35 files changed, 212 insertions, 257 deletions

diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index f4bb43fb8016..e077701ae3d9 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -225,7 +225,7 @@ static const struct agp_bridge_driver parisc_agp_driver = {
         .configure              = parisc_agp_configure,
         .fetch_size             = parisc_agp_fetch_size,
         .tlb_flush              = parisc_agp_tlbflush,
-        .mask_memory            = parisc_agp_mask_memory,
+        .mask_memory            = parisc_agp_page_mask_memory,
         .masks                  = parisc_agp_masks,
         .agp_enable             = parisc_agp_enable,
         .cache_flush            = global_cache_flush,
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 72429b6b2fa8..6c32fbf07164 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -81,6 +81,7 @@ static char *serial_version = "4.30";
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
 
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index f3366d3f06cf..2dafc2da0648 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -633,6 +633,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/major.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index abef1f7d84fe..ff647ca1c489 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -36,6 +36,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 94e7e3c8c05a..d97779ef72cb 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -552,7 +552,7 @@ static int hvc_chars_in_buffer(struct tty_struct *tty)
         struct hvc_struct *hp = tty->driver_data;
 
         if (!hp)
-                return -1;
+                return 0;
         return hp->n_outbuf;
 }
 
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 5dcbe603eca2..91b53eb1c053 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -305,10 +305,11 @@ static int __init intel_init_hw_struct(struct intel_rng_hw *intel_rng_hw,
              (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK))
             == BIOS_CNTL_LOCK_ENABLE_MASK) {
                 static __initdata /*const*/ char warning[] =
-                        KERN_WARNING PFX "Firmware space is locked read-only. If you can't or\n"
-                        KERN_WARNING PFX "don't want to disable this in firmware setup, and if\n"
-                        KERN_WARNING PFX "you are certain that your system has a functional\n"
-                        KERN_WARNING PFX "RNG, try using the 'no_fwh_detect' option.\n";
+                        KERN_WARNING
+PFX "Firmware space is locked read-only. If you can't or\n"
+PFX "don't want to disable this in firmware setup, and if\n"
+PFX "you are certain that your system has a functional\n"
+PFX "RNG, try using the 'no_fwh_detect' option.\n";
 
                 if (no_fwh_detect)
                         return -ENODEV;
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 4159292e35cf..4f1f4cd670da 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -122,6 +122,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
@@ -1478,10 +1479,10 @@ static int __devinit load_firmware(struct pci_dev *pdev,
                 status = inw(base + 0x4);
                 if (status != 0) {
                         dev_warn(&pdev->dev, "Card%d rejected load header:\n"
-                                KERN_WARNING "Address:0x%x\n"
-                                KERN_WARNING "Count:0x%x\n"
-                                KERN_WARNING "Status:0x%x\n",
-                                index + 1, frame->addr, frame->count, status);
+                                 "Address:0x%x\n"
+                                 "Count:0x%x\n"
+                                 "Status:0x%x\n",
+                                 index + 1, frame->addr, frame->count, status);
                         goto errrelfw;
                 }
                 outsw(base, frame->data, word_count);
@@ -1526,10 +1527,10 @@ static int __devinit load_firmware(struct pci_dev *pdev,
                 status = inw(base + 0x4);
                 if (status != 0) {
                         dev_warn(&pdev->dev, "Card%d rejected verify header:\n"
-                                KERN_WARNING "Address:0x%x\n"
-                                KERN_WARNING "Count:0x%x\n"
-                                KERN_WARNING "Status: 0x%x\n",
-                                index + 1, frame->addr, frame->count, status);
+                                 "Address:0x%x\n"
+                                 "Count:0x%x\n"
+                                 "Status: 0x%x\n",
+                                 index + 1, frame->addr, frame->count, status);
                         goto errrelfw;
                 }
 
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 0c999f5bb3db..ab2f3349c5c4 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -20,6 +20,7 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 65b6ff2442c6..dd0083bbb64a 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -34,6 +34,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/major.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 52d953eb30c3..dbf8d52f31d0 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -23,6 +23,7 @@
 #include <linux/errno.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index 1c43c8cdee25..c68118efad84 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -97,6 +97,7 @@
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/errno.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>       /* used in new tty drivers */
 #include <linux/signal.h>       /* used in new tty drivers */
 #include <linux/if.h>
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 2e99158ebb8a..6934025a1ac1 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -58,6 +58,7 @@
 #include <linux/ioport.h>
 #include <linux/in.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/tty.h>
 #include <linux/errno.h>
 #include <linux/string.h>       /* used in new tty drivers */
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 94a5d5020abc..973be2f44195 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1331,9 +1331,6 @@ handle_newline:
 
 static void n_tty_write_wakeup(struct tty_struct *tty)
 {
-        /* Write out any echoed characters that are still pending */
-        process_echoes(tty);
-
         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
 }
@@ -1586,6 +1583,7 @@ static int n_tty_open(struct tty_struct *tty)
 
 static inline int input_available_p(struct tty_struct *tty, int amt)
 {
+        tty_flush_to_ldisc(tty);
         if (tty->icanon) {
                 if (tty->canon_data)
                         return 1;
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index 574f1c79b6e6..ec58d8c387ff 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -828,7 +828,7 @@ static int receive_data(enum port_type index, struct nozomi *dc)
         struct port *port = &dc->port[index];
         void __iomem *addr = port->dl_addr[port->toggle_dl];
         struct tty_struct *tty = tty_port_tty_get(&port->port);
-        int i;
+        int i, ret;
 
         if (unlikely(!tty)) {
                 DBG1("tty not open for port: %d?", index);
@@ -844,12 +844,14 @@ static int receive_data(enum port_type index, struct nozomi *dc)
 
                 /* disable interrupt in downlink... */
                 disable_transmit_dl(index, dc);
-                return 0;
+                ret = 0;
+                goto put;
         }
 
         if (unlikely(size == 0)) {
                 dev_err(&dc->pdev->dev, "size == 0?\n");
-                return 1;
+                ret = 1;
+                goto put;
         }
 
         tty_buffer_request_room(tty, size);
@@ -871,8 +873,10 @@ static int receive_data(enum port_type index, struct nozomi *dc)
         }
 
         set_bit(index, &dc->flip);
+        ret = 1;
+put:
         tty_kref_put(tty);
-        return 1;
+        return ret;
 }
 
 /* Debug for interrupts */
@@ -1862,16 +1866,14 @@ static s32 ntty_chars_in_buffer(struct tty_struct *tty)
 {
         struct port *port = tty->driver_data;
         struct nozomi *dc = get_dc_by_tty(tty);
-        s32 rval;
+        s32 rval = 0;
 
         if (unlikely(!dc || !port)) {
-                rval = -ENODEV;
                 goto exit_in_buffer;
         }
 
         if (unlikely(!port->port.count)) {
                 dev_err(&dc->pdev->dev, "No tty open?\n");
-                rval = -ENODEV;
                 goto exit_in_buffer;
         }
 
diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
index 569f2f7743a7..674b3ab3587d 100644
--- a/drivers/char/pcmcia/ipwireless/tty.c
+++ b/drivers/char/pcmcia/ipwireless/tty.c
@@ -320,10 +320,10 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
         struct ipw_tty *tty = linux_tty->driver_data;
 
         if (!tty)
-                return -ENODEV;
+                return 0;
 
         if (!tty->open_count)
-                return -EINVAL;
+                return 0;
 
         return tty->tx_bytes_queued;
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index daebe1ba43d4..6e6942c45f5b 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -22,6 +22,7 @@
 #include <linux/major.h>
 #include <linux/mm.h>
 #include <linux/init.h>
+#include <linux/smp_lock.h>
 #include <linux/sysctl.h>
 #include <linux/device.h>
 #include <linux/uaccess.h>
@@ -75,114 +76,88 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
  */
 static void pty_unthrottle(struct tty_struct *tty)
 {
-        struct tty_struct *o_tty = tty->link;
-
-        if (!o_tty)
-                return;
-
-        tty_wakeup(o_tty);
+        tty_wakeup(tty->link);
         set_bit(TTY_THROTTLED, &tty->flags);
 }
 
-/*
- * WSH 05/24/97: modified to
- *   (1) use space in tty->flip instead of a shared temp buffer
- *       The flip buffers aren't being used for a pty, so there's lots
- *       of space available.  The buffer is protected by a per-pty
- *       semaphore that should almost never come under contention.
- *   (2) avoid redundant copying for cases where count >> receive_room
- * N.B. Calls from user space may now return an error code instead of
- * a count.
+/**
+ *      pty_space       -       report space left for writing
+ *      @to: tty we are writing into
  *
- * FIXME: Our pty_write method is called with our ldisc lock held but
- * not our partners. We can't just wait on the other one blindly without
- * risking deadlocks. At some point when everything has settled down we need
- * to look into making pty_write at least able to sleep over an ldisc change.
+ *      The tty buffers allow 64K but we sneak a peak and clip at 8K this
+ *      allows a lot of overspill room for echo and other fun messes to
+ *      be handled properly
+ */
+
+static int pty_space(struct tty_struct *to)
+{
+        int n = 8192 - to->buf.memory_used;
+        if (n < 0)
+                return 0;
+        return n;
+}
+
+/**
+ *      pty_write               -       write to a pty
+ *      @tty: the tty we write from
+ *      @buf: kernel buffer of data
+ *      @count: bytes to write
  *
- * The return on no ldisc is a bit counter intuitive but the logic works
- * like this. During an ldisc change the other end will flush its buffers. We
- * thus return the full length which is identical to the case where we had
- * proper locking and happened to queue the bytes just before the flush during
- * the ldisc change.
+ *      Our "hardware" write method. Data is coming from the ldisc which
+ *      may be in a non sleeping state. We simply throw this at the other
+ *      end of the link as if we were an IRQ handler receiving stuff for
+ *      the other side of the pty/tty pair.
  */
+
 static int pty_write(struct tty_struct *tty, const unsigned char *buf,
                                                                 int count)
 {
         struct tty_struct *to = tty->link;
-        struct tty_ldisc *ld;
-        int c = count;
+        int c;
 
-        if (!to || tty->stopped)
+        if (tty->stopped)
                 return 0;
-        ld = tty_ldisc_ref(to);
-
-        if (ld) {
-                c = to->receive_room;
-                if (c > count)
-                        c = count;
-                ld->ops->receive_buf(to, buf, NULL, c);
-                tty_ldisc_deref(ld);
+
+        /* This isn't locked but our 8K is quite sloppy so no
+           big deal */
+
+        c = pty_space(to);
+        if (c > count)
+                c = count;
+        if (c > 0) {
+                /* Stuff the data into the input queue of the other end */
+                c = tty_insert_flip_string(to, buf, c);
+                /* And shovel */
+                tty_flip_buffer_push(to);
+                tty_wakeup(tty);
         }
         return c;
 }
 
+/**
+ *      pty_write_room  -       write space
+ *      @tty: tty we are writing from
+ *
+ *      Report how many bytes the ldisc can send into the queue for
+ *      the other device.
+ */
+
 static int pty_write_room(struct tty_struct *tty)
 {
-        struct tty_struct *to = tty->link;
-
-        if (!to || tty->stopped)
-                return 0;
-
-        return to->receive_room;
+        return pty_space(tty->link);
 }
 
-/*
- *      WSH 05/24/97:  Modified for asymmetric MASTER/SLAVE behavior
- *      The chars_in_buffer() value is used by the ldisc select() function
- *      to hold off writing when chars_in_buffer > WAKEUP_CHARS (== 256).
- *      The pty driver chars_in_buffer() Master/Slave must behave differently:
- *
- *      The Master side needs to allow typed-ahead commands to accumulate
- *      while being canonicalized, so we report "our buffer" as empty until
- *      some threshold is reached, and then report the count. (Any count >
- *      WAKEUP_CHARS is regarded by select() as "full".)  To avoid deadlock
- *      the count returned must be 0 if no canonical data is available to be
- *      read. (The N_TTY ldisc.chars_in_buffer now knows this.)
+/**
+ *      pty_chars_in_buffer     -       characters currently in our tx queue
+ *      @tty: our tty
  *
- *      The Slave side passes all characters in raw mode to the Master side's
- *      buffer where they can be read immediately, so in this case we can
- *      return the true count in the buffer.
+ *      Report how much we have in the transmit queue. As everything is
+ *      instantly at the other end this is easy to implement.
  */
+
 static int pty_chars_in_buffer(struct tty_struct *tty)
 {
-        struct tty_struct *to = tty->link;
-        struct tty_ldisc *ld;
-        int count = 0;
-
-        /* We should get the line discipline lock for "tty->link" */
-        if (!to)
-                return 0;
-        /* We cannot take a sleeping reference here without deadlocking with
-           an ldisc change - but it doesn't really matter */
-        ld = tty_ldisc_ref(to);
-        if (ld == NULL)
-                return 0;
-
-        /* The ldisc must report 0 if no characters available to be read */
-        if (ld->ops->chars_in_buffer)
-                count = ld->ops->chars_in_buffer(to);
-
-        tty_ldisc_deref(ld);
-
-        if (tty->driver->subtype == PTY_TYPE_SLAVE)
-                return count;
-
-        /* Master side driver ... if the other side's read buffer is less than
-         * half full, return 0 to allow writers to proceed; otherwise return
-         * the count.  This leaves a comfortable margin to avoid overflow,
-         * and still allows half a buffer's worth of typed-ahead commands.
-         */
-        return (count < N_TTY_BUF_SIZE/2) ? 0 : count;
+        return 0;
 }
 
 /* Set the lock flag on a pty */
@@ -202,20 +177,10 @@ static void pty_flush_buffer(struct tty_struct *tty)
 {
         struct tty_struct *to = tty->link;
         unsigned long flags;
-        struct tty_ldisc *ld;
 
         if (!to)
                 return;
-        ld = tty_ldisc_ref(to);
-
-        /* The other end is changing discipline */
-        if (!ld)
-                return;
-
-        if (ld->ops->flush_buffer)
-                to->ldisc->ops->flush_buffer(to);
-        tty_ldisc_deref(ld);
-
+        /* tty_buffer_flush(to); FIXME */
         if (to->packet) {
                 spin_lock_irqsave(&tty->ctrl_lock, flags);
                 tty->ctrl_status |= TIOCPKT_FLUSHWRITE;
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index ce81da5b2da9..d58c2eb07f07 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -44,6 +44,7 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
 
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 217660451237..171711acf5cd 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -47,6 +47,7 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/tty_flip.h>
+#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 63d5b628477a..0e29a23ec4c5 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -73,6 +73,7 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index f1f24f0ee26f..51e7a46787be 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -52,6 +52,7 @@
 #include <linux/interrupt.h>
 #include <linux/serial.h>
 #include <linux/serialP.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index e72be4190a44..268e17f9ec3f 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -87,6 +87,7 @@
 #include <linux/tty_flip.h>
 #include <linux/mm.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/fcntl.h>
 #include <linux/major.h>
 #include <linux/delay.h>
@@ -1808,10 +1809,10 @@ static int sx_tiocmset(struct tty_struct *tty, struct file *file,
                 if (clear & TIOCM_DTR)
                         port->MSVR &= ~MSVR_DTR;
         }
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_MSVR, port->MSVR);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
         func_exit();
         return 0;
@@ -1832,11 +1833,11 @@ static int sx_send_break(struct tty_struct *tty, int length)
         port->break_length = SPECIALIX_TPS / HZ * length;
         port->COR2 |= COR2_ETC;
         port->IER  |= IER_TXRDY;
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_COR2, port->COR2);
         sx_out(bp, CD186x_IER, port->IER);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
         sx_wait_CCR(bp);
         spin_lock_irqsave(&bp->lock, flags);
@@ -2022,9 +2023,9 @@ static void sx_unthrottle(struct tty_struct *tty)
         if (sx_crtscts(tty))
                 port->MSVR |= MSVR_DTR;
         /* Else clause: see remark in "sx_throttle"... */
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         if (I_IXOFF(tty)) {
                 spin_unlock_irqrestore(&port->lock, flags);
                 sx_wait_CCR(bp);
@@ -2034,9 +2035,9 @@ static void sx_unthrottle(struct tty_struct *tty)
                 sx_wait_CCR(bp);
                 spin_lock_irqsave(&port->lock, flags);
         }
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_MSVR, port->MSVR);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
 
         func_exit();
@@ -2060,10 +2061,10 @@ static void sx_stop(struct tty_struct *tty)
 
         spin_lock_irqsave(&port->lock, flags);
         port->IER &= ~IER_TXRDY;
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_IER, port->IER);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
 
         func_exit();
@@ -2088,10 +2089,10 @@ static void sx_start(struct tty_struct *tty)
         spin_lock_irqsave(&port->lock, flags);
         if (port->xmit_cnt && port->xmit_buf && !(port->IER & IER_TXRDY)) {
                 port->IER |= IER_TXRDY;
-                spin_lock_irqsave(&bp->lock, flags);
+                spin_lock(&bp->lock);
                 sx_out(bp, CD186x_CAR, port_No(port));
                 sx_out(bp, CD186x_IER, port->IER);
-                spin_unlock_irqrestore(&bp->lock, flags);
+                spin_unlock(&bp->lock);
         }
         spin_unlock_irqrestore(&port->lock, flags);
 
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 518f2a25d91e..a81ec4fcf6ff 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -216,6 +216,7 @@
 #include <linux/eisa.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/bitops.h>
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index afded3a2379c..813552f14884 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -81,6 +81,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index a2e67e6df3a1..91f20a92fddf 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -62,6 +62,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 6f727e3c53ad..8d4a2a8a0a70 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -52,6 +52,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 0db35857e4d8..5d7a02f63e1c 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -35,7 +35,6 @@
 #include <linux/spinlock.h>
 #include <linux/vt_kern.h>
 #include <linux/workqueue.h>
-#include <linux/kexec.h>
 #include <linux/hrtimer.h>
 #include <linux/oom.h>
 
@@ -124,9 +123,12 @@ static struct sysrq_key_op sysrq_unraw_op = {
 static void sysrq_handle_crash(int key, struct tty_struct *tty)
 {
         char *killer = NULL;
+
+        panic_on_oops = 1;      /* force panic */
+        wmb();
         *killer = 1;
 }
-static struct sysrq_key_op sysrq_crashdump_op = {
+static struct sysrq_key_op sysrq_crash_op = {
         .handler        = sysrq_handle_crash,
         .help_msg       = "Crash",
         .action_msg     = "Trigger a crash",
@@ -401,7 +403,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
          */
         NULL,                           /* a */
         &sysrq_reboot_op,               /* b */
-        &sysrq_crashdump_op,            /* c & ibm_emac driver debug */
+        &sysrq_crash_op,                /* c & ibm_emac driver debug */
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index ccdd828adcef..b0603b2e5684 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -26,7 +26,6 @@
 #include <linux/poll.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
 
 #include "tpm.h"
 
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
index 810ee25d66a4..3108991c5c8b 100644
--- a/drivers/char/tty_buffer.c
+++ b/drivers/char/tty_buffer.c
@@ -462,6 +462,19 @@ static void flush_to_ldisc(struct work_struct *work)
 }
 
 /**
+ *      tty_flush_to_ldisc
+ *      @tty: tty to push
+ *
+ *      Push the terminal flip buffers to the line discipline.
+ *
+ *      Must not be called from IRQ context.
+ */
+void tty_flush_to_ldisc(struct tty_struct *tty)
+{
+        flush_to_ldisc(&tty->buf.work.work);
+}
+
+/**
  *      tty_flip_buffer_push    -       terminal
  *      @tty: tty to push
  *
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index b24f6c6a1ea3..ad6ba4ed2808 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -21,7 +21,6 @@
 #include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 913aa8d3f1c5..1733d3439ad2 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -21,7 +21,6 @@
 #include <linux/proc_fs.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/wait.h>
 #include <linux/bitops.h>
@@ -49,6 +48,41 @@ static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
 /* Line disc dispatch table */
 static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
 
+static inline struct tty_ldisc *get_ldisc(struct tty_ldisc *ld)
+{
+        if (ld)
+                atomic_inc(&ld->users);
+        return ld;
+}
+
+static void put_ldisc(struct tty_ldisc *ld)
+{
+        unsigned long flags;
+
+        if (WARN_ON_ONCE(!ld))
+                return;
+
+        /*
+         * If this is the last user, free the ldisc, and
+         * release the ldisc ops.
+         *
+         * We really want an "atomic_dec_and_lock_irqsave()",
+         * but we don't have it, so this does it by hand.
+         */
+        local_irq_save(flags);
+        if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+                struct tty_ldisc_ops *ldo = ld->ops;
+
+                ldo->refcount--;
+                module_put(ldo->owner);
+                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+
+                kfree(ld);
+                return;
+        }
+        local_irq_restore(flags);
+}
+
 /**
  *      tty_register_ldisc      -       install a line discipline
  *      @disc: ldisc number
@@ -143,7 +177,7 @@ static struct tty_ldisc *tty_ldisc_try_get(int disc)
                         /* lock it */
                         ldops->refcount++;
                         ld->ops = ldops;
-                        ld->refcount = 0;
+                        atomic_set(&ld->users, 1);
                         err = 0;
                 }
         }
@@ -182,35 +216,6 @@ static struct tty_ldisc *tty_ldisc_get(int disc)
         return ld;
 }
 
-/**
- *      tty_ldisc_put           -       drop ldisc reference
- *      @ld: ldisc
- *
- *      Drop a reference to a line discipline. Manage refcounts and
- *      module usage counts. Free the ldisc once the recount hits zero.
- *
- *      Locking:
- *              takes tty_ldisc_lock to guard against ldisc races
- */
-
-static void tty_ldisc_put(struct tty_ldisc *ld)
-{
-        unsigned long flags;
-        int disc = ld->ops->num;
-        struct tty_ldisc_ops *ldo;
-
-        BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
-
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ldo = tty_ldiscs[disc];
-        BUG_ON(ldo->refcount == 0);
-        ldo->refcount--;
-        module_put(ldo->owner);
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        WARN_ON(ld->refcount);
-        kfree(ld);
-}
-
 static void *tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
 {
         return (*pos < NR_LDISCS) ? pos : NULL;
@@ -235,7 +240,7 @@ static int tty_ldiscs_seq_show(struct seq_file *m, void *v)
         if (IS_ERR(ld))
                 return 0;
         seq_printf(m, "%-10s %2d\n", ld->ops->name ? ld->ops->name : "???", i);
-        tty_ldisc_put(ld);
+        put_ldisc(ld);
         return 0;
 }
 
@@ -289,20 +294,17 @@ static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
  *      Locking: takes tty_ldisc_lock
  */
 
-static int tty_ldisc_try(struct tty_struct *tty)
+static struct tty_ldisc *tty_ldisc_try(struct tty_struct *tty)
 {
         unsigned long flags;
         struct tty_ldisc *ld;
-        int ret = 0;
 
         spin_lock_irqsave(&tty_ldisc_lock, flags);
-        ld = tty->ldisc;
-        if (test_bit(TTY_LDISC, &tty->flags)) {
-                ld->refcount++;
-                ret = 1;
-        }
+        ld = NULL;
+        if (test_bit(TTY_LDISC, &tty->flags))
+                ld = get_ldisc(tty->ldisc);
         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        return ret;
+        return ld;
 }
 
 /**
@@ -323,10 +325,11 @@ static int tty_ldisc_try(struct tty_struct *tty)
 
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+        struct tty_ldisc *ld;
+
         /* wait_event is a macro */
-        wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
-        WARN_ON(tty->ldisc->refcount == 0);
-        return tty->ldisc;
+        wait_event(tty_ldisc_wait, (ld = tty_ldisc_try(tty)) != NULL);
+        return ld;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
@@ -343,9 +346,7 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
 {
-        if (tty_ldisc_try(tty))
-                return tty->ldisc;
-        return NULL;
+        return tty_ldisc_try(tty);
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
 
@@ -361,21 +362,15 @@ EXPORT_SYMBOL_GPL(tty_ldisc_ref);
 
 void tty_ldisc_deref(struct tty_ldisc *ld)
 {
-        unsigned long flags;
-
-        BUG_ON(ld == NULL);
-
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        if (ld->refcount == 0)
-                printk(KERN_ERR "tty_ldisc_deref: no references.\n");
-        else
-                ld->refcount--;
-        if (ld->refcount == 0)
-                wake_up(&tty_ldisc_wait);
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+        put_ldisc(ld);
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
 
+static inline void tty_ldisc_put(struct tty_ldisc *ld)
+{
+        put_ldisc(ld);
+}
+
 /**
  *      tty_ldisc_enable        -       allow ldisc use
  *      @tty: terminal to activate ldisc on
@@ -524,31 +519,6 @@ static int tty_ldisc_halt(struct tty_struct *tty)
 }
 
 /**
- *      tty_ldisc_wait_idle     -       wait for the ldisc to become idle
- *      @tty: tty to wait for
- *
- *      Wait for the line discipline to become idle. The discipline must
- *      have been halted for this to guarantee it remains idle.
- *
- *      tty_ldisc_lock protects the ref counts currently.
- */
-
-static int tty_ldisc_wait_idle(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty_ldisc_lock, flags);
-        while (tty->ldisc->refcount) {
-                spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-                if (wait_event_timeout(tty_ldisc_wait,
-                                tty->ldisc->refcount == 0, 5 * HZ) == 0)
-                        return -EBUSY;
-                spin_lock_irqsave(&tty_ldisc_lock, flags);
-        }
-        spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-        return 0;
-}
-
-/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
@@ -643,14 +613,6 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         flush_scheduled_work();
 
-        /* Let any existing reference holders finish */
-        retval = tty_ldisc_wait_idle(tty);
-        if (retval < 0) {
-                clear_bit(TTY_LDISC_CHANGING, &tty->flags);
-                tty_ldisc_put(new_ldisc);
-                return retval;
-        }
-
         mutex_lock(&tty->ldisc_mutex);
         if (test_bit(TTY_HUPPED, &tty->flags)) {
                 /* We were raced by the hangup method. It will have stomped
@@ -791,17 +753,19 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          * N_TTY.
          */
         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-                /* Avoid racing set_ldisc */
+                /* Avoid racing set_ldisc or tty_ldisc_release */
                 mutex_lock(&tty->ldisc_mutex);
-                /* Switch back to N_TTY */
-                tty_ldisc_halt(tty);
-                tty_ldisc_wait_idle(tty);
-                tty_ldisc_reinit(tty);
-                /* At this point we have a closed ldisc and we want to
-                   reopen it. We could defer this to the next open but
-                   it means auditing a lot of other paths so this is a FIXME */
-                WARN_ON(tty_ldisc_open(tty, tty->ldisc));
-                tty_ldisc_enable(tty);
+                if (tty->ldisc) {       /* Not yet closed */
+                        /* Switch back to N_TTY */
+                        tty_ldisc_halt(tty);
+                        tty_ldisc_reinit(tty);
+                        /* At this point we have a closed ldisc and we want to
+                           reopen it. We could defer this to the next open but
+                           it means auditing a lot of other paths so this is
+                           a FIXME */
+                        WARN_ON(tty_ldisc_open(tty, tty->ldisc));
+                        tty_ldisc_enable(tty);
+                }
                 mutex_unlock(&tty->ldisc_mutex);
                 tty_reset_termios(tty);
         }
@@ -858,14 +822,7 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
         tty_ldisc_halt(tty);
         flush_scheduled_work();
 
-        /*
-         * Wait for any short term users (we know they are just driver
-         * side waiters as the file is closing so user count on the file
-         * side is zero.
-         */
-
-        tty_ldisc_wait_idle(tty);
-
+        mutex_lock(&tty->ldisc_mutex);
         /*
          * Now kill off the ldisc
          */
@@ -876,6 +833,7 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
 
         /* Ensure the next open requests the N_TTY ldisc */
         tty_set_termios_ldisc(tty, N_TTY);
+        mutex_unlock(&tty->ldisc_mutex);
 
         /* This will need doing differently if we need to lock */
         if (o_tty)
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 4e862a75f7ff..9769b1149f76 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -267,7 +267,7 @@ int tty_port_block_til_ready(struct tty_port *port,
         if (retval == 0)
                 port->flags |= ASYNC_NORMAL_ACTIVE;
         spin_unlock_irqrestore(&port->lock, flags);
-        return 0;
+        return retval;
         
 }
 EXPORT_SYMBOL(tty_port_block_til_ready);
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index d94d25c12aa8..c1791a63d99d 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -495,11 +495,15 @@ void vcs_remove_sysfs(int index)
 
 int __init vcs_init(void)
 {
+        unsigned int i;
+
         if (register_chrdev(VCS_MAJOR, "vcs", &vcs_fops))
                 panic("unable to get major %d for vcs device", VCS_MAJOR);
         vc_class = class_create(THIS_MODULE, "vc");
 
         device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 0), NULL, "vcs");
         device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 128), NULL, "vcsa");
+        for (i = 0; i < MIN_NR_CONSOLES; i++)
+                vcs_make_sysfs(i);
         return 0;
 }
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/char/vr41xx_giu.c
+++ /dev/null
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index d9113b4c76e3..404f4c1ee431 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -89,6 +89,7 @@
 #include <linux/mutex.h>
 #include <linux/vt_kern.h>
 #include <linux/selection.h>
+#include <linux/smp_lock.h>
 #include <linux/tiocl.h>
 #include <linux/kbd_kern.h>
 #include <linux/consolemap.h>
@@ -769,14 +770,12 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
             visual_init(vc, currcons, 1);
             if (!*vc->vc_uni_pagedir_loc)
                 con_set_default_unimap(vc);
-            if (!vc->vc_kmalloced)
-                vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+            vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
             if (!vc->vc_screenbuf) {
                 kfree(vc);
                 vc_cons[currcons].d = NULL;
                 return -ENOMEM;
             }
-            vc->vc_kmalloced = 1;
             vc_init(vc, vc->vc_rows, vc->vc_cols, 1);
             vcs_make_sysfs(currcons);
             atomic_notifier_call_chain(&vt_notifier_list, VT_ALLOCATE, &param);
@@ -912,10 +911,8 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
         if (new_scr_end > new_origin)
                 scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
                             new_scr_end - new_origin);
-        if (vc->vc_kmalloced)
-                kfree(vc->vc_screenbuf);
+        kfree(vc->vc_screenbuf);
         vc->vc_screenbuf = newscreen;
-        vc->vc_kmalloced = 1;
         vc->vc_screenbuf_size = new_screen_size;
         set_origin(vc);
 
@@ -994,8 +991,7 @@ void vc_deallocate(unsigned int currcons)
                 vc->vc_sw->con_deinit(vc);
                 put_pid(vc->vt_pid);
                 module_put(vc->vc_sw->owner);
-                if (vc->vc_kmalloced)
-                        kfree(vc->vc_screenbuf);
+                kfree(vc->vc_screenbuf);
                 if (currcons >= MIN_NR_CONSOLES)
                         kfree(vc);
                 vc_cons[currcons].d = NULL;
@@ -2880,7 +2876,6 @@ static int __init con_init(void)
                 INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
                 visual_init(vc, currcons, 1);
                 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
-                vc->vc_kmalloced = 0;
                 vc_init(vc, vc->vc_rows, vc->vc_cols,
                         currcons || !vc->vc_sw->con_save_screen);
         }
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 7539bed0f7e0..95189f288f8c 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -25,6 +25,7 @@
 #include <linux/console.h>
 #include <linux/consolemap.h>
 #include <linux/signal.h>
+#include <linux/smp_lock.h>
 #include <linux/timex.h>
 
 #include <asm/io.h>