, irq );
+        ip2trace(ITRC_NO_PORT, ITRC_INTR, 99, 1, 0);
        /* Service just the boards on the list using this irq */
        for( i = 0; i < i2nBoards; ++i ) {
@@ -1210,9 +1237,8 @@ ip2_polled_interrupt(void)
 //              Only process those boards which match our IRQ.
 //                      IRQ = 0 for polled boards, we won't poll "IRQ" boards
-                if ( pB && (pB->i2eUsingIrq == irq) ) {
+                if (pB && pB->i2eUsingIrq == 0)
                        ip2_irq_work(pB);
-                }
        }
        ++irq_counter;
@@ -1250,16 +1276,12 @@ ip2_poll(unsigned long arg)
 {
        ip2trace (ITRC_NO_PORT, ITRC_INTR, 100, 0 );
-        TimerOn = 0; // it's the truth but not checked in service
        // Just polled boards, IRQ = 0 will hit all non-interrupt boards.
        // It will NOT poll boards handled by hard interrupts.
        // The issue of queued BH interrupts is handled in ip2_interrupt().
        ip2_polled_interrupt();
-        PollTimer.expires = POLL_TIMEOUT;
+        mod_timer(&PollTimer, POLL_TIMEOUT);
-        add_timer( &PollTimer );
-        TimerOn = 1;
        ip2trace (ITRC_NO_PORT, ITRC_INTR, ITRC_RETURN, 0 );
 }
@@ -2871,7 +2893,7 @@ ip2_ipl_ioctl (struct file *pFile, UINT cmd, ULONG arg )
        case 13:
                switch ( cmd ) {
                case 64:        /* Driver - ip2stat */
-                        rc = put_user(ip2_tty_driver->refcount, pIndex++ );
+                        rc = put_user(-1, pIndex++ );
                        rc = put_user(irq_counter, pIndex++  );
                        rc = put_user(bh_counter, pIndex++  );
                        break;
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 8f7cc190b62d..7d30ee1d3fca 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -421,17 +421,16 @@ static void isicom_tx(unsigned long _data)
        if (retries >= 100)
                goto unlock;
+        tty = tty_port_tty_get(&port->port);
+        if (tty == NULL)
+                goto put_unlock;
        for (; count > 0; count--, port++) {
                /* port not active or tx disabled to force flow control */
                if (!(port->port.flags & ASYNC_INITIALIZED) ||
                                !(port->status & ISI_TXOK))
                        continue;
-                tty = port->port.tty;
-                if (tty == NULL)
-                        continue;
                txcount = min_t(short, TX_SIZE, port->xmit_cnt);
                if (txcount <= 0 || tty->stopped || tty->hw_stopped)
                        continue;
@@ -489,6 +488,8 @@ static void isicom_tx(unsigned long _data)
                        tty_wakeup(tty);
        }
+put_unlock:
+        tty_kref_put(tty);
 unlock:
        spin_unlock_irqrestore(&isi_card[card].card_lock, flags);
        /*      schedule another tx for hopefully in about 10ms */
@@ -547,7 +548,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id)
                return IRQ_HANDLED;
        }
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty == NULL) {
                word_count = byte_count >> 1;
                while (byte_count > 1) {
@@ -588,7 +589,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id)
                        }
                        if (port->port.flags & ASYNC_CTS_FLOW) {
-                                if (port->port.tty->hw_stopped) {
+                                if (tty->hw_stopped) {
                                        if (header & ISI_CTS) {
                                                port->port.tty->hw_stopped = 0;
                                                /* start tx ing */
@@ -597,7 +598,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id)
                                                tty_wakeup(tty);
                                        }
                                } else if (!(header & ISI_CTS)) {
-                                        port->port.tty->hw_stopped = 1;
+                                        tty->hw_stopped = 1;
                                        /* stop tx ing */
                                        port->status &= ~(ISI_TXOK | ISI_CTS);
                                }
@@ -660,24 +661,21 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id)
        }
        outw(0x0000, base+0x04); /* enable interrupts */
        spin_unlock(&card->card_lock);
+        tty_kref_put(tty);
        return IRQ_HANDLED;
 }
-static void isicom_config_port(struct isi_port *port)
+static void isicom_config_port(struct tty_struct *tty)
 {
+        struct isi_port *port = tty->driver_data;
        struct isi_board *card = port->card;
-        struct tty_struct *tty;
        unsigned long baud;
        unsigned long base = card->base;
        u16 channel_setup, channel = port->channel,
                shift_count = card->shift_count;
        unsigned char flow_ctrl;
-        tty = port->port.tty;
-        if (tty == NULL)
-                return;
        /* FIXME: Switch to new tty baud API */
        baud = C_BAUD(tty);
        if (baud & CBAUDEX) {
@@ -690,7 +688,7 @@ static void isicom_config_port(struct isi_port *port)
                /* 1,2,3,4 => 57.6, 115.2, 230, 460 kbps resp. */
                if (baud < 1 || baud > 4)
-                        port->port.tty->termios->c_cflag &= ~CBAUDEX;
+                        tty->termios->c_cflag &= ~CBAUDEX;
                else
                        baud += 15;
        }
@@ -797,8 +795,9 @@ static inline void isicom_setup_board(struct isi_board *bp)
        spin_unlock_irqrestore(&bp->card_lock, flags);
 }
-static int isicom_setup_port(struct isi_port *port)
+static int isicom_setup_port(struct tty_struct *tty)
 {
+        struct isi_port *port = tty->driver_data;
        struct isi_board *card = port->card;
        unsigned long flags;
@@ -808,8 +807,7 @@ static int isicom_setup_port(struct isi_port *port)
                return -ENOMEM;
        spin_lock_irqsave(&card->card_lock, flags);
-        if (port->port.tty)
+        clear_bit(TTY_IO_ERROR, &tty->flags);
-                clear_bit(TTY_IO_ERROR, &port->port.tty->flags);
        if (port->port.count == 1)
                card->count++;
@@ -823,7 +821,7 @@ static int isicom_setup_port(struct isi_port *port)
                InterruptTheCard(card->base);
        }
-        isicom_config_port(port);
+        isicom_config_port(tty);
        port->port.flags |= ASYNC_INITIALIZED;
        spin_unlock_irqrestore(&card->card_lock, flags);
@@ -934,8 +932,8 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
        port->port.count++;
        tty->driver_data = port;
-        port->port.tty = tty;
+        tty_port_tty_set(&port->port, tty);
-        error = isicom_setup_port(port);
+        error = isicom_setup_port(tty);
        if (error == 0)
                error = block_til_ready(tty, filp, port);
        return error;
@@ -955,15 +953,17 @@ static void isicom_shutdown_port(struct isi_port *port)
        struct isi_board *card = port->card;
        struct tty_struct *tty;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
-        if (!(port->port.flags & ASYNC_INITIALIZED))
+        if (!(port->port.flags & ASYNC_INITIALIZED)) {
+                tty_kref_put(tty);
                return;
+        }
        tty_port_free_xmit_buf(&port->port);
        port->port.flags &= ~ASYNC_INITIALIZED;
        /* 3rd October 2000 : Vinayak P Risbud */
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
        /*Fix done by Anil .S on 30-04-2001
        remote login through isi port has dtr toggle problem
@@ -1243,9 +1243,10 @@ static int isicom_tiocmset(struct tty_struct *tty, struct file *file,
        return 0;
 }
-static int isicom_set_serial_info(struct isi_port *port,
+static int isicom_set_serial_info(struct tty_struct *tty,
-        struct serial_struct __user *info)
+                                        struct serial_struct __user *info)
 {
+        struct isi_port *port = tty->driver_data;
        struct serial_struct newinfo;
        int reconfig_port;
@@ -1276,7 +1277,7 @@ static int isicom_set_serial_info(struct isi_port *port,
        if (reconfig_port) {
                unsigned long flags;
                spin_lock_irqsave(&port->card->card_lock, flags);
-                isicom_config_port(port);
+                isicom_config_port(tty);
                spin_unlock_irqrestore(&port->card->card_lock, flags);
        }
        unlock_kernel();
@@ -1318,7 +1319,7 @@ static int isicom_ioctl(struct tty_struct *tty, struct file *filp,
                return isicom_get_serial_info(port, argp);
        case TIOCSSERIAL:
-                return isicom_set_serial_info(port, argp);
+                return isicom_set_serial_info(tty, argp);
        default:
                return -ENOIOCTLCMD;
@@ -1341,7 +1342,7 @@ static void isicom_set_termios(struct tty_struct *tty,
                return;
        spin_lock_irqsave(&port->card->card_lock, flags);
-        isicom_config_port(port);
+        isicom_config_port(tty);
        spin_unlock_irqrestore(&port->card->card_lock, flags);
        if ((old_termios->c_cflag & CRTSCTS) &&
@@ -1419,7 +1420,7 @@ static void isicom_hangup(struct tty_struct *tty)
        port->port.count = 0;
        port->port.flags &= ~ASYNC_NORMAL_ACTIVE;
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
        wake_up_interruptible(&port->port.open_wait);
 }
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 843a2afaf204..505d7a1f6b8c 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -623,24 +623,25 @@ static int	stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, un
 static void     stli_brdpoll(struct stlibrd *brdp, cdkhdr_t __iomem *hdrp);
 static void     stli_poll(unsigned long arg);
 static int      stli_hostcmd(struct stlibrd *brdp, struct stliport *portp);
-static int      stli_initopen(struct stlibrd *brdp, struct stliport *portp);
+static int      stli_initopen(struct tty_struct *tty, struct stlibrd *brdp, struct stliport *portp);
 static int      stli_rawopen(struct stlibrd *brdp, struct stliport *portp, unsigned long arg, int wait);
 static int      stli_rawclose(struct stlibrd *brdp, struct stliport *portp, unsigned long arg, int wait);
-static int      stli_waitcarrier(struct stlibrd *brdp, struct stliport *portp, struct file *filp);
+static int      stli_waitcarrier(struct tty_struct *tty, struct stlibrd *brdp,
-static int      stli_setport(struct stliport *portp);
+                                struct stliport *portp, struct file *filp);
+static int      stli_setport(struct tty_struct *tty);
 static int      stli_cmdwait(struct stlibrd *brdp, struct stliport *portp, unsigned long cmd, void *arg, int size, int copyback);
 static void     stli_sendcmd(struct stlibrd *brdp, struct stliport *portp, unsigned long cmd, void *arg, int size, int copyback);
 static void     __stli_sendcmd(struct stlibrd *brdp, struct stliport *portp, unsigned long cmd, void *arg, int size, int copyback);
 static void     stli_dodelaycmd(struct stliport *portp, cdkctrl_t __iomem *cp);
-static void     stli_mkasyport(struct stliport *portp, asyport_t *pp, struct ktermios *tiosp);
+static void     stli_mkasyport(struct tty_struct *tty, struct stliport *portp, asyport_t *pp, struct ktermios *tiosp);
 static void     stli_mkasysigs(asysigs_t *sp, int dtr, int rts);
 static long     stli_mktiocm(unsigned long sigvalue);
 static void     stli_read(struct stlibrd *brdp, struct stliport *portp);
 static int      stli_getserial(struct stliport *portp, struct serial_struct __user *sp);
-static int      stli_setserial(struct stliport *portp, struct serial_struct __user *sp);
+static int      stli_setserial(struct tty_struct *tty, struct serial_struct __user *sp);
 static int      stli_getbrdstats(combrd_t __user *bp);
-static int      stli_getportstats(struct stliport *portp, comstats_t __user *cp);
+static int      stli_getportstats(struct tty_struct *tty, struct stliport *portp, comstats_t __user *cp);
-static int      stli_portcmdstats(struct stliport *portp);
+static int      stli_portcmdstats(struct tty_struct *tty, struct stliport *portp);
 static int      stli_clrportstats(struct stliport *portp, comstats_t __user *cp);
 static int      stli_getportstruct(struct stliport __user *arg);
 static int      stli_getbrdstruct(struct stlibrd __user *arg);
@@ -731,12 +732,16 @@ static void stli_cleanup_ports(struct stlibrd *brdp)
 {
        struct stliport *portp;
        unsigned int j;
+        struct tty_struct *tty;
        for (j = 0; j < STL_MAXPORTS; j++) {
                portp = brdp->ports[j];
                if (portp != NULL) {
-                        if (portp->port.tty != NULL)
+                        tty = tty_port_tty_get(&portp->port);
-                                tty_hangup(portp->port.tty);
+                        if (tty != NULL) {
+                                tty_hangup(tty);
+                                tty_kref_put(tty);
+                        }
                        kfree(portp);
                }
        }
@@ -824,7 +829,7 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
 *      requires several commands to the board we will need to wait for any
 *      other open that is already initializing the port.
 */
-        portp->port.tty = tty;
+        tty_port_tty_set(&portp->port, tty);
        tty->driver_data = portp;
        portp->port.count++;
@@ -835,7 +840,7 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
        if ((portp->port.flags & ASYNC_INITIALIZED) == 0) {
                set_bit(ST_INITIALIZING, &portp->state);
-                if ((rc = stli_initopen(brdp, portp)) >= 0) {
+                if ((rc = stli_initopen(tty, brdp, portp)) >= 0) {
                        portp->port.flags |= ASYNC_INITIALIZED;
                        clear_bit(TTY_IO_ERROR, &tty->flags);
                }
@@ -864,7 +869,7 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
 *      then also we might have to wait for carrier.
 */
        if (!(filp->f_flags & O_NONBLOCK)) {
-                if ((rc = stli_waitcarrier(brdp, portp, filp)) != 0)
+                if ((rc = stli_waitcarrier(tty, brdp, portp, filp)) != 0)
                        return rc;
        }
        portp->port.flags |= ASYNC_NORMAL_ACTIVE;
@@ -930,7 +935,7 @@ static void stli_close(struct tty_struct *tty, struct file *filp)
        stli_flushbuffer(tty);
        tty->closing = 0;
-        portp->port.tty = NULL;
+        tty_port_tty_set(&portp->port, NULL);
        if (portp->openwaitcnt) {
                if (portp->close_delay)
@@ -952,9 +957,9 @@ static void stli_close(struct tty_struct *tty, struct file *filp)
 *      this still all happens pretty quickly.
 */
-static int stli_initopen(struct stlibrd *brdp, struct stliport *portp)
+static int stli_initopen(struct tty_struct *tty,
+                                struct stlibrd *brdp, struct stliport *portp)
 {
-        struct tty_struct *tty;
        asynotify_t nt;
        asyport_t aport;
        int rc;
@@ -969,10 +974,7 @@ static int stli_initopen(struct stlibrd *brdp, struct stliport *portp)
            sizeof(asynotify_t), 0)) < 0)
                return rc;
-        tty = portp->port.tty;
+        stli_mkasyport(tty, portp, &aport, tty->termios);
-        if (tty == NULL)
-                return -ENODEV;
-        stli_mkasyport(portp, &aport, tty->termios);
        if ((rc = stli_cmdwait(brdp, portp, A_SETPORT, &aport,
            sizeof(asyport_t), 0)) < 0)
                return rc;
@@ -1161,22 +1163,21 @@ static int stli_cmdwait(struct stlibrd *brdp, struct stliport *portp, unsigned l
 *      waiting for the command to complete - so must have user context.
 */
-static int stli_setport(struct stliport *portp)
+static int stli_setport(struct tty_struct *tty)
 {
+        struct stliport *portp = tty->driver_data;
        struct stlibrd *brdp;
        asyport_t aport;
        if (portp == NULL)
                return -ENODEV;
-        if (portp->port.tty == NULL)
-                return -ENODEV;
        if (portp->brdnr >= stli_nrbrds)
                return -ENODEV;
        brdp = stli_brds[portp->brdnr];
        if (brdp == NULL)
                return -ENODEV;
-        stli_mkasyport(portp, &aport, portp->port.tty->termios);
+        stli_mkasyport(tty, portp, &aport, tty->termios);
        return(stli_cmdwait(brdp, portp, A_SETPORT, &aport, sizeof(asyport_t), 0));
 }
@@ -1187,7 +1188,8 @@ static int stli_setport(struct stliport *portp)
 *      maybe because if we are clocal then we don't need to wait...
 */
-static int stli_waitcarrier(struct stlibrd *brdp, struct stliport *portp, struct file *filp)
+static int stli_waitcarrier(struct tty_struct *tty, struct stlibrd *brdp,
+                                struct stliport *portp, struct file *filp)
 {
        unsigned long flags;
        int rc, doclocal;
@@ -1195,7 +1197,7 @@ static int stli_waitcarrier(struct stlibrd *brdp, struct stliport *portp, struct
        rc = 0;
        doclocal = 0;
-        if (portp->port.tty->termios->c_cflag & CLOCAL)
+        if (tty->termios->c_cflag & CLOCAL)
                doclocal++;
        spin_lock_irqsave(&stli_lock, flags);
@@ -1373,8 +1375,6 @@ static void stli_flushchars(struct tty_struct *tty)
        stli_txcookrealsize = 0;
        stli_txcooktty = NULL;
-        if (tty == NULL)
-                return;
        if (cooktty == NULL)
                return;
        if (tty != cooktty)
@@ -1572,10 +1572,11 @@ static int stli_getserial(struct stliport *portp, struct serial_struct __user *s
 *      just quietly ignore any requests to change irq, etc.
 */
-static int stli_setserial(struct stliport *portp, struct serial_struct __user *sp)
+static int stli_setserial(struct tty_struct *tty, struct serial_struct __user *sp)
 {
        struct serial_struct sio;
        int rc;
+        struct stliport *portp = tty->driver_data;
        if (copy_from_user(&sio, sp, sizeof(struct serial_struct)))
                return -EFAULT;
@@ -1594,7 +1595,7 @@ static int stli_setserial(struct stliport *portp, struct serial_struct __user *s
        portp->closing_wait = sio.closing_wait;
        portp->custom_divisor = sio.custom_divisor;
-        if ((rc = stli_setport(portp)) < 0)
+        if ((rc = stli_setport(tty)) < 0)
                return rc;
        return 0;
 }
@@ -1685,17 +1686,17 @@ static int stli_ioctl(struct tty_struct *tty, struct file *file, unsigned int cm
                rc = stli_getserial(portp, argp);
                break;
        case TIOCSSERIAL:
-                rc = stli_setserial(portp, argp);
+                rc = stli_setserial(tty, argp);
                break;
        case STL_GETPFLAG:
                rc = put_user(portp->pflag, (unsigned __user *)argp);
                break;
        case STL_SETPFLAG:
                if ((rc = get_user(portp->pflag, (unsigned __user *)argp)) == 0)
-                        stli_setport(portp);
+                        stli_setport(tty);
                break;
        case COM_GETPORTSTATS:
-                rc = stli_getportstats(portp, argp);
+                rc = stli_getportstats(tty, portp, argp);
                break;
        case COM_CLRPORTSTATS:
                rc = stli_clrportstats(portp, argp);
@@ -1729,8 +1730,6 @@ static void stli_settermios(struct tty_struct *tty, struct ktermios *old)
        struct ktermios *tiosp;
        asyport_t aport;
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1742,7 +1741,7 @@ static void stli_settermios(struct tty_struct *tty, struct ktermios *old)
        tiosp = tty->termios;
-        stli_mkasyport(portp, &aport, tiosp);
+        stli_mkasyport(tty, portp, &aport, tiosp);
        stli_cmdwait(brdp, portp, A_SETPORT, &aport, sizeof(asyport_t), 0);
        stli_mkasysigs(&portp->asig, ((tiosp->c_cflag & CBAUD) ? 1 : 0), -1);
        stli_cmdwait(brdp, portp, A_SETSIGNALS, &portp->asig,
@@ -1854,7 +1853,7 @@ static void stli_hangup(struct tty_struct *tty)
        clear_bit(ST_TXBUSY, &portp->state);
        clear_bit(ST_RXSTOP, &portp->state);
        set_bit(TTY_IO_ERROR, &tty->flags);
-        portp->port.tty = NULL;
+        tty_port_tty_set(&portp->port, NULL);
        portp->port.flags &= ~ASYNC_NORMAL_ACTIVE;
        portp->port.count = 0;
        spin_unlock_irqrestore(&stli_lock, flags);
@@ -1935,8 +1934,6 @@ static void stli_waituntilsent(struct tty_struct *tty, int timeout)
        struct stliport *portp;
        unsigned long tend;
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1998,7 +1995,7 @@ static int stli_portinfo(struct stlibrd *brdp, struct stliport *portp, int portn
        char *sp, *uart;
        int rc, cnt;
-        rc = stli_portcmdstats(portp);
+        rc = stli_portcmdstats(NULL, portp);
        uart = "UNKNOWN";
        if (brdp->state & BST_STARTED) {
@@ -2188,7 +2185,7 @@ static void stli_read(struct stlibrd *brdp, struct stliport *portp)
        if (test_bit(ST_RXSTOP, &portp->state))
                return;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if (tty == NULL)
                return;
@@ -2230,6 +2227,7 @@ static void stli_read(struct stlibrd *brdp, struct stliport *portp)
                set_bit(ST_RXING, &portp->state);
        tty_schedule_flip(tty);
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -2362,7 +2360,7 @@ static int stli_hostcmd(struct stlibrd *brdp, struct stliport *portp)
        if (ap->notify) {
                nt = ap->changed;
                ap->notify = 0;
-                tty = portp->port.tty;
+                tty = tty_port_tty_get(&portp->port);
                if (nt.signal & SG_DCD) {
                        oldsigs = portp->sigs;
@@ -2399,6 +2397,7 @@ static int stli_hostcmd(struct stlibrd *brdp, struct stliport *portp)
                                tty_schedule_flip(tty);
                        }
                }
+                tty_kref_put(tty);
                if (nt.data & DT_RXBUSY) {
                        donerx++;
@@ -2535,14 +2534,15 @@ static void stli_poll(unsigned long arg)
 *      the slave.
 */
-static void stli_mkasyport(struct stliport *portp, asyport_t *pp, struct ktermios *tiosp)
+static void stli_mkasyport(struct tty_struct *tty, struct stliport *portp,
+                                asyport_t *pp, struct ktermios *tiosp)
 {
        memset(pp, 0, sizeof(asyport_t));
 /*
 *      Start of by setting the baud, char size, parity and stop bit info.
 */
-        pp->baudout = tty_get_baud_rate(portp->port.tty);
+        pp->baudout = tty_get_baud_rate(tty);
        if ((tiosp->c_cflag & CBAUD) == B38400) {
                if ((portp->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
                        pp->baudout = 57600;
@@ -2695,7 +2695,7 @@ static int stli_initports(struct stlibrd *brdp)
                        printk("STALLION: failed to allocate port structure\n");
                        continue;
                }
+                tty_port_init(&portp->port);
                portp->magic = STLI_PORTMAGIC;
                portp->portnr = i;
                portp->brdnr = brdp->brdnr;
@@ -4220,7 +4220,7 @@ static struct stliport *stli_getport(unsigned int brdnr, unsigned int panelnr,
 *      what port to get stats for (used through board control device).
 */
-static int stli_portcmdstats(struct stliport *portp)
+static int stli_portcmdstats(struct tty_struct *tty, struct stliport *portp)
 {
        unsigned long   flags;
        struct stlibrd  *brdp;
@@ -4249,15 +4249,15 @@ static int stli_portcmdstats(struct stliport *portp)
        stli_comstats.flags = portp->port.flags;
        spin_lock_irqsave(&brd_lock, flags);
-        if (portp->port.tty != NULL) {
+        if (tty != NULL) {
-                if (portp->port.tty->driver_data == portp) {
+                if (portp->port.tty == tty) {
-                        stli_comstats.ttystate = portp->port.tty->flags;
+                        stli_comstats.ttystate = tty->flags;
                        stli_comstats.rxbuffered = -1;
-                        if (portp->port.tty->termios != NULL) {
+                        if (tty->termios != NULL) {
-                                stli_comstats.cflags = portp->port.tty->termios->c_cflag;
+                                stli_comstats.cflags = tty->termios->c_cflag;
-                                stli_comstats.iflags = portp->port.tty->termios->c_iflag;
+                                stli_comstats.iflags = tty->termios->c_iflag;
-                                stli_comstats.oflags = portp->port.tty->termios->c_oflag;
+                                stli_comstats.oflags = tty->termios->c_oflag;
-                                stli_comstats.lflags = portp->port.tty->termios->c_lflag;
+                                stli_comstats.lflags = tty->termios->c_lflag;
                        }
                }
        }
@@ -4294,7 +4294,8 @@ static int stli_portcmdstats(struct stliport *portp)
 *      what port to get stats for (used through board control device).
 */
-static int stli_getportstats(struct stliport *portp, comstats_t __user *cp)
+static int stli_getportstats(struct tty_struct *tty, struct stliport *portp,
+                                                        comstats_t __user *cp)
 {
        struct stlibrd *brdp;
        int rc;
@@ -4312,7 +4313,7 @@ static int stli_getportstats(struct stliport *portp, comstats_t __user *cp)
        if (!brdp)
                return -ENODEV;
-        if ((rc = stli_portcmdstats(portp)) < 0)
+        if ((rc = stli_portcmdstats(tty, portp)) < 0)
                return rc;
        return copy_to_user(cp, &stli_comstats, sizeof(comstats_t)) ?
@@ -4427,7 +4428,7 @@ static int stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, un
        switch (cmd) {
        case COM_GETPORTSTATS:
-                rc = stli_getportstats(NULL, argp);
+                rc = stli_getportstats(NULL, NULL, argp);
                done++;
                break;
        case COM_CLRPORTSTATS:
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index d3d7864e0c1e..5df4003ad873 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -205,7 +205,7 @@ static int moxa_tiocmset(struct tty_struct *tty, struct file *file,
 static void moxa_poll(unsigned long);
 static void moxa_set_tty_param(struct tty_struct *, struct ktermios *);
 static void moxa_setup_empty_event(struct tty_struct *);
-static void moxa_shut_down(struct moxa_port *);
+static void moxa_shut_down(struct tty_struct *);
 /*
 * moxa board interface functions:
 */
@@ -217,7 +217,7 @@ static void MoxaPortLineCtrl(struct moxa_port *, int, int);
 static void MoxaPortFlowCtrl(struct moxa_port *, int, int, int, int, int);
 static int MoxaPortLineStatus(struct moxa_port *);
 static void MoxaPortFlushData(struct moxa_port *, int);
-static int MoxaPortWriteData(struct moxa_port *, const unsigned char *, int);
+static int MoxaPortWriteData(struct tty_struct *, const unsigned char *, int);
 static int MoxaPortReadData(struct moxa_port *);
 static int MoxaPortTxQueue(struct moxa_port *);
 static int MoxaPortRxQueue(struct moxa_port *);
@@ -332,6 +332,7 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
                for (i = 0; i < MAX_BOARDS; i++) {
                        p = moxa_boards[i].ports;
                        for (j = 0; j < MAX_PORTS_PER_BOARD; j++, p++, argm++) {
+                                struct tty_struct *ttyp;
                                memset(&tmp, 0, sizeof(tmp));
                                if (!moxa_boards[i].ready)
                                        goto copy;
@@ -344,10 +345,12 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
                                if (status & 4)
                                        tmp.dcd = 1;
-                                if (!p->port.tty || !p->port.tty->termios)
+                                ttyp = tty_port_tty_get(&p->port);
+                                if (!ttyp || !ttyp->termios)
                                        tmp.cflag = p->cflag;
                                else
-                                        tmp.cflag = p->port.tty->termios->c_cflag;
+                                        tmp.cflag = ttyp->termios->c_cflag;
+                                tty_kref_put(tty);
 copy:
                                if (copy_to_user(argm, &tmp, sizeof(tmp))) {
                                        mutex_unlock(&moxa_openlock);
@@ -880,8 +883,14 @@ static void moxa_board_deinit(struct moxa_board_conf *brd)
        /* pci hot-un-plug support */
        for (a = 0; a < brd->numPorts; a++)
-                if (brd->ports[a].port.flags & ASYNC_INITIALIZED)
+                if (brd->ports[a].port.flags & ASYNC_INITIALIZED) {
-                        tty_hangup(brd->ports[a].port.tty);
+                        struct tty_struct *tty = tty_port_tty_get(
+                                                &brd->ports[a].port);
+                        if (tty) {
+                                tty_hangup(tty);
+                                tty_kref_put(tty);
+                        }
+                }
        while (1) {
                opened = 0;
                for (a = 0; a < brd->numPorts; a++)
@@ -1096,13 +1105,14 @@ static void __exit moxa_exit(void)
 module_init(moxa_init);
 module_exit(moxa_exit);
-static void moxa_close_port(struct moxa_port *ch)
+static void moxa_close_port(struct tty_struct *tty)
 {
-        moxa_shut_down(ch);
+        struct moxa_port *ch = tty->driver_data;
+        moxa_shut_down(tty);
        MoxaPortFlushData(ch, 2);
        ch->port.flags &= ~ASYNC_NORMAL_ACTIVE;
-        ch->port.tty->driver_data = NULL;
+        tty->driver_data = NULL;
-        ch->port.tty = NULL;
+        tty_port_tty_set(&ch->port, NULL);
 }
 static int moxa_block_till_ready(struct tty_struct *tty, struct file *filp,
@@ -1161,7 +1171,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
        ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
        ch->port.count++;
        tty->driver_data = ch;
-        ch->port.tty = tty;
+        tty_port_tty_set(&ch->port, tty);
        if (!(ch->port.flags & ASYNC_INITIALIZED)) {
                ch->statusflags = 0;
                moxa_set_tty_param(tty, tty->termios);
@@ -1179,7 +1189,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
        if (retval) {
                if (ch->port.count) /* 0 means already hung up... */
                        if (--ch->port.count == 0)
-                                moxa_close_port(ch);
+                                moxa_close_port(tty);
        } else
                ch->port.flags |= ASYNC_NORMAL_ACTIVE;
        mutex_unlock(&moxa_openlock);
@@ -1219,7 +1229,7 @@ static void moxa_close(struct tty_struct *tty, struct file *filp)
                tty_wait_until_sent(tty, 30 * HZ);      /* 30 seconds timeout */
        }
-        moxa_close_port(ch);
+        moxa_close_port(tty);
 unlock:
        mutex_unlock(&moxa_openlock);
 }
@@ -1234,7 +1244,7 @@ static int moxa_write(struct tty_struct *tty,
                return 0;
        spin_lock_bh(&moxa_lock);
-        len = MoxaPortWriteData(ch, buf, count);
+        len = MoxaPortWriteData(tty, buf, count);
        spin_unlock_bh(&moxa_lock);
        ch->statusflags |= LOWWAIT;
@@ -1409,7 +1419,7 @@ static void moxa_hangup(struct tty_struct *tty)
                return;
        }
        ch->port.count = 0;
-        moxa_close_port(ch);
+        moxa_close_port(tty);
        mutex_unlock(&moxa_openlock);
        wake_up_interruptible(&ch->port.open_wait);
@@ -1417,11 +1427,14 @@ static void moxa_hangup(struct tty_struct *tty)
 static void moxa_new_dcdstate(struct moxa_port *p, u8 dcd)
 {
+        struct tty_struct *tty;
        dcd = !!dcd;
-        if (dcd != p->DCDState && p->port.tty && C_CLOCAL(p->port.tty)) {
+        if (dcd != p->DCDState) {
-                if (!dcd)
+                tty = tty_port_tty_get(&p->port);
-                        tty_hangup(p->port.tty);
+                if (tty && C_CLOCAL(tty) && !dcd)
+                        tty_hangup(tty);
+                tty_kref_put(tty);
        }
        p->DCDState = dcd;
 }
@@ -1429,7 +1442,7 @@ static void moxa_new_dcdstate(struct moxa_port *p, u8 dcd)
 static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
                u16 __iomem *ip)
 {
-        struct tty_struct *tty = p->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&p->port);
        void __iomem *ofsAddr;
        unsigned int inited = p->port.flags & ASYNC_INITIALIZED;
        u16 intr;
@@ -1476,6 +1489,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
                tty_insert_flip_char(tty, 0, TTY_BREAK);
                tty_schedule_flip(tty);
        }
+        tty_kref_put(tty);
        if (intr & IntrLine)
                moxa_new_dcdstate(p, readb(ofsAddr + FlagStat) & DCD_state);
@@ -1560,9 +1574,9 @@ static void moxa_setup_empty_event(struct tty_struct *tty)
        spin_unlock_bh(&moxa_lock);
 }
-static void moxa_shut_down(struct moxa_port *ch)
+static void moxa_shut_down(struct tty_struct *tty)
 {
-        struct tty_struct *tp = ch->port.tty;
+        struct moxa_port *ch = tty->driver_data;
        if (!(ch->port.flags & ASYNC_INITIALIZED))
                return;
@@ -1572,7 +1586,7 @@ static void moxa_shut_down(struct moxa_port *ch)
        /*
         * If we're a modem control device and HUPCL is on, drop RTS & DTR.
         */
-        if (C_HUPCL(tp))
+        if (C_HUPCL(tty))
                MoxaPortLineCtrl(ch, 0, 0);
        spin_lock_bh(&moxa_lock);
@@ -1953,9 +1967,10 @@ static int MoxaPortLineStatus(struct moxa_port *port)
        return val;
 }
-static int MoxaPortWriteData(struct moxa_port *port,
+static int MoxaPortWriteData(struct tty_struct *tty,
                const unsigned char *buffer, int len)
 {
+        struct moxa_port *port = tty->driver_data;
        void __iomem *baseAddr, *ofsAddr, *ofs;
        unsigned int c, total;
        u16 head, tail, tx_mask, spage, epage;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index b638403e8e9c..8beef50f95a0 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -610,15 +610,13 @@ static int mxser_block_til_ready(struct tty_struct *tty, struct file *filp,
        return 0;
 }
-static int mxser_set_baud(struct mxser_port *info, long newspd)
+static int mxser_set_baud(struct tty_struct *tty, long newspd)
 {
+        struct mxser_port *info = tty->driver_data;
        int quot = 0, baud;
        unsigned char cval;
-        if (!info->port.tty || !info->port.tty->termios)
+        if (!info->ioaddr)
-                return -1;
-        if (!(info->ioaddr))
                return -1;
        if (newspd > info->max_baud)
@@ -626,13 +624,13 @@ static int mxser_set_baud(struct mxser_port *info, long newspd)
        if (newspd == 134) {
                quot = 2 * info->baud_base / 269;
-                tty_encode_baud_rate(info->port.tty, 134, 134);
+                tty_encode_baud_rate(tty, 134, 134);
        } else if (newspd) {
                quot = info->baud_base / newspd;
                if (quot == 0)
                        quot = 1;
                baud = info->baud_base/quot;
-                tty_encode_baud_rate(info->port.tty, baud, baud);
+                tty_encode_baud_rate(tty, baud, baud);
        } else {
                quot = 0;
        }
@@ -658,7 +656,7 @@ static int mxser_set_baud(struct mxser_port *info, long newspd)
        outb(cval, info->ioaddr + UART_LCR);    /* reset DLAB */
 #ifdef BOTHER
-        if (C_BAUD(info->port.tty) == BOTHER) {
+        if (C_BAUD(tty) == BOTHER) {
                quot = info->baud_base % newspd;
                quot *= 8;
                if (quot % newspd > newspd / 2) {
@@ -679,21 +677,20 @@ static int mxser_set_baud(struct mxser_port *info, long newspd)
 * This routine is called to set the UART divisor registers to match
 * the specified baud rate for a serial port.
 */
-static int mxser_change_speed(struct mxser_port *info,
+static int mxser_change_speed(struct tty_struct *tty,
-                struct ktermios *old_termios)
+                                        struct ktermios *old_termios)
 {
+        struct mxser_port *info = tty->driver_data;
        unsigned cflag, cval, fcr;
        int ret = 0;
        unsigned char status;
-        if (!info->port.tty || !info->port.tty->termios)
+        cflag = tty->termios->c_cflag;
-                return ret;
+        if (!info->ioaddr)
-        cflag = info->port.tty->termios->c_cflag;
-        if (!(info->ioaddr))
                return ret;
-        if (mxser_set_baud_method[info->port.tty->index] == 0)
+        if (mxser_set_baud_method[tty->index] == 0)
-                mxser_set_baud(info, tty_get_baud_rate(info->port.tty));
+                mxser_set_baud(tty, tty_get_baud_rate(tty));
        /* byte size and parity */
        switch (cflag & CSIZE) {
@@ -762,9 +759,9 @@ static int mxser_change_speed(struct mxser_port *info,
                        info->MCR |= UART_MCR_AFE;
                } else {
                        status = inb(info->ioaddr + UART_MSR);
-                        if (info->port.tty->hw_stopped) {
+                        if (tty->hw_stopped) {
                                if (status & UART_MSR_CTS) {
-                                        info->port.tty->hw_stopped = 0;
+                                        tty->hw_stopped = 0;
                                        if (info->type != PORT_16550A &&
                                                        !info->board->chip_flag) {
                                                outb(info->IER & ~UART_IER_THRI,
@@ -774,11 +771,11 @@ static int mxser_change_speed(struct mxser_port *info,
                                                outb(info->IER, info->ioaddr +
                                                                UART_IER);
                                        }
-                                        tty_wakeup(info->port.tty);
+                                        tty_wakeup(tty);
                                }
                        } else {
                                if (!(status & UART_MSR_CTS)) {
-                                        info->port.tty->hw_stopped = 1;
+                                        tty->hw_stopped = 1;
                                        if ((info->type != PORT_16550A) &&
                                                        (!info->board->chip_flag)) {
                                                info->IER &= ~UART_IER_THRI;
@@ -804,21 +801,21 @@ static int mxser_change_speed(struct mxser_port *info,
         * Set up parity check flag
         */
        info->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
-        if (I_INPCK(info->port.tty))
+        if (I_INPCK(tty))
                info->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-        if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+        if (I_BRKINT(tty) || I_PARMRK(tty))
                info->read_status_mask |= UART_LSR_BI;
        info->ignore_status_mask = 0;
-        if (I_IGNBRK(info->port.tty)) {
+        if (I_IGNBRK(tty)) {
                info->ignore_status_mask |= UART_LSR_BI;
                info->read_status_mask |= UART_LSR_BI;
                /*
                 * If we're ignore parity and break indicators, ignore
                 * overruns too.  (For real raw support).
                 */
-                if (I_IGNPAR(info->port.tty)) {
+                if (I_IGNPAR(tty)) {
                        info->ignore_status_mask |=
                                                UART_LSR_OE |
                                                UART_LSR_PE |
@@ -830,16 +827,16 @@ static int mxser_change_speed(struct mxser_port *info,
                }
        }
        if (info->board->chip_flag) {
-                mxser_set_must_xon1_value(info->ioaddr, START_CHAR(info->port.tty));
+                mxser_set_must_xon1_value(info->ioaddr, START_CHAR(tty));
-                mxser_set_must_xoff1_value(info->ioaddr, STOP_CHAR(info->port.tty));
+                mxser_set_must_xoff1_value(info->ioaddr, STOP_CHAR(tty));
-                if (I_IXON(info->port.tty)) {
+                if (I_IXON(tty)) {
                        mxser_enable_must_rx_software_flow_control(
                                        info->ioaddr);
                } else {
                        mxser_disable_must_rx_software_flow_control(
                                        info->ioaddr);
                }
-                if (I_IXOFF(info->port.tty)) {
+                if (I_IXOFF(tty)) {
                        mxser_enable_must_tx_software_flow_control(
                                        info->ioaddr);
                } else {
@@ -855,7 +852,8 @@ static int mxser_change_speed(struct mxser_port *info,
        return ret;
 }
-static void mxser_check_modem_status(struct mxser_port *port, int status)
+static void mxser_check_modem_status(struct tty_struct *tty,
+                                struct mxser_port *port, int status)
 {
        /* update input line counters */
        if (status & UART_MSR_TERI)
@@ -874,10 +872,11 @@ static void mxser_check_modem_status(struct mxser_port *port, int status)
                        wake_up_interruptible(&port->port.open_wait);
        }
+        tty = tty_port_tty_get(&port->port);
        if (port->port.flags & ASYNC_CTS_FLOW) {
-                if (port->port.tty->hw_stopped) {
+                if (tty->hw_stopped) {
                        if (status & UART_MSR_CTS) {
-                                port->port.tty->hw_stopped = 0;
+                                tty->hw_stopped = 0;
                                if ((port->type != PORT_16550A) &&
                                                (!port->board->chip_flag)) {
@@ -887,11 +886,11 @@ static void mxser_check_modem_status(struct mxser_port *port, int status)
                                        outb(port->IER, port->ioaddr +
                                                        UART_IER);
                                }
-                                tty_wakeup(port->port.tty);
+                                tty_wakeup(tty);
                        }
                } else {
                        if (!(status & UART_MSR_CTS)) {
-                                port->port.tty->hw_stopped = 1;
+                                tty->hw_stopped = 1;
                                if (port->type != PORT_16550A &&
                                                !port->board->chip_flag) {
                                        port->IER &= ~UART_IER_THRI;
@@ -903,8 +902,9 @@ static void mxser_check_modem_status(struct mxser_port *port, int status)
        }
 }
-static int mxser_startup(struct mxser_port *info)
+static int mxser_startup(struct tty_struct *tty)
 {
+        struct mxser_port *info = tty->driver_data;
        unsigned long page;
        unsigned long flags;
@@ -921,8 +921,7 @@ static int mxser_startup(struct mxser_port *info)
        }
        if (!info->ioaddr || !info->type) {
-                if (info->port.tty)
+                set_bit(TTY_IO_ERROR, &tty->flags);
-                        set_bit(TTY_IO_ERROR, &info->port.tty->flags);
                free_page(page);
                spin_unlock_irqrestore(&info->slock, flags);
                return 0;
@@ -952,8 +951,8 @@ static int mxser_startup(struct mxser_port *info)
        if (inb(info->ioaddr + UART_LSR) == 0xff) {
                spin_unlock_irqrestore(&info->slock, flags);
                if (capable(CAP_SYS_ADMIN)) {
-                        if (info->port.tty)
+                        if (tty)
-                                set_bit(TTY_IO_ERROR, &info->port.tty->flags);
+                                set_bit(TTY_IO_ERROR, &tty->flags);
                        return 0;
                } else
                        return -ENODEV;
@@ -991,14 +990,13 @@ static int mxser_startup(struct mxser_port *info)
        (void) inb(info->ioaddr + UART_IIR);
        (void) inb(info->ioaddr + UART_MSR);
-        if (info->port.tty)
+        clear_bit(TTY_IO_ERROR, &tty->flags);
-                clear_bit(TTY_IO_ERROR, &info->port.tty->flags);
        info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
        /*
         * and set the speed of the serial port
         */
-        mxser_change_speed(info, NULL);
+        mxser_change_speed(tty, NULL);
        info->port.flags |= ASYNC_INITIALIZED;
        spin_unlock_irqrestore(&info->slock, flags);
@@ -1009,8 +1007,9 @@ static int mxser_startup(struct mxser_port *info)
 * This routine will shutdown a serial port; interrupts maybe disabled, and
 * DTR is dropped if the hangup on close termio flag is on.
 */
-static void mxser_shutdown(struct mxser_port *info)
+static void mxser_shutdown(struct tty_struct *tty)
 {
+        struct mxser_port *info = tty->driver_data;
        unsigned long flags;
        if (!(info->port.flags & ASYNC_INITIALIZED))
@@ -1035,7 +1034,7 @@ static void mxser_shutdown(struct mxser_port *info)
        info->IER = 0;
        outb(0x00, info->ioaddr + UART_IER);
-        if (!info->port.tty || (info->port.tty->termios->c_cflag & HUPCL))
+        if (tty->termios->c_cflag & HUPCL)
                info->MCR &= ~(UART_MCR_DTR | UART_MCR_RTS);
        outb(info->MCR, info->ioaddr + UART_MCR);
@@ -1051,8 +1050,7 @@ static void mxser_shutdown(struct mxser_port *info)
        /* read data port to reset things */
        (void) inb(info->ioaddr + UART_RX);
-        if (info->port.tty)
+        set_bit(TTY_IO_ERROR, &tty->flags);
-                set_bit(TTY_IO_ERROR, &info->port.tty->flags);
        info->port.flags &= ~ASYNC_INITIALIZED;
@@ -1084,14 +1082,14 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
                return -ENODEV;
        tty->driver_data = info;
-        info->port.tty = tty;
+        tty_port_tty_set(&info->port, tty);
        /*
         * Start up serial port
         */
        spin_lock_irqsave(&info->slock, flags);
        info->port.count++;
        spin_unlock_irqrestore(&info->slock, flags);
-        retval = mxser_startup(info);
+        retval = mxser_startup(tty);
        if (retval)
                return retval;
@@ -1209,13 +1207,13 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
                                break;
                }
        }
-        mxser_shutdown(info);
+        mxser_shutdown(tty);
        mxser_flush_buffer(tty);
        tty_ldisc_flush(tty);
        tty->closing = 0;
-        info->port.tty = NULL;
+        tty_port_tty_set(&info->port, NULL);
        if (info->port.blocked_open) {
                if (info->port.close_delay)
                        schedule_timeout_interruptible(info->port.close_delay);
@@ -1337,12 +1335,13 @@ static int mxser_chars_in_buffer(struct tty_struct *tty)
 * friends of mxser_ioctl()
 * ------------------------------------------------------------
 */
-static int mxser_get_serial_info(struct mxser_port *info,
+static int mxser_get_serial_info(struct tty_struct *tty,
                struct serial_struct __user *retinfo)
 {
+        struct mxser_port *info = tty->driver_data;
        struct serial_struct tmp = {
                .type = info->type,
-                .line = info->port.tty->index,
+                .line = tty->index,
                .port = info->ioaddr,
                .irq = info->board->irq,
                .flags = info->port.flags,
@@ -1357,9 +1356,10 @@ static int mxser_get_serial_info(struct mxser_port *info,
        return 0;
 }
-static int mxser_set_serial_info(struct mxser_port *info,
+static int mxser_set_serial_info(struct tty_struct *tty,
                struct serial_struct __user *new_info)
 {
+        struct mxser_port *info = tty->driver_data;
        struct serial_struct new_serial;
        speed_t baud;
        unsigned long sl_flags;
@@ -1393,14 +1393,14 @@ static int mxser_set_serial_info(struct mxser_port *info,
                                (new_serial.flags & ASYNC_FLAGS));
                info->port.close_delay = new_serial.close_delay * HZ / 100;
                info->port.closing_wait = new_serial.closing_wait * HZ / 100;
-                info->port.tty->low_latency =
+                tty->low_latency = (info->port.flags & ASYNC_LOW_LATENCY)
-                                (info->port.flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+                                                                ? 1 : 0;
                if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_CUST &&
                                (new_serial.baud_base != info->baud_base ||
                                new_serial.custom_divisor !=
                                info->custom_divisor)) {
                        baud = new_serial.baud_base / new_serial.custom_divisor;
-                        tty_encode_baud_rate(info->port.tty, baud, baud);
+                        tty_encode_baud_rate(tty, baud, baud);
                }
        }
@@ -1411,11 +1411,11 @@ static int mxser_set_serial_info(struct mxser_port *info,
        if (info->port.flags & ASYNC_INITIALIZED) {
                if (flags != (info->port.flags & ASYNC_SPD_MASK)) {
                        spin_lock_irqsave(&info->slock, sl_flags);
-                        mxser_change_speed(info, NULL);
+                        mxser_change_speed(tty, NULL);
                        spin_unlock_irqrestore(&info->slock, sl_flags);
                }
        } else
-                retval = mxser_startup(info);
+                retval = mxser_startup(tty);
        return retval;
 }
@@ -1461,7 +1461,7 @@ static int mxser_tiocmget(struct tty_struct *tty, struct file *file)
        spin_lock_irqsave(&info->slock, flags);
        status = inb(info->ioaddr + UART_MSR);
        if (status & UART_MSR_ANY_DELTA)
-                mxser_check_modem_status(info, status);
+                mxser_check_modem_status(tty, info, status);
        spin_unlock_irqrestore(&info->slock, flags);
        return ((control & UART_MCR_RTS) ? TIOCM_RTS : 0) |
                    ((control & UART_MCR_DTR) ? TIOCM_DTR : 0) |
@@ -1606,6 +1606,7 @@ static int __init mxser_read_register(int port, unsigned short *regs)
 static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 {
        struct mxser_port *port;
+        struct tty_struct *tty;
        int result, status;
        unsigned int i, j;
        int ret = 0;
@@ -1643,12 +1644,14 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
                                if (!port->ioaddr)
                                        goto copy;
+                                
+                                tty = tty_port_tty_get(&port->port);
-                                if (!port->port.tty || !port->port.tty->termios)
+                                if (!tty || !tty->termios)
                                        ms.cflag = port->normal_termios.c_cflag;
                                else
-                                        ms.cflag = port->port.tty->termios->c_cflag;
+                                        ms.cflag = tty->termios->c_cflag;
+                                tty_kref_put(tty);
                                status = inb(port->ioaddr + UART_MSR);
                                if (status & UART_MSR_DCD)
                                        ms.dcd = 1;
@@ -1704,15 +1707,18 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
                                me->up_txcnt[p] = port->mon_data.up_txcnt;
                                me->modem_status[p] =
                                        port->mon_data.modem_status;
-                                me->baudrate[p] = tty_get_baud_rate(port->port.tty);
+                                tty = tty_port_tty_get(&port->port);
-                                if (!port->port.tty || !port->port.tty->termios) {
+                                if (!tty || !tty->termios) {
                                        cflag = port->normal_termios.c_cflag;
                                        iflag = port->normal_termios.c_iflag;
+                                        me->baudrate[p] = tty_termios_baud_rate(&port->normal_termios);
                                } else {
-                                        cflag = port->port.tty->termios->c_cflag;
+                                        cflag = tty->termios->c_cflag;
-                                        iflag = port->port.tty->termios->c_iflag;
+                                        iflag = tty->termios->c_iflag;
+                                        me->baudrate[p] = tty_get_baud_rate(tty);
                                }
+                                tty_kref_put(tty);
                                me->databits[p] = cflag & CSIZE;
                                me->stopbits[p] = cflag & CSTOPB;
@@ -1822,12 +1828,12 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
        switch (cmd) {
        case TIOCGSERIAL:
                lock_kernel();
-                retval = mxser_get_serial_info(info, argp);
+                retval = mxser_get_serial_info(tty, argp);
                unlock_kernel();
                return retval;
        case TIOCSSERIAL:
                lock_kernel();
-                retval = mxser_set_serial_info(info, argp);
+                retval = mxser_set_serial_info(tty, argp);
                unlock_kernel();
                return retval;
        case TIOCSERGETLSR:     /* Get line status register */
@@ -1896,7 +1902,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                lock_kernel();
                status = mxser_get_msr(info->ioaddr, 1, tty->index);
-                mxser_check_modem_status(info, status);
+                mxser_check_modem_status(tty, info, status);
                mcr = inb(info->ioaddr + UART_MCR);
                if (mcr & MOXA_MUST_MCR_XON_FLAG)
@@ -1909,7 +1915,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                else
                        info->mon_data.hold_reason |= NPPI_NOTIFY_XOFFXENT;
-                if (info->port.tty->hw_stopped)
+                if (tty->hw_stopped)
                        info->mon_data.hold_reason |= NPPI_NOTIFY_CTSHOLD;
                else
                        info->mon_data.hold_reason &= ~NPPI_NOTIFY_CTSHOLD;
@@ -1958,7 +1964,7 @@ static void mxser_stoprx(struct tty_struct *tty)
                }
        }
-        if (info->port.tty->termios->c_cflag & CRTSCTS) {
+        if (tty->termios->c_cflag & CRTSCTS) {
                info->MCR &= ~UART_MCR_RTS;
                outb(info->MCR, info->ioaddr + UART_MCR);
        }
@@ -1995,7 +2001,7 @@ static void mxser_unthrottle(struct tty_struct *tty)
                }
        }
-        if (info->port.tty->termios->c_cflag & CRTSCTS) {
+        if (tty->termios->c_cflag & CRTSCTS) {
                info->MCR |= UART_MCR_RTS;
                outb(info->MCR, info->ioaddr + UART_MCR);
        }
@@ -2040,7 +2046,7 @@ static void mxser_set_termios(struct tty_struct *tty, struct ktermios *old_termi
        unsigned long flags;
        spin_lock_irqsave(&info->slock, flags);
-        mxser_change_speed(info, old_termios);
+        mxser_change_speed(tty, old_termios);
        spin_unlock_irqrestore(&info->slock, flags);
        if ((old_termios->c_cflag & CRTSCTS) &&
@@ -2138,10 +2144,10 @@ static void mxser_hangup(struct tty_struct *tty)
        struct mxser_port *info = tty->driver_data;
        mxser_flush_buffer(tty);
-        mxser_shutdown(info);
+        mxser_shutdown(tty);
        info->port.count = 0;
        info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
-        info->port.tty = NULL;
+        tty_port_tty_set(&info->port, NULL);
        wake_up_interruptible(&info->port.open_wait);
 }
@@ -2164,9 +2170,9 @@ static int mxser_rs_break(struct tty_struct *tty, int break_state)
        return 0;
 }
-static void mxser_receive_chars(struct mxser_port *port, int *status)
+static void mxser_receive_chars(struct tty_struct *tty,
+                                struct mxser_port *port, int *status)
 {
-        struct tty_struct *tty = port->port.tty;
        unsigned char ch, gdl;
        int ignored = 0;
        int cnt = 0;
@@ -2174,9 +2180,8 @@ static void mxser_receive_chars(struct mxser_port *port, int *status)
        int max = 256;
        recv_room = tty->receive_room;
-        if ((recv_room == 0) && (!port->ldisc_stop_rx))
+        if (recv_room == 0 && !port->ldisc_stop_rx)
                mxser_stoprx(tty);
        if (port->board->chip_flag != MOXA_OTHER_UART) {
                if (*status & UART_LSR_SPECIAL)
@@ -2253,7 +2258,7 @@ intr_old:
        } while (*status & UART_LSR_DR);
 end_intr:
-        mxvar_log.rxcnt[port->port.tty->index] += cnt;
+        mxvar_log.rxcnt[tty->index] += cnt;
        port->mon_data.rxcnt += cnt;
        port->mon_data.up_rxcnt += cnt;
@@ -2267,14 +2272,14 @@ end_intr:
        spin_lock(&port->slock);
 }
-static void mxser_transmit_chars(struct mxser_port *port)
+static void mxser_transmit_chars(struct tty_struct *tty, struct mxser_port *port)
 {
        int count, cnt;
        if (port->x_char) {
                outb(port->x_char, port->ioaddr + UART_TX);
                port->x_char = 0;
-                mxvar_log.txcnt[port->port.tty->index]++;
+                mxvar_log.txcnt[tty->index]++;
                port->mon_data.txcnt++;
                port->mon_data.up_txcnt++;
                port->icount.tx++;
@@ -2284,8 +2289,8 @@ static void mxser_transmit_chars(struct mxser_port *port)
        if (port->port.xmit_buf == NULL)
                return;
-        if ((port->xmit_cnt <= 0) || port->port.tty->stopped ||
+        if (port->xmit_cnt <= 0 || tty->stopped ||
-                        (port->port.tty->hw_stopped &&
+                        (tty->hw_stopped &&
                        (port->type != PORT_16550A) &&
                        (!port->board->chip_flag))) {
                port->IER &= ~UART_IER_THRI;
@@ -2302,14 +2307,14 @@ static void mxser_transmit_chars(struct mxser_port *port)
                if (--port->xmit_cnt <= 0)
                        break;
        } while (--count > 0);
-        mxvar_log.txcnt[port->port.tty->index] += (cnt - port->xmit_cnt);
+        mxvar_log.txcnt[tty->index] += (cnt - port->xmit_cnt);
        port->mon_data.txcnt += (cnt - port->xmit_cnt);
        port->mon_data.up_txcnt += (cnt - port->xmit_cnt);
        port->icount.tx += (cnt - port->xmit_cnt);
-        if (port->xmit_cnt < WAKEUP_CHARS)
+        if (port->xmit_cnt < WAKEUP_CHARS && tty)
-                tty_wakeup(port->port.tty);
+                tty_wakeup(tty);
        if (port->xmit_cnt <= 0) {
                port->IER &= ~UART_IER_THRI;
@@ -2328,6 +2333,7 @@ static irqreturn_t mxser_interrupt(int irq, void *dev_id)
        int max, irqbits, bits, msr;
        unsigned int int_cnt, pass_counter = 0;
        int handled = IRQ_NONE;
+        struct tty_struct *tty;
        for (i = 0; i < MXSER_BOARDS; i++)
                if (dev_id == &mxser_boards[i]) {
@@ -2360,13 +2366,15 @@ static irqreturn_t mxser_interrupt(int irq, void *dev_id)
                                if (iir & UART_IIR_NO_INT)
                                        break;
                                iir &= MOXA_MUST_IIR_MASK;
-                                if (!port->port.tty ||
+                                tty = tty_port_tty_get(&port->port);
+                                if (!tty ||
                                                (port->port.flags & ASYNC_CLOSING) ||
                                                !(port->port.flags &
                                                        ASYNC_INITIALIZED)) {
                                        status = inb(port->ioaddr + UART_LSR);
                                        outb(0x27, port->ioaddr + UART_FCR);
                                        inb(port->ioaddr + UART_MSR);
+                                        tty_kref_put(tty);
                                        break;
                                }
@@ -2387,27 +2395,28 @@ static irqreturn_t mxser_interrupt(int irq, void *dev_id)
                                            iir == MOXA_MUST_IIR_RDA ||
                                            iir == MOXA_MUST_IIR_RTO ||
                                            iir == MOXA_MUST_IIR_LSR)
-                                                mxser_receive_chars(port,
+                                                mxser_receive_chars(tty, port,
                                                                &status);
                                } else {
                                        status &= port->read_status_mask;
                                        if (status & UART_LSR_DR)
-                                                mxser_receive_chars(port,
+                                                mxser_receive_chars(tty, port,
                                                                &status);
                                }
                                msr = inb(port->ioaddr + UART_MSR);
                                if (msr & UART_MSR_ANY_DELTA)
-                                        mxser_check_modem_status(port, msr);
+                                        mxser_check_modem_status(tty, port, msr);
                                if (port->board->chip_flag) {
                                        if (iir == 0x02 && (status &
                                                                UART_LSR_THRE))
-                                                mxser_transmit_chars(port);
+                                                mxser_transmit_chars(tty, port);
                                } else {
                                        if (status & UART_LSR_THRE)
-                                                mxser_transmit_chars(port);
+                                                mxser_transmit_chars(tty, port);
                                }
+                                tty_kref_put(tty);
                        } while (int_cnt++ < MXSER_ISR_PASS_LIMIT);
                        spin_unlock(&port->slock);
                }
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index 69ec6399c714..bacb3e2872ae 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -764,7 +764,7 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                break;
        default:
-                error = n_tty_ioctl (tty, file, cmd, arg);
+                error = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
        }
        return error;
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index ae377aa473ba..4a8215a89ad3 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -372,14 +372,8 @@ static void remove_from_rx_queue(struct r3964_info *pInfo,
 static void put_char(struct r3964_info *pInfo, unsigned char ch)
 {
        struct tty_struct *tty = pInfo->tty;
-        if (tty == NULL)
-                return;
        /* FIXME: put_char should not be called from an IRQ */
-        if (tty->ops->put_char) {
+        tty_put_char(tty, ch);
-                tty->ops->put_char(tty, ch);
-        }
        pInfo->bcc ^= ch;
 }
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 708c2b1dbe51..efbfe9612658 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -26,7 +26,7 @@
 *
 * 2002/03/18   Implemented n_tty_wakeup to send SIGIO POLL_OUTs to
 *              waiting writing processes-Sapan Bhatia <sapan@corewars.org>.
- *              Also fixed a bug in BLOCKING mode where write_chan returns
+ *              Also fixed a bug in BLOCKING mode where n_tty_write returns
 *              EAGAIN
 */
@@ -99,6 +99,7 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
 static void n_tty_set_room(struct tty_struct *tty)
 {
+        /* tty->read_cnt is not read locked ? */
        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
        /*
@@ -121,6 +122,16 @@ static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
        }
 }
+/**
+ *      put_tty_queue           -       add character to tty
+ *      @c: character
+ *      @tty: tty device
+ *
+ *      Add a character to the tty read_buf queue. This is done under the
+ *      read_lock to serialize character addition and also to protect us
+ *      against parallel reads or flushes
+ */
 static void put_tty_queue(unsigned char c, struct tty_struct *tty)
 {
        unsigned long flags;
@@ -137,14 +148,11 @@ static void put_tty_queue(unsigned char c, struct tty_struct *tty)
 *      check_unthrottle        -       allow new receive data
 *      @tty; tty device
 *
- *      Check whether to call the driver.unthrottle function.
+ *      Check whether to call the driver unthrottle functions
- *      We test the TTY_THROTTLED bit first so that it always
+ *
- *      indicates the current state. The decision about whether
- *      it is worth allowing more input has been taken by the caller.
 *      Can sleep, may be called under the atomic_read_lock mutex but
 *      this is not guaranteed.
 */
 static void check_unthrottle(struct tty_struct *tty)
 {
        if (tty->count)
@@ -158,6 +166,8 @@ static void check_unthrottle(struct tty_struct *tty)
 *      Reset the read buffer counters, clear the flags,
 *      and make sure the driver is unthrottled. Called
 *      from n_tty_open() and n_tty_flush_buffer().
+ *
+ *      Locking: tty_read_lock for read fields.
 */
 static void reset_buffer_flags(struct tty_struct *tty)
 {
@@ -181,7 +191,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
 *      at hangup) or when the N_TTY line discipline internally has to
 *      clean the pending queue (for example some signals).
 *
- *      Locking: ctrl_lock
+ *      Locking: ctrl_lock, read_lock.
 */
 static void n_tty_flush_buffer(struct tty_struct *tty)
@@ -207,6 +217,8 @@ static void n_tty_flush_buffer(struct tty_struct *tty)
 *
 *      Report the number of characters buffered to be delivered to user
 *      at this instant in time.
+ *
+ *      Locking: read_lock
 */
 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
@@ -346,7 +358,7 @@ static int opost(unsigned char c, struct tty_struct *tty)
 *      the simple cases normally found and helps to generate blocks of
 *      symbols for the console driver and thus improve performance.
 *
- *      Called from write_chan under the tty layer write lock. Relies
+ *      Called from n_tty_write under the tty layer write lock. Relies
 *      on lock_kernel for the tty->column state.
 */
@@ -410,6 +422,8 @@ break_out:
 *
 *      Echo user input back onto the screen. This must be called only when
 *      L_ECHO(tty) is true. Called from the driver receive_buf path.
+ *
+ *      Relies on BKL for tty column locking
 */
 static void echo_char(unsigned char c, struct tty_struct *tty)
@@ -422,6 +436,12 @@ static void echo_char(unsigned char c, struct tty_struct *tty)
                opost(c, tty);
 }
+/**
+ *      finsh_erasing           -       complete erase
+ *      @tty: tty doing the erase
+ *
+ *      Relies on BKL for tty column locking
+ */
 static inline void finish_erasing(struct tty_struct *tty)
 {
        if (tty->erasing) {
@@ -439,6 +459,8 @@ static inline void finish_erasing(struct tty_struct *tty)
 *      Perform erase and necessary output when an erase character is
 *      present in the stream from the driver layer. Handles the complexities
 *      of UTF-8 multibyte symbols.
+ *
+ *      Locking: read_lock for tty buffers, BKL for column/erasing state
 */
 static void eraser(unsigned char c, struct tty_struct *tty)
@@ -447,6 +469,7 @@ static void eraser(unsigned char c, struct tty_struct *tty)
        int head, seen_alnums, cnt;
        unsigned long flags;
+        /* FIXME: locking needed ? */
        if (tty->read_head == tty->canon_head) {
                /* opost('\a', tty); */         /* what do you think? */
                return;
@@ -481,6 +504,7 @@ static void eraser(unsigned char c, struct tty_struct *tty)
        }
        seen_alnums = 0;
+        /* FIXME: Locking ?? */
        while (tty->read_head != tty->canon_head) {
                head = tty->read_head;
@@ -583,6 +607,8 @@ static void eraser(unsigned char c, struct tty_struct *tty)
 *      may caus terminal flushing to take place according to the termios
 *      settings and character used. Called from the driver receive_buf
 *      path so serialized.
+ *
+ *      Locking: ctrl_lock, read_lock (both via flush buffer)
 */
 static inline void isig(int sig, struct tty_struct *tty, int flush)
@@ -1007,12 +1033,26 @@ int is_ignored(int sig)
 *      and is protected from re-entry by the tty layer. The user is
 *      guaranteed that this function will not be re-entered or in progress
 *      when the ldisc is closed.
+ *
+ *      Locking: Caller holds tty->termios_mutex
 */
 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 {
-        if (!tty)
+        int canon_change = 1;
-                return;
+        BUG_ON(!tty);
+        if (old)
+                canon_change = (old->c_lflag ^ tty->termios->c_lflag) & ICANON;
+        if (canon_change) {
+                memset(&tty->read_flags, 0, sizeof tty->read_flags);
+                tty->canon_head = tty->read_tail;
+                tty->canon_data = 0;
+                tty->erasing = 0;
+        }
+        if (canon_change && !L_ICANON(tty) && tty->read_cnt)
+                wake_up_interruptible(&tty->read_wait);
        tty->icanon = (L_ICANON(tty) != 0);
        if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
@@ -1143,7 +1183,7 @@ static inline int input_available_p(struct tty_struct *tty, int amt)
 *      @b: user data
 *      @nr: size of data
 *
- *      Helper function to speed up read_chan.  It is only called when
+ *      Helper function to speed up n_tty_read.  It is only called when
 *      ICANON is off; it copies characters straight from the tty queue to
 *      user space directly.  It can be profitably called twice; once to
 *      drain the space from the tail pointer to the (physical) end of the
@@ -1210,7 +1250,7 @@ static int job_control(struct tty_struct *tty, struct file *file)
        if (file->f_op->write != redirected_tty_write &&
            current->signal->tty == tty) {
                if (!tty->pgrp)
-                        printk(KERN_ERR "read_chan: no tty->pgrp!\n");
+                        printk(KERN_ERR "n_tty_read: no tty->pgrp!\n");
                else if (task_pgrp(current) != tty->pgrp) {
                        if (is_ignored(SIGTTIN) ||
                            is_current_pgrp_orphaned())
@@ -1225,7 +1265,7 @@ static int job_control(struct tty_struct *tty, struct file *file)
 /**
- *      read_chan               -       read function for tty
+ *      n_tty_read              -       read function for tty
 *      @tty: tty device
 *      @file: file object
 *      @buf: userspace buffer pointer
@@ -1239,7 +1279,7 @@ static int job_control(struct tty_struct *tty, struct file *file)
 *      This code must be sure never to sleep through a hangup.
 */
-static ssize_t read_chan(struct tty_struct *tty, struct file *file,
+static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                         unsigned char __user *buf, size_t nr)
 {
        unsigned char __user *b = buf;
@@ -1254,10 +1294,7 @@ static ssize_t read_chan(struct tty_struct *tty, struct file *file,
 do_it_again:
-        if (!tty->read_buf) {
+        BUG_ON(!tty->read_buf);
-                printk(KERN_ERR "n_tty_read_chan: read_buf == NULL?!?\n");
-                return -EIO;
-        }
        c = job_control(tty, file);
        if (c < 0)
@@ -1444,7 +1481,7 @@ do_it_again:
 }
 /**
- *      write_chan              -       write function for tty
+ *      n_tty_write             -       write function for tty
 *      @tty: tty device
 *      @file: file object
 *      @buf: userspace buffer pointer
@@ -1458,7 +1495,7 @@ do_it_again:
 *      This code must be sure never to sleep through a hangup.
 */
-static ssize_t write_chan(struct tty_struct *tty, struct file *file,
+static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
                          const unsigned char *buf, size_t nr)
 {
        const unsigned char *b = buf;
@@ -1532,7 +1569,7 @@ break_out:
 }
 /**
- *      normal_poll             -       poll method for N_TTY
+ *      n_tty_poll              -       poll method for N_TTY
 *      @tty: terminal device
 *      @file: file accessing it
 *      @wait: poll table
@@ -1545,7 +1582,7 @@ break_out:
 *      Called without the kernel lock held - fine
 */
-static unsigned int normal_poll(struct tty_struct *tty, struct file *file,
+static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
                                                        poll_table *wait)
 {
        unsigned int mask = 0;
@@ -1573,6 +1610,44 @@ static unsigned int normal_poll(struct tty_struct *tty, struct file *file,
        return mask;
 }
+static unsigned long inq_canon(struct tty_struct *tty)
+{
+        int nr, head, tail;
+        if (!tty->canon_data)
+                return 0;
+        head = tty->canon_head;
+        tail = tty->read_tail;
+        nr = (head - tail) & (N_TTY_BUF_SIZE-1);
+        /* Skip EOF-chars.. */
+        while (head != tail) {
+                if (test_bit(tail, tty->read_flags) &&
+                    tty->read_buf[tail] == __DISABLED_CHAR)
+                        nr--;
+                tail = (tail+1) & (N_TTY_BUF_SIZE-1);
+        }
+        return nr;
+}
+static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
+                       unsigned int cmd, unsigned long arg)
+{
+        int retval;
+        switch (cmd) {
+        case TIOCOUTQ:
+                return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
+        case TIOCINQ:
+                /* FIXME: Locking */
+                retval = tty->read_cnt;
+                if (L_ICANON(tty))
+                        retval = inq_canon(tty);
+                return put_user(retval, (unsigned int __user *) arg);
+        default:
+                return n_tty_ioctl_helper(tty, file, cmd, arg);
+        }
+}
 struct tty_ldisc_ops tty_ldisc_N_TTY = {
        .magic           = TTY_LDISC_MAGIC,
        .name            = "n_tty",
@@ -1580,11 +1655,11 @@ struct tty_ldisc_ops tty_ldisc_N_TTY = {
        .close           = n_tty_close,
        .flush_buffer    = n_tty_flush_buffer,
        .chars_in_buffer = n_tty_chars_in_buffer,
-        .read            = read_chan,
+        .read            = n_tty_read,
-        .write           = write_chan,
+        .write           = n_tty_write,
        .ioctl           = n_tty_ioctl,
        .set_termios     = n_tty_set_termios,
-        .poll            = normal_poll,
+        .poll            = n_tty_poll,
        .receive_buf     = n_tty_receive_buf,
        .write_wakeup    = n_tty_write_wakeup
 };
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index 66a0f931c66c..9a34a1935283 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -1599,7 +1599,10 @@ static int ntty_open(struct tty_struct *tty, struct file *file)
        return 0;
 }
-/* Called when the userspace process close the tty, /dev/noz*. */
+/* Called when the userspace process close the tty, /dev/noz*. Also
+   called immediately if ntty_open fails in which case tty->driver_data
+   will be NULL an we exit by the first return */
 static void ntty_close(struct tty_struct *tty, struct file *file)
 {
        struct nozomi *dc = get_dc_by_tty(tty);
diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
index 3a23e7694d55..569f2f7743a7 100644
--- a/drivers/char/pcmcia/ipwireless/tty.c
+++ b/drivers/char/pcmcia/ipwireless/tty.c
@@ -276,6 +276,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
        struct ipw_tty *tty = linux_tty->driver_data;
        int room;
+        /* FIXME: Exactly how is the tty object locked here .. */
        if (!tty)
                return -ENODEV;
@@ -397,6 +398,7 @@ static int set_control_lines(struct ipw_tty *tty, unsigned int set,
 static int ipw_tiocmget(struct tty_struct *linux_tty, struct file *file)
 {
        struct ipw_tty *tty = linux_tty->driver_data;
+        /* FIXME: Exactly how is the tty object locked here .. */
        if (!tty)
                return -ENODEV;
@@ -412,6 +414,7 @@ ipw_tiocmset(struct tty_struct *linux_tty, struct file *file,
             unsigned int set, unsigned int clear)
 {
        struct ipw_tty *tty = linux_tty->driver_data;
+        /* FIXME: Exactly how is the tty object locked here .. */
        if (!tty)
                return -ENODEV;
@@ -433,6 +436,8 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
        if (!tty->open_count)
                return -EINVAL;
+        /* FIXME: Exactly how is the tty object locked here .. */
        switch (cmd) {
        case TIOCGSERIAL:
                return ipwireless_get_serial_info(tty, (void __user *) arg);
@@ -467,13 +472,6 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
                        }
                        return 0;
-                case TCGETS:
-                case TCGETA:
-                        return n_tty_ioctl(linux_tty, file, cmd, arg);
-                case TCFLSH:
-                        return n_tty_ioctl(linux_tty, file, cmd, arg);
                case FIONREAD:
                        {
                                int val = 0;
@@ -482,10 +480,11 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
                                        return -EFAULT;
                        }
                        return 0;
+                case TCFLSH:
+                        return tty_perform_flush(linux_tty, arg);
                }
        }
+        return tty_mode_ioctl(linux_tty, file, cmd , arg);
-        return -ENOIOCTLCMD;
 }
 static int add_tty(dev_node_t *nodesp, int j,
@@ -588,6 +587,8 @@ void ipwireless_tty_free(struct ipw_tty *tty)
                                tty_hangup(ttyj->linux_tty);
                                /* Wait till the tty_hangup has completed */
                                flush_scheduled_work();
+                                /* FIXME: Exactly how is the tty object locked here
+                                   against a parallel ioctl etc */
                                mutex_lock(&ttyj->ipw_tty_mutex);
                        }
                        while (ttyj->open_count)
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 76b27932d229..6d4582712b1f 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -8,10 +8,12 @@
 *  Added TTY_DO_WRITE_WAKEUP to enable n_tty to send POLL_OUT to
 *      waiting writers -- Sapan Bhatia <sapan@corewars.org>
 *
- *
+ *  When reading this code see also fs/devpts. In particular note that the
+ *  driver_data field is used by the devpts side as a binding to the devpts
+ *  inode.
 */
-#include <linux/module.h>       /* For EXPORT_SYMBOL */
+#include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/interrupt.h>
@@ -23,26 +25,25 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
+#include <linux/device.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
-#include <asm/system.h>
 #include <linux/bitops.h>
 #include <linux/devpts_fs.h>
+#include <asm/system.h>
 /* These are global because they are accessed in tty_io.c */
 #ifdef CONFIG_UNIX98_PTYS
 struct tty_driver *ptm_driver;
 static struct tty_driver *pts_driver;
 #endif
-static void pty_close(struct tty_struct * tty, struct file * filp)
+static void pty_close(struct tty_struct *tty, struct file *filp)
 {
-        if (!tty)
+        BUG_ON(!tty);
-                return;
+        if (tty->driver->subtype == PTY_TYPE_MASTER)
-        if (tty->driver->subtype == PTY_TYPE_MASTER) {
+                WARN_ON(tty->count > 1);
-                if (tty->count > 1)
+        else {
-                        printk("master pty_close: count = %d!!\n", tty->count);
-        } else {
                if (tty->count > 2)
                        return;
        }
@@ -59,7 +60,7 @@ static void pty_close(struct tty_struct * tty, struct file * filp)
                set_bit(TTY_OTHER_CLOSED, &tty->flags);
 #ifdef CONFIG_UNIX98_PTYS
                if (tty->driver == ptm_driver)
-                        devpts_pty_kill(tty->index);
+                        devpts_pty_kill(tty->link);
 #endif
                tty_vhangup(tty->link);
        }
@@ -69,13 +70,13 @@ static void pty_close(struct tty_struct * tty, struct file * filp)
 * The unthrottle routine is called by the line discipline to signal
 * that it can receive more characters.  For PTY's, the TTY_THROTTLED
 * flag is always set, to force the line discipline to always call the
- * unthrottle routine when there are fewer than TTY_THRESHOLD_UNTHROTTLE 
+ * unthrottle routine when there are fewer than TTY_THRESHOLD_UNTHROTTLE
 * characters in the queue.  This is necessary since each time this
 * happens, we need to wake up any sleeping processes that could be
 * (1) trying to send data to the pty, or (2) waiting in wait_until_sent()
 * for the pty buffer to be drained.
 */
-static void pty_unthrottle(struct tty_struct * tty)
+static void pty_unthrottle(struct tty_struct *tty)
 {
        struct tty_struct *o_tty = tty->link;
@@ -87,7 +88,7 @@ static void pty_unthrottle(struct tty_struct * tty)
 }
 /*
- * WSH 05/24/97: modified to 
+ * WSH 05/24/97: modified to
 *   (1) use space in tty->flip instead of a shared temp buffer
 *       The flip buffers aren't being used for a pty, so there's lots
 *       of space available.  The buffer is protected by a per-pty
@@ -100,7 +101,8 @@ static void pty_unthrottle(struct tty_struct * tty)
 * not our partners. We can't just take the other one blindly without
 * risking deadlocks.
 */
-static int pty_write(struct tty_struct * tty, const unsigned char *buf, int count)
+static int pty_write(struct tty_struct *tty, const unsigned char *buf,
+                                                                int count)
 {
        struct tty_struct *to = tty->link;
        int     c;
@@ -112,7 +114,7 @@ static int pty_write(struct tty_struct * tty, const unsigned char *buf, int coun
        if (c > count)
                c = count;
        to->ldisc.ops->receive_buf(to, buf, NULL, c);
-        
        return c;
 }
@@ -128,17 +130,17 @@ static int pty_write_room(struct tty_struct *tty)
 /*
 *      WSH 05/24/97:  Modified for asymmetric MASTER/SLAVE behavior
- *      The chars_in_buffer() value is used by the ldisc select() function 
+ *      The chars_in_buffer() value is used by the ldisc select() function
 *      to hold off writing when chars_in_buffer > WAKEUP_CHARS (== 256).
 *      The pty driver chars_in_buffer() Master/Slave must behave differently:
 *
 *      The Master side needs to allow typed-ahead commands to accumulate
 *      while being canonicalized, so we report "our buffer" as empty until
 *      some threshold is reached, and then report the count. (Any count >
- *      WAKEUP_CHARS is regarded by select() as "full".)  To avoid deadlock 
+ *      WAKEUP_CHARS is regarded by select() as "full".)  To avoid deadlock
- *      the count returned must be 0 if no canonical data is available to be 
+ *      the count returned must be 0 if no canonical data is available to be
 *      read. (The N_TTY ldisc.chars_in_buffer now knows this.)
- *  
+ *
 *      The Slave side passes all characters in raw mode to the Master side's
 *      buffer where they can be read immediately, so in this case we can
 *      return the true count in the buffer.
@@ -155,21 +157,22 @@ static int pty_chars_in_buffer(struct tty_struct *tty)
        /* The ldisc must report 0 if no characters available to be read */
        count = to->ldisc.ops->chars_in_buffer(to);
-        if (tty->driver->subtype == PTY_TYPE_SLAVE) return count;
+        if (tty->driver->subtype == PTY_TYPE_SLAVE)
+                return count;
-        /* Master side driver ... if the other side's read buffer is less than 
+        /* Master side driver ... if the other side's read buffer is less than
         * half full, return 0 to allow writers to proceed; otherwise return
-         * the count.  This leaves a comfortable margin to avoid overflow, 
+         * the count.  This leaves a comfortable margin to avoid overflow,
         * and still allows half a buffer's worth of typed-ahead commands.
         */
-        return ((count < N_TTY_BUF_SIZE/2) ? 0 : count);
+        return (count < N_TTY_BUF_SIZE/2) ? 0 : count;
 }
 /* Set the lock flag on a pty */
-static int pty_set_lock(struct tty_struct *tty, int __user * arg)
+static int pty_set_lock(struct tty_struct *tty, int __user *arg)
 {
        int val;
-        if (get_user(val,arg))
+        if (get_user(val, arg))
                return -EFAULT;
        if (val)
                set_bit(TTY_PTY_LOCK, &tty->flags);
@@ -182,13 +185,13 @@ static void pty_flush_buffer(struct tty_struct *tty)
 {
        struct tty_struct *to = tty->link;
        unsigned long flags;
-        
        if (!to)
                return;
-        
        if (to->ldisc.ops->flush_buffer)
                to->ldisc.ops->flush_buffer(to);
-        
        if (to->packet) {
                spin_lock_irqsave(&tty->ctrl_lock, flags);
                tty->ctrl_status |= TIOCPKT_FLUSHWRITE;
@@ -197,7 +200,7 @@ static void pty_flush_buffer(struct tty_struct *tty)
        }
 }
-static int pty_open(struct tty_struct *tty, struct file * filp)
+static int pty_open(struct tty_struct *tty, struct file *filp)
 {
        int     retval = -ENODEV;
@@ -220,13 +223,65 @@ out:
        return retval;
 }
-static void pty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+static void pty_set_termios(struct tty_struct *tty,
+                                        struct ktermios *old_termios)
+{
+        tty->termios->c_cflag &= ~(CSIZE | PARENB);
+        tty->termios->c_cflag |= (CS8 | CREAD);
+}
+static int pty_install(struct tty_driver *driver, struct tty_struct *tty)
 {
-        tty->termios->c_cflag &= ~(CSIZE | PARENB);
+        struct tty_struct *o_tty;
-        tty->termios->c_cflag |= (CS8 | CREAD);
+        int idx = tty->index;
+        int retval;
+        o_tty = alloc_tty_struct();
+        if (!o_tty)
+                return -ENOMEM;
+        if (!try_module_get(driver->other->owner)) {
+                /* This cannot in fact currently happen */
+                free_tty_struct(o_tty);
+                return -ENOMEM;
+        }
+        initialize_tty_struct(o_tty, driver->other, idx);
+        /* We always use new tty termios data so we can do this
+           the easy way .. */
+        retval = tty_init_termios(tty);
+        if (retval)
+                goto free_mem_out;
+        retval = tty_init_termios(o_tty);
+        if (retval) {
+                tty_free_termios(tty);
+                goto free_mem_out;
+        }
+        /*
+         * Everything allocated ... set up the o_tty structure.
+         */
+        driver->other->ttys[idx] = o_tty;
+        tty_driver_kref_get(driver->other);
+        if (driver->subtype == PTY_TYPE_MASTER)
+                o_tty->count++;
+        /* Establish the links in both directions */
+        tty->link   = o_tty;
+        o_tty->link = tty;
+        tty_driver_kref_get(driver);
+        tty->count++;
+        driver->ttys[idx] = tty;
+        return 0;
+free_mem_out:
+        module_put(o_tty->driver->owner);
+        free_tty_struct(o_tty);
+        return -ENOMEM;
 }
 static const struct tty_operations pty_ops = {
+        .install = pty_install,
        .open = pty_open,
        .close = pty_close,
        .write = pty_write,
@@ -329,8 +384,11 @@ static inline void legacy_pty_init(void) { }
 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly.
 */
 int pty_limit = NR_UNIX98_PTY_DEFAULT;
-static int pty_limit_min = 0;
+static int pty_limit_min;
 static int pty_limit_max = NR_UNIX98_PTY_MAX;
+static int pty_count;
+static struct cdev ptmx_cdev;
 static struct ctl_table pty_table[] = {
        {
@@ -348,6 +406,7 @@ static struct ctl_table pty_table[] = {
                .procname       = "nr",
                .maxlen         = sizeof(int),
                .mode           = 0444,
+                .data           = &pty_count,
                .proc_handler   = &proc_dointvec,
        }, {
                .ctl_name       = 0
@@ -388,7 +447,127 @@ static int pty_unix98_ioctl(struct tty_struct *tty, struct file *file,
        return -ENOIOCTLCMD;
 }
+/**
+ *      ptm_unix98_lookup       -       find a pty master
+ *      @driver: ptm driver
+ *      @idx: tty index
+ *
+ *      Look up a pty master device. Called under the tty_mutex for now.
+ *      This provides our locking.
+ */
+static struct tty_struct *ptm_unix98_lookup(struct tty_driver *driver,
+                struct inode *ptm_inode, int idx)
+{
+        struct tty_struct *tty = devpts_get_tty(ptm_inode, idx);
+        if (tty)
+                tty = tty->link;
+        return tty;
+}
+/**
+ *      pts_unix98_lookup       -       find a pty slave
+ *      @driver: pts driver
+ *      @idx: tty index
+ *
+ *      Look up a pty master device. Called under the tty_mutex for now.
+ *      This provides our locking.
+ */
+static struct tty_struct *pts_unix98_lookup(struct tty_driver *driver,
+                struct inode *pts_inode, int idx)
+{
+        struct tty_struct *tty = devpts_get_tty(pts_inode, idx);
+        /* Master must be open before slave */
+        if (!tty)
+                return ERR_PTR(-EIO);
+        return tty;
+}
+static void pty_unix98_shutdown(struct tty_struct *tty)
+{
+        /* We have our own method as we don't use the tty index */
+        kfree(tty->termios);
+}
+/* We have no need to install and remove our tty objects as devpts does all
+   the work for us */
+static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
+{
+        struct tty_struct *o_tty;
+        int idx = tty->index;
+        o_tty = alloc_tty_struct();
+        if (!o_tty)
+                return -ENOMEM;
+        if (!try_module_get(driver->other->owner)) {
+                /* This cannot in fact currently happen */
+                free_tty_struct(o_tty);
+                return -ENOMEM;
+        }
+        initialize_tty_struct(o_tty, driver->other, idx);
+        tty->termios = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
+        if (tty->termios == NULL)
+                goto free_mem_out;
+        *tty->termios = driver->init_termios;
+        tty->termios_locked = tty->termios + 1;
+        o_tty->termios = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
+        if (o_tty->termios == NULL)
+                goto free_mem_out;
+        *o_tty->termios = driver->other->init_termios;
+        o_tty->termios_locked = o_tty->termios + 1;
+        tty_driver_kref_get(driver->other);
+        if (driver->subtype == PTY_TYPE_MASTER)
+                o_tty->count++;
+        /* Establish the links in both directions */
+        tty->link   = o_tty;
+        o_tty->link = tty;
+        /*
+         * All structures have been allocated, so now we install them.
+         * Failures after this point use release_tty to clean up, so
+         * there's no need to null out the local pointers.
+         */
+        tty_driver_kref_get(driver);
+        tty->count++;
+        pty_count++;
+        return 0;
+free_mem_out:
+        kfree(o_tty->termios);
+        module_put(o_tty->driver->owner);
+        free_tty_struct(o_tty);
+        kfree(tty->termios);
+        return -ENOMEM;
+}
+static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
+{
+        pty_count--;
+}
+static const struct tty_operations ptm_unix98_ops = {
+        .lookup = ptm_unix98_lookup,
+        .install = pty_unix98_install,
+        .remove = pty_unix98_remove,
+        .open = pty_open,
+        .close = pty_close,
+        .write = pty_write,
+        .write_room = pty_write_room,
+        .flush_buffer = pty_flush_buffer,
+        .chars_in_buffer = pty_chars_in_buffer,
+        .unthrottle = pty_unthrottle,
+        .set_termios = pty_set_termios,
+        .ioctl = pty_unix98_ioctl,
+        .shutdown = pty_unix98_shutdown
+};
 static const struct tty_operations pty_unix98_ops = {
+        .lookup = pts_unix98_lookup,
+        .install = pty_unix98_install,
+        .remove = pty_unix98_remove,
        .open = pty_open,
        .close = pty_close,
        .write = pty_write,
@@ -397,9 +576,73 @@ static const struct tty_operations pty_unix98_ops = {
        .chars_in_buffer = pty_chars_in_buffer,
        .unthrottle = pty_unthrottle,
        .set_termios = pty_set_termios,
-        .ioctl = pty_unix98_ioctl
+        .shutdown = pty_unix98_shutdown
 };
+/**
+ *      ptmx_open               -       open a unix 98 pty master
+ *      @inode: inode of device file
+ *      @filp: file pointer to tty
+ *
+ *      Allocate a unix98 pty master device from the ptmx driver.
+ *
+ *      Locking: tty_mutex protects the init_dev work. tty->count should
+ *              protect the rest.
+ *              allocated_ptys_lock handles the list of free pty numbers
+ */
+static int __ptmx_open(struct inode *inode, struct file *filp)
+{
+        struct tty_struct *tty;
+        int retval;
+        int index;
+        nonseekable_open(inode, filp);
+        /* find a device that is not in use. */
+        index = devpts_new_index(inode);
+        if (index < 0)
+                return index;
+        mutex_lock(&tty_mutex);
+        tty = tty_init_dev(ptm_driver, index, 1);
+        mutex_unlock(&tty_mutex);
+        if (IS_ERR(tty)) {
+                retval = PTR_ERR(tty);
+                goto out;
+        }
+        set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
+        filp->private_data = tty;
+        file_move(filp, &tty->tty_files);
+        retval = devpts_pty_new(inode, tty->link);
+        if (retval)
+                goto out1;
+        retval = ptm_driver->ops->open(tty, filp);
+        if (!retval)
+                return 0;
+out1:
+        tty_release_dev(filp);
+        return retval;
+out:
+        devpts_kill_index(inode, index);
+        return retval;
+}
+static int ptmx_open(struct inode *inode, struct file *filp)
+{
+        int ret;
+        lock_kernel();
+        ret = __ptmx_open(inode, filp);
+        unlock_kernel();
+        return ret;
+}
+static struct file_operations ptmx_fops;
 static void __init unix98_pty_init(void)
 {
@@ -427,7 +670,7 @@ static void __init unix98_pty_init(void)
        ptm_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW |
                TTY_DRIVER_DYNAMIC_DEV | TTY_DRIVER_DEVPTS_MEM;
        ptm_driver->other = pts_driver;
-        tty_set_operations(ptm_driver, &pty_unix98_ops);
+        tty_set_operations(ptm_driver, &ptm_unix98_ops);
        pts_driver->owner = THIS_MODULE;
        pts_driver->driver_name = "pty_slave";
@@ -443,16 +686,26 @@ static void __init unix98_pty_init(void)
        pts_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW |
                TTY_DRIVER_DYNAMIC_DEV | TTY_DRIVER_DEVPTS_MEM;
        pts_driver->other = ptm_driver;
-        tty_set_operations(pts_driver, &pty_ops);
+        tty_set_operations(pts_driver, &pty_unix98_ops);
-        
        if (tty_register_driver(ptm_driver))
                panic("Couldn't register Unix98 ptm driver");
        if (tty_register_driver(pts_driver))
                panic("Couldn't register Unix98 pts driver");
-        pty_table[1].data = &ptm_driver->refcount;
        register_sysctl_table(pty_root_table);
+        /* Now create the /dev/ptmx special device */
+        tty_default_fops(&ptmx_fops);
+        ptmx_fops.open = ptmx_open;
+        cdev_init(&ptmx_cdev, &ptmx_fops);
+        if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
+            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
+                panic("Couldn't register /dev/ptmx driver\n");
+        device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
 }
 #else
 static inline void unix98_pty_init(void) { }
 #endif
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 19db1eb87c26..8b8f07a7f505 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -405,9 +405,9 @@ static unsigned int	stl_baudrates[] = {
 static int      stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg);
 static int      stl_brdinit(struct stlbrd *brdp);
-static int      stl_getportstats(struct stlport *portp, comstats_t __user *cp);
+static int      stl_getportstats(struct tty_struct *tty, struct stlport *portp, comstats_t __user *cp);
 static int      stl_clrportstats(struct stlport *portp, comstats_t __user *cp);
-static int      stl_waitcarrier(struct stlport *portp, struct file *filp);
+static int      stl_waitcarrier(struct tty_struct *tty, struct stlport *portp, struct file *filp);
 /*
 *      CD1400 uart specific handling functions.
@@ -612,8 +612,9 @@ static struct class *stallion_class;
 static void stl_cd_change(struct stlport *portp)
 {
        unsigned int oldsigs = portp->sigs;
+        struct tty_struct *tty = tty_port_tty_get(&portp->port);
-        if (!portp->port.tty)
+        if (!tty)
                return;
        portp->sigs = stl_getsignals(portp);
@@ -623,7 +624,8 @@ static void stl_cd_change(struct stlport *portp)
        if ((oldsigs & TIOCM_CD) && ((portp->sigs & TIOCM_CD) == 0))
                if (portp->port.flags & ASYNC_CHECK_CD)
-                        tty_hangup(portp->port.tty);
+                        tty_hangup(tty);
+        tty_kref_put(tty);
 }
 /*
@@ -734,7 +736,7 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 *      On the first open of the device setup the port hardware, and
 *      initialize the per port data structure.
 */
-        portp->port.tty = tty;
+        tty_port_tty_set(&portp->port, tty);
        tty->driver_data = portp;
        portp->port.count++;
@@ -774,7 +776,7 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 *      then also we might have to wait for carrier.
 */
        if (!(filp->f_flags & O_NONBLOCK))
-                if ((rc = stl_waitcarrier(portp, filp)) != 0)
+                if ((rc = stl_waitcarrier(tty, portp, filp)) != 0)
                        return rc;
        portp->port.flags |= ASYNC_NORMAL_ACTIVE;
@@ -789,7 +791,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 *      maybe because if we are clocal then we don't need to wait...
 */
-static int stl_waitcarrier(struct stlport *portp, struct file *filp)
+static int stl_waitcarrier(struct tty_struct *tty, struct stlport *portp,
+                                                        struct file *filp)
 {
        unsigned long   flags;
        int             rc, doclocal;
@@ -801,7 +804,7 @@ static int stl_waitcarrier(struct stlport *portp, struct file *filp)
        spin_lock_irqsave(&stallion_lock, flags);
-        if (portp->port.tty->termios->c_cflag & CLOCAL)
+        if (tty->termios->c_cflag & CLOCAL)
                doclocal++;
        portp->openwaitcnt++;
@@ -846,8 +849,6 @@ static void stl_flushbuffer(struct tty_struct *tty)
        pr_debug("stl_flushbuffer(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -865,8 +866,6 @@ static void stl_waituntilsent(struct tty_struct *tty, int timeout)
        pr_debug("stl_waituntilsent(tty=%p,timeout=%d)\n", tty, timeout);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -949,7 +948,7 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
        tty_ldisc_flush(tty);
        tty->closing = 0;
-        portp->port.tty = NULL;
+        tty_port_tty_set(&portp->port, NULL);
        if (portp->openwaitcnt) {
                if (portp->close_delay)
@@ -1033,8 +1032,6 @@ static int stl_putchar(struct tty_struct *tty, unsigned char ch)
        pr_debug("stl_putchar(tty=%p,ch=%x)\n", tty, ch);
-        if (tty == NULL)
-                return -EINVAL;
        portp = tty->driver_data;
        if (portp == NULL)
                return -EINVAL;
@@ -1070,8 +1067,6 @@ static void stl_flushchars(struct tty_struct *tty)
        pr_debug("stl_flushchars(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1090,8 +1085,6 @@ static int stl_writeroom(struct tty_struct *tty)
        pr_debug("stl_writeroom(tty=%p)\n", tty);
-        if (tty == NULL)
-                return 0;
        portp = tty->driver_data;
        if (portp == NULL)
                return 0;
@@ -1122,8 +1115,6 @@ static int stl_charsinbuffer(struct tty_struct *tty)
        pr_debug("stl_charsinbuffer(tty=%p)\n", tty);
-        if (tty == NULL)
-                return 0;
        portp = tty->driver_data;
        if (portp == NULL)
                return 0;
@@ -1183,8 +1174,9 @@ static int stl_getserial(struct stlport *portp, struct serial_struct __user *sp)
 *      just quietly ignore any requests to change irq, etc.
 */
-static int stl_setserial(struct stlport *portp, struct serial_struct __user *sp)
+static int stl_setserial(struct tty_struct *tty, struct serial_struct __user *sp)
 {
+        struct stlport *        portp = tty->driver_data;
        struct serial_struct    sio;
        pr_debug("stl_setserial(portp=%p,sp=%p)\n", portp, sp);
@@ -1205,7 +1197,7 @@ static int stl_setserial(struct stlport *portp, struct serial_struct __user *sp)
        portp->close_delay = sio.close_delay;
        portp->closing_wait = sio.closing_wait;
        portp->custom_divisor = sio.custom_divisor;
-        stl_setport(portp, portp->port.tty->termios);
+        stl_setport(portp, tty->termios);
        return 0;
 }
@@ -1215,8 +1207,6 @@ static int stl_tiocmget(struct tty_struct *tty, struct file *file)
 {
        struct stlport  *portp;
-        if (tty == NULL)
-                return -ENODEV;
        portp = tty->driver_data;
        if (portp == NULL)
                return -ENODEV;
@@ -1232,8 +1222,6 @@ static int stl_tiocmset(struct tty_struct *tty, struct file *file,
        struct stlport  *portp;
        int rts = -1, dtr = -1;
-        if (tty == NULL)
-                return -ENODEV;
        portp = tty->driver_data;
        if (portp == NULL)
                return -ENODEV;
@@ -1262,8 +1250,6 @@ static int stl_ioctl(struct tty_struct *tty, struct file *file, unsigned int cmd
        pr_debug("stl_ioctl(tty=%p,file=%p,cmd=%x,arg=%lx)\n", tty, file, cmd,
                        arg);
-        if (tty == NULL)
-                return -ENODEV;
        portp = tty->driver_data;
        if (portp == NULL)
                return -ENODEV;
@@ -1282,10 +1268,10 @@ static int stl_ioctl(struct tty_struct *tty, struct file *file, unsigned int cmd
                rc = stl_getserial(portp, argp);
                break;
        case TIOCSSERIAL:
-                rc = stl_setserial(portp, argp);
+                rc = stl_setserial(tty, argp);
                break;
        case COM_GETPORTSTATS:
-                rc = stl_getportstats(portp, argp);
+                rc = stl_getportstats(tty, portp, argp);
                break;
        case COM_CLRPORTSTATS:
                rc = stl_clrportstats(portp, argp);
@@ -1317,8 +1303,6 @@ static void stl_start(struct tty_struct *tty)
        pr_debug("stl_start(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1334,8 +1318,6 @@ static void stl_settermios(struct tty_struct *tty, struct ktermios *old)
        pr_debug("stl_settermios(tty=%p,old=%p)\n", tty, old);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1369,8 +1351,6 @@ static void stl_throttle(struct tty_struct *tty)
        pr_debug("stl_throttle(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1389,8 +1369,6 @@ static void stl_unthrottle(struct tty_struct *tty)
        pr_debug("stl_unthrottle(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1410,8 +1388,6 @@ static void stl_stop(struct tty_struct *tty)
        pr_debug("stl_stop(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1432,8 +1408,6 @@ static void stl_hangup(struct tty_struct *tty)
        pr_debug("stl_hangup(tty=%p)\n", tty);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1452,7 +1426,7 @@ static void stl_hangup(struct tty_struct *tty)
                portp->tx.head = NULL;
                portp->tx.tail = NULL;
        }
-        portp->port.tty = NULL;
+        tty_port_tty_set(&portp->port, NULL);
        portp->port.flags &= ~ASYNC_NORMAL_ACTIVE;
        portp->port.count = 0;
        wake_up_interruptible(&portp->port.open_wait);
@@ -1466,8 +1440,6 @@ static int stl_breakctl(struct tty_struct *tty, int state)
        pr_debug("stl_breakctl(tty=%p,state=%d)\n", tty, state);
-        if (tty == NULL)
-                return -EINVAL;
        portp = tty->driver_data;
        if (portp == NULL)
                return -EINVAL;
@@ -1484,8 +1456,6 @@ static void stl_sendxchar(struct tty_struct *tty, char ch)
        pr_debug("stl_sendxchar(tty=%p,ch=%x)\n", tty, ch);
-        if (tty == NULL)
-                return;
        portp = tty->driver_data;
        if (portp == NULL)
                return;
@@ -1805,7 +1775,7 @@ static int __devinit stl_initports(struct stlbrd *brdp, struct stlpanel *panelp)
                                "(size=%Zd)\n", sizeof(struct stlport));
                        break;
                }
+                tty_port_init(&portp->port);
                portp->magic = STL_PORTMAGIC;
                portp->portnr = i;
                portp->brdnr = panelp->brdnr;
@@ -1832,6 +1802,7 @@ static void stl_cleanup_panels(struct stlbrd *brdp)
        struct stlpanel *panelp;
        struct stlport *portp;
        unsigned int j, k;
+        struct tty_struct *tty;
        for (j = 0; j < STL_MAXPANELS; j++) {
                panelp = brdp->panels[j];
@@ -1841,8 +1812,11 @@ static void stl_cleanup_panels(struct stlbrd *brdp)
                        portp = panelp->ports[k];
                        if (portp == NULL)
                                continue;
-                        if (portp->port.tty != NULL)
+                        tty = tty_port_tty_get(&portp->port);
-                                stl_hangup(portp->port.tty);
+                        if (tty != NULL) {
+                                stl_hangup(tty);
+                                tty_kref_put(tty);
+                        }
                        kfree(portp->tx.buf);
                        kfree(portp);
                }
@@ -2498,7 +2472,7 @@ static struct stlport *stl_getport(int brdnr, int panelnr, int portnr)
 *      what port to get stats for (used through board control device).
 */
-static int stl_getportstats(struct stlport *portp, comstats_t __user *cp)
+static int stl_getportstats(struct tty_struct *tty, struct stlport *portp, comstats_t __user *cp)
 {
        comstats_t      stl_comstats;
        unsigned char   *head, *tail;
@@ -2525,18 +2499,17 @@ static int stl_getportstats(struct stlport *portp, comstats_t __user *cp)
        portp->stats.rxbuffered = 0;
        spin_lock_irqsave(&stallion_lock, flags);
-        if (portp->port.tty != NULL)
+        if (tty != NULL && portp->port.tty == tty) {
-                if (portp->port.tty->driver_data == portp) {
+                portp->stats.ttystate = tty->flags;
-                        portp->stats.ttystate = portp->port.tty->flags;
+                /* No longer available as a statistic */
-                        /* No longer available as a statistic */
+                portp->stats.rxbuffered = 1; /*tty->flip.count; */
-                        portp->stats.rxbuffered = 1; /*portp->port.tty->flip.count; */
+                if (tty->termios != NULL) {
-                        if (portp->port.tty->termios != NULL) {
+                        portp->stats.cflags = tty->termios->c_cflag;
-                                portp->stats.cflags = portp->port.tty->termios->c_cflag;
+                        portp->stats.iflags = tty->termios->c_iflag;
-                                portp->stats.iflags = portp->port.tty->termios->c_iflag;
+                        portp->stats.oflags = tty->termios->c_oflag;
-                                portp->stats.oflags = portp->port.tty->termios->c_oflag;
+                        portp->stats.lflags = tty->termios->c_lflag;
-                                portp->stats.lflags = portp->port.tty->termios->c_lflag;
-                        }
                }
+        }
        spin_unlock_irqrestore(&stallion_lock, flags);
        head = portp->tx.head;
@@ -2640,7 +2613,7 @@ static int stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, uns
        switch (cmd) {
        case COM_GETPORTSTATS:
-                rc = stl_getportstats(NULL, argp);
+                rc = stl_getportstats(NULL, NULL, argp);
                break;
        case COM_CLRPORTSTATS:
                rc = stl_clrportstats(NULL, argp);
@@ -3243,7 +3216,7 @@ static void stl_cd1400flowctrl(struct stlport *portp, int state)
        if (portp == NULL)
                return;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if (tty == NULL)
                return;
@@ -3288,6 +3261,7 @@ static void stl_cd1400flowctrl(struct stlport *portp, int state)
        BRDDISABLE(portp->brdnr);
        spin_unlock_irqrestore(&brd_lock, flags);
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -3305,7 +3279,7 @@ static void stl_cd1400sendflow(struct stlport *portp, int state)
        if (portp == NULL)
                return;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if (tty == NULL)
                return;
@@ -3325,6 +3299,7 @@ static void stl_cd1400sendflow(struct stlport *portp, int state)
        }
        BRDDISABLE(portp->brdnr);
        spin_unlock_irqrestore(&brd_lock, flags);
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -3478,6 +3453,7 @@ static void stl_cd1400txisr(struct stlpanel *panelp, int ioaddr)
        int             len, stlen;
        char            *head, *tail;
        unsigned char   ioack, srer;
+        struct tty_struct *tty;
        pr_debug("stl_cd1400txisr(panelp=%p,ioaddr=%x)\n", panelp, ioaddr);
@@ -3504,8 +3480,11 @@ static void stl_cd1400txisr(struct stlpanel *panelp, int ioaddr)
        if ((len == 0) || ((len < STL_TXBUFLOW) &&
            (test_bit(ASYI_TXLOW, &portp->istate) == 0))) {
                set_bit(ASYI_TXLOW, &portp->istate);
-                if (portp->port.tty)
+                tty = tty_port_tty_get(&portp->port);
-                        tty_wakeup(portp->port.tty);
+                if (tty) {
+                        tty_wakeup(tty);
+                        tty_kref_put(tty);
+                }
        }
        if (len == 0) {
@@ -3569,7 +3548,7 @@ static void stl_cd1400rxisr(struct stlpanel *panelp, int ioaddr)
                return;
        }
        portp = panelp->ports[(ioack >> 3)];
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if ((ioack & ACK_TYPMASK) == ACK_TYPRXGOOD) {
                outb((RDCR + portp->uartaddr), ioaddr);
@@ -3633,10 +3612,12 @@ static void stl_cd1400rxisr(struct stlpanel *panelp, int ioaddr)
                }
        } else {
                printk("STALLION: bad RX interrupt ack value=%x\n", ioack);
+                tty_kref_put(tty);
                return;
        }
 stl_rxalldone:
+        tty_kref_put(tty);
        outb((EOSRR + portp->uartaddr), ioaddr);
        outb(0, (ioaddr + EREG_DATA));
 }
@@ -4175,7 +4156,7 @@ static void stl_sc26198flowctrl(struct stlport *portp, int state)
        if (portp == NULL)
                return;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if (tty == NULL)
                return;
@@ -4226,6 +4207,7 @@ static void stl_sc26198flowctrl(struct stlport *portp, int state)
        BRDDISABLE(portp->brdnr);
        spin_unlock_irqrestore(&brd_lock, flags);
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -4244,7 +4226,7 @@ static void stl_sc26198sendflow(struct stlport *portp, int state)
        if (portp == NULL)
                return;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        if (tty == NULL)
                return;
@@ -4269,6 +4251,7 @@ static void stl_sc26198sendflow(struct stlport *portp, int state)
        }
        BRDDISABLE(portp->brdnr);
        spin_unlock_irqrestore(&brd_lock, flags);
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -4408,6 +4391,7 @@ static void stl_sc26198intr(struct stlpanel *panelp, unsigned int iobase)
 static void stl_sc26198txisr(struct stlport *portp)
 {
+        struct tty_struct *tty;
        unsigned int    ioaddr;
        unsigned char   mr0;
        int             len, stlen;
@@ -4422,8 +4406,11 @@ static void stl_sc26198txisr(struct stlport *portp)
        if ((len == 0) || ((len < STL_TXBUFLOW) &&
            (test_bit(ASYI_TXLOW, &portp->istate) == 0))) {
                set_bit(ASYI_TXLOW, &portp->istate);
-                if (portp->port.tty)
+                tty = tty_port_tty_get(&portp->port);
-                        tty_wakeup(portp->port.tty);
+                if (tty) {
+                        tty_wakeup(tty);
+                        tty_kref_put(tty);
+                }
        }
        if (len == 0) {
@@ -4476,7 +4463,7 @@ static void stl_sc26198rxisr(struct stlport *portp, unsigned int iack)
        pr_debug("stl_sc26198rxisr(portp=%p,iack=%x)\n", portp, iack);
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        ioaddr = portp->ioaddr;
        outb(GIBCR, (ioaddr + XP_ADDR));
        len = inb(ioaddr + XP_DATA) + 1;
@@ -4515,6 +4502,7 @@ static void stl_sc26198rxisr(struct stlport *portp, unsigned int iack)
                        stl_sc26198txunflow(portp, tty);
                }
        }
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
@@ -4528,7 +4516,7 @@ static void stl_sc26198rxbadch(struct stlport *portp, unsigned char status, char
        struct tty_struct       *tty;
        unsigned int            ioaddr;
-        tty = portp->port.tty;
+        tty = tty_port_tty_get(&portp->port);
        ioaddr = portp->ioaddr;
        if (status & SR_RXPARITY)
@@ -4566,6 +4554,7 @@ static void stl_sc26198rxbadch(struct stlport *portp, unsigned char status, char
                if (status == 0)
                        portp->stats.rxtotal++;
        }
+        tty_kref_put(tty);
 }
 /*****************************************************************************/
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index c385206f9db5..5b8d7a1aa3e6 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2504,7 +2504,7 @@ static void __devexit sx_remove_card(struct sx_board *board,
                del_timer(&board->timer);
                if (pdev) {
 #ifdef CONFIG_PCI
-                        pci_iounmap(pdev, board->base);
+                        pci_iounmap(pdev, board->base2);
                        pci_release_region(pdev, IS_CF_BOARD(board) ? 3 : 2);
 #endif
                } else {
@@ -2703,7 +2703,7 @@ static int __devinit sx_pci_probe(struct pci_dev *pdev,
        return 0;
 err_unmap:
-        pci_iounmap(pdev, board->base);
+        pci_iounmap(pdev, board->base2);
 err_reg:
        pci_release_region(pdev, reg);
 err_flag:
diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
index 3582f43345a8..5787249934c8 100644
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@ -93,7 +93,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
                get_task_comm(name, tsk);
                audit_log_untrustedstring(ab, name);
                audit_log_format(ab, " data=");
-                audit_log_n_untrustedstring(ab, buf->data, buf->valid);
+                audit_log_n_hex(ab, buf->data, buf->valid);
                audit_log_end(ab);
        }
        buf->valid = 0;
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
new file mode 100644
index 000000000000..810ee25d66a4
--- /dev/null
+++ b/drivers/char/tty_buffer.c
@@ -0,0 +1,511 @@
+/*
+ * Tty buffer allocation management
+ */
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+/**
+ *      tty_buffer_free_all             -       free buffers used by a tty
+ *      @tty: tty to free from
+ *
+ *      Remove all the buffers pending on a tty whether queued with data
+ *      or in the free ring. Must be called when the tty is no longer in use
+ *
+ *      Locking: none
+ */
+void tty_buffer_free_all(struct tty_struct *tty)
+{
+        struct tty_buffer *thead;
+        while ((thead = tty->buf.head) != NULL) {
+                tty->buf.head = thead->next;
+                kfree(thead);
+        }
+        while ((thead = tty->buf.free) != NULL) {
+                tty->buf.free = thead->next;
+                kfree(thead);
+        }
+        tty->buf.tail = NULL;
+        tty->buf.memory_used = 0;
+}
+/**
+ *      tty_buffer_alloc        -       allocate a tty buffer
+ *      @tty: tty device
+ *      @size: desired size (characters)
+ *
+ *      Allocate a new tty buffer to hold the desired number of characters.
+ *      Return NULL if out of memory or the allocation would exceed the
+ *      per device queue
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer *p;
+        if (tty->buf.memory_used + size > 65536)
+                return NULL;
+        p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
+        if (p == NULL)
+                return NULL;
+        p->used = 0;
+        p->size = size;
+        p->next = NULL;
+        p->commit = 0;
+        p->read = 0;
+        p->char_buf_ptr = (char *)(p->data);
+        p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
+        tty->buf.memory_used += size;
+        return p;
+}
+/**
+ *      tty_buffer_free         -       free a tty buffer
+ *      @tty: tty owning the buffer
+ *      @b: the buffer to free
+ *
+ *      Free a tty buffer, or add it to the free list according to our
+ *      internal strategy
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
+{
+        /* Dumb strategy for now - should keep some stats */
+        tty->buf.memory_used -= b->size;
+        WARN_ON(tty->buf.memory_used < 0);
+        if (b->size >= 512)
+                kfree(b);
+        else {
+                b->next = tty->buf.free;
+                tty->buf.free = b;
+        }
+}
+/**
+ *      __tty_buffer_flush              -       flush full tty buffers
+ *      @tty: tty to flush
+ *
+ *      flush all the buffers containing receive data. Caller must
+ *      hold the buffer lock and must have ensured no parallel flush to
+ *      ldisc is running.
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+static void __tty_buffer_flush(struct tty_struct *tty)
+{
+        struct tty_buffer *thead;
+        while ((thead = tty->buf.head) != NULL) {
+                tty->buf.head = thead->next;
+                tty_buffer_free(tty, thead);
+        }
+        tty->buf.tail = NULL;
+}
+/**
+ *      tty_buffer_flush                -       flush full tty buffers
+ *      @tty: tty to flush
+ *
+ *      flush all the buffers containing receive data. If the buffer is
+ *      being processed by flush_to_ldisc then we defer the processing
+ *      to that function
+ *
+ *      Locking: none
+ */
+void tty_buffer_flush(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        /* If the data is being pushed to the tty layer then we can't
+           process it here. Instead set a flag and the flush_to_ldisc
+           path will process the flush request before it exits */
+        if (test_bit(TTY_FLUSHING, &tty->flags)) {
+                set_bit(TTY_FLUSHPENDING, &tty->flags);
+                spin_unlock_irqrestore(&tty->buf.lock, flags);
+                wait_event(tty->read_wait,
+                                test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
+                return;
+        } else
+                __tty_buffer_flush(tty);
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+}
+/**
+ *      tty_buffer_find         -       find a free tty buffer
+ *      @tty: tty owning the buffer
+ *      @size: characters wanted
+ *
+ *      Locate an existing suitable tty buffer or if we are lacking one then
+ *      allocate a new one. We round our buffers off in 256 character chunks
+ *      to get better allocation behaviour.
+ *
+ *      Locking: Caller must hold tty->buf.lock
+ */
+static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer **tbh = &tty->buf.free;
+        while ((*tbh) != NULL) {
+                struct tty_buffer *t = *tbh;
+                if (t->size >= size) {
+                        *tbh = t->next;
+                        t->next = NULL;
+                        t->used = 0;
+                        t->commit = 0;
+                        t->read = 0;
+                        tty->buf.memory_used += t->size;
+                        return t;
+                }
+                tbh = &((*tbh)->next);
+        }
+        /* Round the buffer size out */
+        size = (size + 0xFF) & ~0xFF;
+        return tty_buffer_alloc(tty, size);
+        /* Should possibly check if this fails for the largest buffer we
+           have queued and recycle that ? */
+}
+/**
+ *      tty_buffer_request_room         -       grow tty buffer if needed
+ *      @tty: tty structure
+ *      @size: size desired
+ *
+ *      Make at least size bytes of linear space available for the tty
+ *      buffer. If we fail return the size we managed to find.
+ *
+ *      Locking: Takes tty->buf.lock
+ */
+int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer *b, *n;
+        int left;
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
+           remove this conditional if its worth it. This would be invisible
+           to the callers */
+        if ((b = tty->buf.tail) != NULL)
+                left = b->size - b->used;
+        else
+                left = 0;
+        if (left < size) {
+                /* This is the slow path - looking for new buffers to use */
+                if ((n = tty_buffer_find(tty, size)) != NULL) {
+                        if (b != NULL) {
+                                b->next = n;
+                                b->commit = b->used;
+                        } else
+                                tty->buf.head = n;
+                        tty->buf.tail = n;
+                } else
+                        size = left;
+        }
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        return size;
+}
+EXPORT_SYMBOL_GPL(tty_buffer_request_room);
+/**
+ *      tty_insert_flip_string  -       Add characters to the tty buffer
+ *      @tty: tty structure
+ *      @chars: characters
+ *      @size: size
+ *
+ *      Queue a series of bytes to the tty buffering. All the characters
+ *      passed are marked as without error. Returns the number added.
+ *
+ *      Locking: Called functions may take tty->buf.lock
+ */
+int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
+                                size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if (unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+                /* There is a small chance that we need to split the data over
+                   several buffers. If this is the case we must loop */
+        } while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL(tty_insert_flip_string);
+/**
+ *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
+ *      @tty: tty structure
+ *      @chars: characters
+ *      @flags: flag bytes
+ *      @size: size
+ *
+ *      Queue a series of bytes to the tty buffering. For each character
+ *      the flags array indicates the status of the character. Returns the
+ *      number added.
+ *
+ *      Locking: Called functions may take tty->buf.lock
+ */
+int tty_insert_flip_string_flags(struct tty_struct *tty,
+                const unsigned char *chars, const char *flags, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if (unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+                flags += space;
+                /* There is a small chance that we need to split the data over
+                   several buffers. If this is the case we must loop */
+        } while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL(tty_insert_flip_string_flags);
+/**
+ *      tty_schedule_flip       -       push characters to ldisc
+ *      @tty: tty to push from
+ *
+ *      Takes any pending buffers and transfers their ownership to the
+ *      ldisc side of the queue. It then schedules those characters for
+ *      processing by the line discipline.
+ *
+ *      Locking: Takes tty->buf.lock
+ */
+void tty_schedule_flip(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        if (tty->buf.tail != NULL)
+                tty->buf.tail->commit = tty->buf.tail->used;
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        schedule_delayed_work(&tty->buf.work, 1);
+}
+EXPORT_SYMBOL(tty_schedule_flip);
+/**
+ *      tty_prepare_flip_string         -       make room for characters
+ *      @tty: tty
+ *      @chars: return pointer for character write area
+ *      @size: desired size
+ *
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for normal characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ *
+ *      Locking: May call functions taking tty->buf.lock
+ */
+int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars,
+                                                                size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        if (likely(space)) {
+                struct tty_buffer *tb = tty->buf.tail;
+                *chars = tb->char_buf_ptr + tb->used;
+                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+                tb->used += space;
+        }
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
+/**
+ *      tty_prepare_flip_string_flags   -       make room for characters
+ *      @tty: tty
+ *      @chars: return pointer for character write area
+ *      @flags: return pointer for status flag write area
+ *      @size: desired size
+ *
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ *
+ *      Locking: May call functions taking tty->buf.lock
+ */
+int tty_prepare_flip_string_flags(struct tty_struct *tty,
+                        unsigned char **chars, char **flags, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        if (likely(space)) {
+                struct tty_buffer *tb = tty->buf.tail;
+                *chars = tb->char_buf_ptr + tb->used;
+                *flags = tb->flag_buf_ptr + tb->used;
+                tb->used += space;
+        }
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
+/**
+ *      flush_to_ldisc
+ *      @work: tty structure passed from work queue.
+ *
+ *      This routine is called out of the software interrupt to flush data
+ *      from the buffer chain to the line discipline.
+ *
+ *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
+ *      while invoking the line discipline receive_buf method. The
+ *      receive_buf method is single threaded for each tty instance.
+ */
+static void flush_to_ldisc(struct work_struct *work)
+{
+        struct tty_struct *tty =
+                container_of(work, struct tty_struct, buf.work.work);
+        unsigned long   flags;
+        struct tty_ldisc *disc;
+        struct tty_buffer *tbuf, *head;
+        char *char_buf;
+        unsigned char *flag_buf;
+        disc = tty_ldisc_ref(tty);
+        if (disc == NULL)       /*  !TTY_LDISC */
+                return;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        /* So we know a flush is running */
+        set_bit(TTY_FLUSHING, &tty->flags);
+        head = tty->buf.head;
+        if (head != NULL) {
+                tty->buf.head = NULL;
+                for (;;) {
+                        int count = head->commit - head->read;
+                        if (!count) {
+                                if (head->next == NULL)
+                                        break;
+                                tbuf = head;
+                                head = head->next;
+                                tty_buffer_free(tty, tbuf);
+                                continue;
+                        }
+                        /* Ldisc or user is trying to flush the buffers
+                           we are feeding to the ldisc, stop feeding the
+                           line discipline as we want to empty the queue */
+                        if (test_bit(TTY_FLUSHPENDING, &tty->flags))
+                                break;
+                        if (!tty->receive_room) {
+                                schedule_delayed_work(&tty->buf.work, 1);
+                                break;
+                        }
+                        if (count > tty->receive_room)
+                                count = tty->receive_room;
+                        char_buf = head->char_buf_ptr + head->read;
+                        flag_buf = head->flag_buf_ptr + head->read;
+                        head->read += count;
+                        spin_unlock_irqrestore(&tty->buf.lock, flags);
+                        disc->ops->receive_buf(tty, char_buf,
+                                                        flag_buf, count);
+                        spin_lock_irqsave(&tty->buf.lock, flags);
+                }
+                /* Restore the queue head */
+                tty->buf.head = head;
+        }
+        /* We may have a deferred request to flush the input buffer,
+           if so pull the chain under the lock and empty the queue */
+        if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
+                __tty_buffer_flush(tty);
+                clear_bit(TTY_FLUSHPENDING, &tty->flags);
+                wake_up(&tty->read_wait);
+        }
+        clear_bit(TTY_FLUSHING, &tty->flags);
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        tty_ldisc_deref(disc);
+}
+/**
+ *      tty_flip_buffer_push    -       terminal
+ *      @tty: tty to push
+ *
+ *      Queue a push of the terminal flip buffers to the line discipline. This
+ *      function must not be called from IRQ context if tty->low_latency is set.
+ *
+ *      In the event of the queue being busy for flipping the work will be
+ *      held off and retried later.
+ *
+ *      Locking: tty buffer lock. Driver locks in low latency mode.
+ */
+void tty_flip_buffer_push(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        if (tty->buf.tail != NULL)
+                tty->buf.tail->commit = tty->buf.tail->used;
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        if (tty->low_latency)
+                flush_to_ldisc(&tty->buf.work.work);
+        else
+                schedule_delayed_work(&tty->buf.work, 1);
+}
+EXPORT_SYMBOL(tty_flip_buffer_push);
+/**
+ *      tty_buffer_init         -       prepare a tty buffer structure
+ *      @tty: tty to initialise
+ *
+ *      Set up the initial state of the buffer management for a tty device.
+ *      Must be called before the other tty buffer functions are used.
+ *
+ *      Locking: none
+ */
+void tty_buffer_init(struct tty_struct *tty)
+{
+        spin_lock_init(&tty->buf.lock);
+        tty->buf.head = NULL;
+        tty->buf.tail = NULL;
+        tty->buf.free = NULL;
+        tty->buf.memory_used = 0;
+        INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
+}
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index e4dce8709541..7053d6333692 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -49,7 +49,7 @@
 * implement CONFIG_VT and generalize console device interface.
 *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
 *
- * Rewrote init_dev and release_dev to eliminate races.
+ * Rewrote tty_init_dev and tty_release_dev to eliminate races.
 *      -- Bill Hawes <whawes@star.net>, June 97
 *
 * Added devfs support.
@@ -136,13 +136,6 @@ LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
 DEFINE_MUTEX(tty_mutex);
 EXPORT_SYMBOL(tty_mutex);
-#ifdef CONFIG_UNIX98_PTYS
-extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
-static int ptmx_open(struct inode *, struct file *);
-#endif
-static void initialize_tty_struct(struct tty_struct *tty);
 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -171,13 +164,11 @@ static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
 *      Locking: none
 */
-static struct tty_struct *alloc_tty_struct(void)
+struct tty_struct *alloc_tty_struct(void)
 {
        return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
 }
-static void tty_buffer_free_all(struct tty_struct *);
 /**
 *      free_tty_struct         -       free a disused tty
 *      @tty: tty struct to free
@@ -187,7 +178,7 @@ static void tty_buffer_free_all(struct tty_struct *);
 *      Locking: none. Must be called after tty is definitely unused
 */
-static inline void free_tty_struct(struct tty_struct *tty)
+void free_tty_struct(struct tty_struct *tty)
 {
        kfree(tty->write_buf);
        tty_buffer_free_all(tty);
@@ -263,398 +254,6 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
        return 0;
 }
-/*
- * Tty buffer allocation management
- */
-/**
- *      tty_buffer_free_all             -       free buffers used by a tty
- *      @tty: tty to free from
- *
- *      Remove all the buffers pending on a tty whether queued with data
- *      or in the free ring. Must be called when the tty is no longer in use
- *
- *      Locking: none
- */
-static void tty_buffer_free_all(struct tty_struct *tty)
-{
-        struct tty_buffer *thead;
-        while ((thead = tty->buf.head) != NULL) {
-                tty->buf.head = thead->next;
-                kfree(thead);
-        }
-        while ((thead = tty->buf.free) != NULL) {
-                tty->buf.free = thead->next;
-                kfree(thead);
-        }
-        tty->buf.tail = NULL;
-        tty->buf.memory_used = 0;
-}
-/**
- *      tty_buffer_init         -       prepare a tty buffer structure
- *      @tty: tty to initialise
- *
- *      Set up the initial state of the buffer management for a tty device.
- *      Must be called before the other tty buffer functions are used.
- *
- *      Locking: none
- */
-static void tty_buffer_init(struct tty_struct *tty)
-{
-        spin_lock_init(&tty->buf.lock);
-        tty->buf.head = NULL;
-        tty->buf.tail = NULL;
-        tty->buf.free = NULL;
-        tty->buf.memory_used = 0;
-}
-/**
- *      tty_buffer_alloc        -       allocate a tty buffer
- *      @tty: tty device
- *      @size: desired size (characters)
- *
- *      Allocate a new tty buffer to hold the desired number of characters.
- *      Return NULL if out of memory or the allocation would exceed the
- *      per device queue
- *
- *      Locking: Caller must hold tty->buf.lock
- */
-static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
-{
-        struct tty_buffer *p;
-        if (tty->buf.memory_used + size > 65536)
-                return NULL;
-        p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
-        if (p == NULL)
-                return NULL;
-        p->used = 0;
-        p->size = size;
-        p->next = NULL;
-        p->commit = 0;
-        p->read = 0;
-        p->char_buf_ptr = (char *)(p->data);
-        p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
-        tty->buf.memory_used += size;
-        return p;
-}
-/**
- *      tty_buffer_free         -       free a tty buffer
- *      @tty: tty owning the buffer
- *      @b: the buffer to free
- *
- *      Free a tty buffer, or add it to the free list according to our
- *      internal strategy
- *
- *      Locking: Caller must hold tty->buf.lock
- */
-static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
-{
-        /* Dumb strategy for now - should keep some stats */
-        tty->buf.memory_used -= b->size;
-        WARN_ON(tty->buf.memory_used < 0);
-        if (b->size >= 512)
-                kfree(b);
-        else {
-                b->next = tty->buf.free;
-                tty->buf.free = b;
-        }
-}
-/**
- *      __tty_buffer_flush              -       flush full tty buffers
- *      @tty: tty to flush
- *
- *      flush all the buffers containing receive data. Caller must
- *      hold the buffer lock and must have ensured no parallel flush to
- *      ldisc is running.
- *
- *      Locking: Caller must hold tty->buf.lock
- */
-static void __tty_buffer_flush(struct tty_struct *tty)
-{
-        struct tty_buffer *thead;
-        while ((thead = tty->buf.head) != NULL) {
-                tty->buf.head = thead->next;
-                tty_buffer_free(tty, thead);
-        }
-        tty->buf.tail = NULL;
-}
-/**
- *      tty_buffer_flush                -       flush full tty buffers
- *      @tty: tty to flush
- *
- *      flush all the buffers containing receive data. If the buffer is
- *      being processed by flush_to_ldisc then we defer the processing
- *      to that function
- *
- *      Locking: none
- */
-static void tty_buffer_flush(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        /* If the data is being pushed to the tty layer then we can't
-           process it here. Instead set a flag and the flush_to_ldisc
-           path will process the flush request before it exits */
-        if (test_bit(TTY_FLUSHING, &tty->flags)) {
-                set_bit(TTY_FLUSHPENDING, &tty->flags);
-                spin_unlock_irqrestore(&tty->buf.lock, flags);
-                wait_event(tty->read_wait,
-                                test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
-                return;
-        } else
-                __tty_buffer_flush(tty);
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-}
-/**
- *      tty_buffer_find         -       find a free tty buffer
- *      @tty: tty owning the buffer
- *      @size: characters wanted
- *
- *      Locate an existing suitable tty buffer or if we are lacking one then
- *      allocate a new one. We round our buffers off in 256 character chunks
- *      to get better allocation behaviour.
- *
- *      Locking: Caller must hold tty->buf.lock
- */
-static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
-{
-        struct tty_buffer **tbh = &tty->buf.free;
-        while ((*tbh) != NULL) {
-                struct tty_buffer *t = *tbh;
-                if (t->size >= size) {
-                        *tbh = t->next;
-                        t->next = NULL;
-                        t->used = 0;
-                        t->commit = 0;
-                        t->read = 0;
-                        tty->buf.memory_used += t->size;
-                        return t;
-                }
-                tbh = &((*tbh)->next);
-        }
-        /* Round the buffer size out */
-        size = (size + 0xFF) & ~0xFF;
-        return tty_buffer_alloc(tty, size);
-        /* Should possibly check if this fails for the largest buffer we
-           have queued and recycle that ? */
-}
-/**
- *      tty_buffer_request_room         -       grow tty buffer if needed
- *      @tty: tty structure
- *      @size: size desired
- *
- *      Make at least size bytes of linear space available for the tty
- *      buffer. If we fail return the size we managed to find.
- *
- *      Locking: Takes tty->buf.lock
- */
-int tty_buffer_request_room(struct tty_struct *tty, size_t size)
-{
-        struct tty_buffer *b, *n;
-        int left;
-        unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
-           remove this conditional if its worth it. This would be invisible
-           to the callers */
-        if ((b = tty->buf.tail) != NULL)
-                left = b->size - b->used;
-        else
-                left = 0;
-        if (left < size) {
-                /* This is the slow path - looking for new buffers to use */
-                if ((n = tty_buffer_find(tty, size)) != NULL) {
-                        if (b != NULL) {
-                                b->next = n;
-                                b->commit = b->used;
-                        } else
-                                tty->buf.head = n;
-                        tty->buf.tail = n;
-                } else
-                        size = left;
-        }
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        return size;
-}
-EXPORT_SYMBOL_GPL(tty_buffer_request_room);
-/**
- *      tty_insert_flip_string  -       Add characters to the tty buffer
- *      @tty: tty structure
- *      @chars: characters
- *      @size: size
- *
- *      Queue a series of bytes to the tty buffering. All the characters
- *      passed are marked as without error. Returns the number added.
- *
- *      Locking: Called functions may take tty->buf.lock
- */
-int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
-                                size_t size)
-{
-        int copied = 0;
-        do {
-                int space = tty_buffer_request_room(tty, size - copied);
-                struct tty_buffer *tb = tty->buf.tail;
-                /* If there is no space then tb may be NULL */
-                if (unlikely(space == 0))
-                        break;
-                memcpy(tb->char_buf_ptr + tb->used, chars, space);
-                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
-                tb->used += space;
-                copied += space;
-                chars += space;
-                /* There is a small chance that we need to split the data over
-                   several buffers. If this is the case we must loop */
-        } while (unlikely(size > copied));
-        return copied;
-}
-EXPORT_SYMBOL(tty_insert_flip_string);
-/**
- *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
- *      @tty: tty structure
- *      @chars: characters
- *      @flags: flag bytes
- *      @size: size
- *
- *      Queue a series of bytes to the tty buffering. For each character
- *      the flags array indicates the status of the character. Returns the
- *      number added.
- *
- *      Locking: Called functions may take tty->buf.lock
- */
-int tty_insert_flip_string_flags(struct tty_struct *tty,
-                const unsigned char *chars, const char *flags, size_t size)
-{
-        int copied = 0;
-        do {
-                int space = tty_buffer_request_room(tty, size - copied);
-                struct tty_buffer *tb = tty->buf.tail;
-                /* If there is no space then tb may be NULL */
-                if (unlikely(space == 0))
-                        break;
-                memcpy(tb->char_buf_ptr + tb->used, chars, space);
-                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
-                tb->used += space;
-                copied += space;
-                chars += space;
-                flags += space;
-                /* There is a small chance that we need to split the data over
-                   several buffers. If this is the case we must loop */
-        } while (unlikely(size > copied));
-        return copied;
-}
-EXPORT_SYMBOL(tty_insert_flip_string_flags);
-/**
- *      tty_schedule_flip       -       push characters to ldisc
- *      @tty: tty to push from
- *
- *      Takes any pending buffers and transfers their ownership to the
- *      ldisc side of the queue. It then schedules those characters for
- *      processing by the line discipline.
- *
- *      Locking: Takes tty->buf.lock
- */
-void tty_schedule_flip(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
-                tty->buf.tail->commit = tty->buf.tail->used;
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        schedule_delayed_work(&tty->buf.work, 1);
-}
-EXPORT_SYMBOL(tty_schedule_flip);
-/**
- *      tty_prepare_flip_string         -       make room for characters
- *      @tty: tty
- *      @chars: return pointer for character write area
- *      @size: desired size
- *
- *      Prepare a block of space in the buffer for data. Returns the length
- *      available and buffer pointer to the space which is now allocated and
- *      accounted for as ready for normal characters. This is used for drivers
- *      that need their own block copy routines into the buffer. There is no
- *      guarantee the buffer is a DMA target!
- *
- *      Locking: May call functions taking tty->buf.lock
- */
-int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars,
-                                                                size_t size)
-{
-        int space = tty_buffer_request_room(tty, size);
-        if (likely(space)) {
-                struct tty_buffer *tb = tty->buf.tail;
-                *chars = tb->char_buf_ptr + tb->used;
-                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
-                tb->used += space;
-        }
-        return space;
-}
-EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
-/**
- *      tty_prepare_flip_string_flags   -       make room for characters
- *      @tty: tty
- *      @chars: return pointer for character write area
- *      @flags: return pointer for status flag write area
- *      @size: desired size
- *
- *      Prepare a block of space in the buffer for data. Returns the length
- *      available and buffer pointer to the space which is now allocated and
- *      accounted for as ready for characters. This is used for drivers
- *      that need their own block copy routines into the buffer. There is no
- *      guarantee the buffer is a DMA target!
- *
- *      Locking: May call functions taking tty->buf.lock
- */
-int tty_prepare_flip_string_flags(struct tty_struct *tty,
-                        unsigned char **chars, char **flags, size_t size)
-{
-        int space = tty_buffer_request_room(tty, size);
-        if (likely(space)) {
-                struct tty_buffer *tb = tty->buf.tail;
-                *chars = tb->char_buf_ptr + tb->used;
-                *flags = tb->flag_buf_ptr + tb->used;
-                tb->used += space;
-        }
-        return space;
-}
-EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
 /**
 *      get_tty_driver          -       find device of a tty
 *      @dev_t: device identifier
@@ -675,7 +274,7 @@ static struct tty_driver *get_tty_driver(dev_t device, int *index)
                if (device < base || device >= base + p->num)
                        continue;
                *index = device - base;
-                return p;
+                return tty_driver_kref_get(p);
        }
        return NULL;
 }
@@ -719,7 +318,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
                if (tty_line >= 0 && tty_line <= p->num && p->ops &&
                    p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {
-                        res = p;
+                        res = tty_driver_kref_get(p);
                        *line = tty_line;
                        break;
                }
@@ -819,20 +418,6 @@ static const struct file_operations tty_fops = {
        .fasync         = tty_fasync,
 };
-#ifdef CONFIG_UNIX98_PTYS
-static const struct file_operations ptmx_fops = {
-        .llseek         = no_llseek,
-        .read           = tty_read,
-        .write          = tty_write,
-        .poll           = tty_poll,
-        .unlocked_ioctl = tty_ioctl,
-        .compat_ioctl   = tty_compat_ioctl,
-        .open           = ptmx_open,
-        .release        = tty_release,
-        .fasync         = tty_fasync,
-};
-#endif
 static const struct file_operations console_fops = {
        .llseek         = no_llseek,
        .read           = tty_read,
@@ -953,6 +538,7 @@ static void do_tty_hangup(struct work_struct *work)
        struct tty_ldisc *ld;
        int    closecount = 0, n;
        unsigned long flags;
+        int refs = 0;
        if (!tty)
                return;
@@ -1019,8 +605,12 @@ static void do_tty_hangup(struct work_struct *work)
        if (tty->session) {
                do_each_pid_task(tty->session, PIDTYPE_SID, p) {
                        spin_lock_irq(&p->sighand->siglock);
-                        if (p->signal->tty == tty)
+                        if (p->signal->tty == tty) {
                                p->signal->tty = NULL;
+                                /* We defer the dereferences outside fo
+                                   the tasklist lock */
+                                refs++;
+                        }
                        if (!p->signal->leader) {
                                spin_unlock_irq(&p->sighand->siglock);
                                continue;
@@ -1046,6 +636,10 @@ static void do_tty_hangup(struct work_struct *work)
        tty->ctrl_status = 0;
        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+        /* Account for the p->signal references we killed */
+        while (refs--)
+                tty_kref_put(tty);
        /*
         * If one of the devices matches a console pointer, we
         * cannot just call hangup() because that will cause
@@ -1115,6 +709,23 @@ void tty_vhangup(struct tty_struct *tty)
 EXPORT_SYMBOL(tty_vhangup);
 /**
+ *      tty_vhangup_self        -       process vhangup for own ctty
+ *
+ *      Perform a vhangup on the current controlling tty
+ */
+void tty_vhangup_self(void)
+{
+        struct tty_struct *tty;
+        tty = get_current_tty();
+        if (tty) {
+                tty_vhangup(tty);
+                tty_kref_put(tty);
+        }
+}
+/**
 *      tty_hung_up_p           -       was tty hung up
 *      @filp: file pointer of tty
 *
@@ -1167,16 +778,14 @@ void disassociate_ctty(int on_exit)
        struct pid *tty_pgrp = NULL;
-        mutex_lock(&tty_mutex);
        tty = get_current_tty();
        if (tty) {
                tty_pgrp = get_pid(tty->pgrp);
                lock_kernel();
-                mutex_unlock(&tty_mutex);
-                /* XXX: here we race, there is nothing protecting tty */
                if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
                        tty_vhangup(tty);
                unlock_kernel();
+                tty_kref_put(tty);
        } else if (on_exit) {
                struct pid *old_pgrp;
                spin_lock_irq(&current->sighand->siglock);
@@ -1188,7 +797,6 @@ void disassociate_ctty(int on_exit)
                        kill_pgrp(old_pgrp, SIGCONT, on_exit);
                        put_pid(old_pgrp);
                }
-                mutex_unlock(&tty_mutex);
                return;
        }
        if (tty_pgrp) {
@@ -1203,8 +811,6 @@ void disassociate_ctty(int on_exit)
        current->signal->tty_old_pgrp = NULL;
        spin_unlock_irq(&current->sighand->siglock);
-        mutex_lock(&tty_mutex);
-        /* It is possible that do_tty_hangup has free'd this tty */
        tty = get_current_tty();
        if (tty) {
                unsigned long flags;
@@ -1214,13 +820,13 @@ void disassociate_ctty(int on_exit)
                tty->session = NULL;
                tty->pgrp = NULL;
                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+                tty_kref_put(tty);
        } else {
 #ifdef TTY_DEBUG_HANGUP
                printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
                       " = NULL", tty);
 #endif
        }
-        mutex_unlock(&tty_mutex);
        /* Now clear signal->tty under the lock */
        read_lock(&tasklist_lock);
@@ -1420,19 +1026,19 @@ static inline ssize_t do_tty_write(
        /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
        if (tty->write_cnt < chunk) {
-                unsigned char *buf;
+                unsigned char *buf_chunk;
                if (chunk < 1024)
                        chunk = 1024;
-                buf = kmalloc(chunk, GFP_KERNEL);
+                buf_chunk = kmalloc(chunk, GFP_KERNEL);
-                if (!buf) {
+                if (!buf_chunk) {
                        ret = -ENOMEM;
                        goto out;
                }
                kfree(tty->write_buf);
                tty->write_cnt = chunk;
-                tty->write_buf = buf;
+                tty->write_buf = buf_chunk;
        }
        /* Do the write .. */
@@ -1466,6 +1072,31 @@ out:
        return ret;
 }
+/**
+ * tty_write_message - write a message to a certain tty, not just the console.
+ * @tty: the destination tty_struct
+ * @msg: the message to write
+ *
+ * This is used for messages that need to be redirected to a specific tty.
+ * We don't put it into the syslog queue right now maybe in the future if
+ * really needed.
+ *
+ * We must still hold the BKL and test the CLOSING flag for the moment.
+ */
+void tty_write_message(struct tty_struct *tty, char *msg)
+{
+        lock_kernel();
+        if (tty) {
+                mutex_lock(&tty->atomic_write_lock);
+                if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags))
+                        tty->ops->write(tty, msg, strlen(msg));
+                tty_write_unlock(tty);
+        }
+        unlock_kernel();
+        return;
+}
 /**
 *      tty_write               -       write method for tty device file
@@ -1533,42 +1164,6 @@ ssize_t redirected_tty_write(struct file *file, const char __user *buf,
        return tty_write(file, buf, count, ppos);
 }
-void tty_port_init(struct tty_port *port)
-{
-        memset(port, 0, sizeof(*port));
-        init_waitqueue_head(&port->open_wait);
-        init_waitqueue_head(&port->close_wait);
-        mutex_init(&port->mutex);
-        port->close_delay = (50 * HZ) / 100;
-        port->closing_wait = (3000 * HZ) / 100;
-}
-EXPORT_SYMBOL(tty_port_init);
-int tty_port_alloc_xmit_buf(struct tty_port *port)
-{
-        /* We may sleep in get_zeroed_page() */
-        mutex_lock(&port->mutex);
-        if (port->xmit_buf == NULL)
-                port->xmit_buf = (unsigned char *)get_zeroed_page(GFP_KERNEL);
-        mutex_unlock(&port->mutex);
-        if (port->xmit_buf == NULL)
-                return -ENOMEM;
-        return 0;
-}
-EXPORT_SYMBOL(tty_port_alloc_xmit_buf);
-void tty_port_free_xmit_buf(struct tty_port *port)
-{
-        mutex_lock(&port->mutex);
-        if (port->xmit_buf != NULL) {
-                free_page((unsigned long)port->xmit_buf);
-                port->xmit_buf = NULL;
-        }
-        mutex_unlock(&port->mutex);
-}
-EXPORT_SYMBOL(tty_port_free_xmit_buf);
 static char ptychar[] = "pqrstuvwxyzabcde";
 /**
@@ -1592,7 +1187,7 @@ static void pty_line_name(struct tty_driver *driver, int index, char *p)
 }
 /**
- *      pty_line_name   -       generate name for a tty
+ *      tty_line_name   -       generate name for a tty
 *      @driver: the tty driver in use
 *      @index: the minor number
 *      @p: output buffer of at least 7 bytes
@@ -1608,10 +1203,148 @@ static void tty_line_name(struct tty_driver *driver, int index, char *p)
 }
 /**
- *      init_dev                -       initialise a tty device
+ *      tty_driver_lookup_tty() - find an existing tty, if any
+ *      @driver: the driver for the tty
+ *      @idx:    the minor number
+ *
+ *      Return the tty, if found or ERR_PTR() otherwise.
+ *
+ *      Locking: tty_mutex must be held. If tty is found, the mutex must
+ *      be held until the 'fast-open' is also done. Will change once we
+ *      have refcounting in the driver and per driver locking
+ */
+struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
+                struct inode *inode, int idx)
+{
+        struct tty_struct *tty;
+        if (driver->ops->lookup)
+                return driver->ops->lookup(driver, inode, idx);
+        tty = driver->ttys[idx];
+        return tty;
+}
+/**
+ *      tty_init_termios        -  helper for termios setup
+ *      @tty: the tty to set up
+ *
+ *      Initialise the termios structures for this tty. Thus runs under
+ *      the tty_mutex currently so we can be relaxed about ordering.
+ */
+int tty_init_termios(struct tty_struct *tty)
+{
+        struct ktermios *tp;
+        int idx = tty->index;
+        tp = tty->driver->termios[idx];
+        if (tp == NULL) {
+                tp = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
+                if (tp == NULL)
+                        return -ENOMEM;
+                memcpy(tp, &tty->driver->init_termios,
+                                                sizeof(struct ktermios));
+                tty->driver->termios[idx] = tp;
+        }
+        tty->termios = tp;
+        tty->termios_locked = tp + 1;
+        /* Compatibility until drivers always set this */
+        tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
+        tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
+        return 0;
+}
+/**
+ *      tty_driver_install_tty() - install a tty entry in the driver
+ *      @driver: the driver for the tty
+ *      @tty: the tty
+ *
+ *      Install a tty object into the driver tables. The tty->index field
+ *      will be set by the time this is called. This method is responsible
+ *      for ensuring any need additional structures are allocated and
+ *      configured.
+ *
+ *      Locking: tty_mutex for now
+ */
+static int tty_driver_install_tty(struct tty_driver *driver,
+                                                struct tty_struct *tty)
+{
+        int idx = tty->index;
+        if (driver->ops->install)
+                return driver->ops->install(driver, tty);
+        if (tty_init_termios(tty) == 0) {
+                tty_driver_kref_get(driver);
+                tty->count++;
+                driver->ttys[idx] = tty;
+                return 0;
+        }
+        return -ENOMEM;
+}
+/**
+ *      tty_driver_remove_tty() - remove a tty from the driver tables
+ *      @driver: the driver for the tty
+ *      @idx:    the minor number
+ *
+ *      Remvoe a tty object from the driver tables. The tty->index field
+ *      will be set by the time this is called.
+ *
+ *      Locking: tty_mutex for now
+ */
+static void tty_driver_remove_tty(struct tty_driver *driver,
+                                                struct tty_struct *tty)
+{
+        if (driver->ops->remove)
+                driver->ops->remove(driver, tty);
+        else
+                driver->ttys[tty->index] = NULL;
+}
+/*
+ *      tty_reopen()    - fast re-open of an open tty
+ *      @tty    - the tty to open
+ *
+ *      Return 0 on success, -errno on error.
+ *
+ *      Locking: tty_mutex must be held from the time the tty was found
+ *               till this open completes.
+ */
+static int tty_reopen(struct tty_struct *tty)
+{
+        struct tty_driver *driver = tty->driver;
+        if (test_bit(TTY_CLOSING, &tty->flags))
+                return -EIO;
+        if (driver->type == TTY_DRIVER_TYPE_PTY &&
+            driver->subtype == PTY_TYPE_MASTER) {
+                /*
+                 * special case for PTY masters: only one open permitted,
+                 * and the slave side open count is incremented as well.
+                 */
+                if (tty->count)
+                        return -EIO;
+                tty->link->count++;
+        }
+        tty->count++;
+        tty->driver = driver; /* N.B. why do this every time?? */
+        WARN_ON(!test_bit(TTY_LDISC, &tty->flags));
+        return 0;
+}
+/**
+ *      tty_init_dev            -       initialise a tty device
 *      @driver: tty driver we are opening a device on
 *      @idx: device index
- *      @tty: returned tty structure
+ *      @ret_tty: returned tty structure
+ *      @first_ok: ok to open a new device (used by ptmx)
 *
 *      Prepare a tty device. This may not be a "new" clean device but
 *      could also be an active device. The pty drivers require special
@@ -1631,37 +1364,16 @@ static void tty_line_name(struct tty_driver *driver, int index, char *p)
 * relaxed for the (most common) case of reopening a tty.
 */
-static int init_dev(struct tty_driver *driver, int idx,
+struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
-        struct tty_struct **ret_tty)
+                                                                int first_ok)
 {
-        struct tty_struct *tty, *o_tty;
+        struct tty_struct *tty;
-        struct ktermios *tp, **tp_loc, *o_tp, **o_tp_loc;
+        int retval;
-        struct ktermios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
-        int retval = 0;
-        /* check whether we're reopening an existing tty */
+        /* Check if pty master is being opened multiple times */
-        if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
+        if (driver->subtype == PTY_TYPE_MASTER &&
-                tty = devpts_get_tty(idx);
+                (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok)
-                /*
+                return ERR_PTR(-EIO);
-                 * If we don't have a tty here on a slave open, it's because
-                 * the master already started the close process and there's
-                 * no relation between devpts file and tty anymore.
-                 */
-                if (!tty && driver->subtype == PTY_TYPE_SLAVE) {
-                        retval = -EIO;
-                        goto end_init;
-                }
-                /*
-                 * It's safe from now on because init_dev() is called with
-                 * tty_mutex held and release_dev() won't change tty->count
-                 * or tty->flags without having to grab tty_mutex
-                 */
-                if (tty && driver->subtype == PTY_TYPE_MASTER)
-                        tty = tty->link;
-        } else {
-                tty = driver->ttys[idx];
-        }
-        if (tty) goto fast_track;
        /*
         * First time open is complex, especially for PTY devices.
@@ -1671,189 +1383,69 @@ static int init_dev(struct tty_driver *driver, int idx,
         * and locked termios may be retained.)
         */
-        if (!try_module_get(driver->owner)) {
+        if (!try_module_get(driver->owner))
-                retval = -ENODEV;
+                return ERR_PTR(-ENODEV);
-                goto end_init;
-        }
-        o_tty = NULL;
-        tp = o_tp = NULL;
-        ltp = o_ltp = NULL;
        tty = alloc_tty_struct();
        if (!tty)
                goto fail_no_mem;
-        initialize_tty_struct(tty);
+        initialize_tty_struct(tty, driver, idx);
-        tty->driver = driver;
-        tty->ops = driver->ops;
-        tty->index = idx;
-        tty_line_name(driver, idx, tty->name);
-        if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
-                tp_loc = &tty->termios;
-                ltp_loc = &tty->termios_locked;
-        } else {
-                tp_loc = &driver->termios[idx];
-                ltp_loc = &driver->termios_locked[idx];
-        }
-        if (!*tp_loc) {
-                tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
-                if (!tp)
-                        goto free_mem_out;
-                *tp = driver->init_termios;
-        }
-        if (!*ltp_loc) {
-                ltp = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
-                if (!ltp)
-                        goto free_mem_out;
-        }
-        if (driver->type == TTY_DRIVER_TYPE_PTY) {
-                o_tty = alloc_tty_struct();
-                if (!o_tty)
-                        goto free_mem_out;
-                initialize_tty_struct(o_tty);
-                o_tty->driver = driver->other;
-                o_tty->ops = driver->ops;
-                o_tty->index = idx;
-                tty_line_name(driver->other, idx, o_tty->name);
-                if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
+        retval = tty_driver_install_tty(driver, tty);
-                        o_tp_loc = &o_tty->termios;
+        if (retval < 0) {
-                        o_ltp_loc = &o_tty->termios_locked;
+                free_tty_struct(tty);
-                } else {
+                module_put(driver->owner);
-                        o_tp_loc = &driver->other->termios[idx];
+                return ERR_PTR(retval);
-                        o_ltp_loc = &driver->other->termios_locked[idx];
-                }
-                if (!*o_tp_loc) {
-                        o_tp = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
-                        if (!o_tp)
-                                goto free_mem_out;
-                        *o_tp = driver->other->init_termios;
-                }
-                if (!*o_ltp_loc) {
-                        o_ltp = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
-                        if (!o_ltp)
-                                goto free_mem_out;
-                }
-                /*
-                 * Everything allocated ... set up the o_tty structure.
-                 */
-                if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM))
-                        driver->other->ttys[idx] = o_tty;
-                if (!*o_tp_loc)
-                        *o_tp_loc = o_tp;
-                if (!*o_ltp_loc)
-                        *o_ltp_loc = o_ltp;
-                o_tty->termios = *o_tp_loc;
-                o_tty->termios_locked = *o_ltp_loc;
-                driver->other->refcount++;
-                if (driver->subtype == PTY_TYPE_MASTER)
-                        o_tty->count++;
-                /* Establish the links in both directions */
-                tty->link   = o_tty;
-                o_tty->link = tty;
        }
        /*
-         * All structures have been allocated, so now we install them.
-         * Failures after this point use release_tty to clean up, so
-         * there's no need to null out the local pointers.
-         */
-        if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM))
-                driver->ttys[idx] = tty;
-        if (!*tp_loc)
-                *tp_loc = tp;
-        if (!*ltp_loc)
-                *ltp_loc = ltp;
-        tty->termios = *tp_loc;
-        tty->termios_locked = *ltp_loc;
-        /* Compatibility until drivers always set this */
-        tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
-        tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
-        driver->refcount++;
-        tty->count++;
-        /*
         * Structures all installed ... call the ldisc open routines.
         * If we fail here just call release_tty to clean up.  No need
         * to decrement the use counts, as release_tty doesn't care.
         */
-        retval = tty_ldisc_setup(tty, o_tty);
+        retval = tty_ldisc_setup(tty, tty->link);
        if (retval)
                goto release_mem_out;
-         goto success;
+        return tty;
-        /*
-         * This fast open can be used if the tty is already open.
-         * No memory is allocated, and the only failures are from
-         * attempting to open a closing tty or attempting multiple
-         * opens on a pty master.
-         */
-fast_track:
-        if (test_bit(TTY_CLOSING, &tty->flags)) {
-                retval = -EIO;
-                goto end_init;
-        }
-        if (driver->type == TTY_DRIVER_TYPE_PTY &&
-            driver->subtype == PTY_TYPE_MASTER) {
-                /*
-                 * special case for PTY masters: only one open permitted,
-                 * and the slave side open count is incremented as well.
-                 */
-                if (tty->count) {
-                        retval = -EIO;
-                        goto end_init;
-                }
-                tty->link->count++;
-        }
-        tty->count++;
-        tty->driver = driver; /* N.B. why do this every time?? */
-        /* FIXME */
-        if (!test_bit(TTY_LDISC, &tty->flags))
-                printk(KERN_ERR "init_dev but no ldisc\n");
-success:
-        *ret_tty = tty;
-        /* All paths come through here to release the mutex */
-end_init:
-        return retval;
-        /* Release locally allocated memory ... nothing placed in slots */
-free_mem_out:
-        kfree(o_tp);
-        if (o_tty)
-                free_tty_struct(o_tty);
-        kfree(ltp);
-        kfree(tp);
-        free_tty_struct(tty);
 fail_no_mem:
        module_put(driver->owner);
-        retval = -ENOMEM;
+        return ERR_PTR(-ENOMEM);
-        goto end_init;
        /* call the tty release_tty routine to clean out this slot */
 release_mem_out:
        if (printk_ratelimit())
-                printk(KERN_INFO "init_dev: ldisc open failed, "
+                printk(KERN_INFO "tty_init_dev: ldisc open failed, "
                                 "clearing slot %d\n", idx);
        release_tty(tty, idx);
-        goto end_init;
+        return ERR_PTR(retval);
 }
+void tty_free_termios(struct tty_struct *tty)
+{
+        struct ktermios *tp;
+        int idx = tty->index;
+        /* Kill this flag and push into drivers for locking etc */
+        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
+                /* FIXME: Locking on ->termios array */
+                tp = tty->termios;
+                tty->driver->termios[idx] = NULL;
+                kfree(tp);
+        }
+}
+EXPORT_SYMBOL(tty_free_termios);
+void tty_shutdown(struct tty_struct *tty)
+{
+        tty_driver_remove_tty(tty->driver, tty);
+        tty_free_termios(tty);
+}
+EXPORT_SYMBOL(tty_shutdown);
 /**
 *      release_one_tty         -       release tty structure memory
+ *      @kref: kref of tty we are obliterating
 *
 *      Releases memory associated with a tty structure, and clears out the
 *      driver table slots. This function is called when a device is no longer
@@ -1863,31 +1455,19 @@ release_mem_out:
 *              tty_mutex - sometimes only
 *              takes the file list lock internally when working on the list
 *      of ttys that the driver keeps.
- *              FIXME: should we require tty_mutex is held here ??
 */
-static void release_one_tty(struct tty_struct *tty, int idx)
+static void release_one_tty(struct kref *kref)
 {
-        int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
+        struct tty_struct *tty = container_of(kref, struct tty_struct, kref);
-        struct ktermios *tp;
+        struct tty_driver *driver = tty->driver;
-        if (!devpts)
-                tty->driver->ttys[idx] = NULL;
-        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-                tp = tty->termios;
-                if (!devpts)
-                        tty->driver->termios[idx] = NULL;
-                kfree(tp);
-                tp = tty->termios_locked;
-                if (!devpts)
-                        tty->driver->termios_locked[idx] = NULL;
-                kfree(tp);
-        }
+        if (tty->ops->shutdown)
+                tty->ops->shutdown(tty);
+        else
+                tty_shutdown(tty);
        tty->magic = 0;
-        tty->driver->refcount--;
+        tty_driver_kref_put(driver);
+        module_put(driver->owner);
        file_list_lock();
        list_del_init(&tty->tty_files);
@@ -1897,6 +1477,21 @@ static void release_one_tty(struct tty_struct *tty, int idx)
 }
 /**
+ *      tty_kref_put            -       release a tty kref
+ *      @tty: tty device
+ *
+ *      Release a reference to a tty device and if need be let the kref
+ *      layer destruct the object for us
+ */
+void tty_kref_put(struct tty_struct *tty)
+{
+        if (tty)
+                kref_put(&tty->kref, release_one_tty);
+}
+EXPORT_SYMBOL(tty_kref_put);
+/**
 *      release_tty             -       release tty structure memory
 *
 *      Release both @tty and a possible linked partner (think pty pair),
@@ -1907,15 +1502,16 @@ static void release_one_tty(struct tty_struct *tty, int idx)
 *              takes the file list lock internally when working on the list
 *      of ttys that the driver keeps.
 *              FIXME: should we require tty_mutex is held here ??
+ *
 */
 static void release_tty(struct tty_struct *tty, int idx)
 {
-        struct tty_driver *driver = tty->driver;
+        /* This should always be true but check for the moment */
+        WARN_ON(tty->index != idx);
        if (tty->link)
-                release_one_tty(tty->link, idx);
+                tty_kref_put(tty->link);
-        release_one_tty(tty, idx);
+        tty_kref_put(tty);
-        module_put(driver->owner);
 }
 /*
@@ -1926,20 +1522,21 @@ static void release_tty(struct tty_struct *tty, int idx)
 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
 * lead to double frees or releasing memory still in use.
 */
-static void release_dev(struct file *filp)
+void tty_release_dev(struct file *filp)
 {
        struct tty_struct *tty, *o_tty;
        int     pty_master, tty_closing, o_tty_closing, do_sleep;
        int     devpts;
        int     idx;
        char    buf[64];
+        struct  inode *inode;
+        inode = filp->f_path.dentry->d_inode;
        tty = (struct tty_struct *)filp->private_data;
-        if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode,
+        if (tty_paranoia_check(tty, inode, "tty_release_dev"))
-                                                        "release_dev"))
                return;
-        check_tty_count(tty, "release_dev");
+        check_tty_count(tty, "tty_release_dev");
        tty_fasync(-1, filp, 0);
@@ -1951,33 +1548,27 @@ static void release_dev(struct file *filp)
 #ifdef TTY_PARANOIA_CHECK
        if (idx < 0 || idx >= tty->driver->num) {
-                printk(KERN_DEBUG "release_dev: bad idx when trying to "
+                printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
                                  "free (%s)\n", tty->name);
                return;
        }
-        if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
+        if (!devpts) {
                if (tty != tty->driver->ttys[idx]) {
-                        printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
+                        printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
                               "for (%s)\n", idx, tty->name);
                        return;
                }
                if (tty->termios != tty->driver->termios[idx]) {
-                        printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
+                        printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
                               "for (%s)\n",
                               idx, tty->name);
                        return;
                }
-                if (tty->termios_locked != tty->driver->termios_locked[idx]) {
-                        printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
-                               "termios_locked for (%s)\n",
-                               idx, tty->name);
-                        return;
-                }
        }
 #endif
 #ifdef TTY_DEBUG_HANGUP
-        printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
+        printk(KERN_DEBUG "tty_release_dev of %s (tty count=%d)...",
               tty_name(tty, buf), tty->count);
 #endif
@@ -1985,26 +1576,19 @@ static void release_dev(struct file *filp)
        if (tty->driver->other &&
             !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
                if (o_tty != tty->driver->other->ttys[idx]) {
-                        printk(KERN_DEBUG "release_dev: other->table[%d] "
+                        printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
                                          "not o_tty for (%s)\n",
                               idx, tty->name);
                        return;
                }
                if (o_tty->termios != tty->driver->other->termios[idx]) {
-                        printk(KERN_DEBUG "release_dev: other->termios[%d] "
+                        printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
                                          "not o_termios for (%s)\n",
                               idx, tty->name);
                        return;
                }
-                if (o_tty->termios_locked !=
-                      tty->driver->other->termios_locked[idx]) {
-                        printk(KERN_DEBUG "release_dev: other->termios_locked["
-                                          "%d] not o_termios_locked for (%s)\n",
-                               idx, tty->name);
-                        return;
-                }
                if (o_tty->link != tty) {
-                        printk(KERN_DEBUG "release_dev: bad pty pointers\n");
+                        printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
                        return;
                }
        }
@@ -2062,7 +1646,7 @@ static void release_dev(struct file *filp)
                if (!do_sleep)
                        break;
-                printk(KERN_WARNING "release_dev: %s: read/write wait queue "
+                printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
                                    "active!\n", tty_name(tty, buf));
                mutex_unlock(&tty_mutex);
                schedule();
@@ -2075,14 +1659,14 @@ static void release_dev(struct file *filp)
         */
        if (pty_master) {
                if (--o_tty->count < 0) {
-                        printk(KERN_WARNING "release_dev: bad pty slave count "
+                        printk(KERN_WARNING "tty_release_dev: bad pty slave count "
                                            "(%d) for %s\n",
                               o_tty->count, tty_name(o_tty, buf));
                        o_tty->count = 0;
                }
        }
        if (--tty->count < 0) {
-                printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
+                printk(KERN_WARNING "tty_release_dev: bad tty->count (%d) for %s\n",
                       tty->count, tty_name(tty, buf));
                tty->count = 0;
        }
@@ -2145,11 +1729,11 @@ static void release_dev(struct file *filp)
        /* Make this pty number available for reallocation */
        if (devpts)
-                devpts_kill_index(idx);
+                devpts_kill_index(inode, idx);
 }
 /**
- *      tty_open                -       open a tty device
+ *      __tty_open              -       open a tty device
 *      @inode: inode of device file
 *      @filp: file pointer to tty
 *
@@ -2164,14 +1748,14 @@ static void release_dev(struct file *filp)
 *      The termios state of a pty is reset on first open so that
 *      settings don't persist across reuse.
 *
- *      Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
+ *      Locking: tty_mutex protects tty, get_tty_driver and tty_init_dev work.
 *               tty->count should protect the rest.
 *               ->siglock protects ->signal/->sighand
 */
 static int __tty_open(struct inode *inode, struct file *filp)
 {
-        struct tty_struct *tty;
+        struct tty_struct *tty = NULL;
        int noctty, retval;
        struct tty_driver *driver;
        int index;
@@ -2193,23 +1777,25 @@ retry_open:
                        mutex_unlock(&tty_mutex);
                        return -ENXIO;
                }
-                driver = tty->driver;
+                driver = tty_driver_kref_get(tty->driver);
                index = tty->index;
                filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
                /* noctty = 1; */
+                /* FIXME: Should we take a driver reference ? */
+                tty_kref_put(tty);
                goto got_driver;
        }
 #ifdef CONFIG_VT
        if (device == MKDEV(TTY_MAJOR, 0)) {
                extern struct tty_driver *console_driver;
-                driver = console_driver;
+                driver = tty_driver_kref_get(console_driver);
                index = fg_console;
                noctty = 1;
                goto got_driver;
        }
 #endif
        if (device == MKDEV(TTYAUX_MAJOR, 1)) {
-                driver = console_device(&index);
+                driver = tty_driver_kref_get(console_device(&index));
                if (driver) {
                        /* Don't let /dev/console block */
                        filp->f_flags |= O_NONBLOCK;
@@ -2226,10 +1812,25 @@ retry_open:
                return -ENODEV;
        }
 got_driver:
-        retval = init_dev(driver, index, &tty);
+        if (!tty) {
+                /* check whether we're reopening an existing tty */
+                tty = tty_driver_lookup_tty(driver, inode, index);
+                if (IS_ERR(tty))
+                        return PTR_ERR(tty);
+        }
+        if (tty) {
+                retval = tty_reopen(tty);
+                if (retval)
+                        tty = ERR_PTR(retval);
+        } else
+                tty = tty_init_dev(driver, index, 0);
        mutex_unlock(&tty_mutex);
-        if (retval)
+        tty_driver_kref_put(driver);
-                return retval;
+        if (IS_ERR(tty))
+                return PTR_ERR(tty);
        filp->private_data = tty;
        file_move(filp, &tty->tty_files);
@@ -2257,7 +1858,7 @@ got_driver:
                printk(KERN_DEBUG "error %d in opening %s...", retval,
                       tty->name);
 #endif
-                release_dev(filp);
+                tty_release_dev(filp);
                if (retval != -ERESTARTSYS)
                        return retval;
                if (signal_pending(current))
@@ -2296,69 +1897,6 @@ static int tty_open(struct inode *inode, struct file *filp)
-#ifdef CONFIG_UNIX98_PTYS
-/**
- *      ptmx_open               -       open a unix 98 pty master
- *      @inode: inode of device file
- *      @filp: file pointer to tty
- *
- *      Allocate a unix98 pty master device from the ptmx driver.
- *
- *      Locking: tty_mutex protects theinit_dev work. tty->count should
- *              protect the rest.
- *              allocated_ptys_lock handles the list of free pty numbers
- */
-static int __ptmx_open(struct inode *inode, struct file *filp)
-{
-        struct tty_struct *tty;
-        int retval;
-        int index;
-        nonseekable_open(inode, filp);
-        /* find a device that is not in use. */
-        index = devpts_new_index();
-        if (index < 0)
-                return index;
-        mutex_lock(&tty_mutex);
-        retval = init_dev(ptm_driver, index, &tty);
-        mutex_unlock(&tty_mutex);
-        if (retval)
-                goto out;
-        set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
-        filp->private_data = tty;
-        file_move(filp, &tty->tty_files);
-        retval = devpts_pty_new(tty->link);
-        if (retval)
-                goto out1;
-        check_tty_count(tty, "ptmx_open");
-        retval = ptm_driver->ops->open(tty, filp);
-        if (!retval)
-                return 0;
-out1:
-        release_dev(filp);
-        return retval;
-out:
-        devpts_kill_index(index);
-        return retval;
-}
-static int ptmx_open(struct inode *inode, struct file *filp)
-{
-        int ret;
-        lock_kernel();
-        ret = __ptmx_open(inode, filp);
-        unlock_kernel();
-        return ret;
-}
-#endif
 /**
 *      tty_release             -       vfs callback for close
@@ -2369,13 +1907,13 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 *      this tty. There may however be several such references.
 *
 *      Locking:
- *              Takes bkl. See release_dev
+ *              Takes bkl. See tty_release_dev
 */
 static int tty_release(struct inode *inode, struct file *filp)
 {
        lock_kernel();
-        release_dev(filp);
+        tty_release_dev(filp);
        unlock_kernel();
        return 0;
 }
@@ -2524,7 +2062,7 @@ int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
        /* For a PTY we need to lock the tty side */
        mutex_lock(&real_tty->termios_mutex);
-        if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
+        if (!memcmp(ws, &real_tty->winsize, sizeof(*ws)))
                goto done;
        /* Get the PID values and reference them so we can
           avoid holding the tty ctrl lock while sending signals */
@@ -2996,7 +2534,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case TIOCSTI:
                return tiocsti(tty, p);
        case TIOCGWINSZ:
-                return tiocgwinsz(tty, p);
+                return tiocgwinsz(real_tty, p);
        case TIOCSWINSZ:
                return tiocswinsz(tty, real_tty, p);
        case TIOCCONS:
@@ -3026,10 +2564,6 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                return put_user(tty->ldisc.ops->num, (int __user *)p);
        case TIOCSETD:
                return tiocsetd(tty, p);
-#ifdef CONFIG_VT
-        case TIOCLINUX:
-                return tioclinux(tty, arg);
-#endif
        /*
         * Break handling
         */
@@ -3220,113 +2754,6 @@ void do_SAK(struct tty_struct *tty)
 EXPORT_SYMBOL(do_SAK);
 /**
- *      flush_to_ldisc
- *      @work: tty structure passed from work queue.
- *
- *      This routine is called out of the software interrupt to flush data
- *      from the buffer chain to the line discipline.
- *
- *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
- *      while invoking the line discipline receive_buf method. The
- *      receive_buf method is single threaded for each tty instance.
- */
-static void flush_to_ldisc(struct work_struct *work)
-{
-        struct tty_struct *tty =
-                container_of(work, struct tty_struct, buf.work.work);
-        unsigned long   flags;
-        struct tty_ldisc *disc;
-        struct tty_buffer *tbuf, *head;
-        char *char_buf;
-        unsigned char *flag_buf;
-        disc = tty_ldisc_ref(tty);
-        if (disc == NULL)       /*  !TTY_LDISC */
-                return;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        /* So we know a flush is running */
-        set_bit(TTY_FLUSHING, &tty->flags);
-        head = tty->buf.head;
-        if (head != NULL) {
-                tty->buf.head = NULL;
-                for (;;) {
-                        int count = head->commit - head->read;
-                        if (!count) {
-                                if (head->next == NULL)
-                                        break;
-                                tbuf = head;
-                                head = head->next;
-                                tty_buffer_free(tty, tbuf);
-                                continue;
-                        }
-                        /* Ldisc or user is trying to flush the buffers
-                           we are feeding to the ldisc, stop feeding the
-                           line discipline as we want to empty the queue */
-                        if (test_bit(TTY_FLUSHPENDING, &tty->flags))
-                                break;
-                        if (!tty->receive_room) {
-                                schedule_delayed_work(&tty->buf.work, 1);
-                                break;
-                        }
-                        if (count > tty->receive_room)
-                                count = tty->receive_room;
-                        char_buf = head->char_buf_ptr + head->read;
-                        flag_buf = head->flag_buf_ptr + head->read;
-                        head->read += count;
-                        spin_unlock_irqrestore(&tty->buf.lock, flags);
-                        disc->ops->receive_buf(tty, char_buf,
-                                                        flag_buf, count);
-                        spin_lock_irqsave(&tty->buf.lock, flags);
-                }
-                /* Restore the queue head */
-                tty->buf.head = head;
-        }
-        /* We may have a deferred request to flush the input buffer,
-           if so pull the chain under the lock and empty the queue */
-        if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
-                __tty_buffer_flush(tty);
-                clear_bit(TTY_FLUSHPENDING, &tty->flags);
-                wake_up(&tty->read_wait);
-        }
-        clear_bit(TTY_FLUSHING, &tty->flags);
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        tty_ldisc_deref(disc);
-}
-/**
- *      tty_flip_buffer_push    -       terminal
- *      @tty: tty to push
- *
- *      Queue a push of the terminal flip buffers to the line discipline. This
- *      function must not be called from IRQ context if tty->low_latency is set.
- *
- *      In the event of the queue being busy for flipping the work will be
- *      held off and retried later.
- *
- *      Locking: tty buffer lock. Driver locks in low latency mode.
- */
-void tty_flip_buffer_push(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
-                tty->buf.tail->commit = tty->buf.tail->used;
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        if (tty->low_latency)
-                flush_to_ldisc(&tty->buf.work.work);
-        else
-                schedule_delayed_work(&tty->buf.work, 1);
-}
-EXPORT_SYMBOL(tty_flip_buffer_push);
-/**
 *      initialize_tty_struct
 *      @tty: tty to initialize
 *
@@ -3336,9 +2763,11 @@ EXPORT_SYMBOL(tty_flip_buffer_push);
 *      Locking: none - tty in question must not be exposed at this point
 */
-static void initialize_tty_struct(struct tty_struct *tty)
+void initialize_tty_struct(struct tty_struct *tty,
+                struct tty_driver *driver, int idx)
 {
        memset(tty, 0, sizeof(struct tty_struct));
+        kref_init(&tty->kref);
        tty->magic = TTY_MAGIC;
        tty_ldisc_init(tty);
        tty->session = NULL;
@@ -3346,7 +2775,6 @@ static void initialize_tty_struct(struct tty_struct *tty)
        tty->overrun_time = jiffies;
        tty->buf.head = tty->buf.tail = NULL;
        tty_buffer_init(tty);
-        INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
        mutex_init(&tty->termios_mutex);
        init_waitqueue_head(&tty->write_wait);
        init_waitqueue_head(&tty->read_wait);
@@ -3357,6 +2785,11 @@ static void initialize_tty_struct(struct tty_struct *tty)
        spin_lock_init(&tty->ctrl_lock);
        INIT_LIST_HEAD(&tty->tty_files);
        INIT_WORK(&tty->SAK_work, do_SAK_work);
+        tty->driver = driver;
+        tty->ops = driver->ops;
+        tty->index = idx;
+        tty_line_name(driver, idx, tty->name);
 }
 /**
@@ -3377,10 +2810,9 @@ int tty_put_char(struct tty_struct *tty, unsigned char ch)
                return tty->ops->put_char(tty, ch);
        return tty->ops->write(tty, &ch, 1);
 }
 EXPORT_SYMBOL_GPL(tty_put_char);
-static struct class *tty_class;
+struct class *tty_class;
 /**
 *      tty_register_device - register a tty device
@@ -3420,6 +2852,7 @@ struct device *tty_register_device(struct tty_driver *driver, unsigned index,
        return device_create_drvdata(tty_class, device, dev, NULL, name);
 }
+EXPORT_SYMBOL(tty_register_device);
 /**
 *      tty_unregister_device - unregister a tty device
@@ -3437,8 +2870,6 @@ void tty_unregister_device(struct tty_driver *driver, unsigned index)
        device_destroy(tty_class,
                MKDEV(driver->major, driver->minor_start) + index);
 }
-EXPORT_SYMBOL(tty_register_device);
 EXPORT_SYMBOL(tty_unregister_device);
 struct tty_driver *alloc_tty_driver(int lines)
@@ -3447,27 +2878,65 @@ struct tty_driver *alloc_tty_driver(int lines)
        driver = kzalloc(sizeof(struct tty_driver), GFP_KERNEL);
        if (driver) {
+                kref_init(&driver->kref);
                driver->magic = TTY_DRIVER_MAGIC;
                driver->num = lines;
                /* later we'll move allocation of tables here */
        }
        return driver;
 }
+EXPORT_SYMBOL(alloc_tty_driver);
-void put_tty_driver(struct tty_driver *driver)
+static void destruct_tty_driver(struct kref *kref)
 {
+        struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
+        int i;
+        struct ktermios *tp;
+        void *p;
+        if (driver->flags & TTY_DRIVER_INSTALLED) {
+                /*
+                 * Free the termios and termios_locked structures because
+                 * we don't want to get memory leaks when modular tty
+                 * drivers are removed from the kernel.
+                 */
+                for (i = 0; i < driver->num; i++) {
+                        tp = driver->termios[i];
+                        if (tp) {
+                                driver->termios[i] = NULL;
+                                kfree(tp);
+                        }
+                        if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
+                                tty_unregister_device(driver, i);
+                }
+                p = driver->ttys;
+                proc_tty_unregister_driver(driver);
+                driver->ttys = NULL;
+                driver->termios = NULL;
+                kfree(p);
+                cdev_del(&driver->cdev);
+        }
        kfree(driver);
 }
+void tty_driver_kref_put(struct tty_driver *driver)
+{
+        kref_put(&driver->kref, destruct_tty_driver);
+}
+EXPORT_SYMBOL(tty_driver_kref_put);
 void tty_set_operations(struct tty_driver *driver,
                        const struct tty_operations *op)
 {
        driver->ops = op;
 };
+EXPORT_SYMBOL(tty_set_operations);
-EXPORT_SYMBOL(alloc_tty_driver);
+void put_tty_driver(struct tty_driver *d)
+{
+        tty_driver_kref_put(d);
+}
 EXPORT_SYMBOL(put_tty_driver);
-EXPORT_SYMBOL(tty_set_operations);
 /*
 * Called by a tty driver to register itself.
@@ -3479,11 +2948,8 @@ int tty_register_driver(struct tty_driver *driver)
        dev_t dev;
        void **p = NULL;
-        if (driver->flags & TTY_DRIVER_INSTALLED)
-                return 0;
        if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM) && driver->num) {
-                p = kzalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
+                p = kzalloc(driver->num * 2 * sizeof(void *), GFP_KERNEL);
                if (!p)
                        return -ENOMEM;
        }
@@ -3507,12 +2973,9 @@ int tty_register_driver(struct tty_driver *driver)
        if (p) {
                driver->ttys = (struct tty_struct **)p;
                driver->termios = (struct ktermios **)(p + driver->num);
-                driver->termios_locked = (struct ktermios **)
-                                                        (p + driver->num * 2);
        } else {
                driver->ttys = NULL;
                driver->termios = NULL;
-                driver->termios_locked = NULL;
        }
        cdev_init(&driver->cdev, &tty_fops);
@@ -3521,7 +2984,7 @@ int tty_register_driver(struct tty_driver *driver)
        if (error) {
                unregister_chrdev_region(dev, driver->num);
                driver->ttys = NULL;
-                driver->termios = driver->termios_locked = NULL;
+                driver->termios = NULL;
                kfree(p);
                return error;
        }
@@ -3535,6 +2998,7 @@ int tty_register_driver(struct tty_driver *driver)
                    tty_register_device(driver, i, NULL);
        }
        proc_tty_register_driver(driver);
+        driver->flags |= TTY_DRIVER_INSTALLED;
        return 0;
 }
@@ -3545,46 +3009,19 @@ EXPORT_SYMBOL(tty_register_driver);
 */
 int tty_unregister_driver(struct tty_driver *driver)
 {
-        int i;
+#if 0
-        struct ktermios *tp;
+        /* FIXME */
-        void *p;
        if (driver->refcount)
                return -EBUSY;
+#endif
        unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
                                driver->num);
        mutex_lock(&tty_mutex);
        list_del(&driver->tty_drivers);
        mutex_unlock(&tty_mutex);
-        /*
-         * Free the termios and termios_locked structures because
-         * we don't want to get memory leaks when modular tty
-         * drivers are removed from the kernel.
-         */
-        for (i = 0; i < driver->num; i++) {
-                tp = driver->termios[i];
-                if (tp) {
-                        driver->termios[i] = NULL;
-                        kfree(tp);
-                }
-                tp = driver->termios_locked[i];
-                if (tp) {
-                        driver->termios_locked[i] = NULL;
-                        kfree(tp);
-                }
-                if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
-                        tty_unregister_device(driver, i);
-        }
-        p = driver->ttys;
-        proc_tty_unregister_driver(driver);
-        driver->ttys = NULL;
-        driver->termios = driver->termios_locked = NULL;
-        kfree(p);
-        cdev_del(&driver->cdev);
        return 0;
 }
 EXPORT_SYMBOL(tty_unregister_driver);
 dev_t tty_devnum(struct tty_struct *tty)
@@ -3595,9 +3032,12 @@ EXPORT_SYMBOL(tty_devnum);
 void proc_clear_tty(struct task_struct *p)
 {
+        struct tty_struct *tty;
        spin_lock_irq(&p->sighand->siglock);
+        tty = p->signal->tty;
        p->signal->tty = NULL;
        spin_unlock_irq(&p->sighand->siglock);
+        tty_kref_put(tty);
 }
 /* Called under the sighand lock */
@@ -3613,9 +3053,13 @@ static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
                tty->pgrp = get_pid(task_pgrp(tsk));
                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
                tty->session = get_pid(task_session(tsk));
+                if (tsk->signal->tty) {
+                        printk(KERN_DEBUG "tty not NULL!!\n");
+                        tty_kref_put(tsk->signal->tty);
+                }
        }
        put_pid(tsk->signal->tty_old_pgrp);
-        tsk->signal->tty = tty;
+        tsk->signal->tty = tty_kref_get(tty);
        tsk->signal->tty_old_pgrp = NULL;
 }
@@ -3629,18 +3073,20 @@ static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
 struct tty_struct *get_current_tty(void)
 {
        struct tty_struct *tty;
-        WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
+        unsigned long flags;
-        tty = current->signal->tty;
-        /*
+        spin_lock_irqsave(&current->sighand->siglock, flags);
-         * session->tty can be changed/cleared from under us, make sure we
+        tty = tty_kref_get(current->signal->tty);
-         * issue the load. The obtained pointer, when not NULL, is valid as
+        spin_unlock_irqrestore(&current->sighand->siglock, flags);
-         * long as we hold tty_mutex.
-         */
-        barrier();
        return tty;
 }
 EXPORT_SYMBOL_GPL(get_current_tty);
+void tty_default_fops(struct file_operations *fops)
+{
+        *fops = tty_fops;
+}
 /*
 * Initialize the console device. This is called *early*, so
 * we can't necessarily depend on lots of kernel help here.
@@ -3678,12 +3124,6 @@ postcore_initcall(tty_class_init);
 /* 3/2004 jmc: why do these devices exist? */
 static struct cdev tty_cdev, console_cdev;
-#ifdef CONFIG_UNIX98_PTYS
-static struct cdev ptmx_cdev;
-#endif
-#ifdef CONFIG_VT
-static struct cdev vc0_cdev;
-#endif
 /*
 * Ok, now we can initialize the rest of the tty devices and can count
@@ -3695,32 +3135,18 @@ static int __init tty_init(void)
        if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
                panic("Couldn't register /dev/tty driver\n");
-        device_create_drvdata(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL,
+        device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL,
                              "tty");
        cdev_init(&console_cdev, &console_fops);
        if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
                panic("Couldn't register /dev/console driver\n");
-        device_create_drvdata(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
+        device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), NULL,
                              "console");
-#ifdef CONFIG_UNIX98_PTYS
-        cdev_init(&ptmx_cdev, &ptmx_fops);
-        if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
-            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
-                panic("Couldn't register /dev/ptmx driver\n");
-        device_create_drvdata(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), NULL, "ptmx");
-#endif
 #ifdef CONFIG_VT
-        cdev_init(&vc0_cdev, &console_fops);
+        vty_init(&console_fops);
-        if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
-            register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
-                panic("Couldn't register /dev/tty0 driver\n");
-        device_create_drvdata(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
-        vty_init();
 #endif
        return 0;
 }
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index bf34e4597421..a408c8e487ec 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -40,6 +40,15 @@
 #define TERMIOS_OLD     8
+/**
+ *      tty_chars_in_buffer     -       characters pending
+ *      @tty: terminal
+ *
+ *      Return the number of bytes of data in the device private
+ *      output queue. If no private method is supplied there is assumed
+ *      to be no queue on the device.
+ */
 int tty_chars_in_buffer(struct tty_struct *tty)
 {
        if (tty->ops->chars_in_buffer)
@@ -47,26 +56,49 @@ int tty_chars_in_buffer(struct tty_struct *tty)
        else
                return 0;
 }
 EXPORT_SYMBOL(tty_chars_in_buffer);
+/**
+ *      tty_write_room          -       write queue space
+ *      @tty: terminal
+ *
+ *      Return the number of bytes that can be queued to this device
+ *      at the present time. The result should be treated as a guarantee
+ *      and the driver cannot offer a value it later shrinks by more than
+ *      the number of bytes written. If no method is provided 2K is always
+ *      returned and data may be lost as there will be no flow control.
+ */
+ 
 int tty_write_room(struct tty_struct *tty)
 {
        if (tty->ops->write_room)
                return tty->ops->write_room(tty);
        return 2048;
 }
 EXPORT_SYMBOL(tty_write_room);
+/**
+ *      tty_driver_flush_buffer -       discard internal buffer
+ *      @tty: terminal
+ *
+ *      Discard the internal output buffer for this device. If no method
+ *      is provided then either the buffer cannot be hardware flushed or
+ *      there is no buffer driver side.
+ */
 void tty_driver_flush_buffer(struct tty_struct *tty)
 {
        if (tty->ops->flush_buffer)
                tty->ops->flush_buffer(tty);
 }
 EXPORT_SYMBOL(tty_driver_flush_buffer);
+/**
+ *      tty_throttle            -       flow control
+ *      @tty: terminal
+ *
+ *      Indicate that a tty should stop transmitting data down the stack.
+ */
 void tty_throttle(struct tty_struct *tty)
 {
        /* check TTY_THROTTLED first so it indicates our state */
@@ -76,6 +108,13 @@ void tty_throttle(struct tty_struct *tty)
 }
 EXPORT_SYMBOL(tty_throttle);
+/**
+ *      tty_unthrottle          -       flow control
+ *      @tty: terminal
+ *
+ *      Indicate that a tty may continue transmitting data down the stack.
+ */
 void tty_unthrottle(struct tty_struct *tty)
 {
        if (test_and_clear_bit(TTY_THROTTLED, &tty->flags) &&
@@ -112,6 +151,11 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
 }
 EXPORT_SYMBOL(tty_wait_until_sent);
+/*
+ *              Termios Helper Methods
+ */
 static void unset_locked_termios(struct ktermios *termios,
                                 struct ktermios *old,
                                 struct ktermios *locked)
@@ -346,6 +390,16 @@ void tty_termios_encode_baud_rate(struct ktermios *termios,
 }
 EXPORT_SYMBOL_GPL(tty_termios_encode_baud_rate);
+/**
+ *      tty_encode_baud_rate            -       set baud rate of the tty
+ *      @ibaud: input baud rate
+ *      @obad: output baud rate
+ *
+ *      Update the current termios data for the tty with the new speed
+ *      settings. The caller must hold the termios_mutex for the tty in
+ *      question.
+ */
 void tty_encode_baud_rate(struct tty_struct *tty, speed_t ibaud, speed_t obaud)
 {
        tty_termios_encode_baud_rate(tty->termios, ibaud, obaud);
@@ -430,12 +484,11 @@ EXPORT_SYMBOL(tty_termios_hw_change);
 *      is a bit of layering violation here with n_tty in terms of the
 *      internal knowledge of this function.
 *
- *      Locking: termios_sem
+ *      Locking: termios_mutex
 */
 static void change_termios(struct tty_struct *tty, struct ktermios *new_termios)
 {
-        int canon_change;
        struct ktermios old_termios;
        struct tty_ldisc *ld;
        unsigned long flags;
@@ -451,18 +504,6 @@ static void change_termios(struct tty_struct *tty, struct ktermios *new_termios)
        old_termios = *tty->termios;
        *tty->termios = *new_termios;
        unset_locked_termios(tty->termios, &old_termios, tty->termios_locked);
-        canon_change = (old_termios.c_lflag ^ tty->termios->c_lflag) & ICANON;
-        if (canon_change) {
-                memset(&tty->read_flags, 0, sizeof tty->read_flags);
-                tty->canon_head = tty->read_tail;
-                tty->canon_data = 0;
-                tty->erasing = 0;
-        }
-        /* This bit should be in the ldisc code */
-        if (canon_change && !L_ICANON(tty) && tty->read_cnt)
-                /* Get characters left over from canonical mode. */
-                wake_up_interruptible(&tty->read_wait);
        /* See if packet mode change of state. */
        if (tty->link && tty->link->packet) {
@@ -508,7 +549,7 @@ static void change_termios(struct tty_struct *tty, struct ktermios *new_termios)
 *      functions before using change_termios to do the actual changes.
 *
 *      Locking:
- *              Called functions take ldisc and termios_sem locks
+ *              Called functions take ldisc and termios_mutex locks
 */
 static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
@@ -579,25 +620,51 @@ static int get_termio(struct tty_struct *tty, struct termio __user *termio)
        return 0;
 }
-static unsigned long inq_canon(struct tty_struct *tty)
+#ifdef TCGETX
+/**
+ *      set_termiox     -       set termiox fields if possible
+ *      @tty: terminal
+ *      @arg: termiox structure from user
+ *      @opt: option flags for ioctl type
+ *
+ *      Implement the device calling points for the SYS5 termiox ioctl
+ *      interface in Linux
+ */
+static int set_termiox(struct tty_struct *tty, void __user *arg, int opt)
 {
-        int nr, head, tail;
+        struct termiox tnew;
+        struct tty_ldisc *ld;
-        if (!tty->canon_data || !tty->read_buf)
+        if (tty->termiox == NULL)
-                return 0;
+                return -EINVAL;
-        head = tty->canon_head;
+        if (copy_from_user(&tnew, arg, sizeof(struct termiox)))
-        tail = tty->read_tail;
+                return -EFAULT;
-        nr = (head - tail) & (N_TTY_BUF_SIZE-1);
-        /* Skip EOF-chars.. */
+        ld = tty_ldisc_ref(tty);
-        while (head != tail) {
+        if (ld != NULL) {
-                if (test_bit(tail, tty->read_flags) &&
+                if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
-                    tty->read_buf[tail] == __DISABLED_CHAR)
+                        ld->ops->flush_buffer(tty);
-                        nr--;
+                tty_ldisc_deref(ld);
-                tail = (tail+1) & (N_TTY_BUF_SIZE-1);
        }
-        return nr;
+        if (opt & TERMIOS_WAIT) {
+                tty_wait_until_sent(tty, 0);
+                if (signal_pending(current))
+                        return -EINTR;
+        }
+        mutex_lock(&tty->termios_mutex);
+        if (tty->ops->set_termiox)
+                tty->ops->set_termiox(tty, &tnew);
+        mutex_unlock(&tty->termios_mutex);
+        return 0;
 }
+#endif
 #ifdef TIOCGETP
 /*
 * These are deprecated, but there is limited support..
@@ -671,7 +738,7 @@ static void set_sgflags(struct ktermios *termios, int flags)
 *      Updates a terminal from the legacy BSD style terminal information
 *      structure.
 *
- *      Locking: termios_sem
+ *      Locking: termios_mutex
 */
 static int set_sgttyb(struct tty_struct *tty, struct sgttyb __user *sgttyb)
@@ -849,6 +916,7 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
 {
        struct tty_struct *real_tty;
        void __user *p = (void __user *)arg;
+        int ret = 0;
        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
            tty->driver->subtype == PTY_TYPE_MASTER)
@@ -884,18 +952,24 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                return set_termios(real_tty, p, TERMIOS_OLD);
 #ifndef TCGETS2
        case TCGETS:
+                mutex_lock(&real_tty->termios_mutex);
                if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
 #else
        case TCGETS:
+                mutex_lock(&real_tty->termios_mutex);
                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
        case TCGETS2:
+                mutex_lock(&real_tty->termios_mutex);
                if (kernel_termios_to_user_termios((struct termios2 __user *)arg, real_tty->termios))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
        case TCSETSF2:
                return set_termios(real_tty, p,  TERMIOS_FLUSH | TERMIOS_WAIT);
        case TCSETSW2:
@@ -913,34 +987,59 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
                return set_termios(real_tty, p, TERMIOS_TERMIO);
 #ifndef TCGETS2
        case TIOCGLCKTRMIOS:
+                mutex_lock(&real_tty->termios_mutex);
                if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
        case TIOCSLCKTRMIOS:
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
+                mutex_lock(&real_tty->termios_mutex);
                if (user_termios_to_kernel_termios(real_tty->termios_locked,
                                               (struct termios __user *) arg))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
 #else
        case TIOCGLCKTRMIOS:
+                mutex_lock(&real_tty->termios_mutex);
                if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
        case TIOCSLCKTRMIOS:
                if (!capable(CAP_SYS_ADMIN))
-                        return -EPERM;
+                        ret = -EPERM;
+                mutex_lock(&real_tty->termios_mutex);
                if (user_termios_to_kernel_termios_1(real_tty->termios_locked,
                                               (struct termios __user *) arg))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                        return 0;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
 #endif
+#ifdef TCGETX
+        case TCGETX:
+                if (real_tty->termiox == NULL)
+                        return -EINVAL;
+                mutex_lock(&real_tty->termios_mutex);
+                if (copy_to_user(p, real_tty->termiox, sizeof(struct termiox)))
+                        ret = -EFAULT;
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
+        case TCSETX:
+                return set_termiox(real_tty, p, 0);
+        case TCSETXW:
+                return set_termiox(real_tty, p, TERMIOS_WAIT);
+        case TCSETXF:
+                return set_termiox(real_tty, p, TERMIOS_FLUSH);
+#endif          
        case TIOCGSOFTCAR:
-                /* FIXME: for correctness we may need to take the termios
+                mutex_lock(&real_tty->termios_mutex);
-                   lock here - review */
+                ret = put_user(C_CLOCAL(real_tty) ? 1 : 0,
-                return put_user(C_CLOCAL(real_tty) ? 1 : 0,
                                                (int __user *)arg);
+                mutex_unlock(&real_tty->termios_mutex);
+                return ret;
        case TIOCSSOFTCAR:
                if (get_user(arg, (unsigned int __user *) arg))
                        return -EFAULT;
@@ -980,7 +1079,7 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
 }
 EXPORT_SYMBOL_GPL(tty_perform_flush);
-int n_tty_ioctl(struct tty_struct *tty, struct file *file,
+int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                       unsigned int cmd, unsigned long arg)
 {
        unsigned long flags;
@@ -1018,13 +1117,6 @@ int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                return 0;
        case TCFLSH:
                return tty_perform_flush(tty, arg);
-        case TIOCOUTQ:
-                return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
-        case TIOCINQ:
-                retval = tty->read_cnt;
-                if (L_ICANON(tty))
-                        retval = inq_canon(tty);
-                return put_user(retval, (unsigned int __user *) arg);
        case TIOCPKT:
        {
                int pktmode;
@@ -1050,4 +1142,4 @@ int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                return tty_mode_ioctl(tty, file, cmd, arg);
        }
 }
-EXPORT_SYMBOL(n_tty_ioctl);
+EXPORT_SYMBOL(n_tty_ioctl_helper);
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
new file mode 100644
index 000000000000..553b0e9d8d17
--- /dev/null
+++ b/drivers/char/tty_port.c
@@ -0,0 +1,96 @@
+/*
+ * Tty port functions
+ */
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+#include <linux/timer.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <linux/bitops.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+void tty_port_init(struct tty_port *port)
+{
+        memset(port, 0, sizeof(*port));
+        init_waitqueue_head(&port->open_wait);
+        init_waitqueue_head(&port->close_wait);
+        mutex_init(&port->mutex);
+        spin_lock_init(&port->lock);
+        port->close_delay = (50 * HZ) / 100;
+        port->closing_wait = (3000 * HZ) / 100;
+}
+EXPORT_SYMBOL(tty_port_init);
+int tty_port_alloc_xmit_buf(struct tty_port *port)
+{
+        /* We may sleep in get_zeroed_page() */
+        mutex_lock(&port->mutex);
+        if (port->xmit_buf == NULL)
+                port->xmit_buf = (unsigned char *)get_zeroed_page(GFP_KERNEL);
+        mutex_unlock(&port->mutex);
+        if (port->xmit_buf == NULL)
+                return -ENOMEM;
+        return 0;
+}
+EXPORT_SYMBOL(tty_port_alloc_xmit_buf);
+void tty_port_free_xmit_buf(struct tty_port *port)
+{
+        mutex_lock(&port->mutex);
+        if (port->xmit_buf != NULL) {
+                free_page((unsigned long)port->xmit_buf);
+                port->xmit_buf = NULL;
+        }
+        mutex_unlock(&port->mutex);
+}
+EXPORT_SYMBOL(tty_port_free_xmit_buf);
+/**
+ *      tty_port_tty_get        -       get a tty reference
+ *      @port: tty port
+ *
+ *      Return a refcount protected tty instance or NULL if the port is not
+ *      associated with a tty (eg due to close or hangup)
+ */
+struct tty_struct *tty_port_tty_get(struct tty_port *port)
+{
+        unsigned long flags;
+        struct tty_struct *tty;
+        spin_lock_irqsave(&port->lock, flags);
+        tty = tty_kref_get(port->tty);
+        spin_unlock_irqrestore(&port->lock, flags);
+        return tty;
+}
+EXPORT_SYMBOL(tty_port_tty_get);
+/**
+ *      tty_port_tty_set        -       set the tty of a port
+ *      @port: tty port
+ *      @tty: the tty
+ *
+ *      Associate the port and tty pair. Manages any internal refcounts.
+ *      Pass NULL to deassociate a port
+ */
+void tty_port_tty_set(struct tty_port *port, struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&port->lock, flags);
+        if (port->tty)
+                tty_kref_put(port->tty);
+        port->tty = tty;
+        spin_unlock_irqrestore(&port->lock, flags);
+}
+EXPORT_SYMBOL(tty_port_tty_set);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 60359c360912..57029fefd64a 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -100,10 +100,10 @@
 #include <linux/font.h>
 #include <linux/bitops.h>
 #include <linux/notifier.h>
+#include <linux/device.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #define MAX_NR_CON_DRIVER 16
@@ -2136,27 +2136,9 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
            release_console_sem();
            return 0;
        }
-        release_console_sem();
        orig_buf = buf;
        orig_count = count;
-        /* At this point 'buf' is guaranteed to be a kernel buffer
-         * and therefore no access to userspace (and therefore sleeping)
-         * will be needed.  The con_buf_mtx serializes all tty based
-         * console rendering and vcs write/read operations.  We hold
-         * the console spinlock during the entire write.
-         */
-        acquire_console_sem();
-        vc = tty->driver_data;
-        if (vc == NULL) {
-                printk(KERN_ERR "vt: argh, driver_data _became_ NULL !\n");
-                release_console_sem();
-                goto out;
-        }
        himask = vc->vc_hi_font_mask;
        charmask = himask ? 0x1ff : 0xff;
@@ -2370,8 +2352,6 @@ rescan_last_byte:
        FLUSH
        console_conditional_schedule();
        release_console_sem();
-out:
        notify_update(vc);
        return n;
 #undef FLUSH
@@ -2583,8 +2563,6 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
        int lines;
        int ret;
-        if (tty->driver->type != TTY_DRIVER_TYPE_CONSOLE)
-                return -EINVAL;
        if (current->signal->tty != tty && !capable(CAP_SYS_ADMIN))
                return -EPERM;
        if (get_user(type, p))
@@ -2778,6 +2756,12 @@ static int con_open(struct tty_struct *tty, struct file *filp)
                ret = vc_allocate(currcons);
                if (ret == 0) {
                        struct vc_data *vc = vc_cons[currcons].d;
+                        /* Still being freed */
+                        if (vc->vc_tty) {
+                                release_console_sem();
+                                return -ERESTARTSYS;
+                        }
                        tty->driver_data = vc;
                        vc->vc_tty = tty;
@@ -2798,34 +2782,20 @@ static int con_open(struct tty_struct *tty, struct file *filp)
        return ret;
 }
-/*
- * We take tty_mutex in here to prevent another thread from coming in via init_dev
- * and taking a ref against the tty while we're in the process of forgetting
- * about it and cleaning things up.
- *
- * This is because vcs_remove_sysfs() can sleep and will drop the BKL.
- */
 static void con_close(struct tty_struct *tty, struct file *filp)
 {
-        mutex_lock(&tty_mutex);
+        /* Nothing to do - we defer to shutdown */
-        acquire_console_sem();
+}
-        if (tty && tty->count == 1) {
-                struct vc_data *vc = tty->driver_data;
-                if (vc)
+static void con_shutdown(struct tty_struct *tty)
-                        vc->vc_tty = NULL;
+{
-                tty->driver_data = NULL;
+        struct vc_data *vc = tty->driver_data;
-                vcs_remove_sysfs(tty);
+        BUG_ON(vc == NULL);
-                release_console_sem();
+        acquire_console_sem();
-                mutex_unlock(&tty_mutex);
+        vc->vc_tty = NULL;
-                /*
+        vcs_remove_sysfs(tty);
-                 * tty_mutex is released, but we still hold BKL, so there is
-                 * still exclusion against init_dev()
-                 */
-                return;
-        }
        release_console_sem();
-        mutex_unlock(&tty_mutex);
+        tty_shutdown(tty);
 }
 static int default_italic_color    = 2; // green (ASCII)
@@ -2950,10 +2920,19 @@ static const struct tty_operations con_ops = {
        .throttle = con_throttle,
        .unthrottle = con_unthrottle,
        .resize = vt_resize,
+        .shutdown = con_shutdown
 };
-int __init vty_init(void)
+static struct cdev vc0_cdev;
+int __init vty_init(const struct file_operations *console_fops)
 {
+        cdev_init(&vc0_cdev, console_fops);
+        if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
+            register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
+                panic("Couldn't register /dev/tty0 driver\n");
+        device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), NULL, "tty0");
        vcs_init();
        console_driver = alloc_tty_driver(MAX_NR_CONSOLES);
@@ -2972,7 +2951,6 @@ int __init vty_init(void)
        tty_set_operations(console_driver, &con_ops);
        if (tty_register_driver(console_driver))
                panic("Couldn't register console driver\n");
        kbd_init();
        console_map_init();
 #ifdef CONFIG_PROM_CONSOLE
@@ -3466,7 +3444,7 @@ int register_con_driver(const struct consw *csw, int first, int last)
        if (retval)
                goto err;
-        con_driver->dev = device_create_drvdata(vtconsole_class, NULL,
+        con_driver->dev = device_create(vtconsole_class, NULL,
                                                MKDEV(0, con_driver->node),
                                                NULL, "vtcon%i",
                                                con_driver->node);
@@ -3577,7 +3555,7 @@ static int __init vtconsole_class_init(void)
                struct con_driver *con = &registered_con_driver[i];
                if (con->con && !con->dev) {
-                        con->dev = device_create_drvdata(vtconsole_class, NULL,
+                        con->dev = device_create(vtconsole_class, NULL,
                                                         MKDEV(0, con->node),
                                                         NULL, "vtcon%i",
                                                         con->node);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index c904e9ad4a71..8944ce508e2f 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -395,6 +395,8 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
 
        kbd = kbd_table + console;
        switch (cmd) {
+        case TIOCLINUX:
+                return tioclinux(tty, arg);
        case KIOCSOUND:
                if (!perm)
                        goto eperm;
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 871b0cbca5e4..798d7f3e42ef 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -1231,7 +1231,7 @@ static int capinc_tty_ioctl(struct tty_struct *tty, struct file * file,
        int error = 0;
        switch (cmd) {
        default:
-                error = n_tty_ioctl (tty, file, cmd, arg);
+                error = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
        }
        return error;
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 5e89fa177816..07052ed2a0c5 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -571,6 +571,7 @@ gigaset_tty_close(struct tty_struct *tty)
        }
        /* prevent other callers from entering ldisc methods */
+        /* FIXME: should use the tty state flags */
        tty->disc_data = NULL;
        if (!cs->hw.ser)
@@ -642,10 +643,11 @@ gigaset_tty_ioctl(struct tty_struct *tty, struct file *file,
                return -ENXIO;
        switch (cmd) {
-        case TCGETS:
-        case TCGETA:
+        case FIONREAD:
-                /* pass through to underlying serial device */
+                /* unused, always return zero */
-                rc = n_tty_ioctl(tty, file, cmd, arg);
+                val = 0;
+                rc = put_user(val, p);
                break;
        case TCFLSH:
@@ -659,20 +661,13 @@ gigaset_tty_ioctl(struct tty_struct *tty, struct file *file,
                        flush_send_queue(cs);
                        break;
                }
-                /* flush the serial port's buffer */
+                /* Pass through */
-                rc = n_tty_ioctl(tty, file, cmd, arg);
-                break;
-        case FIONREAD:
-                /* unused, always return zero */
-                val = 0;
-                rc = put_user(val, p);
-                break;
        default:
-                rc = -ENOIOCTLCMD;
+                /* pass through to underlying serial device */
+                rc = n_tty_ioctl_helper(tty, file, cmd, arg);
+                break;
        }
        cs_put(cs);
        return rc;
 }
@@ -680,6 +675,8 @@ gigaset_tty_ioctl(struct tty_struct *tty, struct file *file,
 /*
 * Poll on the tty.
 * Unused, always return zero.
+ *
+ * FIXME: should probably return an exception - especially on hangup
 */
 static unsigned int
 gigaset_tty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 5405c30dbb04..08efbe7254ff 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -2092,15 +2092,8 @@ static int cafe_pci_probe(struct pci_dev *pdev,
                const struct pci_device_id *id)
 {
        int ret;
-        u16 classword;
        struct cafe_camera *cam;
-        /*
-         * Make sure we have a camera here - we'll get calls for
-         * the other cafe devices as well.
-         */
-        pci_read_config_word(pdev, PCI_CLASS_DEVICE, &classword);
-        if (classword != PCI_CLASS_MULTIMEDIA_VIDEO)
-                return -ENODEV;
        /*
         * Start putting together one of our big camera structures.
         */
@@ -2288,8 +2281,8 @@ static int cafe_pci_resume(struct pci_dev *pdev)
 static struct pci_device_id cafe_ids[] = {
-        { PCI_DEVICE(0x11ab, 0x4100) }, /* Eventual real ID */
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL,
-        { PCI_DEVICE(0x11ab, 0x4102) }, /* Really eventual real ID */
+                     PCI_DEVICE_ID_MARVELL_88ALP01_CCIC) },
        { 0, }
 };
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 0a84f10d719c..9bd7026b0021 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -327,7 +327,7 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
        {
                .vendor         = PCI_VENDOR_ID_MARVELL,
-                .device         = PCI_DEVICE_ID_MARVELL_CAFE_SD,
+                .device         = PCI_DEVICE_ID_MARVELL_88ALP01_SD,
                .subvendor      = PCI_ANY_ID,
                .subdevice      = PCI_ANY_ID,
                .driver_data    = (kernel_ulong_t)&sdhci_cafe,
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index 95345d051579..b8064bf3aee4 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -1,6 +1,9 @@
 /*
 * Driver for One Laptop Per Child ‘CAFÉ’ controller, aka Marvell 88ALP01
 *
+ * The data sheet for this device can be found at:
+ *    http://www.marvell.com/products/pcconn/88ALP01.jsp
+ *
 * Copyright © 2006 Red Hat, Inc.
 * Copyright © 2006 David Woodhouse <dwmw2@infradead.org>
 */
@@ -842,7 +845,8 @@ static void __devexit cafe_nand_remove(struct pci_dev *pdev)
 }
 static struct pci_device_id cafe_nand_tbl[] = {
-        { 0x11ab, 0x4100, PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_MARVELL, PCI_DEVICE_ID_MARVELL_88ALP01_NAND,
+          PCI_ANY_ID, PCI_ANY_ID },
        { }
 };
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index 2ae2ec40015d..21efd99b9294 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -205,7 +205,7 @@ config WANXL_BUILD_FIRMWARE
 config PC300
        tristate "Cyclades-PC300 support (RS-232/V.35, X.21, T1/E1 boards)"
-        depends on HDLC && PCI
+        depends on HDLC && PCI && BROKEN
        ---help---
          Driver for the Cyclades-PC300 synchronous communication boards.
diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
index 9304c4555079..ed982273fb8b 100644
--- a/drivers/oprofile/buffer_sync.c
+++ b/drivers/oprofile/buffer_sync.c
@@ -5,6 +5,7 @@
 * @remark Read the file COPYING
 *
 * @author John Levon <levon@movementarian.org>
+ * @author Barry Kasindorf
 *
 * This is the core of the buffer management. Each
 * CPU buffer is processed and entered into the
@@ -33,7 +34,7 @@
 #include "event_buffer.h"
 #include "cpu_buffer.h"
 #include "buffer_sync.h"
- 
 static LIST_HEAD(dying_tasks);
 static LIST_HEAD(dead_tasks);
 static cpumask_t marked_cpus = CPU_MASK_NONE;
@@ -48,10 +49,11 @@ static void process_task_mortuary(void);
 * Can be invoked from softirq via RCU callback due to
 * call_rcu() of the task struct, hence the _irqsave.
 */
-static int task_free_notify(struct notifier_block * self, unsigned long val, void * data)
+static int
+task_free_notify(struct notifier_block *self, unsigned long val, void *data)
 {
        unsigned long flags;
-        struct task_struct * task = data;
+        struct task_struct *task = data;
        spin_lock_irqsave(&task_mortuary, flags);
        list_add(&task->tasks, &dying_tasks);
        spin_unlock_irqrestore(&task_mortuary, flags);
@@ -62,13 +64,14 @@ static int task_free_notify(struct notifier_block * self, unsigned long val, voi
 /* The task is on its way out. A sync of the buffer means we can catch
 * any remaining samples for this task.
 */
-static int task_exit_notify(struct notifier_block * self, unsigned long val, void * data)
+static int
+task_exit_notify(struct notifier_block *self, unsigned long val, void *data)
 {
        /* To avoid latency problems, we only process the current CPU,
         * hoping that most samples for the task are on this CPU
         */
        sync_buffer(raw_smp_processor_id());
-        return 0;
+        return 0;
 }
@@ -77,11 +80,12 @@ static int task_exit_notify(struct notifier_block * self, unsigned long val, voi
 * we don't lose any. This does not have to be exact, it's a QoI issue
 * only.
 */
-static int munmap_notify(struct notifier_block * self, unsigned long val, void * data)
+static int
+munmap_notify(struct notifier_block *self, unsigned long val, void *data)
 {
        unsigned long addr = (unsigned long)data;
-        struct mm_struct * mm = current->mm;
+        struct mm_struct *mm = current->mm;
-        struct vm_area_struct * mpnt;
+        struct vm_area_struct *mpnt;
        down_read(&mm->mmap_sem);
@@ -99,11 +103,12 @@ static int munmap_notify(struct notifier_block * self, unsigned long val, void *
        return 0;
 }
- 
 /* We need to be told about new modules so we don't attribute to a previously
 * loaded module, or drop the samples on the floor.
 */
-static int module_load_notify(struct notifier_block * self, unsigned long val, void * data)
+static int
+module_load_notify(struct notifier_block *self, unsigned long val, void *data)
 {
 #ifdef CONFIG_MODULES
        if (val != MODULE_STATE_COMING)
@@ -118,7 +123,7 @@ static int module_load_notify(struct notifier_block * self, unsigned long val, v
        return 0;
 }
- 
 static struct notifier_block task_free_nb = {
        .notifier_call  = task_free_notify,
 };
@@ -135,7 +140,7 @@ static struct notifier_block module_load_nb = {
        .notifier_call = module_load_notify,
 };
- 
 static void end_sync(void)
 {
        end_cpu_work();
@@ -208,14 +213,14 @@ static inline unsigned long fast_get_dcookie(struct path *path)
 * not strictly necessary but allows oprofile to associate
 * shared-library samples with particular applications
 */
-static unsigned long get_exec_dcookie(struct mm_struct * mm)
+static unsigned long get_exec_dcookie(struct mm_struct *mm)
 {
        unsigned long cookie = NO_COOKIE;
-        struct vm_area_struct * vma;
+        struct vm_area_struct *vma;
- 
        if (!mm)
                goto out;
- 
        for (vma = mm->mmap; vma; vma = vma->vm_next) {
                if (!vma->vm_file)
                        continue;
@@ -235,13 +240,14 @@ out:
 * sure to do this lookup before a mm->mmap modification happens so
 * we don't lose track.
 */
-static unsigned long lookup_dcookie(struct mm_struct * mm, unsigned long addr, off_t * offset)
+static unsigned long
+lookup_dcookie(struct mm_struct *mm, unsigned long addr, off_t *offset)
 {
        unsigned long cookie = NO_COOKIE;
-        struct vm_area_struct * vma;
+        struct vm_area_struct *vma;
        for (vma = find_vma(mm, addr); vma; vma = vma->vm_next) {
- 
                if (addr < vma->vm_start || addr >= vma->vm_end)
                        continue;
@@ -263,9 +269,20 @@ static unsigned long lookup_dcookie(struct mm_struct * mm, unsigned long addr, o
        return cookie;
 }
+static void increment_tail(struct oprofile_cpu_buffer *b)
+{
+        unsigned long new_tail = b->tail_pos + 1;
+        rmb();  /* be sure fifo pointers are synchromized */
+        if (new_tail < b->buffer_size)
+                b->tail_pos = new_tail;
+        else
+                b->tail_pos = 0;
+}
 static unsigned long last_cookie = INVALID_COOKIE;
- 
 static void add_cpu_switch(int i)
 {
        add_event_entry(ESCAPE_CODE);
@@ -278,16 +295,16 @@ static void add_kernel_ctx_switch(unsigned int in_kernel)
 {
        add_event_entry(ESCAPE_CODE);
        if (in_kernel)
-                add_event_entry(KERNEL_ENTER_SWITCH_CODE); 
+                add_event_entry(KERNEL_ENTER_SWITCH_CODE);
        else
-                add_event_entry(KERNEL_EXIT_SWITCH_CODE); 
+                add_event_entry(KERNEL_EXIT_SWITCH_CODE);
 }
- 
 static void
-add_user_ctx_switch(struct task_struct const * task, unsigned long cookie)
+add_user_ctx_switch(struct task_struct const *task, unsigned long cookie)
 {
        add_event_entry(ESCAPE_CODE);
-        add_event_entry(CTX_SWITCH_CODE); 
+        add_event_entry(CTX_SWITCH_CODE);
        add_event_entry(task->pid);
        add_event_entry(cookie);
        /* Another code for daemon back-compat */
@@ -296,7 +313,7 @@ add_user_ctx_switch(struct task_struct const * task, unsigned long cookie)
        add_event_entry(task->tgid);
 }
- 
 static void add_cookie_switch(unsigned long cookie)
 {
        add_event_entry(ESCAPE_CODE);
@@ -304,13 +321,78 @@ static void add_cookie_switch(unsigned long cookie)
        add_event_entry(cookie);
 }
- 
 static void add_trace_begin(void)
 {
        add_event_entry(ESCAPE_CODE);
        add_event_entry(TRACE_BEGIN_CODE);
 }
+#ifdef CONFIG_OPROFILE_IBS
+#define IBS_FETCH_CODE_SIZE     2
+#define IBS_OP_CODE_SIZE        5
+#define IBS_EIP(offset)                         \
+        (((struct op_sample *)&cpu_buf->buffer[(offset)])->eip)
+#define IBS_EVENT(offset)                               \
+        (((struct op_sample *)&cpu_buf->buffer[(offset)])->event)
+/*
+ * Add IBS fetch and op entries to event buffer
+ */
+static void add_ibs_begin(struct oprofile_cpu_buffer *cpu_buf, int code,
+        int in_kernel, struct mm_struct *mm)
+{
+        unsigned long rip;
+        int i, count;
+        unsigned long ibs_cookie = 0;
+        off_t offset;
+        increment_tail(cpu_buf);        /* move to RIP entry */
+        rip = IBS_EIP(cpu_buf->tail_pos);
+#ifdef __LP64__
+        rip += IBS_EVENT(cpu_buf->tail_pos) << 32;
+#endif
+        if (mm) {
+                ibs_cookie = lookup_dcookie(mm, rip, &offset);
+                if (ibs_cookie == NO_COOKIE)
+                        offset = rip;
+                if (ibs_cookie == INVALID_COOKIE) {
+                        atomic_inc(&oprofile_stats.sample_lost_no_mapping);
+                        offset = rip;
+                }
+                if (ibs_cookie != last_cookie) {
+                        add_cookie_switch(ibs_cookie);
+                        last_cookie = ibs_cookie;
+                }
+        } else
+                offset = rip;
+        add_event_entry(ESCAPE_CODE);
+        add_event_entry(code);
+        add_event_entry(offset);        /* Offset from Dcookie */
+        /* we send the Dcookie offset, but send the raw Linear Add also*/
+        add_event_entry(IBS_EIP(cpu_buf->tail_pos));
+        add_event_entry(IBS_EVENT(cpu_buf->tail_pos));
+        if (code == IBS_FETCH_CODE)
+                count = IBS_FETCH_CODE_SIZE;    /*IBS FETCH is 2 int64s*/
+        else
+                count = IBS_OP_CODE_SIZE;       /*IBS OP is 5 int64s*/
+        for (i = 0; i < count; i++) {
+                increment_tail(cpu_buf);
+                add_event_entry(IBS_EIP(cpu_buf->tail_pos));
+                add_event_entry(IBS_EVENT(cpu_buf->tail_pos));
+        }
+}
+#endif
 static void add_sample_entry(unsigned long offset, unsigned long event)
 {
@@ -319,13 +401,13 @@ static void add_sample_entry(unsigned long offset, unsigned long event)
 }
-static int add_us_sample(struct mm_struct * mm, struct op_sample * s)
+static int add_us_sample(struct mm_struct *mm, struct op_sample *s)
 {
        unsigned long cookie;
        off_t offset;
- 
-        cookie = lookup_dcookie(mm, s->eip, &offset);
+        cookie = lookup_dcookie(mm, s->eip, &offset);
- 
        if (cookie == INVALID_COOKIE) {
                atomic_inc(&oprofile_stats.sample_lost_no_mapping);
                return 0;
@@ -341,13 +423,13 @@ static int add_us_sample(struct mm_struct * mm, struct op_sample * s)
        return 1;
 }
- 
 /* Add a sample to the global event buffer. If possible the
 * sample is converted into a persistent dentry/offset pair
 * for later lookup from userspace.
 */
 static int
-add_sample(struct mm_struct * mm, struct op_sample * s, int in_kernel)
+add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
 {
        if (in_kernel) {
                add_sample_entry(s->eip, s->event);
@@ -359,9 +441,9 @@ add_sample(struct mm_struct * mm, struct op_sample * s, int in_kernel)
        }
        return 0;
 }
- 
-static void release_mm(struct mm_struct * mm)
+static void release_mm(struct mm_struct *mm)
 {
        if (!mm)
                return;
@@ -370,9 +452,9 @@ static void release_mm(struct mm_struct * mm)
 }
-static struct mm_struct * take_tasks_mm(struct task_struct * task)
+static struct mm_struct *take_tasks_mm(struct task_struct *task)
 {
-        struct mm_struct * mm = get_task_mm(task);
+        struct mm_struct *mm = get_task_mm(task);
        if (mm)
                down_read(&mm->mmap_sem);
        return mm;
@@ -383,10 +465,10 @@ static inline int is_code(unsigned long val)
 {
        return val == ESCAPE_CODE;
 }
- 
 /* "acquire" as many cpu buffer slots as we can */
-static unsigned long get_slots(struct oprofile_cpu_buffer * b)
+static unsigned long get_slots(struct oprofile_cpu_buffer *b)
 {
        unsigned long head = b->head_pos;
        unsigned long tail = b->tail_pos;
@@ -412,19 +494,6 @@ static unsigned long get_slots(struct oprofile_cpu_buffer * b)
 }
-static void increment_tail(struct oprofile_cpu_buffer * b)
-{
-        unsigned long new_tail = b->tail_pos + 1;
-        rmb();
-        if (new_tail < b->buffer_size)
-                b->tail_pos = new_tail;
-        else
-                b->tail_pos = 0;
-}
 /* Move tasks along towards death. Any tasks on dead_tasks
 * will definitely have no remaining references in any
 * CPU buffers at this point, because we use two lists,
@@ -435,8 +504,8 @@ static void process_task_mortuary(void)
 {
        unsigned long flags;
        LIST_HEAD(local_dead_tasks);
-        struct task_struct * task;
+        struct task_struct *task;
-        struct task_struct * ttask;
+        struct task_struct *ttask;
        spin_lock_irqsave(&task_mortuary, flags);
@@ -493,7 +562,7 @@ void sync_buffer(int cpu)
 {
        struct oprofile_cpu_buffer *cpu_buf = &per_cpu(cpu_buffer, cpu);
        struct mm_struct *mm = NULL;
-        struct task_struct * new;
+        struct task_struct *new;
        unsigned long cookie = 0;
        int in_kernel = 1;
        unsigned int i;
@@ -501,7 +570,7 @@ void sync_buffer(int cpu)
        unsigned long available;
        mutex_lock(&buffer_mutex);
- 
        add_cpu_switch(cpu);
        /* Remember, only we can modify tail_pos */
@@ -509,8 +578,8 @@ void sync_buffer(int cpu)
        available = get_slots(cpu_buf);
        for (i = 0; i < available; ++i) {
-                struct op_sample * s = &cpu_buf->buffer[cpu_buf->tail_pos];
+                struct op_sample *s = &cpu_buf->buffer[cpu_buf->tail_pos];
- 
                if (is_code(s->eip)) {
                        if (s->event <= CPU_IS_KERNEL) {
                                /* kernel/userspace switch */
@@ -521,8 +590,18 @@ void sync_buffer(int cpu)
                        } else if (s->event == CPU_TRACE_BEGIN) {
                                state = sb_bt_start;
                                add_trace_begin();
+#ifdef CONFIG_OPROFILE_IBS
+                        } else if (s->event == IBS_FETCH_BEGIN) {
+                                state = sb_bt_start;
+                                add_ibs_begin(cpu_buf,
+                                        IBS_FETCH_CODE, in_kernel, mm);
+                        } else if (s->event == IBS_OP_BEGIN) {
+                                state = sb_bt_start;
+                                add_ibs_begin(cpu_buf,
+                                        IBS_OP_CODE, in_kernel, mm);
+#endif
                        } else {
-                                struct mm_struct * oldmm = mm;
+                                struct mm_struct *oldmm = mm;
                                /* userspace context switch */
                                new = (struct task_struct *)s->event;
@@ -533,13 +612,11 @@ void sync_buffer(int cpu)
                                        cookie = get_exec_dcookie(mm);
                                add_user_ctx_switch(new, cookie);
                        }
-                } else {
+                } else if (state >= sb_bt_start &&
-                        if (state >= sb_bt_start &&
+                           !add_sample(mm, s, in_kernel)) {
-                            !add_sample(mm, s, in_kernel)) {
+                        if (state == sb_bt_start) {
-                                if (state == sb_bt_start) {
+                                state = sb_bt_ignore;
-                                        state = sb_bt_ignore;
+                                atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-                                        atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-                                }
                        }
                }
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 7ba78e6d210e..e1bd5a937f6c 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -5,6 +5,7 @@
 * @remark Read the file COPYING
 *
 * @author John Levon <levon@movementarian.org>
+ * @author Barry Kasindorf <barry.kasindorf@amd.com>
 *
 * Each CPU has a local buffer that stores PC value/event
 * pairs. We also log context switches when we notice them.
@@ -209,7 +210,7 @@ static int log_sample(struct oprofile_cpu_buffer * cpu_buf, unsigned long pc,
        return 1;
 }
-static int oprofile_begin_trace(struct oprofile_cpu_buffer * cpu_buf)
+static int oprofile_begin_trace(struct oprofile_cpu_buffer *cpu_buf)
 {
        if (nr_available_slots(cpu_buf) < 4) {
                cpu_buf->sample_lost_overflow++;
@@ -254,6 +255,75 @@ void oprofile_add_sample(struct pt_regs * const regs, unsigned long event)
        oprofile_add_ext_sample(pc, regs, event, is_kernel);
 }
+#ifdef CONFIG_OPROFILE_IBS
+#define MAX_IBS_SAMPLE_SIZE     14
+static int log_ibs_sample(struct oprofile_cpu_buffer *cpu_buf,
+        unsigned long pc, int is_kernel, unsigned  int *ibs, int ibs_code)
+{
+        struct task_struct *task;
+        cpu_buf->sample_received++;
+        if (nr_available_slots(cpu_buf) < MAX_IBS_SAMPLE_SIZE) {
+                cpu_buf->sample_lost_overflow++;
+                return 0;
+        }
+        is_kernel = !!is_kernel;
+        /* notice a switch from user->kernel or vice versa */
+        if (cpu_buf->last_is_kernel != is_kernel) {
+                cpu_buf->last_is_kernel = is_kernel;
+                add_code(cpu_buf, is_kernel);
+        }
+        /* notice a task switch */
+        if (!is_kernel) {
+                task = current;
+                if (cpu_buf->last_task != task) {
+                        cpu_buf->last_task = task;
+                        add_code(cpu_buf, (unsigned long)task);
+                }
+        }
+        add_code(cpu_buf, ibs_code);
+        add_sample(cpu_buf, ibs[0], ibs[1]);
+        add_sample(cpu_buf, ibs[2], ibs[3]);
+        add_sample(cpu_buf, ibs[4], ibs[5]);
+        if (ibs_code == IBS_OP_BEGIN) {
+        add_sample(cpu_buf, ibs[6], ibs[7]);
+        add_sample(cpu_buf, ibs[8], ibs[9]);
+        add_sample(cpu_buf, ibs[10], ibs[11]);
+        }
+        return 1;
+}
+void oprofile_add_ibs_sample(struct pt_regs *const regs,
+                                unsigned int * const ibs_sample, u8 code)
+{
+        int is_kernel = !user_mode(regs);
+        unsigned long pc = profile_pc(regs);
+        struct oprofile_cpu_buffer *cpu_buf =
+                         &per_cpu(cpu_buffer, smp_processor_id());
+        if (!backtrace_depth) {
+                log_ibs_sample(cpu_buf, pc, is_kernel, ibs_sample, code);
+                return;
+        }
+        /* if log_sample() fails we can't backtrace since we lost the source
+        * of this event */
+        if (log_ibs_sample(cpu_buf, pc, is_kernel, ibs_sample, code))
+                oprofile_ops.backtrace(regs, backtrace_depth);
+}
+#endif
 void oprofile_add_pc(unsigned long pc, int is_kernel, unsigned long event)
 {
        struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(cpu_buffer);
@@ -296,7 +366,7 @@ static void wq_sync_buffer(struct work_struct *work)
        struct oprofile_cpu_buffer * b =
                container_of(work, struct oprofile_cpu_buffer, work.work);
        if (b->cpu != smp_processor_id()) {
-                printk("WQ on CPU%d, prefer CPU%d\n",
+                printk(KERN_DEBUG "WQ on CPU%d, prefer CPU%d\n",
                       smp_processor_id(), b->cpu);
        }
        sync_buffer(b->cpu);
diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h
index c3e366b52261..9c44d004da69 100644
--- a/drivers/oprofile/cpu_buffer.h
+++ b/drivers/oprofile/cpu_buffer.h
@@ -55,5 +55,7 @@ void cpu_buffer_reset(struct oprofile_cpu_buffer * cpu_buf);
 /* transient events for the CPU buffer -> event buffer */
 #define CPU_IS_KERNEL 1
 #define CPU_TRACE_BEGIN 2
+#define IBS_FETCH_BEGIN 3
+#define IBS_OP_BEGIN    4
 #endif /* OPROFILE_CPU_BUFFER_H */
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index d18e6d2e0b49..40759c33477d 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -418,25 +418,22 @@ fs3270_open(struct inode *inode, struct file *filp)
 {
        struct fs3270 *fp;
        struct idal_buffer *ib;
-        int minor, rc;
+        int minor, rc = 0;
        if (imajor(filp->f_path.dentry->d_inode) != IBM_FS3270_MAJOR)
                return -ENODEV;
-        lock_kernel();
        minor = iminor(filp->f_path.dentry->d_inode);
        /* Check for minor 0 multiplexer. */
        if (minor == 0) {
-                struct tty_struct *tty;
+                struct tty_struct *tty = get_current_tty();
-                mutex_lock(&tty_mutex);
-                tty = get_current_tty();
                if (!tty || tty->driver->major != IBM_TTY3270_MAJOR) {
-                        mutex_unlock(&tty_mutex);
+                        tty_kref_put(tty);
-                        rc = -ENODEV;
+                        return -ENODEV;
-                        goto out;
                }
                minor = tty->index + RAW3270_FIRSTMINOR;
-                mutex_unlock(&tty_mutex);
+                tty_kref_put(tty);
        }
+        lock_kernel();
        /* Check if some other program is already using fullscreen mode. */
        fp = (struct fs3270 *) raw3270_find_view(&fs3270_fn, minor);
        if (!IS_ERR(fp)) {
@@ -478,7 +475,7 @@ fs3270_open(struct inode *inode, struct file *filp)
        filp->private_data = fp;
 out:
        unlock_kernel();
-        return 0;
+        return rc;
 }
 /*
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 9ccc563d8730..d4104a3bbe87 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -44,6 +44,10 @@
 #include "8250.h"
+#ifdef CONFIG_SPARC
+#include "suncore.h"
+#endif
 /*
 * Configuration:
 *   share_irqs - whether we pass IRQF_SHARED to request_irq().  This option
@@ -53,6 +57,13 @@ static unsigned int share_irqs = SERIAL8250_SHARE_IRQS;
 static unsigned int nr_uarts = CONFIG_SERIAL_8250_RUNTIME_UARTS;
+static struct uart_driver serial8250_reg;
+static int serial_index(struct uart_port *port)
+{
+        return (serial8250_reg.minor - 64) + port->line;
+}
 /*
 * Debugging.
 */
@@ -536,7 +547,7 @@ static unsigned int serial_icr_read(struct uart_8250_port *up, int offset)
 /*
 * FIFO support.
 */
-static inline void serial8250_clear_fifos(struct uart_8250_port *p)
+static void serial8250_clear_fifos(struct uart_8250_port *p)
 {
        if (p->capabilities & UART_CAP_FIFO) {
                serial_outp(p, UART_FCR, UART_FCR_ENABLE_FIFO);
@@ -551,7 +562,7 @@ static inline void serial8250_clear_fifos(struct uart_8250_port *p)
 * capability" bit enabled.  Note that on XR16C850s, we need to
 * reset LCR to write to IER.
 */
-static inline void serial8250_set_sleep(struct uart_8250_port *p, int sleep)
+static void serial8250_set_sleep(struct uart_8250_port *p, int sleep)
 {
        if (p->capabilities & UART_CAP_SLEEP) {
                if (p->capabilities & UART_CAP_EFR) {
@@ -993,7 +1004,7 @@ static void autoconfig(struct uart_8250_port *up, unsigned int probeflags)
                return;
        DEBUG_AUTOCONF("ttyS%d: autoconf (0x%04x, 0x%p): ",
-                        up->port.line, up->port.iobase, up->port.membase);
+                       serial_index(&up->port), up->port.iobase, up->port.membase);
        /*
         * We really do need global IRQs disabled here - we're going to
@@ -1128,8 +1139,8 @@ static void autoconfig(struct uart_8250_port *up, unsigned int probeflags)
        if (up->capabilities != uart_config[up->port.type].flags) {
                printk(KERN_WARNING
                       "ttyS%d: detected caps %08x should be %08x\n",
-                        up->port.line, up->capabilities,
+                       serial_index(&up->port), up->capabilities,
-                        uart_config[up->port.type].flags);
+                       uart_config[up->port.type].flags);
        }
        up->port.fifosize = uart_config[up->port.type].fifo_size;
@@ -1424,8 +1435,7 @@ static unsigned int check_modem_status(struct uart_8250_port *up)
 /*
 * This handles the interrupt from one port.
 */
-static inline void
+static void serial8250_handle_port(struct uart_8250_port *up)
-serial8250_handle_port(struct uart_8250_port *up)
 {
        unsigned int status;
        unsigned long flags;
@@ -1719,7 +1729,7 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
 /*
 *      Wait for transmitter & holding register to empty
 */
-static inline void wait_for_xmitr(struct uart_8250_port *up, int bits)
+static void wait_for_xmitr(struct uart_8250_port *up, int bits)
 {
        unsigned int status, tmout = 10000;
@@ -1854,7 +1864,8 @@ static int serial8250_startup(struct uart_port *port)
         */
        if (!(up->port.flags & UPF_BUGGY_UART) &&
            (serial_inp(up, UART_LSR) == 0xff)) {
-                printk("ttyS%d: LSR safety check engaged!\n", up->port.line);
+                printk(KERN_INFO "ttyS%d: LSR safety check engaged!\n",
+                       serial_index(&up->port));
                return -ENODEV;
        }
@@ -1909,7 +1920,8 @@ static int serial8250_startup(struct uart_port *port)
                 */
                if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) {
                        up->bugs |= UART_BUG_THRE;
-                        pr_debug("ttyS%d - using backup timer\n", port->line);
+                        pr_debug("ttyS%d - using backup timer\n",
+                                 serial_index(port));
                }
        }
@@ -1969,7 +1981,7 @@ static int serial8250_startup(struct uart_port *port)
                if (!(up->bugs & UART_BUG_TXEN)) {
                        up->bugs |= UART_BUG_TXEN;
                        pr_debug("ttyS%d - enabling bad tx status workarounds\n",
-                                 port->line);
+                                 serial_index(port));
                }
        } else {
                up->bugs &= ~UART_BUG_TXEN;
@@ -2630,7 +2642,6 @@ static int serial8250_console_early_setup(void)
        return serial8250_find_port_for_earlycon();
 }
-static struct uart_driver serial8250_reg;
 static struct console serial8250_console = {
        .name           = "ttyS",
        .write          = serial8250_console_write,
@@ -2677,7 +2688,6 @@ static struct uart_driver serial8250_reg = {
        .dev_name               = "ttyS",
        .major                  = TTY_MAJOR,
        .minor                  = 64,
-        .nr                     = UART_NR,
        .cons                   = SERIAL8250_CONSOLE,
 };
@@ -2959,10 +2969,12 @@ static int __init serial8250_init(void)
                "%d ports, IRQ sharing %sabled\n", nr_uarts,
                share_irqs ? "en" : "dis");
-        for (i = 0; i < NR_IRQS; i++)
+#ifdef CONFIG_SPARC
-                spin_lock_init(&irq_lists[i].lock);
+        ret = sunserial_register_minors(&serial8250_reg, UART_NR);
+#else
+        serial8250_reg.nr = UART_NR;
        ret = uart_register_driver(&serial8250_reg);
+#endif
        if (ret)
                goto out;
@@ -2987,7 +2999,11 @@ static int __init serial8250_init(void)
 put_dev:
        platform_device_put(serial8250_isa_devs);
 unreg_uart_drv:
+#ifdef CONFIG_SPARC
+        sunserial_unregister_minors(&serial8250_reg, UART_NR);
+#else
        uart_unregister_driver(&serial8250_reg);
+#endif
 out:
        return ret;
 }
@@ -3006,7 +3022,11 @@ static void __exit serial8250_exit(void)
        platform_driver_unregister(&serial8250_isa_driver);
        platform_device_unregister(isa_dev);
+#ifdef CONFIG_SPARC
+        sunserial_unregister_minors(&serial8250_reg, UART_NR);
+#else
        uart_unregister_driver(&serial8250_reg);
+#endif
 }
 module_init(serial8250_init);
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index c2f23933155b..c014ffb110e9 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -2041,9 +2041,9 @@ static int pciserial_resume_one(struct pci_dev *dev)
                 * The device may have been disabled.  Re-enable it.
                 */
                err = pci_enable_device(dev);
+                /* FIXME: We cannot simply error out here */
                if (err)
-                        return err;
+                        printk(KERN_ERR "pciserial: Unable to re-enable ports, trying to continue.\n");
                pciserial_resume_ports(priv);
        }
        return 0;
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 77cb34270fc1..31786b3b0a68 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -9,7 +9,6 @@ menu "Serial drivers"
 # The new 8250/16550 serial drivers
 config SERIAL_8250
        tristate "8250/16550 and compatible serial support"
-        depends on (BROKEN || !SPARC)
        select SERIAL_CORE
        ---help---
          This selects whether you want to include the driver for the standard
@@ -994,24 +993,12 @@ config SERIAL_68328_RTS_CTS
        bool "Support RTS/CTS on 68328 serial port"
        depends on SERIAL_68328
-config SERIAL_COLDFIRE
-        bool "ColdFire serial support (DEPRECATED)"
-        depends on COLDFIRE
-        help
-          This driver supports the built-in serial ports of the Motorola ColdFire
-          family of CPUs.
-          This driver is deprecated because it supports only the old interface
-          for serial drivers and features like magic keys are not working.
-          Please switch to the new style driver because this driver will be
-          removed soon.
 config SERIAL_MCF
-        bool "Coldfire serial support (new style driver)"
+        bool "Coldfire serial support"
        depends on COLDFIRE
        select SERIAL_CORE
        help
-          This new serial driver supports the Freescale Coldfire serial ports
+          This serial driver supports the Freescale Coldfire serial ports.
-          using the new serial driver subsystem.
 config SERIAL_MCF_BAUDRATE
        int "Default baudrate for Coldfire serial ports"
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index 7e7383e890d8..0c17c8ddb19d 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -4,6 +4,16 @@
 obj-$(CONFIG_SERIAL_CORE) += serial_core.o
 obj-$(CONFIG_SERIAL_21285) += 21285.o
+# These Sparc drivers have to appear before others such as 8250
+# which share ttySx minor node space.  Otherwise console device
+# names change and other unplesantries.
+obj-$(CONFIG_SERIAL_SUNCORE) += suncore.o
+obj-$(CONFIG_SERIAL_SUNHV) += sunhv.o
+obj-$(CONFIG_SERIAL_SUNZILOG) += sunzilog.o
+obj-$(CONFIG_SERIAL_SUNSU) += sunsu.o
+obj-$(CONFIG_SERIAL_SUNSAB) += sunsab.o
 obj-$(CONFIG_SERIAL_8250) += 8250.o
 obj-$(CONFIG_SERIAL_8250_PNP) += 8250_pnp.o
 obj-$(CONFIG_SERIAL_8250_GSC) += 8250_gsc.o
@@ -31,16 +41,10 @@ obj-$(CONFIG_SERIAL_S3C2400) += s3c2400.o
 obj-$(CONFIG_SERIAL_S3C2410) += s3c2410.o
 obj-$(CONFIG_SERIAL_S3C2412) += s3c2412.o
 obj-$(CONFIG_SERIAL_S3C2440) += s3c2440.o
-obj-$(CONFIG_SERIAL_SUNCORE) += suncore.o
-obj-$(CONFIG_SERIAL_SUNHV) += sunhv.o
-obj-$(CONFIG_SERIAL_SUNZILOG) += sunzilog.o
 obj-$(CONFIG_SERIAL_IP22_ZILOG) += ip22zilog.o
-obj-$(CONFIG_SERIAL_SUNSU) += sunsu.o
-obj-$(CONFIG_SERIAL_SUNSAB) += sunsab.o
 obj-$(CONFIG_SERIAL_MUX) += mux.o
 obj-$(CONFIG_SERIAL_68328) += 68328serial.o
 obj-$(CONFIG_SERIAL_68360) += 68360serial.o
-obj-$(CONFIG_SERIAL_COLDFIRE) += mcfserial.o
 obj-$(CONFIG_SERIAL_MCF) += mcf.o
 obj-$(CONFIG_SERIAL_PMACZILOG) += pmac_zilog.o
 obj-$(CONFIG_SERIAL_LH7A40X) += serial_lh7a40x.o
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 4a0d30bed9f1..569f0e2476c6 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -1,7 +1,7 @@
 /*
 * Blackfin On-Chip Serial Driver
 *
- * Copyright 2006-2007 Analog Devices Inc.
+ * Copyright 2006-2008 Analog Devices Inc.
 *
 * Enter bugs at http://blackfin.uclinux.org/
 *
@@ -42,6 +42,9 @@
 #define BFIN_SERIAL_MAJOR       204
 #define BFIN_SERIAL_MINOR       64
+static struct bfin_serial_port bfin_serial_ports[BFIN_UART_NR_PORTS];
+static int nr_active_ports = ARRAY_SIZE(bfin_serial_resource);
 /*
 * Setup for console. Argument comes from the menuconfig
 */
@@ -126,13 +129,13 @@ static int kgdb_entry_state;
 void kgdb_put_debug_char(int chr)
 {
        struct bfin_serial_port *uart;
-        
        if (CONFIG_KGDB_UART_PORT < 0
                || CONFIG_KGDB_UART_PORT >= BFIN_UART_NR_PORTS)
                uart = &bfin_serial_ports[0];
        else
                uart = &bfin_serial_ports[CONFIG_KGDB_UART_PORT];
-        
        while (!(UART_GET_LSR(uart) & THRE)) {
                SSYNC();
        }
@@ -152,7 +155,7 @@ int kgdb_get_debug_char(void)
                uart = &bfin_serial_ports[0];
        else
                uart = &bfin_serial_ports[CONFIG_KGDB_UART_PORT];
-        
        while(!(UART_GET_LSR(uart) & DR)) {
                SSYNC();
        }
@@ -298,7 +301,11 @@ static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
        bfin_serial_mctrl_check(uart);
        if (uart_circ_empty(xmit) || uart_tx_stopped(&uart->port)) {
-                bfin_serial_stop_tx(&uart->port);
+#ifdef CONFIG_BF54x
+                /* Clear TFI bit */
+                UART_PUT_LSR(uart, TFI);
+#endif
+                UART_CLEAR_IER(uart, ETBEI);
                return;
        }
@@ -317,9 +324,6 @@ static void bfin_serial_tx_chars(struct bfin_serial_port *uart)
        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                uart_write_wakeup(&uart->port);
-        if (uart_circ_empty(xmit))
-                bfin_serial_stop_tx(&uart->port);
 }
 static irqreturn_t bfin_serial_rx_int(int irq, void *dev_id)
@@ -645,6 +649,42 @@ static int bfin_serial_startup(struct uart_port *port)
                free_irq(uart->port.irq, uart);
                return -EBUSY;
        }
+# ifdef CONFIG_BF54x
+        {
+                unsigned uart_dma_ch_rx, uart_dma_ch_tx;
+                switch (uart->port.irq) {
+                case IRQ_UART3_RX:
+                        uart_dma_ch_rx = CH_UART3_RX;
+                        uart_dma_ch_tx = CH_UART3_TX;
+                        break;
+                case IRQ_UART2_RX:
+                        uart_dma_ch_rx = CH_UART2_RX;
+                        uart_dma_ch_tx = CH_UART2_TX;
+                        break;
+                default:
+                        uart_dma_ch_rx = uart_dma_ch_tx = 0;
+                        break;
+                };
+                if (uart_dma_ch_rx &&
+                        request_dma(uart_dma_ch_rx, "BFIN_UART_RX") < 0) {
+                        printk(KERN_NOTICE"Fail to attach UART interrupt\n");
+                        free_irq(uart->port.irq, uart);
+                        free_irq(uart->port.irq + 1, uart);
+                        return -EBUSY;
+                }
+                if (uart_dma_ch_tx &&
+                        request_dma(uart_dma_ch_tx, "BFIN_UART_TX") < 0) {
+                        printk(KERN_NOTICE "Fail to attach UART interrupt\n");
+                        free_dma(uart_dma_ch_rx);
+                        free_irq(uart->port.irq, uart);
+                        free_irq(uart->port.irq + 1, uart);
+                        return -EBUSY;
+                }
+        }
+# endif
 #endif
        UART_SET_IER(uart, ERBFI);
        return 0;
@@ -662,6 +702,20 @@ static void bfin_serial_shutdown(struct uart_port *port)
        del_timer(&(uart->rx_dma_timer));
        dma_free_coherent(NULL, PAGE_SIZE, uart->rx_dma_buf.buf, 0);
 #else
+#ifdef CONFIG_BF54x
+        switch (uart->port.irq) {
+        case IRQ_UART3_RX:
+                free_dma(CH_UART3_RX);
+                free_dma(CH_UART3_TX);
+                break;
+        case IRQ_UART2_RX:
+                free_dma(CH_UART2_RX);
+                free_dma(CH_UART2_TX);
+                break;
+        default:
+                break;
+        };
+#endif
 #ifdef  CONFIG_KGDB_UART
        if (uart->port.line != CONFIG_KGDB_UART_PORT)
 #endif
@@ -757,6 +811,9 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
        val |= UCEN;
        UART_PUT_GCTL(uart, val);
+        /* Port speed changed, update the per-port timeout. */
+        uart_update_timeout(port, termios->c_cflag, baud);
        spin_unlock_irqrestore(&uart->port.lock, flags);
 }
@@ -859,8 +916,9 @@ static void __init bfin_serial_init_ports(void)
                return;
        first = 0;
-        for (i = 0; i < nr_ports; i++) {
+        for (i = 0; i < nr_active_ports; i++) {
                bfin_serial_ports[i].port.uartclk   = get_sclk();
+                bfin_serial_ports[i].port.fifosize  = BFIN_UART_TX_FIFO_SIZE;
                bfin_serial_ports[i].port.ops       = &bfin_serial_pops;
                bfin_serial_ports[i].port.line      = i;
                bfin_serial_ports[i].port.iotype    = UPIO_MEM;
@@ -961,7 +1019,7 @@ bfin_serial_console_setup(struct console *co, char *options)
         * if so, search for the first available port that does have
         * console support.
         */
-        if (co->index == -1 || co->index >= nr_ports)
+        if (co->index == -1 || co->index >= nr_active_ports)
                co->index = 0;
        uart = &bfin_serial_ports[co->index];
@@ -1056,7 +1114,7 @@ static __init void early_serial_write(struct console *con, const char *s,
        }
 }
-static struct __init console bfin_early_serial_console = {
+static struct __initdata console bfin_early_serial_console = {
        .name = "early_BFuart",
        .write = early_serial_write,
        .device = uart_console_device,
@@ -1072,7 +1130,7 @@ struct console __init *bfin_earlyserial_init(unsigned int port,
        struct bfin_serial_port *uart;
        struct ktermios t;
-        if (port == -1 || port >= nr_ports)
+        if (port == -1 || port >= nr_active_ports)
                port = 0;
        bfin_serial_init_ports();
        bfin_early_serial_console.index = port;
@@ -1100,20 +1158,26 @@ static struct uart_driver bfin_serial_reg = {
 static int bfin_serial_suspend(struct platform_device *dev, pm_message_t state)
 {
-        struct bfin_serial_port *uart = platform_get_drvdata(dev);
+        int i;
-        if (uart)
+        for (i = 0; i < nr_active_ports; i++) {
-                uart_suspend_port(&bfin_serial_reg, &uart->port);
+                if (bfin_serial_ports[i].port.dev != &dev->dev)
+                        continue;
+                uart_suspend_port(&bfin_serial_reg, &bfin_serial_ports[i].port);
+        }
        return 0;
 }
 static int bfin_serial_resume(struct platform_device *dev)
 {
-        struct bfin_serial_port *uart = platform_get_drvdata(dev);
+        int i;
-        if (uart)
+        for (i = 0; i < nr_active_ports; i++) {
-                uart_resume_port(&bfin_serial_reg, &uart->port);
+                if (bfin_serial_ports[i].port.dev != &dev->dev)
+                        continue;
+                uart_resume_port(&bfin_serial_reg, &bfin_serial_ports[i].port);
+        }
        return 0;
 }
@@ -1128,32 +1192,31 @@ static int bfin_serial_probe(struct platform_device *dev)
                        break;
        if (i < dev->num_resources) {
-                for (i = 0; i < nr_ports; i++, res++) {
+                for (i = 0; i < nr_active_ports; i++, res++) {
                        if (bfin_serial_ports[i].port.mapbase != res->start)
                                continue;
                        bfin_serial_ports[i].port.dev = &dev->dev;
                        uart_add_one_port(&bfin_serial_reg, &bfin_serial_ports[i].port);
-                        platform_set_drvdata(dev, &bfin_serial_ports[i]);
                }
        }
        return 0;
 }
-static int bfin_serial_remove(struct platform_device *pdev)
+static int bfin_serial_remove(struct platform_device *dev)
 {
-        struct bfin_serial_port *uart = platform_get_drvdata(pdev);
+        int i;
+        for (i = 0; i < nr_active_ports; i++) {
+                if (bfin_serial_ports[i].port.dev != &dev->dev)
+                        continue;
+                uart_remove_one_port(&bfin_serial_reg, &bfin_serial_ports[i].port);
+                bfin_serial_ports[i].port.dev = NULL;
 #ifdef CONFIG_SERIAL_BFIN_CTSRTS
-        gpio_free(uart->cts_pin);
+                gpio_free(bfin_serial_ports[i].cts_pin);
-        gpio_free(uart->rts_pin);
+                gpio_free(bfin_serial_ports[i].rts_pin);
 #endif
+        }
-        platform_set_drvdata(pdev, NULL);
-        if (uart)
-                uart_remove_one_port(&bfin_serial_reg, &uart->port);
        return 0;
 }
diff --git a/drivers/serial/crisv10.c b/drivers/serial/crisv10.c
index bf94a770bb44..211c21797ce0 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/serial/crisv10.c
@@ -457,7 +457,6 @@ static struct e100_serial rs_table[] = {
 #define NR_PORTS (sizeof(rs_table)/sizeof(struct e100_serial))
 static struct ktermios *serial_termios[NR_PORTS];
-static struct ktermios *serial_termios_locked[NR_PORTS];
 #ifdef CONFIG_ETRAX_SERIAL_FAST_TIMER
 static struct fast_timer fast_timers[NR_PORTS];
 #endif
@@ -4419,6 +4418,7 @@ rs_init(void)
                        rs485_pa_bit)) {
                printk(KERN_CRIT "ETRAX100LX serial: Could not allocate "
                        "RS485 pin\n");
+                put_tty_driver(driver);
                return -EBUSY;
        }
 #endif
@@ -4427,6 +4427,7 @@ rs_init(void)
                        rs485_port_g_bit)) {
                printk(KERN_CRIT "ETRAX100LX serial: Could not allocate "
                        "RS485 pin\n");
+                put_tty_driver(driver);
                return -EBUSY;
        }
 #endif
@@ -4446,8 +4447,6 @@ rs_init(void)
        driver->init_termios.c_ispeed = 115200;
        driver->init_termios.c_ospeed = 115200;
        driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
-        driver->termios = serial_termios;
-        driver->termios_locked = serial_termios_locked;
        tty_set_operations(driver, &rs_ops);
        serial_driver = driver;
diff --git a/drivers/serial/mcfserial.c b/drivers/serial/mcfserial.c
deleted file mode 100644
index fbe3835f6b77..000000000000
--- a/drivers/serial/mcfserial.c
+++ /dev/null
@@ -1,1965 +0,0 @@
-#warning This driver is deprecated. Check Kconfig for details.
-/*
- * mcfserial.c -- serial driver for ColdFire internal UARTS.
- *
- * Copyright (C) 1999-2003 Greg Ungerer <gerg@snapgear.com>
- * Copyright (c) 2000-2001 Lineo, Inc. <www.lineo.com> 
- * Copyright (C) 2001-2002 SnapGear Inc. <www.snapgear.com> 
- *
- * Based on code from 68332serial.c which was:
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1998 TSHG
- * Copyright (c) 1999 Rt-Control Inc. <jeff@uclinux.org>
- *
- * Changes:
- * 08/07/2003    Daniele Bellucci <bellucda@tiscali.it>
- *               some cleanups in mcfrs_write.
- *
- */
- 
-#include <linux/module.h>
-#include <linux/errno.h>
-#include <linux/signal.h>
-#include <linux/sched.h>
-#include <linux/timer.h>
-#include <linux/wait.h>
-#include <linux/interrupt.h>
-#include <linux/tty.h>
-#include <linux/tty_flip.h>
-#include <linux/string.h>
-#include <linux/fcntl.h>
-#include <linux/mm.h>
-#include <linux/kernel.h>
-#include <linux/serial.h>
-#include <linux/serialP.h>
-#include <linux/console.h>
-#include <linux/init.h>
-#include <linux/bitops.h>
-#include <linux/delay.h>
-#include <asm/io.h>
-#include <asm/irq.h>
-#include <asm/system.h>
-#include <asm/delay.h>
-#include <asm/coldfire.h>
-#include <asm/mcfsim.h>
-#include <asm/mcfuart.h>
-#include <asm/nettel.h>
-#include <asm/uaccess.h>
-#include "mcfserial.h"
-struct timer_list mcfrs_timer_struct;
-/*
- *      Default console baud rate,  we use this as the default
- *      for all ports so init can just open /dev/console and
- *      keep going.  Perhaps one day the cflag settings for the
- *      console can be used instead.
- */
-#if defined(CONFIG_HW_FEITH)
-#define CONSOLE_BAUD_RATE       38400
-#define DEFAULT_CBAUD           B38400
-#elif defined(CONFIG_MOD5272) || defined(CONFIG_M5208EVB) || \
-      defined(CONFIG_M5329EVB) || defined(CONFIG_GILBARCO)
-#define CONSOLE_BAUD_RATE       115200
-#define DEFAULT_CBAUD           B115200
-#elif defined(CONFIG_ARNEWSH) || defined(CONFIG_FREESCALE) || \
-      defined(CONFIG_senTec) || defined(CONFIG_SNEHA) || defined(CONFIG_AVNET)
-#define CONSOLE_BAUD_RATE       19200
-#define DEFAULT_CBAUD           B19200
-#endif
-#ifndef CONSOLE_BAUD_RATE
-#define CONSOLE_BAUD_RATE       9600
-#define DEFAULT_CBAUD           B9600
-#endif
-int mcfrs_console_inited = 0;
-int mcfrs_console_port = -1;
-int mcfrs_console_baud = CONSOLE_BAUD_RATE;
-int mcfrs_console_cbaud = DEFAULT_CBAUD;
-/*
- *      Driver data structures.
- */
-static struct tty_driver *mcfrs_serial_driver;
-/* number of characters left in xmit buffer before we ask for more */
-#define WAKEUP_CHARS 256
-/* Debugging...
- */
-#undef SERIAL_DEBUG_OPEN
-#undef SERIAL_DEBUG_FLOW
-#if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || \
-    defined(CONFIG_M520x) || defined(CONFIG_M532x)
-#define IRQBASE (MCFINT_VECBASE+MCFINT_UART0)
-#else
-#define IRQBASE 73
-#endif
-/*
- *      Configuration table, UARTs to look for at startup.
- */
-static struct mcf_serial mcfrs_table[] = {
-        {  /* ttyS0 */
-                .magic = 0,
-                .addr = (volatile unsigned char *) (MCF_MBAR+MCFUART_BASE1),
-                .irq = IRQBASE,
-                .flags = ASYNC_BOOT_AUTOCONF,
-        },
-#ifdef MCFUART_BASE2
-        {  /* ttyS1 */
-                .magic = 0,
-                .addr = (volatile unsigned char *) (MCF_MBAR+MCFUART_BASE2),
-                .irq = IRQBASE+1,
-                .flags = ASYNC_BOOT_AUTOCONF,
-        },
-#endif
-#ifdef MCFUART_BASE3
-        {  /* ttyS2 */
-                .magic = 0,
-                .addr = (volatile unsigned char *) (MCF_MBAR+MCFUART_BASE3),
-                .irq = IRQBASE+2,
-                .flags = ASYNC_BOOT_AUTOCONF,
-        },
-#endif
-#ifdef MCFUART_BASE4
-        {  /* ttyS3 */
-                .magic = 0,
-                .addr = (volatile unsigned char *) (MCF_MBAR+MCFUART_BASE4),
-                .irq = IRQBASE+3,
-                .flags = ASYNC_BOOT_AUTOCONF,
-        },
-#endif
-};
-#define NR_PORTS        (sizeof(mcfrs_table) / sizeof(struct mcf_serial))
-/*
- * This is used to figure out the divisor speeds and the timeouts.
- */
-static int mcfrs_baud_table[] = {
-        0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-        9600, 19200, 38400, 57600, 115200, 230400, 460800, 0
-};
-#define MCFRS_BAUD_TABLE_SIZE \
-                        (sizeof(mcfrs_baud_table)/sizeof(mcfrs_baud_table[0]))
-#ifdef CONFIG_MAGIC_SYSRQ
-/*
- *      Magic system request keys. Used for debugging...
- */
-extern int      magic_sysrq_key(int ch);
-#endif
-/*
- *      Forware declarations...
- */
-static void     mcfrs_change_speed(struct mcf_serial *info);
-static void     mcfrs_wait_until_sent(struct tty_struct *tty, int timeout);
-static inline int serial_paranoia_check(struct mcf_serial *info,
-                                        char *name, const char *routine)
-{
-#ifdef SERIAL_PARANOIA_CHECK
-        static const char badmagic[] =
-                "MCFRS(warning): bad magic number for serial struct %s in %s\n";
-        static const char badinfo[] =
-                "MCFRS(warning): null mcf_serial for %s in %s\n";
-        if (!info) {
-                printk(badinfo, name, routine);
-                return 1;
-        }
-        if (info->magic != SERIAL_MAGIC) {
-                printk(badmagic, name, routine);
-                return 1;
-        }
-#endif
-        return 0;
-}
-/*
- *      Sets or clears DTR and RTS on the requested line.
- */
-static void mcfrs_setsignals(struct mcf_serial *info, int dtr, int rts)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        
-#if 0
-        printk("%s(%d): mcfrs_setsignals(info=%x,dtr=%d,rts=%d)\n",
-                __FILE__, __LINE__, info, dtr, rts);
-#endif
-        local_irq_save(flags);
-        if (dtr >= 0) {
-#ifdef MCFPP_DTR0
-                if (info->line)
-                        mcf_setppdata(MCFPP_DTR1, (dtr ? 0 : MCFPP_DTR1));
-                else
-                        mcf_setppdata(MCFPP_DTR0, (dtr ? 0 : MCFPP_DTR0));
-#endif
-        }
-        if (rts >= 0) {
-                uartp = info->addr;
-                if (rts) {
-                        info->sigs |= TIOCM_RTS;
-                        uartp[MCFUART_UOP1] = MCFUART_UOP_RTS;
-                } else {
-                        info->sigs &= ~TIOCM_RTS;
-                        uartp[MCFUART_UOP0] = MCFUART_UOP_RTS;
-                }
-        }
-        local_irq_restore(flags);
-        return;
-}
-/*
- *      Gets values of serial signals.
- */
-static int mcfrs_getsignals(struct mcf_serial *info)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        int                     sigs;
-#if defined(CONFIG_NETtel) && defined(CONFIG_M5307)
-        unsigned short          ppdata;
-#endif
-#if 0
-        printk("%s(%d): mcfrs_getsignals(info=%x)\n", __FILE__, __LINE__);
-#endif
-        local_irq_save(flags);
-        uartp = info->addr;
-        sigs = (uartp[MCFUART_UIPR] & MCFUART_UIPR_CTS) ? 0 : TIOCM_CTS;
-        sigs |= (info->sigs & TIOCM_RTS);
-#ifdef MCFPP_DCD0
-{
-        unsigned int ppdata;
-        ppdata = mcf_getppdata();
-        if (info->line == 0) {
-                sigs |= (ppdata & MCFPP_DCD0) ? 0 : TIOCM_CD;
-                sigs |= (ppdata & MCFPP_DTR0) ? 0 : TIOCM_DTR;
-        } else if (info->line == 1) {
-                sigs |= (ppdata & MCFPP_DCD1) ? 0 : TIOCM_CD;
-                sigs |= (ppdata & MCFPP_DTR1) ? 0 : TIOCM_DTR;
-        }
-}
-#endif
-        local_irq_restore(flags);
-        return(sigs);
-}
-/*
- * ------------------------------------------------------------
- * mcfrs_stop() and mcfrs_start()
- *
- * This routines are called before setting or resetting tty->stopped.
- * They enable or disable transmitter interrupts, as necessary.
- * ------------------------------------------------------------
- */
-static void mcfrs_stop(struct tty_struct *tty)
-{
-        volatile unsigned char  *uartp;
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_stop"))
-                return;
-        
-        local_irq_save(flags);
-        uartp = info->addr;
-        info->imr &= ~MCFUART_UIR_TXREADY;
-        uartp[MCFUART_UIMR] = info->imr;
-        local_irq_restore(flags);
-}
-static void mcfrs_start(struct tty_struct *tty)
-{
-        volatile unsigned char  *uartp;
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        
-        if (serial_paranoia_check(info, tty->name, "mcfrs_start"))
-                return;
-        local_irq_save(flags);
-        if (info->xmit_cnt && info->xmit_buf) {
-                uartp = info->addr;
-                info->imr |= MCFUART_UIR_TXREADY;
-                uartp[MCFUART_UIMR] = info->imr;
-        }
-        local_irq_restore(flags);
-}
-/*
- * ----------------------------------------------------------------------
- *
- * Here starts the interrupt handling routines.  All of the following
- * subroutines are declared as inline and are folded into
- * mcfrs_interrupt().  They were separated out for readability's sake.
- *
- * Note: mcfrs_interrupt() is a "fast" interrupt, which means that it
- * runs with interrupts turned off.  People who may want to modify
- * mcfrs_interrupt() should try to keep the interrupt handler as fast as
- * possible.  After you are done making modifications, it is not a bad
- * idea to do:
- * 
- * gcc -S -DKERNEL -Wall -Wstrict-prototypes -O6 -fomit-frame-pointer serial.c
- *
- * and look at the resulting assemble code in serial.s.
- *
- *                              - Ted Ts'o (tytso@mit.edu), 7-Mar-93
- * -----------------------------------------------------------------------
- */
-static inline void receive_chars(struct mcf_serial *info)
-{
-        volatile unsigned char  *uartp;
-        struct tty_struct       *tty = info->port.tty;
-        unsigned char           status, ch, flag;
-        if (!tty)
-                return;
-        uartp = info->addr;
-        while ((status = uartp[MCFUART_USR]) & MCFUART_USR_RXREADY) {
-                ch = uartp[MCFUART_URB];
-                info->stats.rx++;
-#ifdef CONFIG_MAGIC_SYSRQ
-                if (mcfrs_console_inited && (info->line == mcfrs_console_port)) {
-                        if (magic_sysrq_key(ch))
-                                continue;
-                }
-#endif
-                flag = TTY_NORMAL;
-                if (status & MCFUART_USR_RXERR) {
-                        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETERR;
-                        if (status & MCFUART_USR_RXBREAK) {
-                                info->stats.rxbreak++;
-                                flag = TTY_BREAK;
-                        } else if (status & MCFUART_USR_RXPARITY) {
-                                info->stats.rxparity++;
-                                flag = TTY_PARITY;
-                        } else if (status & MCFUART_USR_RXOVERRUN) {
-                                info->stats.rxoverrun++;
-                                flag = TTY_OVERRUN;
-                        } else if (status & MCFUART_USR_RXFRAMING) {
-                                info->stats.rxframing++;
-                                flag = TTY_FRAME;
-                        }
-                }
-                tty_insert_flip_char(tty, ch, flag);
-        }
-        tty_schedule_flip(tty);
-        return;
-}
-static inline void transmit_chars(struct mcf_serial *info)
-{
-        volatile unsigned char  *uartp;
-        uartp = info->addr;
-        if (info->x_char) {
-                /* Send special char - probably flow control */
-                uartp[MCFUART_UTB] = info->x_char;
-                info->x_char = 0;
-                info->stats.tx++;
-        }
-        if ((info->xmit_cnt <= 0) || info->port.tty->stopped) {
-                info->imr &= ~MCFUART_UIR_TXREADY;
-                uartp[MCFUART_UIMR] = info->imr;
-                return;
-        }
-        while (uartp[MCFUART_USR] & MCFUART_USR_TXREADY) {
-                uartp[MCFUART_UTB] = info->xmit_buf[info->xmit_tail++];
-                info->xmit_tail = info->xmit_tail & (SERIAL_XMIT_SIZE-1);
-                info->stats.tx++;
-                if (--info->xmit_cnt <= 0)
-                        break;
-        }
-        if (info->xmit_cnt < WAKEUP_CHARS)
-                schedule_work(&info->tqueue);
-        return;
-}
-/*
- * This is the serial driver's generic interrupt routine
- */
-irqreturn_t mcfrs_interrupt(int irq, void *dev_id)
-{
-        struct mcf_serial       *info;
-        unsigned char           isr;
-        info = &mcfrs_table[(irq - IRQBASE)];
-        isr = info->addr[MCFUART_UISR] & info->imr;
-        if (isr & MCFUART_UIR_RXREADY)
-                receive_chars(info);
-        if (isr & MCFUART_UIR_TXREADY)
-                transmit_chars(info);
-        return IRQ_HANDLED;
-}
-/*
- * -------------------------------------------------------------------
- * Here ends the serial interrupt routines.
- * -------------------------------------------------------------------
- */
-static void mcfrs_offintr(struct work_struct *work)
-{
-        struct mcf_serial *info = container_of(work, struct mcf_serial, tqueue);
-        struct tty_struct *tty = info->port.tty;
-        
-        if (tty)
-                tty_wakeup(tty);
-}
-/*
- *      Change of state on a DCD line.
- */
-void mcfrs_modem_change(struct mcf_serial *info, int dcd)
-{
-        if (info->count == 0)
-                return;
-        if (info->flags & ASYNC_CHECK_CD) {
-                if (dcd)
-                        wake_up_interruptible(&info->open_wait);
-                else 
-                        schedule_work(&info->tqueue_hangup);
-        }
-}
-#ifdef MCFPP_DCD0
-unsigned short  mcfrs_ppstatus;
-/*
- * This subroutine is called when the RS_TIMER goes off. It is used
- * to monitor the state of the DCD lines - since they have no edge
- * sensors and interrupt generators.
- */
-static void mcfrs_timer(void)
-{
-        unsigned int    ppstatus, dcdval, i;
-        ppstatus = mcf_getppdata() & (MCFPP_DCD0 | MCFPP_DCD1);
-        if (ppstatus != mcfrs_ppstatus) {
-                for (i = 0; (i < 2); i++) {
-                        dcdval = (i ? MCFPP_DCD1 : MCFPP_DCD0);
-                        if ((ppstatus & dcdval) != (mcfrs_ppstatus & dcdval)) {
-                                mcfrs_modem_change(&mcfrs_table[i],
-                                        ((ppstatus & dcdval) ? 0 : 1));
-                        }
-                }
-        }
-        mcfrs_ppstatus = ppstatus;
-        /* Re-arm timer */
-        mcfrs_timer_struct.expires = jiffies + HZ/25;
-        add_timer(&mcfrs_timer_struct);
-}
-#endif  /* MCFPP_DCD0 */
-/*
- * This routine is called from the scheduler tqueue when the interrupt
- * routine has signalled that a hangup has occurred. The path of
- * hangup processing is:
- *
- *      serial interrupt routine -> (scheduler tqueue) ->
- *      do_serial_hangup() -> tty->hangup() -> mcfrs_hangup()
- * 
- */
-static void do_serial_hangup(struct work_struct *work)
-{
-        struct mcf_serial *info = container_of(work, struct mcf_serial, tqueue_hangup);
-        struct tty_struct *tty = info->port.tty;
-        
-        if (tty)
-                tty_hangup(tty);
-}
-static int startup(struct mcf_serial * info)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        
-        if (info->flags & ASYNC_INITIALIZED)
-                return 0;
-        if (!info->xmit_buf) {
-                info->xmit_buf = (unsigned char *) __get_free_page(GFP_KERNEL);
-                if (!info->xmit_buf)
-                        return -ENOMEM;
-        }
-        local_irq_save(flags);
-#ifdef SERIAL_DEBUG_OPEN
-        printk("starting up ttyS%d (irq %d)...\n", info->line, info->irq);
-#endif
-        /*
-         *      Reset UART, get it into known state...
-         */
-        uartp = info->addr;
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETRX;  /* reset RX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETTX;  /* reset TX */
-        mcfrs_setsignals(info, 1, 1);
-        if (info->port.tty)
-                clear_bit(TTY_IO_ERROR, &info->port.tty->flags);
-        info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
-        /*
-         * and set the speed of the serial port
-         */
-        mcfrs_change_speed(info);
-        /*
-         * Lastly enable the UART transmitter and receiver, and
-         * interrupt enables.
-         */
-        info->imr = MCFUART_UIR_RXREADY;
-        uartp[MCFUART_UCR] = MCFUART_UCR_RXENABLE | MCFUART_UCR_TXENABLE;
-        uartp[MCFUART_UIMR] = info->imr;
-        info->flags |= ASYNC_INITIALIZED;
-        local_irq_restore(flags);
-        return 0;
-}
-/*
- * This routine will shutdown a serial port; interrupts are disabled, and
- * DTR is dropped if the hangup on close termio flag is on.
- */
-static void shutdown(struct mcf_serial * info)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        if (!(info->flags & ASYNC_INITIALIZED))
-                return;
-#ifdef SERIAL_DEBUG_OPEN
-        printk("Shutting down serial port %d (irq %d)....\n", info->line,
-               info->irq);
-#endif
-        
-        local_irq_save(flags);
-        uartp = info->addr;
-        uartp[MCFUART_UIMR] = 0;  /* mask all interrupts */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETRX;  /* reset RX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETTX;  /* reset TX */
-        if (!info->port.tty || (info->port.tty->termios->c_cflag & HUPCL))
-                mcfrs_setsignals(info, 0, 0);
-        if (info->xmit_buf) {
-                free_page((unsigned long) info->xmit_buf);
-                info->xmit_buf = 0;
-        }
-        if (info->port.tty)
-                set_bit(TTY_IO_ERROR, &info->port.tty->flags);
-        
-        info->flags &= ~ASYNC_INITIALIZED;
-        local_irq_restore(flags);
-}
-/*
- * This routine is called to set the UART divisor registers to match
- * the specified baud rate for a serial port.
- */
-static void mcfrs_change_speed(struct mcf_serial *info)
-{
-        volatile unsigned char  *uartp;
-        unsigned int            baudclk, cflag;
-        unsigned long           flags;
-        unsigned char           mr1, mr2;
-        int                     i;
-#ifdef  CONFIG_M5272
-        unsigned int            fraction;
-#endif
-        if (!info->port.tty || !info->port.tty->termios)
-                return;
-        cflag = info->port.tty->termios->c_cflag;
-        if (info->addr == 0)
-                return;
-#if 0
-        printk("%s(%d): mcfrs_change_speed()\n", __FILE__, __LINE__);
-#endif
-        i = cflag & CBAUD;
-        if (i & CBAUDEX) {
-                i &= ~CBAUDEX;
-                if (i < 1 || i > 4)
-                        info->port.tty->termios->c_cflag &= ~CBAUDEX;
-                else
-                        i += 15;
-        }
-        if (i == 0) {
-                mcfrs_setsignals(info, 0, -1);
-                return;
-        }
-        /* compute the baudrate clock */
-#ifdef  CONFIG_M5272
-        /*
-         * For the MCF5272, also compute the baudrate fraction.
-         */
-        baudclk = (MCF_BUSCLK / mcfrs_baud_table[i]) / 32;
-        fraction = MCF_BUSCLK - (baudclk * 32 * mcfrs_baud_table[i]);
-        fraction *= 16;
-        fraction /= (32 * mcfrs_baud_table[i]);
-#else
-        baudclk = ((MCF_BUSCLK / mcfrs_baud_table[i]) + 16) / 32;
-#endif
-        info->baud = mcfrs_baud_table[i];
-        mr1 = MCFUART_MR1_RXIRQRDY | MCFUART_MR1_RXERRCHAR;
-        mr2 = 0;
-        switch (cflag & CSIZE) {
-        case CS5:       mr1 |= MCFUART_MR1_CS5; break;
-        case CS6:       mr1 |= MCFUART_MR1_CS6; break;
-        case CS7:       mr1 |= MCFUART_MR1_CS7; break;
-        case CS8:
-        default:        mr1 |= MCFUART_MR1_CS8; break;
-        }
-        if (cflag & PARENB) {
-                if (cflag & CMSPAR) {
-                        if (cflag & PARODD)
-                                mr1 |= MCFUART_MR1_PARITYMARK;
-                        else
-                                mr1 |= MCFUART_MR1_PARITYSPACE;
-                } else {
-                        if (cflag & PARODD)
-                                mr1 |= MCFUART_MR1_PARITYODD;
-                        else
-                                mr1 |= MCFUART_MR1_PARITYEVEN;
-                }
-        } else {
-                mr1 |= MCFUART_MR1_PARITYNONE;
-        }
-        if (cflag & CSTOPB)
-                mr2 |= MCFUART_MR2_STOP2;
-        else
-                mr2 |= MCFUART_MR2_STOP1;
-        if (cflag & CRTSCTS) {
-                mr1 |= MCFUART_MR1_RXRTS;
-                mr2 |= MCFUART_MR2_TXCTS;
-        }
-        if (cflag & CLOCAL)
-                info->flags &= ~ASYNC_CHECK_CD;
-        else
-                info->flags |= ASYNC_CHECK_CD;
-        uartp = info->addr;
-        local_irq_save(flags);
-#if 0
-        printk("%s(%d): mr1=%x mr2=%x baudclk=%x\n", __FILE__, __LINE__,
-                mr1, mr2, baudclk);
-#endif
-        /*
-          Note: pg 12-16 of MCF5206e User's Manual states that a
-          software reset should be performed prior to changing
-          UMR1,2, UCSR, UACR, bit 7
-        */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETRX;    /* reset RX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETTX;    /* reset TX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETMRPTR; /* reset MR pointer */
-        uartp[MCFUART_UMR] = mr1;
-        uartp[MCFUART_UMR] = mr2;
-        uartp[MCFUART_UBG1] = (baudclk & 0xff00) >> 8;  /* set msb byte */
-        uartp[MCFUART_UBG2] = (baudclk & 0xff);         /* set lsb byte */
-#ifdef  CONFIG_M5272
-        uartp[MCFUART_UFPD] = (fraction & 0xf);         /* set fraction */
-#endif
-        uartp[MCFUART_UCSR] = MCFUART_UCSR_RXCLKTIMER | MCFUART_UCSR_TXCLKTIMER;
-        uartp[MCFUART_UCR] = MCFUART_UCR_RXENABLE | MCFUART_UCR_TXENABLE;
-        mcfrs_setsignals(info, 1, -1);
-        local_irq_restore(flags);
-        return;
-}
-static void mcfrs_flush_chars(struct tty_struct *tty)
-{
-        volatile unsigned char  *uartp;
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_flush_chars"))
-                return;
-        uartp = (volatile unsigned char *) info->addr;
-        /*
-         * re-enable receiver interrupt
-         */
-        local_irq_save(flags);
-        if ((!(info->imr & MCFUART_UIR_RXREADY)) &&
-            (info->flags & ASYNC_INITIALIZED) ) {
-                info->imr |= MCFUART_UIR_RXREADY;
-                uartp[MCFUART_UIMR] = info->imr;
-        }
-        local_irq_restore(flags);
-        if (info->xmit_cnt <= 0 || tty->stopped || tty->hw_stopped ||
-            !info->xmit_buf)
-                return;
-        /* Enable transmitter */
-        local_irq_save(flags);
-        info->imr |= MCFUART_UIR_TXREADY;
-        uartp[MCFUART_UIMR] = info->imr;
-        local_irq_restore(flags);
-}
-static int mcfrs_write(struct tty_struct * tty,
-                    const unsigned char *buf, int count)
-{
-        volatile unsigned char  *uartp;
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        int                     c, total = 0;
-#if 0
-        printk("%s(%d): mcfrs_write(tty=%x,buf=%x,count=%d)\n",
-                __FILE__, __LINE__, (int)tty, (int)buf, count);
-#endif
-        if (serial_paranoia_check(info, tty->name, "mcfrs_write"))
-                return 0;
-        if (!tty || !info->xmit_buf)
-                return 0;
-        
-        local_save_flags(flags);
-        while (1) {
-                local_irq_disable();            
-                c = min(count, (int) min(((int)SERIAL_XMIT_SIZE) - info->xmit_cnt - 1,
-                        ((int)SERIAL_XMIT_SIZE) - info->xmit_head));
-                local_irq_restore(flags);
-                if (c <= 0)
-                        break;
-                memcpy(info->xmit_buf + info->xmit_head, buf, c);
-                local_irq_disable();
-                info->xmit_head = (info->xmit_head + c) & (SERIAL_XMIT_SIZE-1);
-                info->xmit_cnt += c;
-                local_irq_restore(flags);
-                buf += c;
-                count -= c;
-                total += c;
-        }
-        local_irq_disable();
-        uartp = info->addr;
-        info->imr |= MCFUART_UIR_TXREADY;
-        uartp[MCFUART_UIMR] = info->imr;
-        local_irq_restore(flags);
-        return total;
-}
-static int mcfrs_write_room(struct tty_struct *tty)
-{
-        struct mcf_serial *info = (struct mcf_serial *)tty->driver_data;
-        int     ret;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_write_room"))
-                return 0;
-        ret = SERIAL_XMIT_SIZE - info->xmit_cnt - 1;
-        if (ret < 0)
-                ret = 0;
-        return ret;
-}
-static int mcfrs_chars_in_buffer(struct tty_struct *tty)
-{
-        struct mcf_serial *info = (struct mcf_serial *)tty->driver_data;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_chars_in_buffer"))
-                return 0;
-        return info->xmit_cnt;
-}
-static void mcfrs_flush_buffer(struct tty_struct *tty)
-{
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_flush_buffer"))
-                return;
-        local_irq_save(flags);
-        info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
-        local_irq_restore(flags);
-        tty_wakeup(tty);
-}
-/*
- * ------------------------------------------------------------
- * mcfrs_throttle()
- * 
- * This routine is called by the upper-layer tty layer to signal that
- * incoming characters should be throttled.
- * ------------------------------------------------------------
- */
-static void mcfrs_throttle(struct tty_struct * tty)
-{
-        struct mcf_serial *info = (struct mcf_serial *)tty->driver_data;
-#ifdef SERIAL_DEBUG_THROTTLE
-        char    buf[64];
-        
-        printk("throttle %s: %d....\n", tty_name(tty, buf),
-               tty->ldisc.chars_in_buffer(tty));
-#endif
-        if (serial_paranoia_check(info, tty->name, "mcfrs_throttle"))
-                return;
-        
-        if (I_IXOFF(tty))
-                info->x_char = STOP_CHAR(tty);
-        /* Turn off RTS line (do this atomic) */
-}
-static void mcfrs_unthrottle(struct tty_struct * tty)
-{
-        struct mcf_serial *info = (struct mcf_serial *)tty->driver_data;
-#ifdef SERIAL_DEBUG_THROTTLE
-        char    buf[64];
-        
-        printk("unthrottle %s: %d....\n", tty_name(tty, buf),
-               tty->ldisc.chars_in_buffer(tty));
-#endif
-        if (serial_paranoia_check(info, tty->name, "mcfrs_unthrottle"))
-                return;
-        
-        if (I_IXOFF(tty)) {
-                if (info->x_char)
-                        info->x_char = 0;
-                else
-                        info->x_char = START_CHAR(tty);
-        }
-        /* Assert RTS line (do this atomic) */
-}
-/*
- * ------------------------------------------------------------
- * mcfrs_ioctl() and friends
- * ------------------------------------------------------------
- */
-static int get_serial_info(struct mcf_serial * info,
-                           struct serial_struct * retinfo)
-{
-        struct serial_struct tmp;
-  
-        if (!retinfo)
-                return -EFAULT;
-        memset(&tmp, 0, sizeof(tmp));
-        tmp.type = info->type;
-        tmp.line = info->line;
-        tmp.port = (unsigned int) info->addr;
-        tmp.irq = info->irq;
-        tmp.flags = info->flags;
-        tmp.baud_base = info->baud_base;
-        tmp.close_delay = info->close_delay;
-        tmp.closing_wait = info->closing_wait;
-        tmp.custom_divisor = info->custom_divisor;
-        return copy_to_user(retinfo,&tmp,sizeof(*retinfo)) ? -EFAULT : 0;
-}
-static int set_serial_info(struct mcf_serial * info,
-                           struct serial_struct * new_info)
-{
-        struct serial_struct new_serial;
-        struct mcf_serial old_info;
-        int     retval = 0;
-        if (!new_info)
-                return -EFAULT;
-        if (copy_from_user(&new_serial,new_info,sizeof(new_serial)))
-                return -EFAULT;
-        old_info = *info;
-        if (!capable(CAP_SYS_ADMIN)) {
-                if ((new_serial.baud_base != info->baud_base) ||
-                    (new_serial.type != info->type) ||
-                    (new_serial.close_delay != info->close_delay) ||
-                    ((new_serial.flags & ~ASYNC_USR_MASK) !=
-                     (info->flags & ~ASYNC_USR_MASK)))
-                        return -EPERM;
-                info->flags = ((info->flags & ~ASYNC_USR_MASK) |
-                               (new_serial.flags & ASYNC_USR_MASK));
-                info->custom_divisor = new_serial.custom_divisor;
-                goto check_and_exit;
-        }
-        if (info->count > 1)
-                return -EBUSY;
-        /*
-         * OK, past this point, all the error checking has been done.
-         * At this point, we start making changes.....
-         */
-        info->baud_base = new_serial.baud_base;
-        info->flags = ((info->flags & ~ASYNC_FLAGS) |
-                        (new_serial.flags & ASYNC_FLAGS));
-        info->type = new_serial.type;
-        info->close_delay = new_serial.close_delay;
-        info->closing_wait = new_serial.closing_wait;
-check_and_exit:
-        retval = startup(info);
-        return retval;
-}
-/*
- * get_lsr_info - get line status register info
- *
- * Purpose: Let user call ioctl() to get info when the UART physically
- *          is emptied.  On bus types like RS485, the transmitter must
- *          release the bus after transmitting. This must be done when
- *          the transmit shift register is empty, not be done when the
- *          transmit holding register is empty.  This functionality
- *          allows an RS485 driver to be written in user space. 
- */
-static int get_lsr_info(struct mcf_serial * info, unsigned int *value)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        unsigned char           status;
-        local_irq_save(flags);
-        uartp = info->addr;
-        status = (uartp[MCFUART_USR] & MCFUART_USR_TXEMPTY) ? TIOCSER_TEMT : 0;
-        local_irq_restore(flags);
-        return put_user(status,value);
-}
-/*
- * This routine sends a break character out the serial port.
- */
-static void send_break( struct mcf_serial * info, int duration)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        if (!info->addr)
-                return;
-        set_current_state(TASK_INTERRUPTIBLE);
-        uartp = info->addr;
-        local_irq_save(flags);
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDBREAKSTART;
-        schedule_timeout(duration);
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDBREAKSTOP;
-        local_irq_restore(flags);
-}
-static int mcfrs_tiocmget(struct tty_struct *tty, struct file *file)
-{
-        struct mcf_serial * info = (struct mcf_serial *)tty->driver_data;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_ioctl"))
-                return -ENODEV;
-        if (tty->flags & (1 << TTY_IO_ERROR))
-                return -EIO;
-        return mcfrs_getsignals(info);
-}
-static int mcfrs_tiocmset(struct tty_struct *tty, struct file *file,
-                          unsigned int set, unsigned int clear)
-{
-        struct mcf_serial * info = (struct mcf_serial *)tty->driver_data;
-        int rts = -1, dtr = -1;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_ioctl"))
-                return -ENODEV;
-        if (tty->flags & (1 << TTY_IO_ERROR))
-                return -EIO;
-        if (set & TIOCM_RTS)
-                rts = 1;
-        if (set & TIOCM_DTR)
-                dtr = 1;
-        if (clear & TIOCM_RTS)
-                rts = 0;
-        if (clear & TIOCM_DTR)
-                dtr = 0;
-        mcfrs_setsignals(info, dtr, rts);
-        return 0;
-}
-static int mcfrs_ioctl(struct tty_struct *tty, struct file * file,
-                    unsigned int cmd, unsigned long arg)
-{
-        struct mcf_serial * info = (struct mcf_serial *)tty->driver_data;
-        int retval, error;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_ioctl"))
-                return -ENODEV;
-        if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-            (cmd != TIOCSERCONFIG) && (cmd != TIOCSERGWILD)  &&
-            (cmd != TIOCSERSWILD) && (cmd != TIOCSERGSTRUCT)) {
-                if (tty->flags & (1 << TTY_IO_ERROR))
-                    return -EIO;
-        }
-        
-        switch (cmd) {
-                case TCSBRK:    /* SVID version: non-zero arg --> no break */
-                        retval = tty_check_change(tty);
-                        if (retval)
-                                return retval;
-                        tty_wait_until_sent(tty, 0);
-                        if (!arg)
-                                send_break(info, HZ/4); /* 1/4 second */
-                        return 0;
-                case TCSBRKP:   /* support for POSIX tcsendbreak() */
-                        retval = tty_check_change(tty);
-                        if (retval)
-                                return retval;
-                        tty_wait_until_sent(tty, 0);
-                        send_break(info, arg ? arg*(HZ/10) : HZ/4);
-                        return 0;
-                case TIOCGSERIAL:
-                        if (access_ok(VERIFY_WRITE, (void *) arg,
-                                                sizeof(struct serial_struct)))
-                                return get_serial_info(info,
-                                               (struct serial_struct *) arg);
-                        return -EFAULT;
-                case TIOCSSERIAL:
-                        return set_serial_info(info,
-                                               (struct serial_struct *) arg);
-                case TIOCSERGETLSR: /* Get line status register */
-                        if (access_ok(VERIFY_WRITE, (void *) arg,
-                                                sizeof(unsigned int)))
-                                return get_lsr_info(info, (unsigned int *) arg);
-                        return -EFAULT;
-                case TIOCSERGSTRUCT:
-                        error = copy_to_user((struct mcf_serial *) arg,
-                                    info, sizeof(struct mcf_serial));
-                        if (error)
-                                return -EFAULT;
-                        return 0;
-                        
-#ifdef TIOCSET422
-                case TIOCSET422: {
-                        unsigned int val;
-                        get_user(val, (unsigned int *) arg);
-                        mcf_setpa(MCFPP_PA11, (val ? 0 : MCFPP_PA11));
-                        break;
-                }
-                case TIOCGET422: {
-                        unsigned int val;
-                        val = (mcf_getpa() & MCFPP_PA11) ? 0 : 1;
-                        put_user(val, (unsigned int *) arg);
-                        break;
-                }
-#endif
-                default:
-                        return -ENOIOCTLCMD;
-                }
-        return 0;
-}
-static void mcfrs_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
-{
-        struct mcf_serial *info = (struct mcf_serial *)tty->driver_data;
-        if (tty->termios->c_cflag == old_termios->c_cflag)
-                return;
-        mcfrs_change_speed(info);
-        if ((old_termios->c_cflag & CRTSCTS) &&
-            !(tty->termios->c_cflag & CRTSCTS)) {
-                tty->hw_stopped = 0;
-                mcfrs_setsignals(info, -1, 1);
-#if 0
-                mcfrs_start(tty);
-#endif
-        }
-}
-/*
- * ------------------------------------------------------------
- * mcfrs_close()
- * 
- * This routine is called when the serial port gets closed.  First, we
- * wait for the last remaining data to be sent.  Then, we unlink its
- * S structure from the interrupt chain if necessary, and we free
- * that IRQ if nothing is left in the chain.
- * ------------------------------------------------------------
- */
-static void mcfrs_close(struct tty_struct *tty, struct file * filp)
-{
-        volatile unsigned char  *uartp;
-        struct mcf_serial       *info = (struct mcf_serial *)tty->driver_data;
-        unsigned long           flags;
-        if (!info || serial_paranoia_check(info, tty->name, "mcfrs_close"))
-                return;
-        
-        local_irq_save(flags);
-        
-        if (tty_hung_up_p(filp)) {
-                local_irq_restore(flags);
-                return;
-        }
-        
-#ifdef SERIAL_DEBUG_OPEN
-        printk("mcfrs_close ttyS%d, count = %d\n", info->line, info->count);
-#endif
-        if ((tty->count == 1) && (info->count != 1)) {
-                /*
-                 * Uh, oh.  tty->count is 1, which means that the tty
-                 * structure will be freed.  Info->count should always
-                 * be one in these conditions.  If it's greater than
-                 * one, we've got real problems, since it means the
-                 * serial port won't be shutdown.
-                 */
-                printk("MCFRS: bad serial port count; tty->count is 1, "
-                       "info->count is %d\n", info->count);
-                info->count = 1;
-        }
-        if (--info->count < 0) {
-                printk("MCFRS: bad serial port count for ttyS%d: %d\n",
-                       info->line, info->count);
-                info->count = 0;
-        }
-        if (info->count) {
-                local_irq_restore(flags);
-                return;
-        }
-        info->flags |= ASYNC_CLOSING;
-        /*
-         * Now we wait for the transmit buffer to clear; and we notify 
-         * the line discipline to only process XON/XOFF characters.
-         */
-        tty->closing = 1;
-        if (info->closing_wait != ASYNC_CLOSING_WAIT_NONE)
-                tty_wait_until_sent(tty, info->closing_wait);
-        /*
-         * At this point we stop accepting input.  To do this, we
-         * disable the receive line status interrupts, and tell the
-         * interrupt driver to stop checking the data ready bit in the
-         * line status register.
-         */
-        info->imr &= ~MCFUART_UIR_RXREADY;
-        uartp = info->addr;
-        uartp[MCFUART_UIMR] = info->imr;
-#if 0
-        /* FIXME: do we need to keep this enabled for console?? */
-        if (mcfrs_console_inited && (mcfrs_console_port == info->line)) {
-                /* Do not disable the UART */ ;
-        } else
-#endif
-        shutdown(info);
-        mcfrs_flush_buffer(tty);
-        tty_ldisc_flush(tty);
-        
-        tty->closing = 0;
-        info->event = 0;
-        info->port.tty = NULL;
-#if 0   
-        if (tty->ldisc.num != ldiscs[N_TTY].num) {
-                if (tty->ldisc.close)
-                        (tty->ldisc.close)(tty);
-                tty->ldisc = ldiscs[N_TTY];
-                tty->termios->c_line = N_TTY;
-                if (tty->ldisc.open)
-                        (tty->ldisc.open)(tty);
-        }
-#endif  
-        if (info->blocked_open) {
-                if (info->close_delay) {
-                        msleep_interruptible(jiffies_to_msecs(info->close_delay));
-                }
-                wake_up_interruptible(&info->open_wait);
-        }
-        info->flags &= ~(ASYNC_NORMAL_ACTIVE|ASYNC_CLOSING);
-        wake_up_interruptible(&info->close_wait);
-        local_irq_restore(flags);
-}
-/*
- * mcfrs_wait_until_sent() --- wait until the transmitter is empty
- */
-static void
-mcfrs_wait_until_sent(struct tty_struct *tty, int timeout)
-{
-#ifdef  CONFIG_M5272
-#define MCF5272_FIFO_SIZE       25              /* fifo size + shift reg */
-        struct mcf_serial * info = (struct mcf_serial *)tty->driver_data;
-        volatile unsigned char *uartp;
-        unsigned long orig_jiffies, fifo_time, char_time, fifo_cnt;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_wait_until_sent"))
-                return;
-        orig_jiffies = jiffies;
-        /*
-         * Set the check interval to be 1/5 of the approximate time
-         * to send the entire fifo, and make it at least 1.  The check
-         * interval should also be less than the timeout.
-         *
-         * Note: we have to use pretty tight timings here to satisfy
-         * the NIST-PCTS.
-         */
-        lock_kernel();
-        fifo_time = (MCF5272_FIFO_SIZE * HZ * 10) / info->baud;
-        char_time = fifo_time / 5;
-        if (char_time == 0)
-                char_time = 1;
-        if (timeout && timeout < char_time)
-                char_time = timeout;
-        /*
-         * Clamp the timeout period at 2 * the time to empty the
-         * fifo.  Just to be safe, set the minimum at .5 seconds.
-         */
-        fifo_time *= 2;
-        if (fifo_time < (HZ/2))
-                fifo_time = HZ/2;
-        if (!timeout || timeout > fifo_time)
-                timeout = fifo_time;
-        /*
-         * Account for the number of bytes in the UART
-         * transmitter FIFO plus any byte being shifted out.
-         */
-        uartp = (volatile unsigned char *) info->addr;
-        for (;;) {
-                fifo_cnt = (uartp[MCFUART_UTF] & MCFUART_UTF_TXB);
-                if ((uartp[MCFUART_USR] & (MCFUART_USR_TXREADY|
-                                MCFUART_USR_TXEMPTY)) ==
-                        MCFUART_USR_TXREADY)
-                        fifo_cnt++;
-                if (fifo_cnt == 0)
-                        break;
-                msleep_interruptible(jiffies_to_msecs(char_time));
-                if (signal_pending(current))
-                        break;
-                if (timeout && time_after(jiffies, orig_jiffies + timeout))
-                        break;
-        }
-        unlock_kernel();
-#else
-        /*
-         * For the other coldfire models, assume all data has been sent
-         */
-#endif
-}
-/*
- * mcfrs_hangup() --- called by tty_hangup() when a hangup is signaled.
- */
-void mcfrs_hangup(struct tty_struct *tty)
-{
-        struct mcf_serial * info = (struct mcf_serial *)tty->driver_data;
-        
-        if (serial_paranoia_check(info, tty->name, "mcfrs_hangup"))
-                return;
-        
-        mcfrs_flush_buffer(tty);
-        shutdown(info);
-        info->event = 0;
-        info->count = 0;
-        info->flags &= ~ASYNC_NORMAL_ACTIVE;
-        info->port.tty = NULL;
-        wake_up_interruptible(&info->open_wait);
-}
-/*
- * ------------------------------------------------------------
- * mcfrs_open() and friends
- * ------------------------------------------------------------
- */
-static int block_til_ready(struct tty_struct *tty, struct file * filp,
-                           struct mcf_serial *info)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        int     retval;
-        int     do_clocal = 0;
-        /*
-         * If the device is in the middle of being closed, then block
-         * until it's done, and then try again.
-         */
-        if (info->flags & ASYNC_CLOSING) {
-                interruptible_sleep_on(&info->close_wait);
-#ifdef SERIAL_DO_RESTART
-                if (info->flags & ASYNC_HUP_NOTIFY)
-                        return -EAGAIN;
-                else
-                        return -ERESTARTSYS;
-#else
-                return -EAGAIN;
-#endif
-        }
-        
-        /*
-         * If non-blocking mode is set, or the port is not enabled,
-         * then make the check up front and then exit.
-         */
-        if ((filp->f_flags & O_NONBLOCK) ||
-            (tty->flags & (1 << TTY_IO_ERROR))) {
-                info->flags |= ASYNC_NORMAL_ACTIVE;
-                return 0;
-        }
-        if (tty->termios->c_cflag & CLOCAL)
-                do_clocal = 1;
-        /*
-         * Block waiting for the carrier detect and the line to become
-         * free (i.e., not in use by the callout).  While we are in
-         * this loop, info->count is dropped by one, so that
-         * mcfrs_close() knows when to free things.  We restore it upon
-         * exit, either normal or abnormal.
-         */
-        retval = 0;
-        add_wait_queue(&info->open_wait, &wait);
-#ifdef SERIAL_DEBUG_OPEN
-        printk("block_til_ready before block: ttyS%d, count = %d\n",
-               info->line, info->count);
-#endif
-        info->count--;
-        info->blocked_open++;
-        while (1) {
-                local_irq_disable();
-                mcfrs_setsignals(info, 1, 1);
-                local_irq_enable();
-                current->state = TASK_INTERRUPTIBLE;
-                if (tty_hung_up_p(filp) ||
-                    !(info->flags & ASYNC_INITIALIZED)) {
-#ifdef SERIAL_DO_RESTART
-                        if (info->flags & ASYNC_HUP_NOTIFY)
-                                retval = -EAGAIN;
-                        else
-                                retval = -ERESTARTSYS;  
-#else
-                        retval = -EAGAIN;
-#endif
-                        break;
-                }
-                if (!(info->flags & ASYNC_CLOSING) &&
-                    (do_clocal || (mcfrs_getsignals(info) & TIOCM_CD)))
-                        break;
-                if (signal_pending(current)) {
-                        retval = -ERESTARTSYS;
-                        break;
-                }
-#ifdef SERIAL_DEBUG_OPEN
-                printk("block_til_ready blocking: ttyS%d, count = %d\n",
-                       info->line, info->count);
-#endif
-                schedule();
-        }
-        current->state = TASK_RUNNING;
-        remove_wait_queue(&info->open_wait, &wait);
-        if (!tty_hung_up_p(filp))
-                info->count++;
-        info->blocked_open--;
-#ifdef SERIAL_DEBUG_OPEN
-        printk("block_til_ready after blocking: ttyS%d, count = %d\n",
-               info->line, info->count);
-#endif
-        if (retval)
-                return retval;
-        info->flags |= ASYNC_NORMAL_ACTIVE;
-        return 0;
-}       
-/*
- * This routine is called whenever a serial port is opened. It
- * enables interrupts for a serial port, linking in its structure into
- * the IRQ chain.   It also performs the serial-specific
- * initialization for the tty structure.
- */
-int mcfrs_open(struct tty_struct *tty, struct file * filp)
-{
-        struct mcf_serial       *info;
-        int                     retval, line;
-        line = tty->index;
-        if ((line < 0) || (line >= NR_PORTS))
-                return -ENODEV;
-        info = mcfrs_table + line;
-        if (serial_paranoia_check(info, tty->name, "mcfrs_open"))
-                return -ENODEV;
-#ifdef SERIAL_DEBUG_OPEN
-        printk("mcfrs_open %s, count = %d\n", tty->name, info->count);
-#endif
-        info->count++;
-        tty->driver_data = info;
-        info->port.tty = tty;
-        /*
-         * Start up serial port
-         */
-        retval = startup(info);
-        if (retval)
-                return retval;
-        retval = block_til_ready(tty, filp, info);
-        if (retval) {
-#ifdef SERIAL_DEBUG_OPEN
-                printk("mcfrs_open returning after block_til_ready with %d\n",
-                       retval);
-#endif
-                return retval;
-        }
-#ifdef SERIAL_DEBUG_OPEN
-        printk("mcfrs_open %s successful...\n", tty->name);
-#endif
-        return 0;
-}
-/*
- *      Based on the line number set up the internal interrupt stuff.
- */
-static void mcfrs_irqinit(struct mcf_serial *info)
-{
-#if defined(CONFIG_M5272)
-        volatile unsigned long  *icrp;
-        volatile unsigned long  *portp;
-        volatile unsigned char  *uartp;
-        uartp = info->addr;
-        icrp = (volatile unsigned long *) (MCF_MBAR + MCFSIM_ICR2);
-        switch (info->line) {
-        case 0:
-                *icrp = 0xe0000000;
-                break;
-        case 1:
-                *icrp = 0x0e000000;
-                break;
-        default:
-                printk("MCFRS: don't know how to handle UART %d interrupt?\n",
-                        info->line);
-                return;
-        }
-        /* Enable the output lines for the serial ports */
-        portp = (volatile unsigned long *) (MCF_MBAR + MCFSIM_PBCNT);
-        *portp = (*portp & ~0x000000ff) | 0x00000055;
-        portp = (volatile unsigned long *) (MCF_MBAR + MCFSIM_PDCNT);
-        *portp = (*portp & ~0x000003fc) | 0x000002a8;
-#elif defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x)
-        volatile unsigned char *icrp, *uartp;
-        volatile unsigned long *imrp;
-        uartp = info->addr;
-        icrp = (volatile unsigned char *) (MCF_MBAR + MCFICM_INTC0 +
-                MCFINTC_ICR0 + MCFINT_UART0 + info->line);
-        *icrp = 0x30 + info->line; /* level 6, line based priority */
-        imrp = (volatile unsigned long *) (MCF_MBAR + MCFICM_INTC0 +
-                MCFINTC_IMRL);
-        *imrp &= ~((1 << (info->irq - MCFINT_VECBASE)) | 1);
-#if defined(CONFIG_M527x)
-        {
-                /*
-                 * External Pin Mask Setting & Enable External Pin for Interface
-                 * mrcbis@aliceposta.it
-                 */
-                u16 *serpin_enable_mask;
-                serpin_enable_mask = (u16 *) (MCF_IPSBAR + MCF_GPIO_PAR_UART);
-                if (info->line == 0)
-                        *serpin_enable_mask |= UART0_ENABLE_MASK;
-                else if (info->line == 1)
-                        *serpin_enable_mask |= UART1_ENABLE_MASK;
-                else if (info->line == 2)
-                        *serpin_enable_mask |= UART2_ENABLE_MASK;
-        }
-#endif
-#if defined(CONFIG_M528x)
-        /* make sure PUAPAR is set for UART0 and UART1 */
-        if (info->line < 2) {
-                volatile unsigned char *portp = (volatile unsigned char *) (MCF_MBAR + MCF5282_GPIO_PUAPAR);
-                *portp |= (0x03 << (info->line * 2));
-        }
-#endif
-#elif defined(CONFIG_M520x)
-        volatile unsigned char *icrp, *uartp;
-        volatile unsigned long *imrp;
-        uartp = info->addr;
-        icrp = (volatile unsigned char *) (MCF_MBAR + MCFICM_INTC0 +
-                MCFINTC_ICR0 + MCFINT_UART0 + info->line);
-        *icrp = 0x03;
-        imrp = (volatile unsigned long *) (MCF_MBAR + MCFICM_INTC0 +
-                MCFINTC_IMRL);
-        *imrp &= ~((1 << (info->irq - MCFINT_VECBASE)) | 1);
-        if (info->line < 2) {
-                unsigned short *uart_par;
-                uart_par = (unsigned short *)(MCF_IPSBAR + MCF_GPIO_PAR_UART);
-                if (info->line == 0)
-                        *uart_par |=  MCF_GPIO_PAR_UART_PAR_UTXD0
-                                  | MCF_GPIO_PAR_UART_PAR_URXD0;
-                else if (info->line == 1)
-                        *uart_par |=  MCF_GPIO_PAR_UART_PAR_UTXD1
-                                  | MCF_GPIO_PAR_UART_PAR_URXD1;
-                } else if (info->line == 2) {
-                        unsigned char *feci2c_par;
-                        feci2c_par = (unsigned char *)(MCF_IPSBAR +  MCF_GPIO_PAR_FECI2C);
-                        *feci2c_par &= ~0x0F;
-                        *feci2c_par |=  MCF_GPIO_PAR_FECI2C_PAR_SCL_UTXD2
-                                    | MCF_GPIO_PAR_FECI2C_PAR_SDA_URXD2;
-                }
-#elif defined(CONFIG_M532x)
-        volatile unsigned char *uartp;
-        uartp = info->addr;
-        switch (info->line) {
-        case 0:
-                MCF_INTC0_ICR26 = 0x3;
-                MCF_INTC0_CIMR = 26;
-                /* GPIO initialization */
-                MCF_GPIO_PAR_UART |= 0x000F;
-                break;
-        case 1:
-                MCF_INTC0_ICR27 = 0x3;
-                MCF_INTC0_CIMR = 27;
-                /* GPIO initialization */
-                MCF_GPIO_PAR_UART |= 0x0FF0;
-                break;
-        case 2:
-                MCF_INTC0_ICR28 = 0x3;
-                MCF_INTC0_CIMR = 28;
-                /* GPIOs also must be initalized, depends on board */
-                break;
-        }
-#else
-        volatile unsigned char  *icrp, *uartp;
-        switch (info->line) {
-        case 0:
-                icrp = (volatile unsigned char *) (MCF_MBAR + MCFSIM_UART1ICR);
-                *icrp = /*MCFSIM_ICR_AUTOVEC |*/ MCFSIM_ICR_LEVEL6 |
-                        MCFSIM_ICR_PRI1;
-                mcf_setimr(mcf_getimr() & ~MCFSIM_IMR_UART1);
-                break;
-        case 1:
-                icrp = (volatile unsigned char *) (MCF_MBAR + MCFSIM_UART2ICR);
-                *icrp = /*MCFSIM_ICR_AUTOVEC |*/ MCFSIM_ICR_LEVEL6 |
-                        MCFSIM_ICR_PRI2;
-                mcf_setimr(mcf_getimr() & ~MCFSIM_IMR_UART2);
-                break;
-        default:
-                printk("MCFRS: don't know how to handle UART %d interrupt?\n",
-                        info->line);
-                return;
-        }
-        uartp = info->addr;
-        uartp[MCFUART_UIVR] = info->irq;
-#endif
-        /* Clear mask, so no surprise interrupts. */
-        uartp[MCFUART_UIMR] = 0;
-        if (request_irq(info->irq, mcfrs_interrupt, IRQF_DISABLED,
-            "ColdFire UART", NULL)) {
-                printk("MCFRS: Unable to attach ColdFire UART %d interrupt "
-                        "vector=%d\n", info->line, info->irq);
-        }
-        return;
-}
-char *mcfrs_drivername = "ColdFire internal UART serial driver version 1.00\n";
-/*
- * Serial stats reporting...
- */
-int mcfrs_readproc(char *page, char **start, off_t off, int count,
-                         int *eof, void *data)
-{
-        struct mcf_serial       *info;
-        char                    str[20];
-        int                     len, sigs, i;
-        len = sprintf(page, mcfrs_drivername);
-        for (i = 0; (i < NR_PORTS); i++) {
-                info = &mcfrs_table[i];
-                len += sprintf((page + len), "%d: port:%x irq=%d baud:%d ",
-                        i, (unsigned int) info->addr, info->irq, info->baud);
-                if (info->stats.rx || info->stats.tx)
-                        len += sprintf((page + len), "tx:%d rx:%d ",
-                        info->stats.tx, info->stats.rx);
-                if (info->stats.rxframing)
-                        len += sprintf((page + len), "fe:%d ",
-                        info->stats.rxframing);
-                if (info->stats.rxparity)
-                        len += sprintf((page + len), "pe:%d ",
-                        info->stats.rxparity);
-                if (info->stats.rxbreak)
-                        len += sprintf((page + len), "brk:%d ",
-                        info->stats.rxbreak);
-                if (info->stats.rxoverrun)
-                        len += sprintf((page + len), "oe:%d ",
-                        info->stats.rxoverrun);
-                str[0] = str[1] = 0;
-                if ((sigs = mcfrs_getsignals(info))) {
-                        if (sigs & TIOCM_RTS)
-                                strcat(str, "|RTS");
-                        if (sigs & TIOCM_CTS)
-                                strcat(str, "|CTS");
-                        if (sigs & TIOCM_DTR)
-                                strcat(str, "|DTR");
-                        if (sigs & TIOCM_CD)
-                                strcat(str, "|CD");
-                }
-                len += sprintf((page + len), "%s\n", &str[1]);
-        }
-        return(len);
-}
-/* Finally, routines used to initialize the serial driver. */
-static void show_serial_version(void)
-{
-        printk(mcfrs_drivername);
-}
-static const struct tty_operations mcfrs_ops = {
-        .open = mcfrs_open,
-        .close = mcfrs_close,
-        .write = mcfrs_write,
-        .flush_chars = mcfrs_flush_chars,
-        .write_room = mcfrs_write_room,
-        .chars_in_buffer = mcfrs_chars_in_buffer,
-        .flush_buffer = mcfrs_flush_buffer,
-        .ioctl = mcfrs_ioctl,
-        .throttle = mcfrs_throttle,
-        .unthrottle = mcfrs_unthrottle,
-        .set_termios = mcfrs_set_termios,
-        .stop = mcfrs_stop,
-        .start = mcfrs_start,
-        .hangup = mcfrs_hangup,
-        .read_proc = mcfrs_readproc,
-        .wait_until_sent = mcfrs_wait_until_sent,
-        .tiocmget = mcfrs_tiocmget,
-        .tiocmset = mcfrs_tiocmset,
-};
-/* mcfrs_init inits the driver */
-static int __init
-mcfrs_init(void)
-{
-        struct mcf_serial       *info;
-        unsigned long           flags;
-        int                     i;
-        /* Setup base handler, and timer table. */
-#ifdef MCFPP_DCD0
-        init_timer(&mcfrs_timer_struct);
-        mcfrs_timer_struct.function = mcfrs_timer;
-        mcfrs_timer_struct.data = 0;
-        mcfrs_timer_struct.expires = jiffies + HZ/25;
-        add_timer(&mcfrs_timer_struct);
-        mcfrs_ppstatus = mcf_getppdata() & (MCFPP_DCD0 | MCFPP_DCD1);
-#endif
-        mcfrs_serial_driver = alloc_tty_driver(NR_PORTS);
-        if (!mcfrs_serial_driver)
-                return -ENOMEM;
-        show_serial_version();
-        /* Initialize the tty_driver structure */
-        mcfrs_serial_driver->owner = THIS_MODULE;
-        mcfrs_serial_driver->name = "ttyS";
-        mcfrs_serial_driver->driver_name = "mcfserial";
-        mcfrs_serial_driver->major = TTY_MAJOR;
-        mcfrs_serial_driver->minor_start = 64;
-        mcfrs_serial_driver->type = TTY_DRIVER_TYPE_SERIAL;
-        mcfrs_serial_driver->subtype = SERIAL_TYPE_NORMAL;
-        mcfrs_serial_driver->init_termios = tty_std_termios;
-        mcfrs_serial_driver->init_termios.c_cflag =
-                mcfrs_console_cbaud | CS8 | CREAD | HUPCL | CLOCAL;
-        mcfrs_serial_driver->flags = TTY_DRIVER_REAL_RAW;
-        tty_set_operations(mcfrs_serial_driver, &mcfrs_ops);
-        if (tty_register_driver(mcfrs_serial_driver)) {
-                printk("MCFRS: Couldn't register serial driver\n");
-                put_tty_driver(mcfrs_serial_driver);
-                return(-EBUSY);
-        }
-        local_irq_save(flags);
-        /*
-         *      Configure all the attached serial ports.
-         */
-        for (i = 0, info = mcfrs_table; (i < NR_PORTS); i++, info++) {
-                info->magic = SERIAL_MAGIC;
-                info->line = i;
-                info->port.tty = NULL;
-                info->custom_divisor = 16;
-                info->close_delay = 50;
-                info->closing_wait = 3000;
-                info->x_char = 0;
-                info->event = 0;
-                info->count = 0;
-                info->blocked_open = 0;
-                INIT_WORK(&info->tqueue, mcfrs_offintr);
-                INIT_WORK(&info->tqueue_hangup, do_serial_hangup);
-                init_waitqueue_head(&info->open_wait);
-                init_waitqueue_head(&info->close_wait);
-                info->imr = 0;
-                mcfrs_setsignals(info, 0, 0);
-                mcfrs_irqinit(info);
-                printk("ttyS%d at 0x%04x (irq = %d)", info->line,
-                        (unsigned int) info->addr, info->irq);
-                printk(" is a builtin ColdFire UART\n");
-        }
-        local_irq_restore(flags);
-        return 0;
-}
-module_init(mcfrs_init);
-/****************************************************************************/
-/*                          Serial Console                                  */
-/****************************************************************************/
-/*
- *      Quick and dirty UART initialization, for console output.
- */
-void mcfrs_init_console(void)
-{
-        volatile unsigned char  *uartp;
-        unsigned int            clk;
-        /*
-         *      Reset UART, get it into known state...
-         */
-        uartp = (volatile unsigned char *) (MCF_MBAR +
-                (mcfrs_console_port ? MCFUART_BASE2 : MCFUART_BASE1));
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETRX;  /* reset RX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETTX;  /* reset TX */
-        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETMRPTR;  /* reset MR pointer */
-        /*
-         * Set port for defined baud , 8 data bits, 1 stop bit, no parity.
-         */
-        uartp[MCFUART_UMR] = MCFUART_MR1_PARITYNONE | MCFUART_MR1_CS8;
-        uartp[MCFUART_UMR] = MCFUART_MR2_STOP1;
-#ifdef  CONFIG_M5272
-{
-        /*
-         * For the MCF5272, also compute the baudrate fraction.
-         */
-        int fraction = MCF_BUSCLK - (clk * 32 * mcfrs_console_baud);
-        fraction *= 16;
-        fraction /= (32 * mcfrs_console_baud);
-        uartp[MCFUART_UFPD] = (fraction & 0xf);         /* set fraction */
-        clk = (MCF_BUSCLK / mcfrs_console_baud) / 32;
-}
-#else
-        clk = ((MCF_BUSCLK / mcfrs_console_baud) + 16) / 32; /* set baud */
-#endif
-        uartp[MCFUART_UBG1] = (clk & 0xff00) >> 8;  /* set msb baud */
-        uartp[MCFUART_UBG2] = (clk & 0xff);  /* set lsb baud */
-        uartp[MCFUART_UCSR] = MCFUART_UCSR_RXCLKTIMER | MCFUART_UCSR_TXCLKTIMER;
-        uartp[MCFUART_UCR] = MCFUART_UCR_RXENABLE | MCFUART_UCR_TXENABLE;
-        mcfrs_console_inited++;
-        return;
-}
-/*
- *      Setup for console. Argument comes from the boot command line.
- */
-int mcfrs_console_setup(struct console *cp, char *arg)
-{
-        int             i, n = CONSOLE_BAUD_RATE;
-        if (!cp)
-                return(-1);
-        if (!strncmp(cp->name, "ttyS", 4))
-                mcfrs_console_port = cp->index;
-        else if (!strncmp(cp->name, "cua", 3))
-                mcfrs_console_port = cp->index;
-        else
-                return(-1);
-        if (arg)
-                n = simple_strtoul(arg,NULL,0);
-        for (i = 0; i < MCFRS_BAUD_TABLE_SIZE; i++)
-                if (mcfrs_baud_table[i] == n)
-                        break;
-        if (i < MCFRS_BAUD_TABLE_SIZE) {
-                mcfrs_console_baud = n;
-                mcfrs_console_cbaud = 0;
-                if (i > 15) {
-                        mcfrs_console_cbaud |= CBAUDEX;
-                        i -= 15;
-                }
-                mcfrs_console_cbaud |= i;
-        }
-        mcfrs_init_console(); /* make sure baud rate changes */
-        return(0);
-}
-static struct tty_driver *mcfrs_console_device(struct console *c, int *index)
-{
-        *index = c->index;
-        return mcfrs_serial_driver;
-}
-/*
- *      Output a single character, using UART polled mode.
- *      This is used for console output.
- */
-int mcfrs_put_char(char ch)
-{
-        volatile unsigned char  *uartp;
-        unsigned long           flags;
-        int                     i;
-        uartp = (volatile unsigned char *) (MCF_MBAR +
-                (mcfrs_console_port ? MCFUART_BASE2 : MCFUART_BASE1));
-        local_irq_save(flags);
-        for (i = 0; (i < 0x10000); i++) {
-                if (uartp[MCFUART_USR] & MCFUART_USR_TXREADY)
-                        break;
-        }
-        if (i < 0x10000) {
-                uartp[MCFUART_UTB] = ch;
-                for (i = 0; (i < 0x10000); i++)
-                        if (uartp[MCFUART_USR] & MCFUART_USR_TXEMPTY)
-                                break;
-        }
-        if (i >= 0x10000)
-                mcfrs_init_console(); /* try and get it back */
-        local_irq_restore(flags);
-        return 1;
-}
-/*
- * rs_console_write is registered for printk output.
- */
-void mcfrs_console_write(struct console *cp, const char *p, unsigned len)
-{
-        if (!mcfrs_console_inited)
-                mcfrs_init_console();
-        while (len-- > 0) {
-                if (*p == '\n')
-                        mcfrs_put_char('\r');
-                mcfrs_put_char(*p++);
-        }
-}
-/*
- * declare our consoles
- */
-struct console mcfrs_console = {
-        .name           = "ttyS",
-        .write          = mcfrs_console_write,
-        .device         = mcfrs_console_device,
-        .setup          = mcfrs_console_setup,
-        .flags          = CON_PRINTBUFFER,
-        .index          = -1,
-};
-static int __init mcfrs_console_init(void)
-{
-        register_console(&mcfrs_console);
-        return 0;
-}
-console_initcall(mcfrs_console_init);
-/****************************************************************************/
diff --git a/drivers/serial/mcfserial.h b/drivers/serial/mcfserial.h
deleted file mode 100644
index 56420e2cb110..000000000000
--- a/drivers/serial/mcfserial.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * mcfserial.c -- serial driver for ColdFire internal UARTS.
- *
- * Copyright (c) 1999 Greg Ungerer <gerg@snapgear.com>
- * Copyright (c) 2000-2001 Lineo, Inc. <www.lineo.com>
- * Copyright (c) 2002 SnapGear Inc., <www.snapgear.com>
- *
- * Based on code from 68332serial.c which was:
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1998 TSHG
- * Copyright (c) 1999 Rt-Control Inc. <jeff@uclinux.org>
- */ 
-#ifndef _MCF_SERIAL_H
-#define _MCF_SERIAL_H
-#include <linux/serial.h>
-#ifdef __KERNEL__
-/*
- *      Define a local serial stats structure.
- */
-struct mcf_stats {
-        unsigned int    rx;
-        unsigned int    tx;
-        unsigned int    rxbreak;
-        unsigned int    rxframing;
-        unsigned int    rxparity;
-        unsigned int    rxoverrun;
-};
-/*
- * This is our internal structure for each serial port's state.
- * Each serial port has one of these structures associated with it.
- */
-struct mcf_serial {
-        int                     magic;
-        volatile unsigned char  *addr;          /* UART memory address */
-        int                     irq;
-        int                     flags;          /* defined in tty.h */
-        int                     type;           /* UART type */
-        struct tty_struct       *tty;
-        unsigned char           imr;            /* Software imr register */
-        unsigned int            baud;
-        int                     sigs;
-        int                     custom_divisor;
-        int                     x_char; /* xon/xoff character */
-        int                     baud_base;
-        int                     close_delay;
-        unsigned short          closing_wait;
-        unsigned short          closing_wait2;
-        unsigned long           event;
-        int                     line;
-        int                     count;      /* # of fd on device */
-        int                     blocked_open; /* # of blocked opens */
-        unsigned char           *xmit_buf;
-        int                     xmit_head;
-        int                     xmit_tail;
-        int                     xmit_cnt;
-        struct mcf_stats        stats;
-        struct work_struct      tqueue;
-        struct work_struct      tqueue_hangup;
-        wait_queue_head_t       open_wait;
-        wait_queue_head_t       close_wait;
-};
-#endif /* __KERNEL__ */
-#endif /* _MCF_SERIAL_H */
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index f977c98cfa95..6bdf3362e3b1 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -2051,7 +2051,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
                                        "transmitter\n",
                               port->dev ? port->dev->bus_id : "",
                               port->dev ? ": " : "",
-                               drv->dev_name, port->line);
+                               drv->dev_name,
+                               drv->tty_driver->name_base + port->line);
                ops->shutdown(port);
        }
@@ -2154,12 +2155,11 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
        switch (port->iotype) {
        case UPIO_PORT:
-                snprintf(address, sizeof(address),
+                snprintf(address, sizeof(address), "I/O 0x%lx", port->iobase);
-                         "I/O 0x%x", port->iobase);
                break;
        case UPIO_HUB6:
                snprintf(address, sizeof(address),
-                         "I/O 0x%x offset 0x%x", port->iobase, port->hub6);
+                         "I/O 0x%lx offset 0x%x", port->iobase, port->hub6);
                break;
        case UPIO_MEM:
        case UPIO_MEM32:
@@ -2177,7 +2177,9 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
        printk(KERN_INFO "%s%s%s%d at %s (irq = %d) is a %s\n",
               port->dev ? port->dev->bus_id : "",
               port->dev ? ": " : "",
-               drv->dev_name, port->line, address, port->irq, uart_type(port));
+               drv->dev_name,
+               drv->tty_driver->name_base + port->line,
+               address, port->irq, uart_type(port));
 }
 static void
diff --git a/drivers/usb/serial/aircable.c b/drivers/usb/serial/aircable.c
index 79ea98c66fa8..99fb7dc59c45 100644
--- a/drivers/usb/serial/aircable.c
+++ b/drivers/usb/serial/aircable.c
@@ -272,7 +272,7 @@ static void aircable_read(struct work_struct *work)
         * 64 bytes, to ensure I do not get throttled.
         * Ask USB mailing list for better aproach.
         */
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty) {
                schedule_work(&priv->rx_work);
@@ -283,12 +283,13 @@ static void aircable_read(struct work_struct *work)
        count = min(64, serial_buf_data_avail(priv->rx_buf));
        if (count <= 0)
-                return; /* We have finished sending everything. */
+                goto out; /* We have finished sending everything. */
        tty_prepare_flip_string(tty, &data, count);
        if (!data) {
-                err("%s- kzalloc(%d) failed.", __func__, count);
+                dev_err(&port->dev, "%s- kzalloc(%d) failed.",
-                return;
+                                                        __func__, count);
+                goto out;
        }
        serial_buf_get(priv->rx_buf, data, count);
@@ -297,7 +298,8 @@ static void aircable_read(struct work_struct *work)
        if (serial_buf_data_avail(priv->rx_buf))
                schedule_work(&priv->rx_work);
+out:            
+        tty_kref_put(tty);
        return;
 }
 /* End of private methods */
@@ -495,7 +497,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                                urb->actual_length, urb->transfer_buffer);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                if (urb->actual_length <= 2) {
                        /* This is an incomplete package */
@@ -527,6 +529,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
                }
                aircable_read(&priv->rx_work);
        }
+        tty_kref_put(tty);
        /* Schedule the next read _if_ we are still open */
        if (port->port.count) {
diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 2ebe06c3405a..1913bc7c5f0b 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -322,7 +322,7 @@ static void belkin_sa_read_int_callback(struct urb *urb)
         * to look in to this before committing any code.
         */
        if (priv->last_lsr & BELKIN_SA_LSR_ERR) {
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                /* Overrun Error */
                if (priv->last_lsr & BELKIN_SA_LSR_OE) {
                }
@@ -335,6 +335,7 @@ static void belkin_sa_read_int_callback(struct urb *urb)
                /* Break Indicator */
                if (priv->last_lsr & BELKIN_SA_LSR_BI) {
                }
+                tty_kref_put(tty);
        }
 #endif
        spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index e980766bb84b..5b20de130e08 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -117,7 +117,7 @@ static int usb_console_setup(struct console *co, char *options)
        }
        port = serial->port[0];
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
        info->port = port;
@@ -143,7 +143,7 @@ static int usb_console_setup(struct console *co, char *options)
                        }
                        memset(&dummy, 0, sizeof(struct ktermios));
                        tty->termios = termios;
-                        port->port.tty = tty;
+                        tty_port_tty_set(&port->port, tty);
                }
                /* only call the device specific open if this
@@ -163,7 +163,7 @@ static int usb_console_setup(struct console *co, char *options)
                        tty_termios_encode_baud_rate(termios, baud, baud);
                        serial->type->set_termios(tty, port, &dummy);
-                        port->port.tty = NULL;
+                        tty_port_tty_set(&port->port, NULL);
                        kfree(termios);
                        kfree(tty);
                }
@@ -176,7 +176,7 @@ out:
        return retval;
 free_termios:
        kfree(termios);
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
 free_tty:
        kfree(tty);
 reset_open_count:
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index b4d72351cb96..94ef36c4764b 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -384,7 +384,7 @@ static void cyberjack_read_bulk_callback(struct urb *urb)
                return;
        }
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty) {
                dbg("%s - ignoring since device not open\n", __func__);
                return;
@@ -394,6 +394,7 @@ static void cyberjack_read_bulk_callback(struct urb *urb)
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        spin_lock(&priv->lock);
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 22837a3f2f89..f3514a91f915 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1286,7 +1286,7 @@ static void cypress_read_int_callback(struct urb *urb)
        }
        spin_unlock_irqrestore(&priv->lock, flags);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty) {
                dbg("%s - bad tty pointer - exiting", __func__);
                return;
@@ -1362,7 +1362,7 @@ static void cypress_read_int_callback(struct urb *urb)
                                        data[i]);
                        tty_insert_flip_char(tty, data[i], tty_flag);
                }
-                tty_flip_buffer_push(port->port.tty);
+                tty_flip_buffer_push(tty);
        }
        spin_lock_irqsave(&priv->lock, flags);
@@ -1371,6 +1371,7 @@ static void cypress_read_int_callback(struct urb *urb)
        spin_unlock_irqrestore(&priv->lock, flags);
 continue_read:
+        tty_kref_put(tty);
        /* Continue trying to always read... unless the port has closed. */
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 240aad1acaab..5756ac6d6c92 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -604,7 +604,9 @@ static void digi_wakeup_write_lock(struct work_struct *work)
 static void digi_wakeup_write(struct usb_serial_port *port)
 {
-        tty_wakeup(port->port.tty);
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
+        tty_wakeup(tty);
+        tty_kref_put(tty);
 }
@@ -1668,7 +1670,7 @@ static int digi_read_inb_callback(struct urb *urb)
 {
        struct usb_serial_port *port = urb->context;
-        struct tty_struct *tty = port->port.tty;
+        struct tty_struct *tty;
        struct digi_port *priv = usb_get_serial_port_data(port);
        int opcode = ((unsigned char *)urb->transfer_buffer)[0];
        int len = ((unsigned char *)urb->transfer_buffer)[1];
@@ -1692,6 +1694,7 @@ static int digi_read_inb_callback(struct urb *urb)
                return -1;
        }
+        tty = tty_port_tty_get(&port->port);
        spin_lock(&priv->dp_port_lock);
        /* check for throttle; if set, do not resubmit read urb */
@@ -1735,6 +1738,7 @@ static int digi_read_inb_callback(struct urb *urb)
                }
        }
        spin_unlock(&priv->dp_port_lock);
+        tty_kref_put(tty);
        if (opcode == DIGI_CMD_RECEIVE_DISABLE)
                dbg("%s: got RECEIVE_DISABLE", __func__);
@@ -1760,6 +1764,7 @@ static int digi_read_oob_callback(struct urb *urb)
        struct usb_serial_port *port = urb->context;
        struct usb_serial *serial = port->serial;
+        struct tty_struct *tty;
        struct digi_port *priv = usb_get_serial_port_data(port);
        int opcode, line, status, val;
        int i;
@@ -1787,10 +1792,11 @@ static int digi_read_oob_callback(struct urb *urb)
                if (priv == NULL)
                        return -1;
+                tty = tty_port_tty_get(&port->port);
                rts = 0;
                if (port->port.count)
-                        rts = port->port.tty->termios->c_cflag & CRTSCTS;
+                        rts = tty->termios->c_cflag & CRTSCTS;
+                
                if (opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
                        spin_lock(&priv->dp_port_lock);
                        /* convert from digi flags to termiox flags */
@@ -1798,14 +1804,14 @@ static int digi_read_oob_callback(struct urb *urb)
                                priv->dp_modem_signals |= TIOCM_CTS;
                                /* port must be open to use tty struct */
                                if (rts) {
-                                        port->port.tty->hw_stopped = 0;
+                                        tty->hw_stopped = 0;
                                        digi_wakeup_write(port);
                                }
                        } else {
                                priv->dp_modem_signals &= ~TIOCM_CTS;
                                /* port must be open to use tty struct */
                                if (rts)
-                                        port->port.tty->hw_stopped = 1;
+                                        tty->hw_stopped = 1;
                        }
                        if (val & DIGI_READ_INPUT_SIGNALS_DSR)
                                priv->dp_modem_signals |= TIOCM_DSR;
@@ -1830,6 +1836,7 @@ static int digi_read_oob_callback(struct urb *urb)
                } else if (opcode == DIGI_CMD_IFLUSH_FIFO) {
                        wake_up_interruptible(&priv->dp_flush_wait);
                }
+                tty_kref_put(tty);
        }
        return 0;
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index a6ab5b58d9ca..1072e847280f 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -33,9 +33,8 @@
 *      Moved MOD_DEC_USE_COUNT to end of empeg_close().
 *
 * (12/03/2000) gb
- *      Added port->port.tty->ldisc.set_termios(port->port.tty, NULL) to
+ *      Added tty->ldisc.set_termios(port, tty, NULL) to empeg_open().
- *      empeg_open(). This notifies the tty driver that the termios have
+ *      This notifies the tty driver that the termios have changed.
- *      changed.
 *
 * (11/13/2000) gb
 *      Moved tty->low_latency = 1 from empeg_read_bulk_callback() to
@@ -354,7 +353,7 @@ static void empeg_read_bulk_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                                                urb->actual_length, data);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length);
@@ -362,6 +361,7 @@ static void empeg_read_bulk_callback(struct urb *urb)
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
+        tty_kref_put(tty);
        /* Continue trying to always read  */
        usb_fill_bulk_urb(
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3dc93b542b30..c2ac129557aa 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -860,7 +860,7 @@ static int update_mctrl(struct usb_serial_port *port, unsigned int set,
        kfree(buf);
        if (rv < 0) {
-                err("%s Error from MODEM_CTRL urb: DTR %s, RTS %s",
+                dbg("%s Error from MODEM_CTRL urb: DTR %s, RTS %s",
                                __func__,
                                (set & TIOCM_DTR) ? "HIGH" :
                                (clear & TIOCM_DTR) ? "LOW" : "unchanged",
@@ -1808,7 +1808,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
        if (port->port.count <= 0)
                return;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty) {
                dbg("%s - bad tty pointer - exiting", __func__);
                return;
@@ -1817,7 +1817,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
        priv = usb_get_serial_port_data(port);
        if (!priv) {
                dbg("%s - bad port private data pointer - exiting", __func__);
-                return;
+                goto out;
        }
        if (urb != port->read_urb)
@@ -1827,7 +1827,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
                /* This will happen at close every time so it is a dbg not an
                   err */
                dbg("(this is ok on close) nonzero read bulk status received: %d", status);
-                return;
+                goto out;
        }
        /* count data bytes, but not status bytes */
@@ -1838,7 +1838,8 @@ static void ftdi_read_bulk_callback(struct urb *urb)
        spin_unlock_irqrestore(&priv->rx_lock, flags);
        ftdi_process_read(&priv->rx_work.work);
+out:
+        tty_kref_put(tty);
 } /* ftdi_read_bulk_callback */
@@ -1863,7 +1864,7 @@ static void ftdi_process_read(struct work_struct *work)
        if (port->port.count <= 0)
                return;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty) {
                dbg("%s - bad tty pointer - exiting", __func__);
                return;
@@ -1872,13 +1873,13 @@ static void ftdi_process_read(struct work_struct *work)
        priv = usb_get_serial_port_data(port);
        if (!priv) {
                dbg("%s - bad port private data pointer - exiting", __func__);
-                return;
+                goto out;
        }
        urb = port->read_urb;
        if (!urb) {
                dbg("%s - bad read_urb pointer - exiting", __func__);
-                return;
+                goto out;
        }
        data = urb->transfer_buffer;
@@ -2020,7 +2021,7 @@ static void ftdi_process_read(struct work_struct *work)
                        schedule_delayed_work(&priv->rx_work, 1);
                else
                        dbg("%s - port is closed", __func__);
-                return;
+                goto out;
        }
        /* urb is completely processed */
@@ -2041,6 +2042,8 @@ static void ftdi_process_read(struct work_struct *work)
                        err("%s - failed resubmitting read urb, error %d",
                                                        __func__, result);
        }
+out:
+        tty_kref_put(tty);
 } /* ftdi_process_read */
@@ -2256,7 +2259,7 @@ static int ftdi_tiocmget(struct tty_struct *tty, struct file *file)
                           0, 0,
                           buf, 1, WDR_TIMEOUT);
                if (ret < 0) {
-                        err("%s Could not get modem status of device - err: %d", __func__,
+                        dbg("%s Could not get modem status of device - err: %d", __func__,
                            ret);
                        return ret;
                }
@@ -2275,7 +2278,7 @@ static int ftdi_tiocmget(struct tty_struct *tty, struct file *file)
                                   0, priv->interface,
                                   buf, 2, WDR_TIMEOUT);
                if (ret < 0) {
-                        err("%s Could not get modem status of device - err: %d", __func__,
+                        dbg("%s Could not get modem status of device - err: %d", __func__,
                            ret);
                        return ret;
                }
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index d95382088075..2ad0569bcf19 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -276,7 +276,7 @@ static inline int isAbortTrfCmnd(const unsigned char *buf)
 static void send_to_tty(struct usb_serial_port *port,
                        char *data, unsigned int actual_length)
 {
-        struct tty_struct *tty = port->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
        if (tty && actual_length) {
@@ -287,6 +287,7 @@ static void send_to_tty(struct usb_serial_port *port,
                tty_insert_flip_string(tty, data, actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index fe84c88ec20c..814909f1ee63 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -330,7 +330,7 @@ static void resubmit_read_urb(struct usb_serial_port *port, gfp_t mem_flags)
 static void flush_and_resubmit_read_urb(struct usb_serial_port *port)
 {
        struct urb *urb = port->read_urb;
-        struct tty_struct *tty = port->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
        int room;
        /* Push data to tty */
@@ -341,6 +341,7 @@ static void flush_and_resubmit_read_urb(struct usb_serial_port *port)
                        tty_flip_buffer_push(tty);
                }
        }
+        tty_kref_put(tty);
        resubmit_read_urb(port, GFP_ATOMIC);
 }
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index bfa508ddb0fe..611f97fd62f1 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -600,6 +600,7 @@ static void edge_interrupt_callback(struct urb *urb)
        struct edgeport_serial  *edge_serial = urb->context;
        struct edgeport_port *edge_port;
        struct usb_serial_port *port;
+        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
        int length = urb->actual_length;
        int bytes_avail;
@@ -675,9 +676,12 @@ static void edge_interrupt_callback(struct urb *urb)
                                        /* tell the tty driver that something
                                           has changed */
-                                        if (edge_port->port->port.tty)
+                                        tty = tty_port_tty_get(
-                                                tty_wakeup(edge_port->port->port.tty);
+                                                &edge_port->port->port);
+                                        if (tty) {
+                                                tty_wakeup(tty);
+                                                tty_kref_put(tty);
+                                        }
                                        /* Since we have more credit, check
                                           if more data can be sent */
                                        send_more_port_data(edge_serial,
@@ -778,13 +782,14 @@ static void edge_bulk_out_data_callback(struct urb *urb)
                    __func__, status);
        }
-        tty = edge_port->port->port.tty;
+        tty = tty_port_tty_get(&edge_port->port->port);
        if (tty && edge_port->open) {
                /* let the tty driver wakeup if it has a special
                   write_wakeup function */
                tty_wakeup(tty);
        }
+        tty_kref_put(tty);
        /* Release the Write URB */
        edge_port->write_in_progress = false;
@@ -826,11 +831,12 @@ static void edge_bulk_out_cmd_callback(struct urb *urb)
        }
        /* Get pointer to tty */
-        tty = edge_port->port->port.tty;
+        tty = tty_port_tty_get(&edge_port->port->port);
        /* tell the tty driver that something has changed */
        if (tty && edge_port->open)
                tty_wakeup(tty);
+        tty_kref_put(tty);
        /* we have completed the command */
        edge_port->commandPending = false;
@@ -1932,11 +1938,13 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
                                                        edge_serial->rxPort];
                                edge_port = usb_get_serial_port_data(port);
                                if (edge_port->open) {
-                                        tty = edge_port->port->port.tty;
+                                        tty = tty_port_tty_get(
+                                                &edge_port->port->port);
                                        if (tty) {
                                                dbg("%s - Sending %d bytes to TTY for port %d",
                                                        __func__, rxLen, edge_serial->rxPort);
                                                edge_tty_recv(&edge_serial->serial->dev->dev, tty, buffer, rxLen);
+                                                tty_kref_put(tty);
                                        }
                                        edge_port->icount.rx += rxLen;
                                }
@@ -1971,6 +1979,7 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
 {
        struct usb_serial_port *port;
        struct edgeport_port *edge_port;
+        struct tty_struct *tty;
        __u8 code = edge_serial->rxStatusCode;
        /* switch the port pointer to the one being currently talked about */
@@ -2020,10 +2029,12 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
                /* send the current line settings to the port so we are
                   in sync with any further termios calls */
-                /* FIXME: locking on tty */
+                tty = tty_port_tty_get(&edge_port->port->port);
-                if (edge_port->port->port.tty)
+                if (tty) {
-                        change_port_settings(edge_port->port->port.tty,
+                        change_port_settings(tty,
-                                edge_port, edge_port->port->port.tty->termios);
+                                edge_port, tty->termios);
+                        tty_kref_put(tty);
+                }
                /* we have completed the open */
                edge_port->openPending = false;
@@ -2163,10 +2174,14 @@ static void handle_new_lsr(struct edgeport_port *edge_port, __u8 lsrData,
        }
        /* Place LSR data byte into Rx buffer */
-        if (lsrData && edge_port->port->port.tty)
+        if (lsrData) {
-                edge_tty_recv(&edge_port->port->dev,
+                struct tty_struct *tty =
-                                        edge_port->port->port.tty, &data, 1);
+                                tty_port_tty_get(&edge_port->port->port);
+                if (tty) {
+                        edge_tty_recv(&edge_port->port->dev, tty, &data, 1);
+                        tty_kref_put(tty);
+                }
+        }
        /* update input line counters */
        icount = &edge_port->icount;
        if (newLsr & LSR_BREAK)
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index cb4c54316cf5..541dd8e6e7a2 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -572,7 +572,7 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
                                                                int flush)
 {
        int baud_rate;
-        struct tty_struct *tty = port->port->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&port->port->port);
        wait_queue_t wait;
        unsigned long flags;
@@ -599,6 +599,7 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
        if (flush)
                edge_buf_clear(port->ep_out_buf);
        spin_unlock_irqrestore(&port->ep_lock, flags);
+        tty_kref_put(tty);
        /* wait for data to drain from the device */
        timeout += jiffies;
@@ -1554,7 +1555,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
        /* Save the new modem status */
        edge_port->shadow_msr = msr & 0xf0;
-        tty = edge_port->port->port.tty;
+        tty = tty_port_tty_get(&edge_port->port->port);
        /* handle CTS flow control */
        if (tty && C_CRTSCTS(tty)) {
                if (msr & EDGEPORT_MSR_CTS) {
@@ -1564,6 +1565,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
                        tty->hw_stopped = 1;
                }
        }
+        tty_kref_put(tty);
        return;
 }
@@ -1574,6 +1576,7 @@ static void handle_new_lsr(struct edgeport_port *edge_port, int lsr_data,
        struct async_icount *icount;
        __u8 new_lsr = (__u8)(lsr & (__u8)(LSR_OVER_ERR | LSR_PAR_ERR |
                                                LSR_FRM_ERR | LSR_BREAK));
+        struct tty_struct *tty;
        dbg("%s - %02x", __func__, new_lsr);
@@ -1587,8 +1590,13 @@ static void handle_new_lsr(struct edgeport_port *edge_port, int lsr_data,
                new_lsr &= (__u8)(LSR_OVER_ERR | LSR_BREAK);
        /* Place LSR data byte into Rx buffer */
-        if (lsr_data && edge_port->port->port.tty)
+        if (lsr_data) {
-                edge_tty_recv(&edge_port->port->dev, edge_port->port->port.tty, &data, 1);
+                tty = tty_port_tty_get(&edge_port->port->port);
+                if (tty) {
+                        edge_tty_recv(&edge_port->port->dev, tty, &data, 1);
+                        tty_kref_put(tty);
+                }
+        }
        /* update input line counters */
        icount = &edge_port->icount;
@@ -1749,7 +1757,7 @@ static void edge_bulk_in_callback(struct urb *urb)
                ++data;
        }
-        tty = edge_port->port->port.tty;
+        tty = tty_port_tty_get(&edge_port->port->port);
        if (tty && urb->actual_length) {
                usb_serial_debug_data(debug, &edge_port->port->dev,
                                        __func__, urb->actual_length, data);
@@ -1761,6 +1769,7 @@ static void edge_bulk_in_callback(struct urb *urb)
                                                        urb->actual_length);
                edge_port->icount.rx += urb->actual_length;
        }
+        tty_kref_put(tty);
 exit:
        /* continue read unless stopped */
@@ -1796,6 +1805,7 @@ static void edge_bulk_out_callback(struct urb *urb)
        struct usb_serial_port *port = urb->context;
        struct edgeport_port *edge_port = usb_get_serial_port_data(port);
        int status = urb->status;
+        struct tty_struct *tty;
        dbg("%s - port %d", __func__, port->number);
@@ -1818,7 +1828,9 @@ static void edge_bulk_out_callback(struct urb *urb)
        }
        /* send any buffered data */
-        edge_send(port->port.tty);
+        tty = tty_port_tty_get(&port->port);
+        edge_send(tty);
+        tty_kref_put(tty);
 }
 static int edge_open(struct tty_struct *tty,
@@ -1876,7 +1888,7 @@ static int edge_open(struct tty_struct *tty,
        /* set up the port settings */
        if (tty)
-                edge_set_termios(tty, port, port->port.tty->termios);
+                edge_set_termios(tty, port, tty->termios);
        /* open up the port */
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index cd9a2e138c8b..2affa9c118b2 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -764,13 +764,14 @@ static void ipaq_read_bulk_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                                                urb->actual_length, data);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length);
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
+        tty_kref_put(tty);
        /* Continue trying to always read  */
        usb_fill_bulk_urb(port->read_urb, port->serial->dev,
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index a842025b9b57..480cac27d646 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -170,12 +170,13 @@ static void ipw_read_bulk_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                                        urb->actual_length, data);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length);
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Continue trying to always read  */
        usb_fill_bulk_urb(port->read_urb, port->serial->dev,
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index e59155c6607d..45d4043e04ab 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -465,11 +465,12 @@ static void ir_read_bulk_callback(struct urb *urb)
                        ir_baud = *data & 0x0f;
                usb_serial_debug_data(debug, &port->dev, __func__,
                                                urb->actual_length, data);
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                if (tty_buffer_request_room(tty, urb->actual_length - 1)) {
                        tty_insert_flip_string(tty, data+1, urb->actual_length - 1);
                        tty_flip_buffer_push(tty);
                }
+                tty_kref_put(tty);
                /*
                 * No break here.
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index ddff37fa6339..53710aa7eadd 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -629,13 +629,14 @@ static void read_buf_callback(struct urb *urb)
        }
        dbg("%s - %i chars to write", __func__, urb->actual_length);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (data == NULL)
                dbg("%s - data is NULL !!!", __func__);
        if (tty && urb->actual_length && data) {
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        iuu_led_activity_on(urb);
 }
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 704716f6f6d3..15447af48691 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -430,7 +430,7 @@ static void	usa26_indat_callback(struct urb *urb)
        }
        port =  urb->context;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                /* 0x80 bit is error flag */
                if ((data[0] & 0x80) == 0) {
@@ -459,6 +459,7 @@ static void	usa26_indat_callback(struct urb *urb)
                }
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Resubmit urb so we continue receiving */
        urb->dev = port->serial->dev;
@@ -513,6 +514,7 @@ static void	usa26_instat_callback(struct urb *urb)
        struct usb_serial                       *serial;
        struct usb_serial_port                  *port;
        struct keyspan_port_private             *p_priv;
+        struct tty_struct                       *tty;
        int old_dcd_state, err;
        int status = urb->status;
@@ -553,12 +555,11 @@ static void	usa26_instat_callback(struct urb *urb)
        p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0);
        p_priv->ri_state = ((msg->ri) ? 1 : 0);
-        if (port->port.tty && !C_CLOCAL(port->port.tty)
+        if (old_dcd_state != p_priv->dcd_state) {
-            && old_dcd_state != p_priv->dcd_state) {
+                tty = tty_port_tty_get(&port->port);
-                if (old_dcd_state)
+                if (tty && !C_CLOCAL(tty))
-                        tty_hangup(port->port.tty);
+                        tty_hangup(tty);
-                /*  else */
+                tty_kref_put(tty);
-                /*      wake_up_interruptible(&p_priv->open_wait); */
        }
        /* Resubmit urb so we continue receiving */
@@ -604,11 +605,12 @@ static void usa28_indat_callback(struct urb *urb)
                p_priv = usb_get_serial_port_data(port);
                data = urb->transfer_buffer;
-                tty = port->port.tty;
+                tty =tty_port_tty_get(&port->port);
-                if (urb->actual_length) {
+                if (tty && urb->actual_length) {
                        tty_insert_flip_string(tty, data, urb->actual_length);
                        tty_flip_buffer_push(tty);
                }
+                tty_kref_put(tty);
                /* Resubmit urb so we continue receiving */
                urb->dev = port->serial->dev;
@@ -652,6 +654,7 @@ static void	usa28_instat_callback(struct urb *urb)
        struct usb_serial                       *serial;
        struct usb_serial_port                  *port;
        struct keyspan_port_private             *p_priv;
+        struct tty_struct                       *tty;
        int old_dcd_state;
        int status = urb->status;
@@ -689,12 +692,11 @@ static void	usa28_instat_callback(struct urb *urb)
        p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
        p_priv->ri_state = ((msg->ri) ? 1 : 0);
-        if (port->port.tty && !C_CLOCAL(port->port.tty)
+        if( old_dcd_state != p_priv->dcd_state && old_dcd_state) {
-            && old_dcd_state != p_priv->dcd_state) {
+                tty = tty_port_tty_get(&port->port);
-                if (old_dcd_state)
+                if (tty && !C_CLOCAL(tty)) 
-                        tty_hangup(port->port.tty);
+                        tty_hangup(tty);
-                /*  else */
+                tty_kref_put(tty);
-                /*      wake_up_interruptible(&p_priv->open_wait); */
        }
                /* Resubmit urb so we continue receiving */
@@ -785,12 +787,11 @@ static void	usa49_instat_callback(struct urb *urb)
        p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
        p_priv->ri_state = ((msg->ri) ? 1 : 0);
-        if (port->port.tty && !C_CLOCAL(port->port.tty)
+        if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
-            && old_dcd_state != p_priv->dcd_state) {
+                struct tty_struct *tty = tty_port_tty_get(&port->port);
-                if (old_dcd_state)
+                if (tty && !C_CLOCAL(tty))
-                        tty_hangup(port->port.tty);
+                        tty_hangup(tty);
-                /*  else */
+                tty_kref_put(tty);
-                /*      wake_up_interruptible(&p_priv->open_wait); */
        }
        /* Resubmit urb so we continue receiving */
@@ -827,7 +828,7 @@ static void	usa49_indat_callback(struct urb *urb)
        }
        port =  urb->context;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                /* 0x80 bit is error flag */
                if ((data[0] & 0x80) == 0) {
@@ -850,6 +851,7 @@ static void	usa49_indat_callback(struct urb *urb)
                }
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Resubmit urb so we continue receiving */
        urb->dev = port->serial->dev;
@@ -893,7 +895,7 @@ static void usa49wg_indat_callback(struct urb *urb)
                                return;
                        }
                        port = serial->port[data[i++]];
-                        tty = port->port.tty;
+                        tty = tty_port_tty_get(&port->port);
                        len = data[i++];
                        /* 0x80 bit is error flag */
@@ -927,6 +929,7 @@ static void usa49wg_indat_callback(struct urb *urb)
                        }
                        if (port->port.count)
                                tty_flip_buffer_push(tty);
+                        tty_kref_put(tty);
                }
        }
@@ -967,8 +970,8 @@ static void usa90_indat_callback(struct urb *urb)
        port =  urb->context;
        p_priv = usb_get_serial_port_data(port);
-        tty = port->port.tty;
        if (urb->actual_length) {
+                tty = tty_port_tty_get(&port->port);
                /* if current mode is DMA, looks like usa28 format
                   otherwise looks like usa26 data format */
@@ -1004,6 +1007,7 @@ static void usa90_indat_callback(struct urb *urb)
                        }
                }
                tty_flip_buffer_push(tty);
+                tty_kref_put(tty);
        }
        /* Resubmit urb so we continue receiving */
@@ -1025,6 +1029,7 @@ static void	usa90_instat_callback(struct urb *urb)
        struct usb_serial                       *serial;
        struct usb_serial_port                  *port;
        struct keyspan_port_private             *p_priv;
+        struct tty_struct                       *tty;
        int old_dcd_state, err;
        int status = urb->status;
@@ -1053,12 +1058,11 @@ static void	usa90_instat_callback(struct urb *urb)
        p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
        p_priv->ri_state = ((msg->ri) ? 1 : 0);
-        if (port->port.tty && !C_CLOCAL(port->port.tty)
+        if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
-            && old_dcd_state != p_priv->dcd_state) {
+                tty = tty_port_tty_get(&port->port);
-                if (old_dcd_state)
+                if (tty && !C_CLOCAL(tty))
-                        tty_hangup(port->port.tty);
+                        tty_hangup(tty);
-                /*  else */
+                tty_kref_put(tty);
-                /*      wake_up_interruptible(&p_priv->open_wait); */
        }
        /* Resubmit urb so we continue receiving */
@@ -1130,12 +1134,11 @@ static void	usa67_instat_callback(struct urb *urb)
        p_priv->cts_state = ((msg->hskia_cts) ? 1 : 0);
        p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0);
-        if (port->port.tty && !C_CLOCAL(port->port.tty)
+        if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
-            && old_dcd_state != p_priv->dcd_state) {
+                struct tty_struct *tty = tty_port_tty_get(&port->port);
-                if (old_dcd_state)
+                if (tty && !C_CLOCAL(tty))
-                        tty_hangup(port->port.tty);
+                        tty_hangup(tty);
-                /*  else */
+                tty_kref_put(tty);
-                /*      wake_up_interruptible(&p_priv->open_wait); */
        }
        /* Resubmit urb so we continue receiving */
@@ -1332,7 +1335,7 @@ static void keyspan_close(struct tty_struct *tty,
                        stop_urb(p_priv->out_urbs[i]);
                }
        }
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
 }
 /* download the firmware to a pre-renumeration device */
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 040040a267d9..99e9a14c5bf6 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -172,8 +172,9 @@ static void keyspan_pda_wakeup_write(struct work_struct *work)
        struct keyspan_pda_private *priv =
                container_of(work, struct keyspan_pda_private, wakeup_work);
        struct usb_serial_port *port = priv->port;
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
-        tty_wakeup(port->port.tty);
+        tty_wakeup(tty);
+        tty_kref_put(tty);
 }
 static void keyspan_pda_request_unthrottle(struct work_struct *work)
@@ -205,7 +206,7 @@ static void keyspan_pda_request_unthrottle(struct work_struct *work)
 static void keyspan_pda_rx_interrupt(struct urb *urb)
 {
        struct usb_serial_port *port = urb->context;
-        struct tty_struct *tty = port->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
        unsigned char *data = urb->transfer_buffer;
        int retval;
        int status = urb->status;
@@ -222,7 +223,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
                /* this urb is terminated, clean up */
                dbg("%s - urb shutting down with status: %d",
                    __func__, status);
-                return;
+                goto out;
        default:
                dbg("%s - nonzero urb status received: %d",
                    __func__, status);
@@ -261,8 +262,11 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
 exit:
        retval = usb_submit_urb(urb, GFP_ATOMIC);
        if (retval)
-                err("%s - usb_submit_urb failed with result %d",
+                dev_err(&port->dev,
-                     __func__, retval);
+                        "%s - usb_submit_urb failed with result %d",
+                        __func__, retval);
+out:
+        tty_kref_put(tty);                   
 }
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index b84dddc71124..ff3a07f5102f 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -658,7 +658,7 @@ static void klsi_105_read_bulk_callback(struct urb *urb)
        } else {
                int bytes_sent = ((__u8 *) data)[0] +
                                 ((unsigned int) ((__u8 *) data)[1] << 8);
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                /* we should immediately resubmit the URB, before attempting
                 * to pass the data on to the tty layer. But that needs locking
                 * against re-entry an then mixed-up data because of
@@ -679,6 +679,7 @@ static void klsi_105_read_bulk_callback(struct urb *urb)
                tty_buffer_request_room(tty, bytes_sent);
                tty_insert_flip_string(tty, data + 2, bytes_sent);
                tty_flip_buffer_push(tty);
+                tty_kref_put(tty);
                /* again lockless, but debug info only */
                priv->bytes_in += bytes_sent;
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index deba28ec77e8..cfcf37c2b957 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -383,7 +383,7 @@ static void kobil_read_int_callback(struct urb *urb)
                return;
        }
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (urb->actual_length) {
                /* BEGIN DEBUG */
@@ -405,6 +405,7 @@ static void kobil_read_int_callback(struct urb *urb)
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* someone sets the dev to 0 if the close method has been called */
        port->interrupt_in_urb->dev = port->serial->dev;
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 0ded8bd6ec85..9b2cef81cde0 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -563,10 +563,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
         * Work-a-round: handle the 'usual' bulk-in pipe here
         */
        if (urb->transfer_buffer_length > 2) {
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                if (urb->actual_length) {
                        tty_insert_flip_string(tty, data, urb->actual_length);
                        tty_flip_buffer_push(tty);
+                        tty_kref_put(tty);
                }
                goto exit;
        }
@@ -591,7 +592,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
         * to look in to this before committing any code.
         */
        if (priv->last_lsr & MCT_U232_LSR_ERR) {
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                /* Overrun Error */
                if (priv->last_lsr & MCT_U232_LSR_OE) {
                }
@@ -604,6 +605,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
                /* Break Indicator */
                if (priv->last_lsr & MCT_U232_LSR_BI) {
                }
+                tty_kref_put(tty);
        }
 #endif
        spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 7c4917d77c0a..7b538caec37f 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -216,12 +216,13 @@ static void mos7720_bulk_in_callback(struct urb *urb)
        data = urb->transfer_buffer;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length);
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        if (!port->read_urb) {
                dbg("URB KILLED !!!");
@@ -262,10 +263,11 @@ static void mos7720_bulk_out_data_callback(struct urb *urb)
        dbg("Entering .........");
-        tty = mos7720_port->port->port.tty;
+        tty = tty_port_tty_get(&mos7720_port->port->port);
        if (tty && mos7720_port->open)
                tty_wakeup(tty);
+        tty_kref_put(tty);
 }
 /*
@@ -1267,29 +1269,6 @@ static int get_lsr_info(struct tty_struct *tty,
        return 0;
 }
-/*
- * get_number_bytes_avail - get number of bytes available
- *
- * Purpose: Let user call ioctl to get the count of number of bytes available.
- */
-static int get_number_bytes_avail(struct moschip_port *mos7720_port,
-                                  unsigned int __user *value)
-{
-        unsigned int result = 0;
-        struct tty_struct *tty = mos7720_port->port->port.tty;
-        if (!tty)
-                return -ENOIOCTLCMD;
-        result = tty->read_cnt;
-        dbg("%s(%d) = %d", __func__,  mos7720_port->port->number, result);
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-        return -ENOIOCTLCMD;
-}
 static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
                          unsigned int __user *value)
 {
@@ -1409,13 +1388,6 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
        dbg("%s - port %d, cmd = 0x%x", __func__, port->number, cmd);
        switch (cmd) {
-        case TIOCINQ:
-                /* return number of bytes available */
-                dbg("%s (%d) TIOCINQ", __func__,  port->number);
-                return get_number_bytes_avail(mos7720_port,
-                                              (unsigned int __user *)arg);
-                break;
        case TIOCSERGETLSR:
                dbg("%s (%d) TIOCSERGETLSR", __func__,  port->number);
                return get_lsr_info(tty, mos7720_port,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 09d82062b973..60543d79ef56 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -709,12 +709,13 @@ static void mos7840_bulk_in_callback(struct urb *urb)
        dbg("%s", "Entering ........... \n");
        if (urb->actual_length) {
-                tty = mos7840_port->port->port.tty;
+                tty = tty_port_tty_get(&mos7840_port->port->port);
                if (tty) {
                        tty_buffer_request_room(tty, urb->actual_length);
                        tty_insert_flip_string(tty, data, urb->actual_length);
                        dbg(" %s \n", data);
                        tty_flip_buffer_push(tty);
+                        tty_kref_put(tty);
                }
                mos7840_port->icount.rx += urb->actual_length;
                smp_wmb();
@@ -773,10 +774,10 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
        dbg("%s \n", "Entering .........");
-        tty = mos7840_port->port->port.tty;
+        tty = tty_port_tty_get(&mos7840_port->port->port);
        if (tty && mos7840_port->open)
                tty_wakeup(tty);
+        tty_kref_put(tty);
 }
diff --git a/drivers/usb/serial/navman.c b/drivers/usb/serial/navman.c
index d6736531a0fa..bcdcbb822705 100644
--- a/drivers/usb/serial/navman.c
+++ b/drivers/usb/serial/navman.c
@@ -64,12 +64,13 @@ static void navman_read_int_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                              urb->actual_length, data);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length);
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
 exit:
        result = usb_submit_urb(urb, GFP_ATOMIC);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index ae8e227f3db2..c4d70b0f1e48 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -172,7 +172,7 @@ static int omninet_open(struct tty_struct *tty,
        dbg("%s - port %d", __func__, port->number);
        wport = serial->port[1];
-        wport->port.tty = tty;          /* FIXME */
+        tty_port_tty_set(&wport->port, tty);
        /* Start reading from the device */
        usb_fill_bulk_urb(port->read_urb, serial->dev,
@@ -229,9 +229,11 @@ static void omninet_read_bulk_callback(struct urb *urb)
        }
        if (urb->actual_length && header->oh_len) {
-                tty_insert_flip_string(port->port.tty,
+                struct tty_struct *tty = tty_port_tty_get(&port->port);
-                        data + OMNINET_DATAOFFSET, header->oh_len);
+                tty_insert_flip_string(tty, data + OMNINET_DATAOFFSET,
-                tty_flip_buffer_push(port->port.tty);
+                                                        header->oh_len);
+                tty_flip_buffer_push(tty);
+                tty_kref_put(tty);
        }
        /* Continue trying to always read  */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 73f8277f88f2..6b1727e751e3 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -571,14 +571,14 @@ static void option_indat_callback(struct urb *urb)
                dbg("%s: nonzero status: %d on endpoint %02x.",
                    __func__, status, endpoint);
        } else {
-                tty = port->port.tty;
+                tty = tty_port_tty_get(&port->port);
                if (urb->actual_length) {
                        tty_buffer_request_room(tty, urb->actual_length);
                        tty_insert_flip_string(tty, data, urb->actual_length);
                        tty_flip_buffer_push(tty);
-                } else {
+                } else 
                        dbg("%s: empty read urb received", __func__);
-                }
+                tty_kref_put(tty);
                /* Resubmit urb so we continue receiving */
                if (port->port.count && status != -ESHUTDOWN) {
@@ -647,9 +647,13 @@ static void option_instat_callback(struct urb *urb)
                        portdata->dsr_state = ((signals & 0x02) ? 1 : 0);
                        portdata->ri_state = ((signals & 0x08) ? 1 : 0);
-                        if (port->port.tty && !C_CLOCAL(port->port.tty) &&
+                        if (old_dcd_state && !portdata->dcd_state) {
-                                        old_dcd_state && !portdata->dcd_state)
+                                struct tty_struct *tty =
-                                tty_hangup(port->port.tty);
+                                                tty_port_tty_get(&port->port);
+                                if (tty && !C_CLOCAL(tty))
+                                        tty_hangup(tty);
+                                tty_kref_put(tty);
+                        }
                } else {
                        dbg("%s: type %x req %x", __func__,
                                req_pkt->bRequestType, req_pkt->bRequest);
@@ -793,7 +797,7 @@ static void option_close(struct tty_struct *tty,
                for (i = 0; i < N_OUT_URB; i++)
                        usb_kill_urb(portdata->out_urbs[i]);
        }
-        port->port.tty = NULL;  /* FIXME */
+        tty_port_tty_set(&port->port, NULL);
 }
 /* Helper functions used by option_setup_urbs */
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 81db5715ee25..ba551f00f16f 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -224,10 +224,6 @@ struct oti6858_private {
        struct usb_serial_port *port;   /* USB port with which associated */
 };
-#undef dbg
-/* #define dbg(format, arg...) printk(KERN_INFO "%s: " format "\n", __FILE__, ## arg) */
-#define dbg(format, arg...) printk(KERN_INFO "" format "\n", ## arg)
 static void setup_line(struct work_struct *work)
 {
        struct oti6858_private *priv = container_of(work,
@@ -1002,11 +998,12 @@ static void oti6858_read_bulk_callback(struct urb *urb)
                return;
        }
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty != NULL && urb->actual_length > 0) {
                tty_insert_flip_string(tty, data, urb->actual_length);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* schedule the interrupt urb if we are still open */
        if (port->port.count != 0) {
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 1ede1441cb1b..908437847165 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -154,7 +154,6 @@ struct pl2303_private {
        wait_queue_head_t delta_msr_wait;
        u8 line_control;
        u8 line_status;
-        u8 termios_initialized;
        enum pl2303_type type;
 };
@@ -526,16 +525,6 @@ static void pl2303_set_termios(struct tty_struct *tty,
        dbg("%s -  port %d", __func__, port->number);
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!priv->termios_initialized) {
-                *(tty->termios) = tty_std_termios;
-                tty->termios->c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
-                tty->termios->c_ispeed = 9600;
-                tty->termios->c_ospeed = 9600;
-                priv->termios_initialized = 1;
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
        /* The PL2303 is reported to lose bytes if you change
           serial settings even to the same values as before. Thus
           we actually need to filter in this specific case */
@@ -1057,7 +1046,7 @@ static void pl2303_read_bulk_callback(struct urb *urb)
                tty_flag = TTY_FRAME;
        dbg("%s - tty_flag = %d", __func__, tty_flag);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length + 1);
                /* overrun is special, not associated with a char */
@@ -1067,7 +1056,7 @@ static void pl2303_read_bulk_callback(struct urb *urb)
                        tty_insert_flip_char(tty, data[i], tty_flag);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Schedule the next read _if_ we are still open */
        if (port->port.count) {
                urb->dev = port->serial->dev;
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index def52d07a4ea..72903ac9f5c0 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -217,6 +217,7 @@ static void safe_read_bulk_callback(struct urb *urb)
        struct usb_serial_port *port =  urb->context;
        unsigned char *data = urb->transfer_buffer;
        unsigned char length = urb->actual_length;
+        struct tty_struct *tty;
        int result;
        int status = urb->status;
@@ -242,6 +243,7 @@ static void safe_read_bulk_callback(struct urb *urb)
                printk("\n");
        }
 #endif
+        tty = tty_port_tty_get(&port->port);
        if (safe) {
                __u16 fcs;
                fcs = fcs_compute10(data, length, CRC10_INITFCS);
@@ -250,9 +252,9 @@ static void safe_read_bulk_callback(struct urb *urb)
                        if (actual_length <= (length - 2)) {
                                info("%s - actual: %d", __func__,
                                                        actual_length);
-                                tty_insert_flip_string(port->port.tty,
+                                tty_insert_flip_string(tty,
                                                        data, actual_length);
-                                tty_flip_buffer_push(port->port.tty);
+                                tty_flip_buffer_push(tty);
                        } else {
                                err("%s - inconsistent lengths %d:%d",
                                        __func__, actual_length, length);
@@ -261,9 +263,10 @@ static void safe_read_bulk_callback(struct urb *urb)
                        err("%s - bad CRC %x", __func__, fcs);
                }
        } else {
-                tty_insert_flip_string(port->port.tty, data, length);
+                tty_insert_flip_string(tty, data, length);
-                tty_flip_buffer_push(port->port.tty);
+                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Continue trying to always read  */
        usb_fill_bulk_urb(urb, port->serial->dev,
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ea1a103c99be..8b9eaf383679 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -440,14 +440,14 @@ static void sierra_indat_callback(struct urb *urb)
                dbg("%s: nonzero status: %d on endpoint %02x.",
                    __func__, status, endpoint);
        } else {
-                tty = port->port.tty;
                if (urb->actual_length) {
+                tty = tty_port_tty_get(&port->port);
                        tty_buffer_request_room(tty, urb->actual_length);
                        tty_insert_flip_string(tty, data, urb->actual_length);
                        tty_flip_buffer_push(tty);
-                } else {
+                        tty_kref_put(tty);
+                } else
                        dbg("%s: empty read urb received", __func__);
-                }
                /* Resubmit urb so we continue receiving */
                if (port->port.count && status != -ESHUTDOWN) {
@@ -485,6 +485,7 @@ static void sierra_instat_callback(struct urb *urb)
                        unsigned char signals = *((unsigned char *)
                                        urb->transfer_buffer +
                                        sizeof(struct usb_ctrlrequest));
+                        struct tty_struct *tty;
                        dbg("%s: signal x%x", __func__, signals);
@@ -494,9 +495,11 @@ static void sierra_instat_callback(struct urb *urb)
                        portdata->dsr_state = ((signals & 0x02) ? 1 : 0);
                        portdata->ri_state = ((signals & 0x08) ? 1 : 0);
-                        if (port->port.tty && !C_CLOCAL(port->port.tty) &&
+                        tty = tty_port_tty_get(&port->port);
+                        if (tty && !C_CLOCAL(tty) &&
                                        old_dcd_state && !portdata->dcd_state)
-                                tty_hangup(port->port.tty);
+                                tty_hangup(tty);
+                        tty_kref_put(tty);
                } else {
                        dbg("%s: type %x req %x", __func__,
                                req_pkt->bRequestType, req_pkt->bRequest);
@@ -616,8 +619,7 @@ static void sierra_close(struct tty_struct *tty,
        }
        usb_kill_urb(port->interrupt_in_urb);
+        tty_port_tty_set(&port->port, NULL);
-        port->port.tty = NULL;  /* FIXME */
 }
 static int sierra_startup(struct usb_serial *serial)
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 283cf6b36b2c..1533d6e12238 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -755,7 +755,7 @@ static void spcp8x5_read_bulk_callback(struct urb *urb)
                tty_flag = TTY_FRAME;
        dev_dbg(&port->dev, "tty_flag = %d\n", tty_flag);
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (tty && urb->actual_length) {
                tty_buffer_request_room(tty, urb->actual_length + 1);
                /* overrun is special, not associated with a char */
@@ -765,6 +765,7 @@ static void spcp8x5_read_bulk_callback(struct urb *urb)
                        tty_insert_flip_char(tty, data[i], tty_flag);
                tty_flip_buffer_push(tty);
        }
+        tty_kref_put(tty);
        /* Schedule the next read _if_ we are still open */
        if (port->port.count) {
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 9a3e495c769c..c90237d48b0e 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -179,7 +179,7 @@ static int ti_set_mcr(struct ti_port *tport, unsigned int mcr);
 static int ti_get_lsr(struct ti_port *tport);
 static int ti_get_serial_info(struct ti_port *tport,
        struct serial_struct __user *ret_arg);
-static int ti_set_serial_info(struct ti_port *tport,
+static int ti_set_serial_info(struct tty_struct *tty, struct ti_port *tport,
        struct serial_struct __user *new_arg);
 static void ti_handle_new_msr(struct ti_port *tport, __u8 msr);
@@ -857,8 +857,8 @@ static int ti_ioctl(struct tty_struct *tty, struct file *file,
                                (struct serial_struct __user *)arg);
        case TIOCSSERIAL:
                dbg("%s - (%d) TIOCSSERIAL", __func__, port->number);
-                return ti_set_serial_info(tport,
+                return ti_set_serial_info(tty, tport,
-                                        (struct serial_struct __user *)arg);
+                                (struct serial_struct __user *)arg);
        case TIOCMIWAIT:
                dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
                cprev = tport->tp_icount;
@@ -1211,6 +1211,7 @@ static void ti_bulk_in_callback(struct urb *urb)
        struct device *dev = &urb->dev->dev;
        int status = urb->status;
        int retval = 0;
+        struct tty_struct *tty;
        dbg("%s", __func__);
@@ -1239,20 +1240,22 @@ static void ti_bulk_in_callback(struct urb *urb)
                return;
        }
-        if (port->port.tty && urb->actual_length) {
+        tty = tty_port_tty_get(&port->port);
+        if (tty && urb->actual_length) {
                usb_serial_debug_data(debug, dev, __func__,
                        urb->actual_length, urb->transfer_buffer);
                if (!tport->tp_is_open)
                        dbg("%s - port closed, dropping data", __func__);
                else
-                        ti_recv(&urb->dev->dev, port->port.tty,
+                        ti_recv(&urb->dev->dev, tty,
                                                urb->transfer_buffer,
                                                urb->actual_length);
                spin_lock(&tport->tp_lock);
                tport->tp_icount.rx += urb->actual_length;
                spin_unlock(&tport->tp_lock);
+                tty_kref_put(tty);
        }
 exit:
@@ -1330,7 +1333,7 @@ static void ti_send(struct ti_port *tport)
 {
        int count, result;
        struct usb_serial_port *port = tport->tp_port;
-        struct tty_struct *tty = port->port.tty;        /* FIXME */
+        struct tty_struct *tty = tty_port_tty_get(&port->port); /* FIXME */
        unsigned long flags;
@@ -1338,19 +1341,15 @@ static void ti_send(struct ti_port *tport)
        spin_lock_irqsave(&tport->tp_lock, flags);
-        if (tport->tp_write_urb_in_use) {
+        if (tport->tp_write_urb_in_use)
-                spin_unlock_irqrestore(&tport->tp_lock, flags);
+                goto unlock;
-                return;
-        }
        count = ti_buf_get(tport->tp_write_buf,
                                port->write_urb->transfer_buffer,
                                port->bulk_out_size);
-        if (count == 0) {
+        if (count == 0)
-                spin_unlock_irqrestore(&tport->tp_lock, flags);
+                goto unlock;
-                return;
-        }
        tport->tp_write_urb_in_use = 1;
@@ -1380,7 +1379,13 @@ static void ti_send(struct ti_port *tport)
        /* more room in the buffer for new writes, wakeup */
        if (tty)
                tty_wakeup(tty);
+        tty_kref_put(tty);
        wake_up_interruptible(&tport->tp_write_wait);
+        return;
+unlock:
+        spin_unlock_irqrestore(&tport->tp_lock, flags);
+        tty_kref_put(tty);
+        return;
 }
@@ -1464,20 +1469,16 @@ static int ti_get_serial_info(struct ti_port *tport,
 }
-static int ti_set_serial_info(struct ti_port *tport,
+static int ti_set_serial_info(struct tty_struct *tty, struct ti_port *tport,
        struct serial_struct __user *new_arg)
 {
-        struct usb_serial_port *port = tport->tp_port;
        struct serial_struct new_serial;
        if (copy_from_user(&new_serial, new_arg, sizeof(new_serial)))
                return -EFAULT;
        tport->tp_flags = new_serial.flags & TI_SET_SERIAL_FLAGS;
-        /* FIXME */
+        tty->low_latency = (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-        if (port->port.tty)
-                port->port.tty->low_latency =
-                        (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
        tport->tp_closing_wait = new_serial.closing_wait;
        return 0;
@@ -1510,7 +1511,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
        tport->tp_msr = msr & TI_MSR_MASK;
        /* handle CTS flow control */
-        tty = tport->tp_port->port.tty;
+        tty = tty_port_tty_get(&tport->tp_port->port);
        if (tty && C_CRTSCTS(tty)) {
                if (msr & TI_MSR_CTS) {
                        tty->hw_stopped = 0;
@@ -1519,6 +1520,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
                        tty->hw_stopped = 1;
                }
        }
+        tty_kref_put(tty);
 }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 4f7f9e3ae0a4..e7d4246027b2 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -214,7 +214,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
        /* set up our port structure making the tty driver
         * remember our port object, and us it */
        tty->driver_data = port;
-        port->port.tty = tty;
+        tty_port_tty_set(&port->port, tty);
        if (port->port.count == 1) {
@@ -246,7 +246,7 @@ bailout_module_put:
 bailout_mutex_unlock:
        port->port.count = 0;
        tty->driver_data = NULL;
-        port->port.tty = NULL;
+        tty_port_tty_set(&port->port, NULL);
        mutex_unlock(&port->mutex);
 bailout_kref_put:
        usb_serial_put(serial);
@@ -276,10 +276,11 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
                port->serial->type->close(tty, port, filp);
        if (port->port.count == (port->console? 1 : 0)) {
-                if (port->port.tty) {
+                struct tty_struct *tty = tty_port_tty_get(&port->port);
-                        if (port->port.tty->driver_data)
+                if (tty) {
-                                port->port.tty->driver_data = NULL;
+                        if (tty->driver_data)
-                        port->port.tty = NULL;
+                                tty->driver_data = NULL;
+                        tty_port_tty_set(&port->port, NULL);
                }
        }
@@ -508,11 +509,12 @@ static void usb_serial_port_work(struct work_struct *work)
        if (!port)
                return;
-        tty = port->port.tty;
+        tty = tty_port_tty_get(&port->port);
        if (!tty)
                return;
        tty_wakeup(tty);
+        tty_kref_put(tty);
 }
 static void port_release(struct device *dev)
@@ -819,6 +821,7 @@ int usb_serial_probe(struct usb_interface *interface,
                port = kzalloc(sizeof(struct usb_serial_port), GFP_KERNEL);
                if (!port)
                        goto probe_error;
+                tty_port_init(&port->port);
                port->serial = serial;
                spin_lock_init(&port->lock);
                mutex_init(&port->mutex);
@@ -1040,8 +1043,11 @@ void usb_serial_disconnect(struct usb_interface *interface)
        for (i = 0; i < serial->num_ports; ++i) {
                port = serial->port[i];
                if (port) {
-                        if (port->port.tty)
+                        struct tty_struct *tty = tty_port_tty_get(&port->port);
-                                tty_hangup(port->port.tty);
+                        if (tty) {
+                                tty_hangup(tty);
+                                tty_kref_put(tty);
+                        }
                        kill_traffic(port);
                }
        }
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index cf8924f9a2cc..a6d1c75a1c89 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -499,7 +499,7 @@ static void visor_read_bulk_callback(struct urb *urb)
        int status = urb->status;
        struct tty_struct *tty;
        int result;
-        int available_room;
+        int available_room = 0;
        dbg("%s - port %d", __func__, port->number);
@@ -512,13 +512,17 @@ static void visor_read_bulk_callback(struct urb *urb)
        usb_serial_debug_data(debug, &port->dev, __func__,
                                                urb->actual_length, data);
-        tty = port->port.tty;
+        if (urb->actual_length) {
-        if (tty && urb->actual_length) {
+                tty = tty_port_tty_get(&port->port);
-                available_room = tty_buffer_request_room(tty,
+                if (tty) {
+                        available_room = tty_buffer_request_room(tty,
                                                        urb->actual_length);
-                if (available_room) {
+                        if (available_room) {
-                        tty_insert_flip_string(tty, data, available_room);
+                                tty_insert_flip_string(tty, data,
-                        tty_flip_buffer_push(tty);
+                                                        available_room);
+                                tty_flip_buffer_push(tty);
+                        }
+                        tty_kref_put(tty);
                }
                spin_lock(&priv->lock);
                priv->bytes_in += available_room;
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 3a9d14384a43..11c8b97a5177 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -1481,7 +1481,7 @@ static void rx_data_softint(struct work_struct *work)
        struct whiteheat_private *info =
                container_of(work, struct whiteheat_private, rx_work);
        struct usb_serial_port *port = info->port;
-        struct tty_struct *tty = port->port.tty;
+        struct tty_struct *tty = tty_port_tty_get(&port->port);
        struct whiteheat_urb_wrap *wrap;
        struct urb *urb;
        unsigned long flags;
@@ -1493,7 +1493,7 @@ static void rx_data_softint(struct work_struct *work)
        spin_lock_irqsave(&info->lock, flags);
        if (info->flags & THROTTLED) {
                spin_unlock_irqrestore(&info->lock, flags);
-                return;
+                goto out;
        }
        list_for_each_safe(tmp, tmp2, &info->rx_urb_q) {
@@ -1513,7 +1513,7 @@ static void rx_data_softint(struct work_struct *work)
                                spin_unlock_irqrestore(&info->lock, flags);
                                tty_flip_buffer_push(tty);
                                schedule_work(&info->rx_work);
-                                return;
+                                goto out;
                        }
                        tty_insert_flip_string(tty, urb->transfer_buffer, len);
                        sent += len;
@@ -1536,6 +1536,8 @@ static void rx_data_softint(struct work_struct *work)
        if (sent)
                tty_flip_buffer_push(tty);
+out:
+        tty_kref_put(tty);
 }
diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
index 385cba40ea87..06964af761c6 100644
--- a/drivers/video/backlight/mbp_nvidia_bl.c
+++ b/drivers/video/backlight/mbp_nvidia_bl.c
@@ -111,6 +111,4 @@ module_exit(mbp_exit);
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
 MODULE_DESCRIPTION("Nvidia-based Macbook Pro Backlight Driver");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("svnAppleInc.:pnMacBookPro3,1");
+MODULE_DEVICE_TABLE(dmi, mbp_device_table);
-MODULE_ALIAS("svnAppleInc.:pnMacBookPro3,2");
-MODULE_ALIAS("svnAppleInc.:pnMacBookPro4,1");
diff --git a/fs/Kconfig b/fs/Kconfig
index 40183d94b683..f54a157a0296 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -170,8 +170,8 @@ config EXT4DEV_COMPAT
        help
          Starting with 2.6.28, the name of the ext4 filesystem was
          renamed from ext4dev to ext4.  Unfortunately there are some
-          lagecy userspace programs (such as klibc's fstype) have
+          legacy userspace programs (such as klibc's fstype) have
-          "ext4dev" hardcoded.  
+          "ext4dev" hardcoded.
          To enable backwards compatibility so that systems that are
          still expecting to mount ext4 filesystems using ext4dev,
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 4a551af6f3fc..17c9c5ec14c5 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -59,10 +59,12 @@ config BINFMT_SHARED_FLAT
        help
          Support FLAT shared libraries
+config HAVE_AOUT
+       def_bool n
 config BINFMT_AOUT
        tristate "Kernel support for a.out and ECOFF binaries"
-        depends on ARCH_SUPPORTS_AOUT && \
+        depends on HAVE_AOUT
-                (X86_32 || ALPHA || ARM || M68K)
        ---help---
          A.out (Assembler.OUTput) is a set of formats for libraries and
          executables used in the earliest versions of UNIX.  Linux used
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 488eb424f662..a70d5d0890c7 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -27,6 +27,7 @@
 #define DEVPTS_SUPER_MAGIC 0x1cd1
 #define DEVPTS_DEFAULT_MODE 0600
+#define PTMX_MINOR      2
 extern int pty_limit;                   /* Config limit on Unix98 ptys */
 static DEFINE_IDA(allocated_ptys);
@@ -169,15 +170,7 @@ static struct file_system_type devpts_fs_type = {
 * to the System V naming convention
 */
-static struct dentry *get_node(int num)
+int devpts_new_index(struct inode *ptmx_inode)
-{
-        char s[12];
-        struct dentry *root = devpts_root;
-        mutex_lock(&root->d_inode->i_mutex);
-        return lookup_one_len(s, root, sprintf(s, "%d", num));
-}
-int devpts_new_index(void)
 {
        int index;
        int ida_ret;
@@ -205,20 +198,21 @@ retry:
        return index;
 }
-void devpts_kill_index(int idx)
+void devpts_kill_index(struct inode *ptmx_inode, int idx)
 {
        mutex_lock(&allocated_ptys_lock);
        ida_remove(&allocated_ptys, idx);
        mutex_unlock(&allocated_ptys_lock);
 }
-int devpts_pty_new(struct tty_struct *tty)
+int devpts_pty_new(struct inode *ptmx_inode, struct tty_struct *tty)
 {
        int number = tty->index; /* tty layer puts index from devpts_new_index() in here */
        struct tty_driver *driver = tty->driver;
        dev_t device = MKDEV(driver->major, driver->minor_start+number);
        struct dentry *dentry;
        struct inode *inode = new_inode(devpts_mnt->mnt_sb);
+        char s[12];
        /* We're supposed to be given the slave end of a pty */
        BUG_ON(driver->type != TTY_DRIVER_TYPE_PTY);
@@ -233,10 +227,15 @@ int devpts_pty_new(struct tty_struct *tty)
        inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
        init_special_inode(inode, S_IFCHR|config.mode, device);
        inode->i_private = tty;
+        tty->driver_data = inode;
-        dentry = get_node(number);
+        sprintf(s, "%d", number);
-        if (!IS_ERR(dentry) && !dentry->d_inode) {
-                d_instantiate(dentry, inode);
+        mutex_lock(&devpts_root->d_inode->i_mutex);
+        dentry = d_alloc_name(devpts_root, s);
+        if (!IS_ERR(dentry)) {
+                d_add(dentry, inode);
                fsnotify_create(devpts_root->d_inode, dentry);
        }
@@ -245,36 +244,31 @@ int devpts_pty_new(struct tty_struct *tty)
        return 0;
 }
-struct tty_struct *devpts_get_tty(int number)
+struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number)
 {
-        struct dentry *dentry = get_node(number);
+        BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
-        struct tty_struct *tty;
-        tty = NULL;
-        if (!IS_ERR(dentry)) {
-                if (dentry->d_inode)
-                        tty = dentry->d_inode->i_private;
-                dput(dentry);
-        }
-        mutex_unlock(&devpts_root->d_inode->i_mutex);
+        if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
+                return (struct tty_struct *)pts_inode->i_private;
-        return tty;
+        return NULL;
 }
-void devpts_pty_kill(int number)
+void devpts_pty_kill(struct tty_struct *tty)
 {
-        struct dentry *dentry = get_node(number);
+        struct inode *inode = tty->driver_data;
+        struct dentry *dentry;
-        if (!IS_ERR(dentry)) {
+        BUG_ON(inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
-                struct inode *inode = dentry->d_inode;
-                if (inode) {
+        mutex_lock(&devpts_root->d_inode->i_mutex);
-                        inode->i_nlink--;
-                        d_delete(dentry);
+        dentry = d_find_alias(inode);
-                        dput(dentry);
+        if (dentry && !IS_ERR(dentry)) {
-                }
+                inode->i_nlink--;
+                d_delete(dentry);
                dput(dentry);
        }
        mutex_unlock(&devpts_root->d_inode->i_mutex);
 }
diff --git a/fs/dquot.c b/fs/dquot.c
index 8ec4d6cc7633..ad7e59003e04 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -895,10 +895,9 @@ static void print_warning(struct dquot *dquot, const int warntype)
            warntype == QUOTA_NL_BSOFTBELOW || !need_print_warning(dquot))
                return;
-        mutex_lock(&tty_mutex);
        tty = get_current_tty();
        if (!tty)
-                goto out_lock;
+                return;
        tty_write_message(tty, dquot->dq_sb->s_id);
        if (warntype == QUOTA_NL_ISOFTWARN || warntype == QUOTA_NL_BSOFTWARN)
                tty_write_message(tty, ": warning, ");
@@ -926,8 +925,7 @@ static void print_warning(struct dquot *dquot, const int warntype)
                        break;
        }
        tty_write_message(tty, msg);
-out_lock:
+        tty_kref_put(tty);
-        mutex_unlock(&tty_mutex);
 }
 #endif
diff --git a/fs/efs/super.c b/fs/efs/super.c
index 567b134fa1f1..73b19cfc91fc 100644
--- a/fs/efs/super.c
+++ b/fs/efs/super.c
@@ -341,8 +341,6 @@ static int efs_statfs(struct dentry *dentry, struct kstatfs *buf) {
                        sb->inode_blocks *
                        (EFS_BLOCKSIZE / sizeof(struct efs_dinode));
        buf->f_ffree   = sb->inode_free;        /* free inodes */
-        buf->f_fsid.val[0] = (sb->fs_magic >> 16) & 0xffff; /* fs ID */
-        buf->f_fsid.val[1] =  sb->fs_magic        & 0xffff; /* fs ID */
        buf->f_namelen = EFS_MAXNAMELEN;        /* max filename length */
        return 0;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index f46a513a5157..6690a41cdd9f 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -540,6 +540,8 @@ do {									       \
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
 #define EXT4_MOUNT_DELALLOC             0x8000000 /* Delalloc support */
+#define EXT4_MOUNT_DATA_ERR_ABORT       0x10000000 /* Abort on file data write */
 /* Compatibility, for having both ext2_fs.h and ext4_fs.h included at once */
 #ifndef _LINUX_EXT2_FS_H
 #define clear_opt(o, opt)               o &= ~EXT4_MOUNT_##opt
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index ea27eaa0cfe5..dc99b4776d58 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -192,7 +192,7 @@ setversion_out:
        case EXT4_IOC_GROUP_EXTEND: {
                ext4_fsblk_t n_blocks_count;
                struct super_block *sb = inode->i_sb;
-                int err;
+                int err, err2;
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
@@ -206,8 +206,10 @@ setversion_out:
                err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
-                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                if (err == 0)
+                        err = err2;
                mnt_drop_write(filp->f_path.mnt);
                return err;
@@ -215,7 +217,7 @@ setversion_out:
        case EXT4_IOC_GROUP_ADD: {
                struct ext4_new_group_data input;
                struct super_block *sb = inode->i_sb;
-                int err;
+                int err, err2;
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
@@ -230,8 +232,10 @@ setversion_out:
                err = ext4_group_add(sb, &input);
                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
-                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                if (err == 0)
+                        err = err2;
                mnt_drop_write(filp->f_path.mnt);
                return err;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0e661c569660..fb940c22ab0d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -507,7 +507,8 @@ static void ext4_put_super(struct super_block *sb)
        ext4_mb_release(sb);
        ext4_ext_release(sb);
        ext4_xattr_put_super(sb);
-        jbd2_journal_destroy(sbi->s_journal);
+        if (jbd2_journal_destroy(sbi->s_journal) < 0)
+                ext4_abort(sb, __func__, "Couldn't clean up the journal");
        sbi->s_journal = NULL;
        if (!(sb->s_flags & MS_RDONLY)) {
                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
@@ -777,6 +778,9 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
                seq_printf(seq, ",inode_readahead_blks=%u",
                           sbi->s_inode_readahead_blks);
+        if (test_opt(sb, DATA_ERR_ABORT))
+                seq_puts(seq, ",data_err=abort");
        ext4_show_quota_options(seq, sb);
        return 0;
 }
@@ -906,6 +910,7 @@ enum {
        Opt_commit, Opt_journal_update, Opt_journal_inum, Opt_journal_dev,
        Opt_journal_checksum, Opt_journal_async_commit,
        Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback,
+        Opt_data_err_abort, Opt_data_err_ignore,
        Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
        Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
        Opt_ignore, Opt_barrier, Opt_err, Opt_resize, Opt_usrquota,
@@ -952,6 +957,8 @@ static match_table_t tokens = {
        {Opt_data_journal, "data=journal"},
        {Opt_data_ordered, "data=ordered"},
        {Opt_data_writeback, "data=writeback"},
+        {Opt_data_err_abort, "data_err=abort"},
+        {Opt_data_err_ignore, "data_err=ignore"},
        {Opt_offusrjquota, "usrjquota="},
        {Opt_usrjquota, "usrjquota=%s"},
        {Opt_offgrpjquota, "grpjquota="},
@@ -1186,6 +1193,12 @@ static int parse_options(char *options, struct super_block *sb,
                                sbi->s_mount_opt |= data_opt;
                        }
                        break;
+                case Opt_data_err_abort:
+                        set_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
+                case Opt_data_err_ignore:
+                        clear_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
 #ifdef CONFIG_QUOTA
                case Opt_usrjquota:
                        qtype = USRQUOTA;
@@ -2218,6 +2231,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                goto failed_mount;
        }
+#ifdef CONFIG_PROC_FS
        if (ext4_proc_root)
                sbi->s_proc = proc_mkdir(sb->s_id, ext4_proc_root);
@@ -2225,6 +2239,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                proc_create_data("inode_readahead_blks", 0644, sbi->s_proc,
                                 &ext4_ui_proc_fops,
                                 &sbi->s_inode_readahead_blks);
+#endif
        bgl_lock_init(&sbi->s_blockgroup_lock);
@@ -2534,6 +2549,10 @@ static void ext4_init_journal_params(struct super_block *sb, journal_t *journal)
                journal->j_flags |= JBD2_BARRIER;
        else
                journal->j_flags &= ~JBD2_BARRIER;
+        if (test_opt(sb, DATA_ERR_ABORT))
+                journal->j_flags |= JBD2_ABORT_ON_SYNCDATA_ERR;
+        else
+                journal->j_flags &= ~JBD2_ABORT_ON_SYNCDATA_ERR;
        spin_unlock(&journal->j_state_lock);
 }
@@ -2853,7 +2872,9 @@ static void ext4_mark_recovery_complete(struct super_block *sb,
        journal_t *journal = EXT4_SB(sb)->s_journal;
        jbd2_journal_lock_updates(journal);
-        jbd2_journal_flush(journal);
+        if (jbd2_journal_flush(journal) < 0)
+                goto out;
        lock_super(sb);
        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER) &&
            sb->s_flags & MS_RDONLY) {
@@ -2862,6 +2883,8 @@ static void ext4_mark_recovery_complete(struct super_block *sb,
                ext4_commit_super(sb, es, 1);
        }
        unlock_super(sb);
+out:
        jbd2_journal_unlock_updates(journal);
 }
@@ -2962,7 +2985,13 @@ static void ext4_write_super_lockfs(struct super_block *sb)
                /* Now we set up the journal barrier. */
                jbd2_journal_lock_updates(journal);
-                jbd2_journal_flush(journal);
+                /*
+                 * We don't want to clear needs_recovery flag when we failed
+                 * to flush the journal.
+                 */
+                if (jbd2_journal_flush(journal) < 0)
+                        return;
                /* Journal blocked and flushed, clear needs_recovery flag. */
                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
@@ -3402,8 +3431,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
                 * otherwise be livelocked...
                 */
                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
-                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                err = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                if (err) {
+                        path_put(&nd.path);
+                        return err;
+                }
        }
        err = vfs_quota_on_path(sb, type, format_id, &nd.path);
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 42895d369458..9203c3332f17 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -94,7 +94,8 @@ static int __try_to_free_cp_buf(struct journal_head *jh)
        int ret = 0;
        struct buffer_head *bh = jh2bh(jh);
-        if (jh->b_jlist == BJ_None && !buffer_locked(bh) && !buffer_dirty(bh)) {
+        if (jh->b_jlist == BJ_None && !buffer_locked(bh) &&
+            !buffer_dirty(bh) && !buffer_write_io_error(bh)) {
                JBUFFER_TRACE(jh, "remove from checkpoint list");
                ret = __jbd2_journal_remove_checkpoint(jh) + 1;
                jbd_unlock_bh_state(bh);
@@ -176,21 +177,25 @@ static void jbd_sync_bh(journal_t *journal, struct buffer_head *bh)
 * buffers. Note that we take the buffers in the opposite ordering
 * from the one in which they were submitted for IO.
 *
+ * Return 0 on success, and return <0 if some buffers have failed
+ * to be written out.
+ *
 * Called with j_list_lock held.
 */
-static void __wait_cp_io(journal_t *journal, transaction_t *transaction)
+static int __wait_cp_io(journal_t *journal, transaction_t *transaction)
 {
        struct journal_head *jh;
        struct buffer_head *bh;
        tid_t this_tid;
        int released = 0;
+        int ret = 0;
        this_tid = transaction->t_tid;
 restart:
        /* Did somebody clean up the transaction in the meanwhile? */
        if (journal->j_checkpoint_transactions != transaction ||
                        transaction->t_tid != this_tid)
-                return;
+                return ret;
        while (!released && transaction->t_checkpoint_io_list) {
                jh = transaction->t_checkpoint_io_list;
                bh = jh2bh(jh);
@@ -210,6 +215,9 @@ restart:
                        spin_lock(&journal->j_list_lock);
                        goto restart;
                }
+                if (unlikely(buffer_write_io_error(bh)))
+                        ret = -EIO;
                /*
                 * Now in whatever state the buffer currently is, we know that
                 * it has been written out and so we can drop it from the list
@@ -219,6 +227,8 @@ restart:
                jbd2_journal_remove_journal_head(bh);
                __brelse(bh);
        }
+        return ret;
 }
 #define NR_BATCH        64
@@ -242,7 +252,8 @@ __flush_batch(journal_t *journal, struct buffer_head **bhs, int *batch_count)
 * Try to flush one buffer from the checkpoint list to disk.
 *
 * Return 1 if something happened which requires us to abort the current
- * scan of the checkpoint list.
+ * scan of the checkpoint list.  Return <0 if the buffer has failed to
+ * be written out.
 *
 * Called with j_list_lock held and drops it if 1 is returned
 * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
@@ -274,6 +285,9 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
                jbd2_log_wait_commit(journal, tid);
                ret = 1;
        } else if (!buffer_dirty(bh)) {
+                ret = 1;
+                if (unlikely(buffer_write_io_error(bh)))
+                        ret = -EIO;
                J_ASSERT_JH(jh, !buffer_jbddirty(bh));
                BUFFER_TRACE(bh, "remove from checkpoint");
                __jbd2_journal_remove_checkpoint(jh);
@@ -281,7 +295,6 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
                jbd_unlock_bh_state(bh);
                jbd2_journal_remove_journal_head(bh);
                __brelse(bh);
-                ret = 1;
        } else {
                /*
                 * Important: we are about to write the buffer, and
@@ -314,6 +327,7 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
 * to disk. We submit larger chunks of data at once.
 *
 * The journal should be locked before calling this function.
+ * Called with j_checkpoint_mutex held.
 */
 int jbd2_log_do_checkpoint(journal_t *journal)
 {
@@ -339,6 +353,7 @@ int jbd2_log_do_checkpoint(journal_t *journal)
         * OK, we need to start writing disk blocks.  Take one transaction
         * and write it.
         */
+        result = 0;
        spin_lock(&journal->j_list_lock);
        if (!journal->j_checkpoint_transactions)
                goto out;
@@ -357,7 +372,7 @@ restart:
                int batch_count = 0;
                struct buffer_head *bhs[NR_BATCH];
                struct journal_head *jh;
-                int retry = 0;
+                int retry = 0, err;
                while (!retry && transaction->t_checkpoint_list) {
                        struct buffer_head *bh;
@@ -371,6 +386,8 @@ restart:
                        }
                        retry = __process_buffer(journal, jh, bhs, &batch_count,
                                                 transaction);
+                        if (retry < 0 && !result)
+                                result = retry;
                        if (!retry && (need_resched() ||
                                spin_needbreak(&journal->j_list_lock))) {
                                spin_unlock(&journal->j_list_lock);
@@ -395,14 +412,18 @@ restart:
                 * Now we have cleaned up the first transaction's checkpoint
                 * list. Let's clean up the second one
                 */
-                __wait_cp_io(journal, transaction);
+                err = __wait_cp_io(journal, transaction);
+                if (!result)
+                        result = err;
        }
 out:
        spin_unlock(&journal->j_list_lock);
-        result = jbd2_cleanup_journal_tail(journal);
        if (result < 0)
-                return result;
+                jbd2_journal_abort(journal, result);
-        return 0;
+        else
+                result = jbd2_cleanup_journal_tail(journal);
+        return (result < 0) ? result : 0;
 }
 /*
@@ -418,8 +439,9 @@ out:
 * This is the only part of the journaling code which really needs to be
 * aware of transaction aborts.  Checkpointing involves writing to the
 * main filesystem area rather than to the journal, so it can proceed
- * even in abort state, but we must not update the journal superblock if
+ * even in abort state, but we must not update the super block if
- * we have an abort error outstanding.
+ * checkpointing may have failed.  Otherwise, we would lose some metadata
+ * buffers which should be written-back to the filesystem.
 */
 int jbd2_cleanup_journal_tail(journal_t *journal)
@@ -428,6 +450,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
        tid_t           first_tid;
        unsigned long   blocknr, freed;
+        if (is_journal_aborted(journal))
+                return 1;
        /* OK, work out the oldest transaction remaining in the log, and
         * the log block it starts at.
         *
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 0d3814a35ed1..0abe02c4242a 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -504,9 +504,10 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                jh = commit_transaction->t_buffers;
                /* If we're in abort mode, we just un-journal the buffer and
-                   release it for background writing. */
+                   release it. */
                if (is_journal_aborted(journal)) {
+                        clear_buffer_jbddirty(jh2bh(jh));
                        JBUFFER_TRACE(jh, "journal is aborting: refile");
                        jbd2_journal_refile_buffer(journal, jh);
                        /* If that was the last one, we need to clean up
@@ -683,6 +684,8 @@ start_journal_io:
                printk(KERN_WARNING
                        "JBD2: Detected IO errors while flushing file data "
                       "on %s\n", journal->j_devname);
+                if (journal->j_flags & JBD2_ABORT_ON_SYNCDATA_ERR)
+                        jbd2_journal_abort(journal, err);
                err = 0;
        }
@@ -783,6 +786,9 @@ wait_for_iobuf:
                /* AKPM: bforget here */
        }
+        if (err)
+                jbd2_journal_abort(journal, err);
        jbd_debug(3, "JBD: commit phase 5\n");
        if (!JBD2_HAS_INCOMPAT_FEATURE(journal,
@@ -881,6 +887,8 @@ restart_loop:
                if (buffer_jbddirty(bh)) {
                        JBUFFER_TRACE(jh, "add to new checkpointing trans");
                        __jbd2_journal_insert_checkpoint(jh, commit_transaction);
+                        if (is_journal_aborted(journal))
+                                clear_buffer_jbddirty(bh);
                        JBUFFER_TRACE(jh, "refile for checkpoint writeback");
                        __jbd2_journal_refile_buffer(jh);
                        jbd_unlock_bh_state(bh);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 01c3901c3a07..783de118de92 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1451,9 +1451,12 @@ recovery_error:
 *
 * Release a journal_t structure once it is no longer in use by the
 * journaled object.
+ * Return <0 if we couldn't clean up the journal.
 */
-void jbd2_journal_destroy(journal_t *journal)
+int jbd2_journal_destroy(journal_t *journal)
 {
+        int err = 0;
        /* Wait for the commit thread to wake up and die. */
        journal_kill_thread(journal);
@@ -1476,11 +1479,16 @@ void jbd2_journal_destroy(journal_t *journal)
        J_ASSERT(journal->j_checkpoint_transactions == NULL);
        spin_unlock(&journal->j_list_lock);
-        /* We can now mark the journal as empty. */
-        journal->j_tail = 0;
-        journal->j_tail_sequence = ++journal->j_transaction_sequence;
        if (journal->j_sb_buffer) {
-                jbd2_journal_update_superblock(journal, 1);
+                if (!is_journal_aborted(journal)) {
+                        /* We can now mark the journal as empty. */
+                        journal->j_tail = 0;
+                        journal->j_tail_sequence =
+                                ++journal->j_transaction_sequence;
+                        jbd2_journal_update_superblock(journal, 1);
+                } else {
+                        err = -EIO;
+                }
                brelse(journal->j_sb_buffer);
        }
@@ -1492,6 +1500,8 @@ void jbd2_journal_destroy(journal_t *journal)
                jbd2_journal_destroy_revoke(journal);
        kfree(journal->j_wbuf);
        kfree(journal);
+        return err;
 }
@@ -1717,10 +1727,16 @@ int jbd2_journal_flush(journal_t *journal)
        spin_lock(&journal->j_list_lock);
        while (!err && journal->j_checkpoint_transactions != NULL) {
                spin_unlock(&journal->j_list_lock);
+                mutex_lock(&journal->j_checkpoint_mutex);
                err = jbd2_log_do_checkpoint(journal);
+                mutex_unlock(&journal->j_checkpoint_mutex);
                spin_lock(&journal->j_list_lock);
        }
        spin_unlock(&journal->j_list_lock);
+        if (is_journal_aborted(journal))
+                return -EIO;
        jbd2_cleanup_journal_tail(journal);
        /* Finally, mark the journal as really needing no recovery.
@@ -1742,7 +1758,7 @@ int jbd2_journal_flush(journal_t *journal)
        J_ASSERT(journal->j_head == journal->j_tail);
        J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
        spin_unlock(&journal->j_state_lock);
-        return err;
+        return 0;
 }
 /**
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 058f50f65b76..73063285b13f 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -225,7 +225,7 @@ do {									\
 */
 int jbd2_journal_recover(journal_t *journal)
 {
-        int                     err;
+        int                     err, err2;
        journal_superblock_t *  sb;
        struct recovery_info    info;
@@ -263,7 +263,10 @@ int jbd2_journal_recover(journal_t *journal)
        journal->j_transaction_sequence = ++info.end_transaction;
        jbd2_journal_clear_revoke(journal);
-        sync_blockdev(journal->j_fs_dev);
+        err2 = sync_blockdev(journal->j_fs_dev);
+        if (!err)
+                err = err2;
        return err;
 }
diff --git a/fs/open.c b/fs/open.c
index 07da9359481c..5596049863bf 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1141,8 +1141,7 @@ EXPORT_SYMBOL(sys_close);
 asmlinkage long sys_vhangup(void)
 {
        if (capable(CAP_SYS_TTY_CONFIG)) {
-                /* XXX: this needs locking */
+                tty_vhangup_self();
-                tty_vhangup(current->signal->tty);
                return 0;
        }
        return -EPERM;
diff --git a/include/asm-cris/a.out.h b/include/asm-cris/a.out.h
deleted file mode 100644
index c82e9f9b75f6..000000000000
--- a/include/asm-cris/a.out.h
+++ /dev/null
@@ -1,26 +0,0 @@
-#ifndef __CRIS_A_OUT_H__
-#define __CRIS_A_OUT_H__
-/* we don't support a.out binaries on Linux/CRIS anyway, so this is
- * not really used but still needed because binfmt_elf.c for some reason
- * wants to know about a.out even if there is no interpreter available...
- */
-struct exec
-{
-  unsigned long a_info;         /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;              /* length of text, in bytes */
-  unsigned a_data;              /* length of data, in bytes */
-  unsigned a_bss;               /* length of uninitialized data area for file, in bytes */
-  unsigned a_syms;              /* length of symbol table data in file, in bytes */
-  unsigned a_entry;             /* start address */
-  unsigned a_trsize;            /* length of relocation info for text, in bytes */
-  unsigned a_drsize;            /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif
diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
index 1d01043e797d..6129d6802149 100644
--- a/include/asm-generic/statfs.h
+++ b/include/asm-generic/statfs.h
@@ -6,33 +6,64 @@
 typedef __kernel_fsid_t fsid_t;
 #endif
+/*
+ * Most 64-bit platforms use 'long', while most 32-bit platforms use '__u32'.
+ * Yes, they differ in signedness as well as size.
+ * Special cases can override it for themselves -- except for S390x, which
+ * is just a little too special for us. And MIPS, which I'm not touching
+ * with a 10' pole.
+ */
+#ifndef __statfs_word
+#if BITS_PER_LONG == 64
+#define __statfs_word long
+#else
+#define __statfs_word __u32
+#endif
+#endif
 struct statfs {
-        __u32 f_type;
+        __statfs_word f_type;
-        __u32 f_bsize;
+        __statfs_word f_bsize;
-        __u32 f_blocks;
+        __statfs_word f_blocks;
-        __u32 f_bfree;
+        __statfs_word f_bfree;
-        __u32 f_bavail;
+        __statfs_word f_bavail;
-        __u32 f_files;
+        __statfs_word f_files;
-        __u32 f_ffree;
+        __statfs_word f_ffree;
        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
+        __statfs_word f_namelen;
-        __u32 f_frsize;
+        __statfs_word f_frsize;
-        __u32 f_spare[5];
+        __statfs_word f_spare[5];
 };
+/*
+ * ARM needs to avoid the 32-bit padding at the end, for consistency
+ * between EABI and OABI 
+ */
+#ifndef ARCH_PACK_STATFS64
+#define ARCH_PACK_STATFS64
+#endif
 struct statfs64 {
-        __u32 f_type;
+        __statfs_word f_type;
-        __u32 f_bsize;
+        __statfs_word f_bsize;
        __u64 f_blocks;
        __u64 f_bfree;
        __u64 f_bavail;
        __u64 f_files;
        __u64 f_ffree;
        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
+        __statfs_word f_namelen;
-        __u32 f_frsize;
+        __statfs_word f_frsize;
-        __u32 f_spare[5];
+        __statfs_word f_spare[5];
-};
+} ARCH_PACK_STATFS64;
+/* 
+ * IA64 and x86_64 need to avoid the 32-bit padding at the end,
+ * to be compatible with the i386 ABI
+ */
+#ifndef ARCH_PACK_COMPAT_STATFS64
+#define ARCH_PACK_COMPAT_STATFS64
+#endif
 struct compat_statfs64 {
        __u32 f_type;
@@ -46,6 +77,6 @@ struct compat_statfs64 {
        __u32 f_namelen;
        __u32 f_frsize;
        __u32 f_spare[5];
-};
+} ARCH_PACK_COMPAT_STATFS64;
 #endif
diff --git a/include/asm-m32r/a.out.h b/include/asm-m32r/a.out.h
deleted file mode 100644
index ab150f5c1666..000000000000
--- a/include/asm-m32r/a.out.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef _ASM_M32R_A_OUT_H
-#define _ASM_M32R_A_OUT_H
-struct exec
-{
-  unsigned long a_info;         /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;              /* length of text, in bytes */
-  unsigned a_data;              /* length of data, in bytes */
-  unsigned a_bss;               /* length of uninitialized data area for file, in bytes */
-  unsigned a_syms;              /* length of symbol table data in file, in bytes */
-  unsigned a_entry;             /* start address */
-  unsigned a_trsize;            /* length of relocation info for text, in bytes */
-  unsigned a_drsize;            /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* _ASM_M32R_A_OUT_H */
diff --git a/include/asm-parisc/a.out.h b/include/asm-parisc/a.out.h
deleted file mode 100644
index eb04e34c5bb1..000000000000
--- a/include/asm-parisc/a.out.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef __PARISC_A_OUT_H__
-#define __PARISC_A_OUT_H__
-struct exec
-{
-  unsigned int a_info;          /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;              /* length of text, in bytes */
-  unsigned a_data;              /* length of data, in bytes */
-  unsigned a_bss;               /* length of uninitialized data area for file, in bytes */
-  unsigned a_syms;              /* length of symbol table data in file, in bytes */
-  unsigned a_entry;             /* start address */
-  unsigned a_trsize;            /* length of relocation info for text, in bytes */
-  unsigned a_drsize;            /* length of relocation info for data, in bytes */
-};
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#endif /* __A_OUT_GNU_H__ */
diff --git a/include/asm-parisc/statfs.h b/include/asm-parisc/statfs.h
index 1d2b8130b23d..324bea905dc6 100644
--- a/include/asm-parisc/statfs.h
+++ b/include/asm-parisc/statfs.h
@@ -1,58 +1,7 @@
 #ifndef _PARISC_STATFS_H
 #define _PARISC_STATFS_H
-#ifndef __KERNEL_STRICT_NAMES
+#define __statfs_word long
+#include <asm-generic/statfs.h>
-#include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
-/*
- * It appears that PARISC could be 64 _or_ 32 bit.
- * 64-bit fields must be explicitly 64-bit in statfs64.
- */
-struct statfs {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct statfs64 {
-        long f_type;
-        long f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct compat_statfs64 {
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-};
 #endif
diff --git a/include/asm-x86/desc.h b/include/asm-x86/desc.h
index ebc307817e98..f06adac7938c 100644
--- a/include/asm-x86/desc.h
+++ b/include/asm-x86/desc.h
@@ -351,20 +351,16 @@ static inline void set_system_intr_gate(unsigned int n, void *addr)
        _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
 }
-static inline void set_trap_gate(unsigned int n, void *addr)
+static inline void set_system_trap_gate(unsigned int n, void *addr)
 {
        BUG_ON((unsigned)n > 0xFF);
-        _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
+        _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
 }
-static inline void set_system_gate(unsigned int n, void *addr)
+static inline void set_trap_gate(unsigned int n, void *addr)
 {
        BUG_ON((unsigned)n > 0xFF);
-#ifdef CONFIG_X86_32
+        _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-        _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
-#else
-        _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
-#endif
 }
 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
@@ -379,7 +375,7 @@ static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
        _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
 }
-static inline void set_system_gate_ist(int n, void *addr, unsigned ist)
+static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
 {
        BUG_ON((unsigned)n > 0xFF);
        _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
diff --git a/include/asm-x86/es7000/mpparse.h b/include/asm-x86/es7000/mpparse.h
index 7b5c889d8e7d..ed5a3caae141 100644
--- a/include/asm-x86/es7000/mpparse.h
+++ b/include/asm-x86/es7000/mpparse.h
@@ -5,6 +5,7 @@
 extern int parse_unisys_oem (char *oemptr);
 extern int find_unisys_acpi_oem_table(unsigned long *oem_addr);
+extern void unmap_unisys_acpi_oem_table(unsigned long oem_addr);
 extern void setup_unisys(void);
 #ifndef CONFIG_X86_GENERICARCH
diff --git a/include/asm-x86/fixmap_32.h b/include/asm-x86/fixmap_32.h
index 784e3e759866..8844002da0e0 100644
--- a/include/asm-x86/fixmap_32.h
+++ b/include/asm-x86/fixmap_32.h
@@ -94,10 +94,10 @@ enum fixed_addresses {
         * can have a single pgd entry and a single pte table:
         */
 #define NR_FIX_BTMAPS           64
-#define FIX_BTMAPS_NESTING      4
+#define FIX_BTMAPS_SLOTS        4
        FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 256 -
                        (__end_of_permanent_fixed_addresses & 255),
-        FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_NESTING - 1,
+        FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1,
        FIX_WP_TEST,
 #ifdef CONFIG_ACPI
        FIX_ACPI_BEGIN,
diff --git a/include/asm-x86/fixmap_64.h b/include/asm-x86/fixmap_64.h
index dafb24bc0424..dab4751d1307 100644
--- a/include/asm-x86/fixmap_64.h
+++ b/include/asm-x86/fixmap_64.h
@@ -49,6 +49,7 @@ enum fixed_addresses {
 #ifdef CONFIG_PARAVIRT
        FIX_PARAVIRT_BOOTMAP,
 #endif
+        __end_of_permanent_fixed_addresses,
 #ifdef CONFIG_ACPI
        FIX_ACPI_BEGIN,
        FIX_ACPI_END = FIX_ACPI_BEGIN + FIX_ACPI_PAGES - 1,
@@ -56,19 +57,18 @@ enum fixed_addresses {
 #ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
        FIX_OHCI1394_BASE,
 #endif
-        __end_of_permanent_fixed_addresses,
        /*
         * 256 temporary boot-time mappings, used by early_ioremap(),
         * before ioremap() is functional.
         *
-         * We round it up to the next 512 pages boundary so that we
+         * We round it up to the next 256 pages boundary so that we
         * can have a single pgd entry and a single pte table:
         */
 #define NR_FIX_BTMAPS           64
-#define FIX_BTMAPS_NESTING      4
+#define FIX_BTMAPS_SLOTS        4
-        FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 512 -
+        FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 256 -
-                        (__end_of_permanent_fixed_addresses & 511),
+                        (__end_of_permanent_fixed_addresses & 255),
-        FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_NESTING - 1,
+        FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1,
        __end_of_fixed_addresses
 };
diff --git a/include/asm-x86/io.h b/include/asm-x86/io.h
index 72b7719523bf..a233f835e0b5 100644
--- a/include/asm-x86/io.h
+++ b/include/asm-x86/io.h
@@ -5,20 +5,6 @@
 #include <linux/compiler.h>
-/*
- * early_ioremap() and early_iounmap() are for temporary early boot-time
- * mappings, before the real ioremap() is functional.
- * A boot-time mapping is currently limited to at most 16 pages.
- */
-#ifndef __ASSEMBLY__
-extern void early_ioremap_init(void);
-extern void early_ioremap_clear(void);
-extern void early_ioremap_reset(void);
-extern void *early_ioremap(unsigned long offset, unsigned long size);
-extern void early_iounmap(void *addr, unsigned long size);
-extern void __iomem *fix_ioremap(unsigned idx, unsigned long phys);
-#endif
 #define build_mmio_read(name, size, type, reg, barrier) \
 static inline type name(const volatile void __iomem *addr) \
 { type ret; asm volatile("mov" size " %1,%0":reg (ret) \
@@ -97,6 +83,7 @@ extern void early_ioremap_init(void);
 extern void early_ioremap_clear(void);
 extern void early_ioremap_reset(void);
 extern void *early_ioremap(unsigned long offset, unsigned long size);
+extern void *early_memremap(unsigned long offset, unsigned long size);
 extern void early_iounmap(void *addr, unsigned long size);
 extern void __iomem *fix_ioremap(unsigned idx, unsigned long phys);
diff --git a/include/asm-x86/io_64.h b/include/asm-x86/io_64.h
index 64429e9431a8..ee6e086b7dfe 100644
--- a/include/asm-x86/io_64.h
+++ b/include/asm-x86/io_64.h
@@ -165,9 +165,6 @@ static inline void *phys_to_virt(unsigned long address)
 #include <asm-generic/iomap.h>
-extern void *early_ioremap(unsigned long addr, unsigned long size);
-extern void early_iounmap(void *addr, unsigned long size);
 /*
 * This one maps high address device memory and turns off caching for that area.
 * it's useful if some control registers are in such an area and write combining
diff --git a/include/asm-x86/ioctls.h b/include/asm-x86/ioctls.h
index 336603512399..06752a649044 100644
--- a/include/asm-x86/ioctls.h
+++ b/include/asm-x86/ioctls.h
@@ -51,9 +51,15 @@
 #define TCSETS2         _IOW('T', 0x2B, struct termios2)
 #define TCSETSW2        _IOW('T', 0x2C, struct termios2)
 #define TCSETSF2        _IOW('T', 0x2D, struct termios2)
+#define TIOCGRS485      0x542E
+#define TIOCSRS485      0x542F
 #define TIOCGPTN        _IOR('T', 0x30, unsigned int)
                                /* Get Pty Number (of pty-mux device) */
 #define TIOCSPTLCK      _IOW('T', 0x31, int)  /* Lock/unlock Pty */
+#define TCGETX          0x5432 /* SYS5 TCGETX compatibility */
+#define TCSETX          0x5433
+#define TCSETXF         0x5434
+#define TCSETXW         0x5435
 #define FIONCLEX        0x5450
 #define FIOCLEX         0x5451
diff --git a/include/asm-x86/irqflags.h b/include/asm-x86/irqflags.h
index 424acb48cd61..2bdab21f0898 100644
--- a/include/asm-x86/irqflags.h
+++ b/include/asm-x86/irqflags.h
@@ -166,27 +166,6 @@ static inline int raw_irqs_disabled(void)
        return raw_irqs_disabled_flags(flags);
 }
-/*
- * makes the traced hardirq state match with the machine state
- *
- * should be a rarely used function, only in places where its
- * otherwise impossible to know the irq state, like in traps.
- */
-static inline void trace_hardirqs_fixup_flags(unsigned long flags)
-{
-        if (raw_irqs_disabled_flags(flags))
-                trace_hardirqs_off();
-        else
-                trace_hardirqs_on();
-}
-static inline void trace_hardirqs_fixup(void)
-{
-        unsigned long flags = __raw_local_save_flags();
-        trace_hardirqs_fixup_flags(flags);
-}
 #else
 #ifdef CONFIG_X86_64
diff --git a/include/asm-x86/kdebug.h b/include/asm-x86/kdebug.h
index 5ec3ad3e825c..fbbab66ee9df 100644
--- a/include/asm-x86/kdebug.h
+++ b/include/asm-x86/kdebug.h
@@ -27,10 +27,9 @@ extern void printk_address(unsigned long address, int reliable);
 extern void die(const char *, struct pt_regs *,long);
 extern int __must_check __die(const char *, struct pt_regs *, long);
 extern void show_registers(struct pt_regs *regs);
-extern void __show_registers(struct pt_regs *, int all);
 extern void show_trace(struct task_struct *t, struct pt_regs *regs,
                       unsigned long *sp, unsigned long bp);
-extern void __show_regs(struct pt_regs *regs);
+extern void __show_regs(struct pt_regs *regs, int all);
 extern void show_regs(struct pt_regs *regs);
 extern unsigned long oops_begin(void);
 extern void oops_end(unsigned long, struct pt_regs *, int signr);
diff --git a/include/asm-x86/kprobes.h b/include/asm-x86/kprobes.h
index bd8407863c13..8a0748d01036 100644
--- a/include/asm-x86/kprobes.h
+++ b/include/asm-x86/kprobes.h
@@ -82,15 +82,6 @@ struct kprobe_ctlblk {
        struct prev_kprobe prev_kprobe;
 };
-/* trap3/1 are intr gates for kprobes.  So, restore the status of IF,
- * if necessary, before executing the original int3/1 (trap) handler.
- */
-static inline void restore_interrupts(struct pt_regs *regs)
-{
-        if (regs->flags & X86_EFLAGS_IF)
-                local_irq_enable();
-}
 extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 extern int kprobe_exceptions_notify(struct notifier_block *self,
                                    unsigned long val, void *data);
diff --git a/include/asm-x86/mach-default/mach_traps.h b/include/asm-x86/mach-default/mach_traps.h
index de9ac3f5c4ce..ff8778f26b84 100644
--- a/include/asm-x86/mach-default/mach_traps.h
+++ b/include/asm-x86/mach-default/mach_traps.h
@@ -7,12 +7,6 @@
 #include <asm/mc146818rtc.h>
-static inline void clear_mem_error(unsigned char reason)
-{
-        reason = (reason & 0xf) | 4;
-        outb(reason, 0x61);
-}
 static inline unsigned char get_nmi_reason(void)
 {
        return inb(0x61);
diff --git a/include/asm-x86/module.h b/include/asm-x86/module.h
index 48dc3e0c07d9..864f2005fc1d 100644
--- a/include/asm-x86/module.h
+++ b/include/asm-x86/module.h
@@ -52,8 +52,6 @@ struct mod_arch_specific {};
 #define MODULE_PROC_FAMILY "EFFICEON "
 #elif defined CONFIG_MWINCHIPC6
 #define MODULE_PROC_FAMILY "WINCHIPC6 "
-#elif defined CONFIG_MWINCHIP2
-#define MODULE_PROC_FAMILY "WINCHIP2 "
 #elif defined CONFIG_MWINCHIP3D
 #define MODULE_PROC_FAMILY "WINCHIP3D "
 #elif defined CONFIG_MCYRIXIII
diff --git a/include/asm-x86/nmi.h b/include/asm-x86/nmi.h
index d5e715f024dc..a53f829a97c5 100644
--- a/include/asm-x86/nmi.h
+++ b/include/asm-x86/nmi.h
@@ -15,10 +15,6 @@
 */
 int do_nmi_callback(struct pt_regs *regs, int cpu);
-#ifdef CONFIG_X86_64
-extern void default_do_nmi(struct pt_regs *);
-#endif
 extern void die_nmi(char *str, struct pt_regs *regs, int do_panic);
 extern int check_nmi_watchdog(void);
 extern int nmi_watchdog_enabled;
diff --git a/include/asm-x86/page.h b/include/asm-x86/page.h
index c91574776751..d4f1d5791fc1 100644
--- a/include/asm-x86/page.h
+++ b/include/asm-x86/page.h
@@ -179,6 +179,7 @@ static inline pteval_t native_pte_flags(pte_t pte)
 #endif  /* CONFIG_PARAVIRT */
 #define __pa(x)         __phys_addr((unsigned long)(x))
+#define __pa_nodebug(x) __phys_addr_nodebug((unsigned long)(x))
 /* __pa_symbol should be used for C visible symbols.
   This seems to be the official gcc blessed way to do such arithmetic. */
 #define __pa_symbol(x)  __pa(__phys_reloc_hide((unsigned long)(x)))
@@ -188,9 +189,14 @@ static inline pteval_t native_pte_flags(pte_t pte)
 #define __boot_va(x)            __va(x)
 #define __boot_pa(x)            __pa(x)
+/*
+ * virt_to_page(kaddr) returns a valid pointer if and only if
+ * virt_addr_valid(kaddr) returns true.
+ */
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
 #define pfn_to_kaddr(pfn)      __va((pfn) << PAGE_SHIFT)
-#define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
+extern bool __virt_addr_valid(unsigned long kaddr);
+#define virt_addr_valid(kaddr)  __virt_addr_valid((unsigned long) (kaddr))
 #endif  /* __ASSEMBLY__ */
diff --git a/include/asm-x86/page_32.h b/include/asm-x86/page_32.h
index 9c5a737a9af9..e8d80d1de237 100644
--- a/include/asm-x86/page_32.h
+++ b/include/asm-x86/page_32.h
@@ -20,6 +20,12 @@
 #endif
 #define THREAD_SIZE     (PAGE_SIZE << THREAD_ORDER)
+#define STACKFAULT_STACK 0
+#define DOUBLEFAULT_STACK 1
+#define NMI_STACK 0
+#define DEBUG_STACK 0
+#define MCE_STACK 0
+#define N_EXCEPTION_STACKS 1
 #ifdef CONFIG_X86_PAE
 /* 44=32+12, the limit we can fit into an unsigned long pfn */
@@ -73,11 +79,11 @@ typedef struct page *pgtable_t;
 #endif
 #ifndef __ASSEMBLY__
-#define __phys_addr_const(x)    ((x) - PAGE_OFFSET)
+#define __phys_addr_nodebug(x)  ((x) - PAGE_OFFSET)
 #ifdef CONFIG_DEBUG_VIRTUAL
 extern unsigned long __phys_addr(unsigned long);
 #else
-#define __phys_addr(x)          ((x) - PAGE_OFFSET)
+#define __phys_addr(x)          __phys_addr_nodebug(x)
 #endif
 #define __phys_reloc_hide(x)    RELOC_HIDE((x), 0)
diff --git a/include/asm-x86/pgtable.h b/include/asm-x86/pgtable.h
index ed932453ef26..182f9d4c570f 100644
--- a/include/asm-x86/pgtable.h
+++ b/include/asm-x86/pgtable.h
@@ -15,7 +15,7 @@
 #define _PAGE_BIT_PAT           7       /* on 4KB pages */
 #define _PAGE_BIT_GLOBAL        8       /* Global TLB entry PPro+ */
 #define _PAGE_BIT_UNUSED1       9       /* available for programmer */
-#define _PAGE_BIT_UNUSED2       10
+#define _PAGE_BIT_IOMAP         10      /* flag used to indicate IO mapping */
 #define _PAGE_BIT_UNUSED3       11
 #define _PAGE_BIT_PAT_LARGE     12      /* On 2MB or 1GB pages */
 #define _PAGE_BIT_SPECIAL       _PAGE_BIT_UNUSED1
@@ -32,7 +32,7 @@
 #define _PAGE_PSE       (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
 #define _PAGE_GLOBAL    (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
 #define _PAGE_UNUSED1   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
-#define _PAGE_UNUSED2   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED2)
+#define _PAGE_IOMAP     (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
 #define _PAGE_UNUSED3   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED3)
 #define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
@@ -99,6 +99,11 @@
 #define __PAGE_KERNEL_LARGE_NOCACHE     (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
+#define __PAGE_KERNEL_IO                (__PAGE_KERNEL | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_NOCACHE        (__PAGE_KERNEL_NOCACHE | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_UC_MINUS       (__PAGE_KERNEL_UC_MINUS | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_WC             (__PAGE_KERNEL_WC | _PAGE_IOMAP)
 #define PAGE_KERNEL                     __pgprot(__PAGE_KERNEL)
 #define PAGE_KERNEL_RO                  __pgprot(__PAGE_KERNEL_RO)
 #define PAGE_KERNEL_EXEC                __pgprot(__PAGE_KERNEL_EXEC)
@@ -113,6 +118,11 @@
 #define PAGE_KERNEL_VSYSCALL            __pgprot(__PAGE_KERNEL_VSYSCALL)
 #define PAGE_KERNEL_VSYSCALL_NOCACHE    __pgprot(__PAGE_KERNEL_VSYSCALL_NOCACHE)
+#define PAGE_KERNEL_IO                  __pgprot(__PAGE_KERNEL_IO)
+#define PAGE_KERNEL_IO_NOCACHE          __pgprot(__PAGE_KERNEL_IO_NOCACHE)
+#define PAGE_KERNEL_IO_UC_MINUS         __pgprot(__PAGE_KERNEL_IO_UC_MINUS)
+#define PAGE_KERNEL_IO_WC               __pgprot(__PAGE_KERNEL_IO_WC)
 /*         xwr */
 #define __P000  PAGE_NONE
 #define __P001  PAGE_READONLY
@@ -196,7 +206,7 @@ static inline int pte_exec(pte_t pte)
 static inline int pte_special(pte_t pte)
 {
-        return pte_val(pte) & _PAGE_SPECIAL;
+        return pte_flags(pte) & _PAGE_SPECIAL;
 }
 static inline unsigned long pte_pfn(pte_t pte)
diff --git a/include/asm-x86/ptrace.h b/include/asm-x86/ptrace.h
index ac578f11c1c5..a2025525a15a 100644
--- a/include/asm-x86/ptrace.h
+++ b/include/asm-x86/ptrace.h
@@ -174,12 +174,8 @@ extern unsigned long profile_pc(struct pt_regs *regs);
 extern unsigned long
 convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs);
-#ifdef CONFIG_X86_32
 extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
                         int error_code, int si_code);
-#endif
 void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
 extern long syscall_trace_enter(struct pt_regs *);
diff --git a/include/asm-x86/segment.h b/include/asm-x86/segment.h
index ea5f0a8686f7..5d6e69454891 100644
--- a/include/asm-x86/segment.h
+++ b/include/asm-x86/segment.h
@@ -131,12 +131,6 @@
 * Matching rules for certain types of segments.
 */
-/* Matches only __KERNEL_CS, ignoring PnP / USER / APM segments */
-#define SEGMENT_IS_KERNEL_CODE(x) (((x) & 0xfc) == GDT_ENTRY_KERNEL_CS * 8)
-/* Matches __KERNEL_CS and __USER_CS (they must be 2 entries apart) */
-#define SEGMENT_IS_FLAT_CODE(x)  (((x) & 0xec) == GDT_ENTRY_KERNEL_CS * 8)
 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
 #define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
diff --git a/include/asm-x86/smp.h b/include/asm-x86/smp.h
index 6df2615f9138..a6afc29f2dd9 100644
--- a/include/asm-x86/smp.h
+++ b/include/asm-x86/smp.h
@@ -141,6 +141,8 @@ void play_dead_common(void);
 void native_send_call_func_ipi(cpumask_t mask);
 void native_send_call_func_single_ipi(int cpu);
+extern void prefill_possible_map(void);
 void smp_store_cpu_info(int id);
 #define cpu_physical_id(cpu)    per_cpu(x86_cpu_to_apicid, cpu)
@@ -149,15 +151,11 @@ static inline int num_booting_cpus(void)
 {
        return cpus_weight(cpu_callout_map);
 }
-#endif /* CONFIG_SMP */
-#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_CPU)
-extern void prefill_possible_map(void);
 #else
 static inline void prefill_possible_map(void)
 {
 }
-#endif
+#endif /* CONFIG_SMP */
 extern unsigned disabled_cpus __cpuinitdata;
diff --git a/include/asm-x86/statfs.h b/include/asm-x86/statfs.h
index 3f005bc3aa5b..ca5dc19dd461 100644
--- a/include/asm-x86/statfs.h
+++ b/include/asm-x86/statfs.h
@@ -1,63 +1,12 @@
 #ifndef ASM_X86__STATFS_H
 #define ASM_X86__STATFS_H
-#ifdef __i386__
-#include <asm-generic/statfs.h>
-#else
-#ifndef __KERNEL_STRICT_NAMES
-#include <linux/types.h>
-typedef __kernel_fsid_t fsid_t;
-#endif
 /*
- * This is ugly -- we're already 64-bit clean, so just duplicate the
+ * We need compat_statfs64 to be packed, because the i386 ABI won't
- * definitions.
+ * add padding at the end to bring it to a multiple of 8 bytes, but
+ * the x86_64 ABI will.
 */
-struct statfs {
+#define ARCH_PACK_COMPAT_STATFS64 __attribute__((packed,aligned(4)))
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct statfs64 {
-        long f_type;
-        long f_bsize;
-        long f_blocks;
-        long f_bfree;
-        long f_bavail;
-        long f_files;
-        long f_ffree;
-        __kernel_fsid_t f_fsid;
-        long f_namelen;
-        long f_frsize;
-        long f_spare[5];
-};
-struct compat_statfs64 {
+#include <asm-generic/statfs.h>
-        __u32 f_type;
-        __u32 f_bsize;
-        __u64 f_blocks;
-        __u64 f_bfree;
-        __u64 f_bavail;
-        __u64 f_files;
-        __u64 f_ffree;
-        __kernel_fsid_t f_fsid;
-        __u32 f_namelen;
-        __u32 f_frsize;
-        __u32 f_spare[5];
-} __attribute__((packed));
-#endif /* !__i386__ */
 #endif /* ASM_X86__STATFS_H */
diff --git a/include/asm-x86/system.h b/include/asm-x86/system.h
index 34505dd7b24d..b20c894660f9 100644
--- a/include/asm-x86/system.h
+++ b/include/asm-x86/system.h
@@ -64,7 +64,10 @@ do {									\
                                                                        \
                       /* regparm parameters for __switch_to(): */      \
                       [prev]     "a" (prev),                           \
-                       [next]     "d" (next));                          \
+                       [next]     "d" (next)                            \
+                                                                        \
+                     : /* reloaded segment registers */                 \
+                        "memory");                                      \
 } while (0)
 /*
diff --git a/include/asm-x86/traps.h b/include/asm-x86/traps.h
index 7a692baa51ae..6c3dc2c65751 100644
--- a/include/asm-x86/traps.h
+++ b/include/asm-x86/traps.h
@@ -3,7 +3,12 @@
 #include <asm/debugreg.h>
-/* Common in X86_32 and X86_64 */
+#ifdef CONFIG_X86_32
+#define dotraplinkage
+#else
+#define dotraplinkage asmlinkage
+#endif
 asmlinkage void divide_error(void);
 asmlinkage void debug(void);
 asmlinkage void nmi(void);
@@ -12,31 +17,47 @@ asmlinkage void overflow(void);
 asmlinkage void bounds(void);
 asmlinkage void invalid_op(void);
 asmlinkage void device_not_available(void);
+#ifdef CONFIG_X86_64
+asmlinkage void double_fault(void);
+#endif
 asmlinkage void coprocessor_segment_overrun(void);
 asmlinkage void invalid_TSS(void);
 asmlinkage void segment_not_present(void);
 asmlinkage void stack_segment(void);
 asmlinkage void general_protection(void);
 asmlinkage void page_fault(void);
+asmlinkage void spurious_interrupt_bug(void);
 asmlinkage void coprocessor_error(void);
-asmlinkage void simd_coprocessor_error(void);
 asmlinkage void alignment_check(void);
-asmlinkage void spurious_interrupt_bug(void);
 #ifdef CONFIG_X86_MCE
 asmlinkage void machine_check(void);
 #endif /* CONFIG_X86_MCE */
+asmlinkage void simd_coprocessor_error(void);
-void do_divide_error(struct pt_regs *, long);
+dotraplinkage void do_divide_error(struct pt_regs *, long);
-void do_overflow(struct pt_regs *, long);
+dotraplinkage void do_debug(struct pt_regs *, long);
-void do_bounds(struct pt_regs *, long);
+dotraplinkage void do_nmi(struct pt_regs *, long);
-void do_coprocessor_segment_overrun(struct pt_regs *, long);
+dotraplinkage void do_int3(struct pt_regs *, long);
-void do_invalid_TSS(struct pt_regs *, long);
+dotraplinkage void do_overflow(struct pt_regs *, long);
-void do_segment_not_present(struct pt_regs *, long);
+dotraplinkage void do_bounds(struct pt_regs *, long);
-void do_stack_segment(struct pt_regs *, long);
+dotraplinkage void do_invalid_op(struct pt_regs *, long);
-void do_alignment_check(struct pt_regs *, long);
+dotraplinkage void do_device_not_available(struct pt_regs *, long);
-void do_invalid_op(struct pt_regs *, long);
+dotraplinkage void do_coprocessor_segment_overrun(struct pt_regs *, long);
-void do_general_protection(struct pt_regs *, long);
+dotraplinkage void do_invalid_TSS(struct pt_regs *, long);
-void do_nmi(struct pt_regs *, long);
+dotraplinkage void do_segment_not_present(struct pt_regs *, long);
+dotraplinkage void do_stack_segment(struct pt_regs *, long);
+dotraplinkage void do_general_protection(struct pt_regs *, long);
+dotraplinkage void do_page_fault(struct pt_regs *, unsigned long);
+dotraplinkage void do_spurious_interrupt_bug(struct pt_regs *, long);
+dotraplinkage void do_coprocessor_error(struct pt_regs *, long);
+dotraplinkage void do_alignment_check(struct pt_regs *, long);
+#ifdef CONFIG_X86_MCE
+dotraplinkage void do_machine_check(struct pt_regs *, long);
+#endif
+dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);
+#ifdef CONFIG_X86_32
+dotraplinkage void do_iret_error(struct pt_regs *, long);
+#endif
 static inline int get_si_code(unsigned long condition)
 {
@@ -52,31 +73,9 @@ extern int panic_on_unrecovered_nmi;
 extern int kstack_depth_to_print;
 #ifdef CONFIG_X86_32
-void do_iret_error(struct pt_regs *, long);
-void do_int3(struct pt_regs *, long);
-void do_debug(struct pt_regs *, long);
 void math_error(void __user *);
-void do_coprocessor_error(struct pt_regs *, long);
-void do_simd_coprocessor_error(struct pt_regs *, long);
-void do_spurious_interrupt_bug(struct pt_regs *, long);
 unsigned long patch_espfix_desc(unsigned long, unsigned long);
 asmlinkage void math_emulate(long);
+#endif
-void do_page_fault(struct pt_regs *regs, unsigned long error_code);
-#else /* CONFIG_X86_32 */
-asmlinkage void double_fault(void);
-asmlinkage void do_int3(struct pt_regs *, long);
-asmlinkage void do_stack_segment(struct pt_regs *, long);
-asmlinkage void do_debug(struct pt_regs *, unsigned long);
-asmlinkage void do_coprocessor_error(struct pt_regs *);
-asmlinkage void do_simd_coprocessor_error(struct pt_regs *);
-asmlinkage void do_spurious_interrupt_bug(struct pt_regs *);
-asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code);
-#endif /* CONFIG_X86_32 */
 #endif /* ASM_X86__TRAPS_H */
diff --git a/include/asm-xtensa/a.out.h b/include/asm-xtensa/a.out.h
deleted file mode 100644
index fdf13702924a..000000000000
--- a/include/asm-xtensa/a.out.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * include/asm-xtensa/a.out.h
- *
- * Dummy a.out file. Xtensa does not support the a.out format, but the kernel
- * seems to depend on it.
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2001 - 2005 Tensilica Inc.
- */
-#ifndef _XTENSA_A_OUT_H
-#define _XTENSA_A_OUT_H
-struct exec
-{
-  unsigned long a_info;
-  unsigned a_text;
-  unsigned a_data;
-  unsigned a_bss;
-  unsigned a_syms;
-  unsigned a_entry;
-  unsigned a_trsize;
-  unsigned a_drsize;
-};
-#endif /* _XTENSA_A_OUT_H */
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 154769cad3f3..5ce0e5fd712e 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -17,20 +17,31 @@
 #ifdef CONFIG_UNIX98_PTYS
-int devpts_new_index(void);
+int devpts_new_index(struct inode *ptmx_inode);
-void devpts_kill_index(int idx);
+void devpts_kill_index(struct inode *ptmx_inode, int idx);
-int devpts_pty_new(struct tty_struct *tty);      /* mknod in devpts */
+/* mknod in devpts */
-struct tty_struct *devpts_get_tty(int number);   /* get tty structure */
+int devpts_pty_new(struct inode *ptmx_inode, struct tty_struct *tty);
-void devpts_pty_kill(int number);                /* unlink */
+/* get tty structure */
+struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number);
+/* unlink */
+void devpts_pty_kill(struct tty_struct *tty);
 #else
 /* Dummy stubs in the no-pty case */
-static inline int devpts_new_index(void) { return -EINVAL; }
+static inline int devpts_new_index(struct inode *ptmx_inode) { return -EINVAL; }
-static inline void devpts_kill_index(int idx) { }
+static inline void devpts_kill_index(struct inode *ptmx_inode, int idx) { }
-static inline int devpts_pty_new(struct tty_struct *tty) { return -EINVAL; }
+static inline int devpts_pty_new(struct inode *ptmx_inode,
-static inline struct tty_struct *devpts_get_tty(int number) { return NULL; }
+                                struct tty_struct *tty)
-static inline void devpts_pty_kill(int number) { }
+{
+        return -EINVAL;
+}
+static inline struct tty_struct *devpts_get_tty(struct inode *pts_inode,
+                int number)
+{
+        return NULL;
+}
+static inline void devpts_pty_kill(struct tty_struct *tty) { }
 #endif
diff --git a/include/linux/dmi.h b/include/linux/dmi.h
index 2a063b64133f..e5084eb5943a 100644
--- a/include/linux/dmi.h
+++ b/include/linux/dmi.h
@@ -2,29 +2,9 @@
 #define __DMI_H__
 #include <linux/list.h>
+#include <linux/mod_devicetable.h>
-enum dmi_field {
+/* enum dmi_field is in mod_devicetable.h */
-        DMI_NONE,
-        DMI_BIOS_VENDOR,
-        DMI_BIOS_VERSION,
-        DMI_BIOS_DATE,
-        DMI_SYS_VENDOR,
-        DMI_PRODUCT_NAME,
-        DMI_PRODUCT_VERSION,
-        DMI_PRODUCT_SERIAL,
-        DMI_PRODUCT_UUID,
-        DMI_BOARD_VENDOR,
-        DMI_BOARD_NAME,
-        DMI_BOARD_VERSION,
-        DMI_BOARD_SERIAL,
-        DMI_BOARD_ASSET_TAG,
-        DMI_CHASSIS_VENDOR,
-        DMI_CHASSIS_TYPE,
-        DMI_CHASSIS_VERSION,
-        DMI_CHASSIS_SERIAL,
-        DMI_CHASSIS_ASSET_TAG,
-        DMI_STRING_MAX,
-};
 enum dmi_device_type {
        DMI_DEV_TYPE_ANY = 0,
@@ -48,23 +28,6 @@ struct dmi_header {
        u16 handle;
 };
-/*
- *      DMI callbacks for problem boards
- */
-struct dmi_strmatch {
-        u8 slot;
-        char *substr;
-};
-struct dmi_system_id {
-        int (*callback)(const struct dmi_system_id *);
-        const char *ident;
-        struct dmi_strmatch matches[4];
-        void *driver_data;
-};
-#define DMI_MATCH(a, b) { a, b }
 struct dmi_device {
        struct list_head list;
        int type;
diff --git a/include/linux/hpet.h b/include/linux/hpet.h
index 2dc29ce6c8e4..79f63a27bcef 100644
--- a/include/linux/hpet.h
+++ b/include/linux/hpet.h
@@ -37,6 +37,7 @@ struct hpet {
 #define hpet_compare    _u1._hpet_compare
 #define HPET_MAX_TIMERS (32)
+#define HPET_MAX_IRQ    (32)
 /*
 * HPET general capabilities register
@@ -64,7 +65,7 @@ struct hpet {
 */
 #define Tn_INT_ROUTE_CAP_MASK           (0xffffffff00000000ULL)
-#define Tn_INI_ROUTE_CAP_SHIFT          (32UL)
+#define Tn_INT_ROUTE_CAP_SHIFT          (32UL)
 #define Tn_FSB_INT_DELCAP_MASK          (0x8000UL)
 #define Tn_FSB_INT_DELCAP_SHIFT         (15)
 #define Tn_FSB_EN_CNF_MASK              (0x4000UL)
@@ -91,23 +92,14 @@ struct hpet {
 * exported interfaces
 */
-struct hpet_task {
-        void (*ht_func) (void *);
-        void *ht_data;
-        void *ht_opaque;
-};
 struct hpet_data {
        unsigned long hd_phys_address;
        void __iomem *hd_address;
        unsigned short hd_nirqs;
-        unsigned short hd_flags;
        unsigned int hd_state;  /* timer allocated */
        unsigned int hd_irq[HPET_MAX_TIMERS];
 };
-#define HPET_DATA_PLATFORM      0x0001  /* platform call to hpet_alloc */
 static inline void hpet_reserve_timer(struct hpet_data *hd, int timer)
 {
        hd->hd_state |= (1 << timer);
@@ -125,7 +117,7 @@ struct hpet_info {
        unsigned short hi_timer;
 };
-#define HPET_INFO_PERIODIC      0x0001  /* timer is periodic */
+#define HPET_INFO_PERIODIC      0x0010  /* periodic-capable comparator */
 #define HPET_IE_ON      _IO('h', 0x01)  /* interrupt on */
 #define HPET_IE_OFF     _IO('h', 0x02)  /* interrupt off */
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 66c3499478b5..d2e91ea998fd 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -967,6 +967,9 @@ struct journal_s
 #define JBD2_FLUSHED    0x008   /* The journal superblock has been flushed */
 #define JBD2_LOADED     0x010   /* The journal superblock has been loaded */
 #define JBD2_BARRIER    0x020   /* Use IDE barriers */
+#define JBD2_ABORT_ON_SYNCDATA_ERR      0x040   /* Abort the journal on file
+                                                 * data write error in ordered
+                                                 * mode */
 /*
 * Function declarations for the journaling transaction and buffer
@@ -1060,7 +1063,7 @@ extern void	   jbd2_journal_clear_features
                   (journal_t *, unsigned long, unsigned long, unsigned long);
 extern int         jbd2_journal_create     (journal_t *);
 extern int         jbd2_journal_load       (journal_t *journal);
-extern void        jbd2_journal_destroy    (journal_t *);
+extern int         jbd2_journal_destroy    (journal_t *);
 extern int         jbd2_journal_recover    (journal_t *journal);
 extern int         jbd2_journal_wipe       (journal_t *, int);
 extern int         jbd2_journal_skip_recovery   (journal_t *);
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index c4db5827963d..3481a7d5bc0a 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -388,5 +388,52 @@ struct i2c_device_id {
                        __attribute__((aligned(sizeof(kernel_ulong_t))));
 };
+/* dmi */
+enum dmi_field {
+        DMI_NONE,
+        DMI_BIOS_VENDOR,
+        DMI_BIOS_VERSION,
+        DMI_BIOS_DATE,
+        DMI_SYS_VENDOR,
+        DMI_PRODUCT_NAME,
+        DMI_PRODUCT_VERSION,
+        DMI_PRODUCT_SERIAL,
+        DMI_PRODUCT_UUID,
+        DMI_BOARD_VENDOR,
+        DMI_BOARD_NAME,
+        DMI_BOARD_VERSION,
+        DMI_BOARD_SERIAL,
+        DMI_BOARD_ASSET_TAG,
+        DMI_CHASSIS_VENDOR,
+        DMI_CHASSIS_TYPE,
+        DMI_CHASSIS_VERSION,
+        DMI_CHASSIS_SERIAL,
+        DMI_CHASSIS_ASSET_TAG,
+        DMI_STRING_MAX,
+};
+struct dmi_strmatch {
+        unsigned char slot;
+        char substr[79];
+};
+#ifndef __KERNEL__
+struct dmi_system_id {
+        kernel_ulong_t callback;
+        kernel_ulong_t ident;
+        struct dmi_strmatch matches[4];
+        kernel_ulong_t driver_data
+                        __attribute__((aligned(sizeof(kernel_ulong_t))));
+};
+#else
+struct dmi_system_id {
+        int (*callback)(const struct dmi_system_id *);
+        const char *ident;
+        struct dmi_strmatch matches[4];
+        void *driver_data;
+};
+#endif
+#define DMI_MATCH(a, b) { a, b }
 #endif /* LINUX_MOD_DEVICETABLE_H */
diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
index 041bb31100f4..bcb8f725427c 100644
--- a/include/linux/oprofile.h
+++ b/include/linux/oprofile.h
@@ -36,6 +36,8 @@
 #define XEN_ENTER_SWITCH_CODE           10
 #define SPU_PROFILING_CODE              11
 #define SPU_CTX_SWITCH_CODE             12
+#define IBS_FETCH_CODE                  13
+#define IBS_OP_CODE                     14
 struct super_block;
 struct dentry;
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f63b5455801c..1176f1f177e2 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1533,7 +1533,9 @@
 #define PCI_DEVICE_ID_MARVELL_GT64260   0x6430
 #define PCI_DEVICE_ID_MARVELL_MV64360   0x6460
 #define PCI_DEVICE_ID_MARVELL_MV64460   0x6480
-#define PCI_DEVICE_ID_MARVELL_CAFE_SD   0x4101
+#define PCI_DEVICE_ID_MARVELL_88ALP01_NAND      0x4100
+#define PCI_DEVICE_ID_MARVELL_88ALP01_SD        0x4101
+#define PCI_DEVICE_ID_MARVELL_88ALP01_CCIC      0x4102
 #define PCI_VENDOR_ID_V3                0x11b0
 #define PCI_DEVICE_ID_V3_V960           0x0001
diff --git a/include/linux/serial.h b/include/linux/serial.h
index deb714314fb1..1ea8d9265bf6 100644
--- a/include/linux/serial.h
+++ b/include/linux/serial.h
@@ -173,6 +173,22 @@ struct serial_icounter_struct {
        int reserved[9];
 };
+/*
+ * Serial interface for controlling RS485 settings on chips with suitable
+ * support. Set with TIOCSRS485 and get with TIOCGRS485 if supported by your
+ * platform. The set function returns the new state, with any unsupported bits
+ * reverted appropriately.
+ */
+struct serial_rs485 {
+        __u32   flags;                  /* RS485 feature flags */
+#define SER_RS485_ENABLED               (1 << 0)
+#define SER_RS485_RTS_ON_SEND           (1 << 1)
+#define SER_RS485_RTS_AFTER_SEND        (1 << 2)
+        __u32   delay_rts_before_send;  /* Milliseconds */
+        __u32   padding[6];             /* Memory is cheap, new structs
+                                           are a royal PITA .. */
+};
 #ifdef __KERNEL__
 #include <linux/compiler.h>
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index 3b2f6c04855e..e27f216361fc 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -241,7 +241,7 @@ typedef unsigned int __bitwise__ upf_t;
 struct uart_port {
        spinlock_t              lock;                   /* port lock */
-        unsigned int            iobase;                 /* in/out[bwl] */
+        unsigned long           iobase;                 /* in/out[bwl] */
        unsigned char __iomem   *membase;               /* read/write[bwl] */
        unsigned int            irq;                    /* irq number */
        unsigned int            uartclk;                /* base uart clock */
diff --git a/include/linux/termios.h b/include/linux/termios.h
index 478662889f48..2acd0c1f8a2a 100644
--- a/include/linux/termios.h
+++ b/include/linux/termios.h
@@ -4,4 +4,19 @@
 #include <linux/types.h>
 #include <asm/termios.h>
+#define NFF     5
+struct termiox
+{
+        __u16   x_hflag;
+        __u16   x_cflag;
+        __u16   x_rflag[NFF];
+        __u16   x_sflag;
+};
+#define RTSXOFF         0x0001          /* RTS flow control on input */
+#define CTSXON          0x0002          /* CTS flow control on output */
+#define DTRXOFF         0x0004          /* DTR flow control on input */
+#define DSRXON          0x0008          /* DCD flow control on output */
 #endif
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 0cbec74ec086..3b8121d4e36f 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -23,7 +23,7 @@
 */
 #define NR_UNIX98_PTY_DEFAULT   4096      /* Default maximum for Unix98 ptys */
 #define NR_UNIX98_PTY_MAX       (1 << MINORBITS) /* Absolute limit */
-#define NR_LDISCS               18
+#define NR_LDISCS               19
 /* line disciplines */
 #define N_TTY           0
@@ -45,6 +45,7 @@
 #define N_HCI           15      /* Bluetooth HCI UART */
 #define N_GIGASET_M101  16      /* Siemens Gigaset M101 serial DECT adapter */
 #define N_SLCAN         17      /* Serial / USB serial CAN Adaptors */
+#define N_PPS           18      /* Pulse per Second */
 /*
 * This character is the same as _POSIX_VDISABLE: it cannot be used as
@@ -181,6 +182,7 @@ struct signal_struct;
 struct tty_port {
        struct tty_struct       *tty;           /* Back pointer */
+        spinlock_t              lock;           /* Lock protecting tty field */
        int                     blocked_open;   /* Waiting to open */
        int                     count;          /* Usage count */
        wait_queue_head_t       open_wait;      /* Open waiters */
@@ -208,6 +210,7 @@ struct tty_operations;
 struct tty_struct {
        int     magic;
+        struct kref kref;
        struct tty_driver *driver;
        const struct tty_operations *ops;
        int index;
@@ -217,6 +220,7 @@ struct tty_struct {
        spinlock_t ctrl_lock;
        /* Termios values are protected by the termios mutex */
        struct ktermios *termios, *termios_locked;
+        struct termiox *termiox;        /* May be NULL for unsupported */
        char name[64];
        struct pid *pgrp;               /* Protected by ctrl lock */
        struct pid *session;
@@ -310,6 +314,25 @@ extern int kmsg_redirect;
 extern void console_init(void);
 extern int vcs_init(void);
+extern struct class *tty_class;
+/**
+ *      tty_kref_get            -       get a tty reference
+ *      @tty: tty device
+ *
+ *      Return a new reference to a tty object. The caller must hold
+ *      sufficient locks/counts to ensure that their existing reference cannot
+ *      go away
+ */
+extern inline struct tty_struct *tty_kref_get(struct tty_struct *tty)
+{
+        if (tty)
+                kref_get(&tty->kref);
+        return tty;
+}
+extern void tty_kref_put(struct tty_struct *tty);
 extern int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
                              const char *routine);
 extern char *tty_name(struct tty_struct *tty, char *buf);
@@ -333,13 +356,15 @@ extern void tty_throttle(struct tty_struct *tty);
 extern void tty_unthrottle(struct tty_struct *tty);
 extern int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
                                                struct winsize *ws);
+extern void tty_shutdown(struct tty_struct *tty);
+extern void tty_free_termios(struct tty_struct *tty);
 extern int is_current_pgrp_orphaned(void);
 extern struct pid *tty_get_pgrp(struct tty_struct *tty);
 extern int is_ignored(int sig);
 extern int tty_signal(int sig, struct tty_struct *tty);
 extern void tty_hangup(struct tty_struct *tty);
 extern void tty_vhangup(struct tty_struct *tty);
+extern void tty_vhangup_self(void);
 extern void tty_unhangup(struct file *filp);
 extern int tty_hung_up_p(struct file *filp);
 extern void do_SAK(struct tty_struct *tty);
@@ -347,6 +372,9 @@ extern void __do_SAK(struct tty_struct *tty);
 extern void disassociate_ctty(int priv);
 extern void no_tty(void);
 extern void tty_flip_buffer_push(struct tty_struct *tty);
+extern void tty_buffer_free_all(struct tty_struct *tty);
+extern void tty_buffer_flush(struct tty_struct *tty);
+extern void tty_buffer_init(struct tty_struct *tty);
 extern speed_t tty_get_baud_rate(struct tty_struct *tty);
 extern speed_t tty_termios_baud_rate(struct ktermios *termios);
 extern speed_t tty_termios_input_baud_rate(struct ktermios *termios);
@@ -372,6 +400,15 @@ extern int tty_perform_flush(struct tty_struct *tty, unsigned long arg);
 extern dev_t tty_devnum(struct tty_struct *tty);
 extern void proc_clear_tty(struct task_struct *p);
 extern struct tty_struct *get_current_tty(void);
+extern void tty_default_fops(struct file_operations *fops);
+extern struct tty_struct *alloc_tty_struct(void);
+extern void free_tty_struct(struct tty_struct *tty);
+extern void initialize_tty_struct(struct tty_struct *tty,
+                struct tty_driver *driver, int idx);
+extern struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
+                                                                int first_ok);
+extern void tty_release_dev(struct file *filp);
+extern int tty_init_termios(struct tty_struct *tty);
 extern struct mutex tty_mutex;
@@ -382,6 +419,8 @@ extern int tty_write_lock(struct tty_struct *tty, int ndelay);
 extern void tty_port_init(struct tty_port *port);
 extern int tty_port_alloc_xmit_buf(struct tty_port *port);
 extern void tty_port_free_xmit_buf(struct tty_port *port);
+extern struct tty_struct *tty_port_tty_get(struct tty_port *port);
+extern void tty_port_tty_set(struct tty_port *port, struct tty_struct *tty);
 extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc);
 extern int tty_unregister_ldisc(int disc);
@@ -427,7 +466,7 @@ static inline void tty_audit_push_task(struct task_struct *tsk,
 #endif
 /* tty_ioctl.c */
-extern int n_tty_ioctl(struct tty_struct *tty, struct file *file,
+extern int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                       unsigned int cmd, unsigned long arg);
 /* serial.c */
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 16d27944c321..78416b901589 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -7,6 +7,28 @@
 * defined; unless noted otherwise, they are optional, and can be
 * filled in with a null pointer.
 *
+ * struct tty_struct * (*lookup)(struct tty_driver *self, int idx)
+ *
+ *      Return the tty device corresponding to idx, NULL if there is not
+ *      one currently in use and an ERR_PTR value on error. Called under
+ *      tty_mutex (for now!)
+ *
+ *      Optional method. Default behaviour is to use the ttys array
+ *
+ * int (*install)(struct tty_driver *self, struct tty_struct *tty)
+ *
+ *      Install a new tty into the tty driver internal tables. Used in
+ *      conjunction with lookup and remove methods.
+ *
+ *      Optional method. Default behaviour is to use the ttys array
+ *
+ * void (*remove)(struct tty_driver *self, struct tty_struct *tty)
+ *
+ *      Remove a closed tty from the tty driver internal tables. Used in
+ *      conjunction with lookup and remove methods.
+ *
+ *      Optional method. Default behaviour is to use the ttys array
+ *
 * int  (*open)(struct tty_struct * tty, struct file * filp);
 *
 *      This routine is called when a particular tty device is opened.
@@ -21,6 +43,11 @@
 *
 *      Required method.
 *
+ * void (*shutdown)(struct tty_struct * tty);
+ *
+ *      This routine is called when a particular tty device is closed for
+ *      the last time freeing up the resources.
+ *
 * int (*write)(struct tty_struct * tty,
 *               const unsigned char *buf, int count);
 *
@@ -180,6 +207,14 @@
 *      not force errors here if they are not resizable objects (eg a serial
 *      line). See tty_do_resize() if you need to wrap the standard method
 *      in your own logic - the usual case.
+ *
+ * void (*set_termiox)(struct tty_struct *tty, struct termiox *new);
+ *
+ *      Called when the device receives a termiox based ioctl. Passes down
+ *      the requested data from user space. This method will not be invoked
+ *      unless the tty also has a valid tty->termiox pointer.
+ *
+ *      Optional: Called under the termios lock
 */
 #include <linux/fs.h>
@@ -190,8 +225,13 @@ struct tty_struct;
 struct tty_driver;
 struct tty_operations {
+        struct tty_struct * (*lookup)(struct tty_driver *driver,
+                        struct inode *inode, int idx);
+        int  (*install)(struct tty_driver *driver, struct tty_struct *tty);
+        void (*remove)(struct tty_driver *driver, struct tty_struct *tty);
        int  (*open)(struct tty_struct * tty, struct file * filp);
        void (*close)(struct tty_struct * tty, struct file * filp);
+        void (*shutdown)(struct tty_struct *tty);
        int  (*write)(struct tty_struct * tty,
                      const unsigned char *buf, int count);
        int  (*put_char)(struct tty_struct *tty, unsigned char ch);
@@ -220,6 +260,7 @@ struct tty_operations {
                        unsigned int set, unsigned int clear);
        int (*resize)(struct tty_struct *tty, struct tty_struct *real_tty,
                                struct winsize *ws);
+        int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
 #ifdef CONFIG_CONSOLE_POLL
        int (*poll_init)(struct tty_driver *driver, int line, char *options);
        int (*poll_get_char)(struct tty_driver *driver, int line);
@@ -229,6 +270,7 @@ struct tty_operations {
 struct tty_driver {
        int     magic;          /* magic number for this structure */
+        struct kref kref;       /* Reference management */
        struct cdev cdev;
        struct module   *owner;
        const char      *driver_name;
@@ -242,7 +284,6 @@ struct tty_driver {
        short   subtype;        /* subtype of tty driver */
        struct ktermios init_termios; /* Initial termios */
        int     flags;          /* tty driver flags */
-        int     refcount;       /* for loadable tty drivers */
        struct proc_dir_entry *proc_entry; /* /proc fs entry */
        struct tty_driver *other; /* only used for the PTY driver */
@@ -264,12 +305,19 @@ struct tty_driver {
 extern struct list_head tty_drivers;
-struct tty_driver *alloc_tty_driver(int lines);
+extern struct tty_driver *alloc_tty_driver(int lines);
-void put_tty_driver(struct tty_driver *driver);
+extern void put_tty_driver(struct tty_driver *driver);
-void tty_set_operations(struct tty_driver *driver,
+extern void tty_set_operations(struct tty_driver *driver,
                        const struct tty_operations *op);
 extern struct tty_driver *tty_find_polling_driver(char *name, int *line);
+extern void tty_driver_kref_put(struct tty_driver *driver);
+extern inline struct tty_driver *tty_driver_kref_get(struct tty_driver *d)
+{
+        kref_get(&d->kref);
+        return d;
+}
 /* tty driver magic number */
 #define TTY_DRIVER_MAGIC                0x5402
diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
index 1cbd0a7db4e6..2f1113467f70 100644
--- a/include/linux/vt_kern.h
+++ b/include/linux/vt_kern.h
@@ -96,7 +96,7 @@ void change_console(struct vc_data *new_vc);
 void reset_vc(struct vc_data *vc);
 extern int unbind_con_driver(const struct consw *csw, int first, int last,
                             int deflt);
-int vty_init(void);
+int vty_init(const struct file_operations *console_fops);
 /*
 * vc_screen.c shares this temporary buffer with the console write code so that
diff --git a/kernel/acct.c b/kernel/acct.c
index dd68b9059418..f6006a60df5d 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -548,7 +548,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
 #endif
        spin_lock_irq(&current->sighand->siglock);
-        tty = current->signal->tty;
+        tty = current->signal->tty;     /* Safe as we hold the siglock */
        ac.ac_tty = tty ? old_encode_dev(tty_devnum(tty)) : 0;
        ac.ac_utime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_utime)));
        ac.ac_stime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_stime)));
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 59cedfb040e7..cf5bc2f5f9c3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -246,8 +246,8 @@ static int audit_match_perm(struct audit_context *ctx, int mask)
        unsigned n;
        if (unlikely(!ctx))
                return 0;
        n = ctx->major;
        switch (audit_classify_syscall(ctx->arch, n)) {
        case 0: /* native */
                if ((mask & AUDIT_PERM_WRITE) &&
@@ -1204,13 +1204,13 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                                 (context->return_valid==AUDITSC_SUCCESS)?"yes":"no",
                                 context->return_code);
-        mutex_lock(&tty_mutex);
+        spin_lock_irq(&tsk->sighand->siglock);
-        read_lock(&tasklist_lock);
        if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name)
                tty = tsk->signal->tty->name;
        else
                tty = "(none)";
-        read_unlock(&tasklist_lock);
+        spin_unlock_irq(&tsk->sighand->siglock);
        audit_log_format(ab,
                  " a0=%lx a1=%lx a2=%lx a3=%lx items=%d"
                  " ppid=%d pid=%d auid=%u uid=%u gid=%u"
@@ -1230,7 +1230,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                  context->egid, context->sgid, context->fsgid, tty,
                  tsk->sessionid);
-        mutex_unlock(&tty_mutex);
        audit_log_task_info(ab, tsk);
        if (context->filterkey) {
diff --git a/kernel/fork.c b/kernel/fork.c
index 7ce2ebe84796..30de644a40c4 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -802,6 +802,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
        sig->leader = 0;        /* session leadership doesn't inherit */
        sig->tty_old_pgrp = NULL;
+        sig->tty = NULL;
        sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
        sig->gtime = cputime_zero;
@@ -838,6 +839,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
 void __cleanup_signal(struct signal_struct *sig)
 {
        exit_thread_group_keys(sig);
+        tty_kref_put(sig->tty);
        kmem_cache_free(signal_cachep, sig);
 }
@@ -1227,7 +1229,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                                p->nsproxy->pid_ns->child_reaper = p;
                        p->signal->leader_pid = pid;
-                        p->signal->tty = current->signal->tty;
+                        tty_kref_put(p->signal->tty);
+                        p->signal->tty = tty_kref_get(current->signal->tty);
                        set_task_pgrp(p, task_pgrp_nr(current));
                        set_task_session(p, task_session_nr(current));
                        attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
diff --git a/kernel/printk.c b/kernel/printk.c
index b51b1567bb55..a430fd04008b 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1291,22 +1291,6 @@ static int __init disable_boot_consoles(void)
 }
 late_initcall(disable_boot_consoles);
-/**
- * tty_write_message - write a message to a certain tty, not just the console.
- * @tty: the destination tty_struct
- * @msg: the message to write
- *
- * This is used for messages that need to be redirected to a specific tty.
- * We don't put it into the syslog queue right now maybe in the future if
- * really needed.
- */
-void tty_write_message(struct tty_struct *tty, char *msg)
-{
-        if (tty && tty->ops->write)
-                tty->ops->write(tty, msg, strlen(msg));
-        return;
-}
 #if defined CONFIG_PRINTK
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index 038a7bc0901d..234d9454294e 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1060,9 +1060,7 @@ asmlinkage long sys_setsid(void)
        group_leader->signal->leader = 1;
        __set_special_pids(sid);
-        spin_lock(&group_leader->sighand->siglock);
+        proc_clear_tty(group_leader);
-        group_leader->signal->tty = NULL;
-        spin_unlock(&group_leader->sighand->siglock);
        err = session;
 out:
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 4c9890ec2528..473f94e56ead 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -629,6 +629,59 @@ static int do_i2c_entry(const char *filename, struct i2c_device_id *id,
        return 1;
 }
+static const struct dmifield {
+        const char *prefix;
+        int field;
+} dmi_fields[] = {
+        { "bvn", DMI_BIOS_VENDOR },
+        { "bvr", DMI_BIOS_VERSION },
+        { "bd",  DMI_BIOS_DATE },
+        { "svn", DMI_SYS_VENDOR },
+        { "pn",  DMI_PRODUCT_NAME },
+        { "pvr", DMI_PRODUCT_VERSION },
+        { "rvn", DMI_BOARD_VENDOR },
+        { "rn",  DMI_BOARD_NAME },
+        { "rvr", DMI_BOARD_VERSION },
+        { "cvn", DMI_CHASSIS_VENDOR },
+        { "ct",  DMI_CHASSIS_TYPE },
+        { "cvr", DMI_CHASSIS_VERSION },
+        { NULL,  DMI_NONE }
+};
+static void dmi_ascii_filter(char *d, const char *s)
+{
+        /* Filter out characters we don't want to see in the modalias string */
+        for (; *s; s++)
+                if (*s > ' ' && *s < 127 && *s != ':')
+                        *(d++) = *s;
+        *d = 0;
+}
+static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
+                        char *alias)
+{
+        int i, j;
+        sprintf(alias, "dmi*");
+        for (i = 0; i < ARRAY_SIZE(dmi_fields); i++) {
+                for (j = 0; j < 4; j++) {
+                        if (id->matches[j].slot &&
+                            id->matches[j].slot == dmi_fields[i].field) {
+                                sprintf(alias + strlen(alias), ":%s*",
+                                        dmi_fields[i].prefix);
+                                dmi_ascii_filter(alias + strlen(alias),
+                                                 id->matches[j].substr);
+                                strcat(alias, "*");
+                        }
+                }
+        }
+        strcat(alias, ":");
+        return 1;
+}
 /* Ignore any prefix, eg. some architectures prepend _ */
 static inline int sym_is(const char *symbol, const char *name)
 {
@@ -760,6 +813,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
                do_table(symval, sym->st_size,
                         sizeof(struct i2c_device_id), "i2c",
                         do_i2c_entry, mod);
+        else if (sym_is(symname, "__mod_dmi_device_table"))
+                do_table(symval, sym->st_size,
+                         sizeof(struct dmi_system_id), "dmi",
+                         do_dmi_entry, mod);
        free(zeros);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c679ba653e1d..88f19536efad 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2122,7 +2122,6 @@ static inline void flush_unauthorized_files(struct files_struct *files)
        long j = -1;
        int drop_tty = 0;
-        mutex_lock(&tty_mutex);
        tty = get_current_tty();
        if (tty) {
                file_list_lock();
@@ -2140,8 +2139,8 @@ static inline void flush_unauthorized_files(struct files_struct *files)
                        }
                }
                file_list_unlock();
+                tty_kref_put(tty);
        }
-        mutex_unlock(&tty_mutex);
        /* Reset controlling tty. */
        if (drop_tty)
                no_tty();