119 files changed, 1880 insertions, 1457 deletions

diff --git a/drivers/Makefile b/drivers/Makefile
index 03da5b663aef..a16a8d001ae0 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -17,6 +17,10 @@ obj-$(CONFIG_PARISC)		+= parisc/
 obj-$(CONFIG_RAPIDIO)           += rapidio/
 obj-y                           += video/
 obj-y                           += idle/
+
+# IPMI must come before ACPI in order to provide IPMI opregion support
+obj-$(CONFIG_IPMI_HANDLER)      += char/ipmi/
+
 obj-$(CONFIG_ACPI)              += acpi/
 obj-$(CONFIG_SFI)               += sfi/
 # PnP must come after ACPI since it will eventually need to check if acpi
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 47199e2a9130..82422fe90f81 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -47,6 +47,10 @@ acpi-y				+= video_detect.o
 endif
 
 # These are (potentially) separate modules
+
+# IPMI may be used by other drivers, so it has to initialise before them
+obj-$(CONFIG_ACPI_IPMI)         += acpi_ipmi.o
+
 obj-$(CONFIG_ACPI_AC)           += ac.o
 obj-$(CONFIG_ACPI_BUTTON)       += button.o
 obj-$(CONFIG_ACPI_FAN)          += fan.o
@@ -70,6 +74,5 @@ processor-y			+= processor_idle.o processor_thermal.o
 processor-$(CONFIG_CPU_FREQ)    += processor_perflib.o
 
 obj-$(CONFIG_ACPI_PROCESSOR_AGGREGATOR) += acpi_pad.o
-obj-$(CONFIG_ACPI_IPMI)         += acpi_ipmi.o
 
 obj-$(CONFIG_ACPI_APEI)         += apei/
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index c8abce3d2d9c..ed0fade46aed 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -270,15 +270,10 @@ static int hci_uart_send_frame(struct sk_buff *skb)
  */
 static int hci_uart_tty_open(struct tty_struct *tty)
 {
-        struct hci_uart *hu = (void *) tty->disc_data;
+        struct hci_uart *hu;
 
         BT_DBG("tty %p", tty);
 
-        /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
-           the pointer */
-        if (hu)
-                return -EEXIST;
-
         /* Error if the tty has no write op instead of leaving an exploitable
            hole */
         if (tty->ops->write == NULL)
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index d0b27a39f1d4..7ff1d0d208a7 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -52,7 +52,6 @@ obj-$(CONFIG_TELCLOCK)		+= tlclk.o
 obj-$(CONFIG_MWAVE)             += mwave/
 obj-$(CONFIG_AGP)               += agp/
 obj-$(CONFIG_PCMCIA)            += pcmcia/
-obj-$(CONFIG_IPMI_HANDLER)      += ipmi/
 
 obj-$(CONFIG_HANGCHECK_TIMER)   += hangcheck-timer.o
 obj-$(CONFIG_TCG_TPM)           += tpm/
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index e01f5eaaec82..38390f7c6ab6 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -667,7 +667,7 @@ static int intel_gtt_init(void)
         gtt_map_size = intel_private.base.gtt_total_entries * 4;
 
         intel_private.gtt = NULL;
-        if (INTEL_GTT_GEN < 6)
+        if (INTEL_GTT_GEN < 6 && INTEL_GTT_GEN > 2)
                 intel_private.gtt = ioremap_wc(intel_private.gtt_bus_addr,
                                                gtt_map_size);
         if (intel_private.gtt == NULL)
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 2c29942b1326..a0c84bb30856 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1880,7 +1880,7 @@ int ipmi_request_supply_msgs(ipmi_user_t          user,
                              struct ipmi_recv_msg *supplied_recv,
                              int                  priority)
 {
-        unsigned char saddr, lun;
+        unsigned char saddr = 0, lun = 0;
         int           rv;
 
         if (!user)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 83f85cf7fb1b..32a6c7e256bd 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2424,6 +2424,38 @@ static void ipmi_pci_cleanup(struct smi_info *info)
         pci_disable_device(pdev);
 }
 
+static int __devinit ipmi_pci_probe_regspacing(struct smi_info *info)
+{
+        if (info->si_type == SI_KCS) {
+                unsigned char   status;
+                int             regspacing;
+
+                info->io.regsize = DEFAULT_REGSIZE;
+                info->io.regshift = 0;
+                info->io_size = 2;
+                info->handlers = &kcs_smi_handlers;
+
+                /* detect 1, 4, 16byte spacing */
+                for (regspacing = DEFAULT_REGSPACING; regspacing <= 16;) {
+                        info->io.regspacing = regspacing;
+                        if (info->io_setup(info)) {
+                                dev_err(info->dev,
+                                        "Could not setup I/O space\n");
+                                return DEFAULT_REGSPACING;
+                        }
+                        /* write invalid cmd */
+                        info->io.outputb(&info->io, 1, 0x10);
+                        /* read status back */
+                        status = info->io.inputb(&info->io, 1);
+                        info->io_cleanup(info);
+                        if (status)
+                                return regspacing;
+                        regspacing *= 4;
+                }
+        }
+        return DEFAULT_REGSPACING;
+}
+
 static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
                                     const struct pci_device_id *ent)
 {
@@ -2476,8 +2508,8 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         }
         info->io.addr_data = pci_resource_start(pdev, 0);
 
-        info->io.regspacing = DEFAULT_REGSPACING;
-        info->io.regsize = DEFAULT_REGSPACING;
+        info->io.regspacing = ipmi_pci_probe_regspacing(info);
+        info->io.regsize = DEFAULT_REGSIZE;
         info->io.regshift = 0;
 
         info->irq = pdev->irq;
diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
index c1cdc9236666..90723e65b081 100644
--- a/drivers/firmware/memmap.c
+++ b/drivers/firmware/memmap.c
@@ -237,7 +237,7 @@ static ssize_t memmap_attr_show(struct kobject *kobj,
  * firmware_map_add() or firmware_map_add_early() afterwards, the entries
  * are not added to sysfs.
  */
-static int __init memmap_init(void)
+static int __init firmware_memmap_init(void)
 {
         struct firmware_map_entry *entry;
 
@@ -246,5 +246,5 @@ static int __init memmap_init(void)
 
         return 0;
 }
-late_initcall(memmap_init);
+late_initcall(firmware_memmap_init);
 
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 902af437eaf2..7a874129e5d8 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -381,11 +381,13 @@ static int mvebu_gpio_irq_set_type(struct irq_data *d, unsigned int type)
                 u = readl_relaxed(mvebu_gpioreg_in_pol(mvchip));
                 u &= ~(1 << pin);
                 writel_relaxed(u, mvebu_gpioreg_in_pol(mvchip));
+                break;
         case IRQ_TYPE_EDGE_FALLING:
         case IRQ_TYPE_LEVEL_LOW:
                 u = readl_relaxed(mvebu_gpioreg_in_pol(mvchip));
                 u |= 1 << pin;
                 writel_relaxed(u, mvebu_gpioreg_in_pol(mvchip));
+                break;
         case IRQ_TYPE_EDGE_BOTH: {
                 u32 v;
 
@@ -401,6 +403,7 @@ static int mvebu_gpio_irq_set_type(struct irq_data *d, unsigned int type)
                 else
                         u &= ~(1 << pin);       /* rising */
                 writel_relaxed(u, mvebu_gpioreg_in_pol(mvchip));
+                break;
         }
         }
         return 0;
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index cdf8b1e7602d..441ebc1bdbef 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -239,7 +239,7 @@ int drm_vma_info(struct seq_file *m, void *data)
         mutex_lock(&dev->struct_mutex);
         seq_printf(m, "vma use count: %d, high_memory = %pK, 0x%pK\n",
                    atomic_read(&dev->vma_count),
-                   high_memory, (void *)virt_to_phys(high_memory));
+                   high_memory, (void *)(unsigned long)virt_to_phys(high_memory));
 
         list_for_each_entry(pt, &dev->vmalist, head) {
                 vma = pt->vma;
diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
index 38f3a6cb8c7d..3edd981e0770 100644
--- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
+++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
@@ -303,10 +303,10 @@ static bool ch7xxx_get_hw_state(struct intel_dvo_device *dvo)
 
         ch7xxx_readb(dvo, CH7xxx_PM, &val);
 
-        if (val & CH7xxx_PM_FPD)
-                return false;
-        else
+        if (val & (CH7xxx_PM_DVIL | CH7xxx_PM_DVIP))
                 return true;
+        else
+                return false;
 }
 
 static void ch7xxx_dump_regs(struct intel_dvo_device *dvo)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 4f2831aa5fed..b84f7861e438 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1341,9 +1341,14 @@ int __must_check i915_gem_object_get_pages(struct drm_i915_gem_object *obj);
 static inline struct page *i915_gem_object_get_page(struct drm_i915_gem_object *obj, int n)
 {
         struct scatterlist *sg = obj->pages->sgl;
-        while (n >= SG_MAX_SINGLE_ALLOC) {
+        int nents = obj->pages->nents;
+        while (nents > SG_MAX_SINGLE_ALLOC) {
+                if (n < SG_MAX_SINGLE_ALLOC - 1)
+                        break;
+
                 sg = sg_chain_ptr(sg + SG_MAX_SINGLE_ALLOC - 1);
                 n -= SG_MAX_SINGLE_ALLOC - 1;
+                nents -= SG_MAX_SINGLE_ALLOC - 1;
         }
         return sg_page(sg+n);
 }
@@ -1427,7 +1432,7 @@ int __must_check i915_gpu_idle(struct drm_device *dev);
 int __must_check i915_gem_idle(struct drm_device *dev);
 int i915_add_request(struct intel_ring_buffer *ring,
                      struct drm_file *file,
-                     struct drm_i915_gem_request *request);
+                     u32 *seqno);
 int __must_check i915_wait_seqno(struct intel_ring_buffer *ring,
                                  uint32_t seqno);
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 19dbdd7dd564..d33d02d13c96 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1955,11 +1955,12 @@ i915_gem_next_request_seqno(struct intel_ring_buffer *ring)
 int
 i915_add_request(struct intel_ring_buffer *ring,
                  struct drm_file *file,
-                 struct drm_i915_gem_request *request)
+                 u32 *out_seqno)
 {
         drm_i915_private_t *dev_priv = ring->dev->dev_private;
-        uint32_t seqno;
+        struct drm_i915_gem_request *request;
         u32 request_ring_position;
+        u32 seqno;
         int was_empty;
         int ret;
 
@@ -1974,11 +1975,9 @@ i915_add_request(struct intel_ring_buffer *ring,
         if (ret)
                 return ret;
 
-        if (request == NULL) {
-                request = kmalloc(sizeof(*request), GFP_KERNEL);
-                if (request == NULL)
-                        return -ENOMEM;
-        }
+        request = kmalloc(sizeof(*request), GFP_KERNEL);
+        if (request == NULL)
+                return -ENOMEM;
 
         seqno = i915_gem_next_request_seqno(ring);
 
@@ -2030,6 +2029,8 @@ i915_add_request(struct intel_ring_buffer *ring,
                 }
         }
 
+        if (out_seqno)
+                *out_seqno = seqno;
         return 0;
 }
 
@@ -3959,6 +3960,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (!intel_enable_gtt())
                 return -EIO;
 
+        if (IS_HASWELL(dev) && (I915_READ(0x120010) == 1))
+                I915_WRITE(0x9008, I915_READ(0x9008) | 0xf0000);
+
         i915_gem_l3_remap(dev);
 
         i915_gem_init_swizzling(dev);
@@ -4098,7 +4102,6 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
         }
 
         BUG_ON(!list_empty(&dev_priv->mm.active_list));
-        BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
         mutex_unlock(&dev->struct_mutex);
 
         ret = drm_irq_install(dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 64c1be0a9cfd..a4162ddff6c5 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -521,7 +521,7 @@
  */
 # define _3D_CHICKEN2_WM_READ_PIPELINED                 (1 << 14)
 #define _3D_CHICKEN3    0x02090
-#define  _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL           (1 << 5)
+#define  _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL          (1 << 5)
 
 #define MI_MODE         0x0209c
 # define VS_TIMER_DISPATCH                              (1 << 6)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2b6ce9b2674a..682bd3729baf 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3253,6 +3253,16 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
 
         if (HAS_PCH_CPT(dev))
                 intel_cpt_verify_modeset(dev, intel_crtc->pipe);
+
+        /*
+         * There seems to be a race in PCH platform hw (at least on some
+         * outputs) where an enabled pipe still completes any pageflip right
+         * away (as if the pipe is off) instead of waiting for vblank. As soon
+         * as the first vblank happend, everything works as expected. Hence just
+         * wait for one vblank before returning to avoid strange things
+         * happening.
+         */
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
 }
 
 static void ironlake_crtc_disable(struct drm_crtc *crtc)
@@ -7892,8 +7902,7 @@ static struct intel_quirk intel_quirks[] = {
         /* ThinkPad T60 needs pipe A force quirk (bug #16494) */
         { 0x2782, 0x17aa, 0x201a, quirk_pipea_force },
 
-        /* 855 & before need to leave pipe A & dpll A up */
-        { 0x3582, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
+        /* 830/845 need to leave pipe A & dpll A up */
         { 0x2562, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
         { 0x3577, PCI_ANY_ID, PCI_ANY_ID, quirk_pipea_force },
 
@@ -8049,29 +8058,42 @@ static void intel_enable_pipe_a(struct drm_device *dev)
 
 }
 
+static bool
+intel_check_plane_mapping(struct intel_crtc *crtc)
+{
+        struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
+        u32 reg, val;
+
+        if (dev_priv->num_pipe == 1)
+                return true;
+
+        reg = DSPCNTR(!crtc->plane);
+        val = I915_READ(reg);
+
+        if ((val & DISPLAY_PLANE_ENABLE) &&
+            (!!(val & DISPPLANE_SEL_PIPE_MASK) == crtc->pipe))
+                return false;
+
+        return true;
+}
+
 static void intel_sanitize_crtc(struct intel_crtc *crtc)
 {
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 reg, val;
+        u32 reg;
 
         /* Clear any frame start delays used for debugging left by the BIOS */
         reg = PIPECONF(crtc->pipe);
         I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
 
         /* We need to sanitize the plane -> pipe mapping first because this will
-         * disable the crtc (and hence change the state) if it is wrong. */
-        if (!HAS_PCH_SPLIT(dev)) {
+         * disable the crtc (and hence change the state) if it is wrong. Note
+         * that gen4+ has a fixed plane -> pipe mapping.  */
+        if (INTEL_INFO(dev)->gen < 4 && !intel_check_plane_mapping(crtc)) {
                 struct intel_connector *connector;
                 bool plane;
 
-                reg = DSPCNTR(crtc->plane);
-                val = I915_READ(reg);
-
-                if ((val & DISPLAY_PLANE_ENABLE) == 0 &&
-                    (!!(val & DISPPLANE_SEL_PIPE_MASK) == crtc->pipe))
-                        goto ok;
-
                 DRM_DEBUG_KMS("[CRTC:%d] wrong plane connection detected!\n",
                               crtc->base.base.id);
 
@@ -8095,7 +8117,6 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                 WARN_ON(crtc->active);
                 crtc->base.enabled = false;
         }
-ok:
 
         if (dev_priv->quirks & QUIRK_PIPEA_FORCE &&
             crtc->pipe == PIPE_A && !crtc->active) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index d1e8ddb2d6c0..1b727a5c9ee5 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2369,8 +2369,9 @@ static void
 intel_dp_destroy(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
+        struct intel_dp *intel_dp = intel_attached_dp(connector);
 
-        if (intel_dpd_is_edp(dev))
+        if (is_edp(intel_dp))
                 intel_panel_destroy_backlight(dev);
 
         drm_sysfs_connector_remove(connector);
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index ebff850a9ab6..495625914e4a 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -209,7 +209,6 @@ static void intel_overlay_unmap_regs(struct intel_overlay *overlay,
 }
 
 static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
-                                         struct drm_i915_gem_request *request,
                                          void (*tail)(struct intel_overlay *))
 {
         struct drm_device *dev = overlay->dev;
@@ -218,12 +217,10 @@ static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
         int ret;
 
         BUG_ON(overlay->last_flip_req);
-        ret = i915_add_request(ring, NULL, request);
-        if (ret) {
-            kfree(request);
-            return ret;
-        }
-        overlay->last_flip_req = request->seqno;
+        ret = i915_add_request(ring, NULL, &overlay->last_flip_req);
+        if (ret)
+                return ret;
+
         overlay->flip_tail = tail;
         ret = i915_wait_seqno(ring, overlay->last_flip_req);
         if (ret)
@@ -240,7 +237,6 @@ static int intel_overlay_on(struct intel_overlay *overlay)
         struct drm_device *dev = overlay->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
-        struct drm_i915_gem_request *request;
         int ret;
 
         BUG_ON(overlay->active);
@@ -248,17 +244,9 @@ static int intel_overlay_on(struct intel_overlay *overlay)
 
         WARN_ON(IS_I830(dev) && !(dev_priv->quirks & QUIRK_PIPEA_FORCE));
 
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
         ret = intel_ring_begin(ring, 4);
-        if (ret) {
-                kfree(request);
-                goto out;
-        }
+        if (ret)
+                return ret;
 
         intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_ON);
         intel_ring_emit(ring, overlay->flip_addr | OFC_UPDATE);
@@ -266,9 +254,7 @@ static int intel_overlay_on(struct intel_overlay *overlay)
         intel_ring_emit(ring, MI_NOOP);
         intel_ring_advance(ring);
 
-        ret = intel_overlay_do_wait_request(overlay, request, NULL);
-out:
-        return ret;
+        return intel_overlay_do_wait_request(overlay, NULL);
 }
 
 /* overlay needs to be enabled in OCMD reg */
@@ -278,17 +264,12 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
         struct drm_device *dev = overlay->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
-        struct drm_i915_gem_request *request;
         u32 flip_addr = overlay->flip_addr;
         u32 tmp;
         int ret;
 
         BUG_ON(!overlay->active);
 
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL)
-                return -ENOMEM;
-
         if (load_polyphase_filter)
                 flip_addr |= OFC_UPDATE;
 
@@ -298,22 +279,14 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
                 DRM_DEBUG("overlay underrun, DOVSTA: %x\n", tmp);
 
         ret = intel_ring_begin(ring, 2);
-        if (ret) {
-                kfree(request);
+        if (ret)
                 return ret;
-        }
+
         intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
         intel_ring_emit(ring, flip_addr);
         intel_ring_advance(ring);
 
-        ret = i915_add_request(ring, NULL, request);
-        if (ret) {
-                kfree(request);
-                return ret;
-        }
-
-        overlay->last_flip_req = request->seqno;
-        return 0;
+        return i915_add_request(ring, NULL, &overlay->last_flip_req);
 }
 
 static void intel_overlay_release_old_vid_tail(struct intel_overlay *overlay)
@@ -349,15 +322,10 @@ static int intel_overlay_off(struct intel_overlay *overlay)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
         u32 flip_addr = overlay->flip_addr;
-        struct drm_i915_gem_request *request;
         int ret;
 
         BUG_ON(!overlay->active);
 
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL)
-                return -ENOMEM;
-
         /* According to intel docs the overlay hw may hang (when switching
          * off) without loading the filter coeffs. It is however unclear whether
          * this applies to the disabling of the overlay or to the switching off
@@ -365,10 +333,9 @@ static int intel_overlay_off(struct intel_overlay *overlay)
         flip_addr |= OFC_UPDATE;
 
         ret = intel_ring_begin(ring, 6);
-        if (ret) {
-                kfree(request);
+        if (ret)
                 return ret;
-        }
+
         /* wait for overlay to go idle */
         intel_ring_emit(ring, MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
         intel_ring_emit(ring, flip_addr);
@@ -379,8 +346,7 @@ static int intel_overlay_off(struct intel_overlay *overlay)
         intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
         intel_ring_advance(ring);
 
-        return intel_overlay_do_wait_request(overlay, request,
-                                             intel_overlay_off_tail);
+        return intel_overlay_do_wait_request(overlay, intel_overlay_off_tail);
 }
 
 /* recover from an interruption due to a signal
@@ -425,24 +391,16 @@ static int intel_overlay_release_old_vid(struct intel_overlay *overlay)
                 return 0;
 
         if (I915_READ(ISR) & I915_OVERLAY_PLANE_FLIP_PENDING_INTERRUPT) {
-                struct drm_i915_gem_request *request;
-
                 /* synchronous slowpath */
-                request = kzalloc(sizeof(*request), GFP_KERNEL);
-                if (request == NULL)
-                        return -ENOMEM;
-
                 ret = intel_ring_begin(ring, 2);
-                if (ret) {
-                        kfree(request);
+                if (ret)
                         return ret;
-                }
 
                 intel_ring_emit(ring, MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
                 intel_ring_emit(ring, MI_NOOP);
                 intel_ring_advance(ring);
 
-                ret = intel_overlay_do_wait_request(overlay, request,
+                ret = intel_overlay_do_wait_request(overlay,
                                                     intel_overlay_release_old_vid_tail);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index b3b4b6cea8b0..72f41aaa71ff 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3442,8 +3442,8 @@ static void gen6_init_clock_gating(struct drm_device *dev)
                    GEN6_RCCUNIT_CLOCK_GATE_DISABLE);
 
         /* Bspec says we need to always set all mask bits. */
-        I915_WRITE(_3D_CHICKEN, (0xFFFF << 16) |
-                   _3D_CHICKEN_SF_DISABLE_FASTCLIP_CULL);
+        I915_WRITE(_3D_CHICKEN3, (0xFFFF << 16) |
+                   _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL);
 
         /*
          * According to the spec the following bits should be
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
index 9ed6e728a94c..7d750382a833 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
@@ -43,7 +43,7 @@ dcb_table(struct nouveau_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
         *ver = nv_ro08(bios, dcb);
 
         if (*ver >= 0x41) {
-                nv_warn(bios, "DCB *ver 0x%02x unknown\n", *ver);
+                nv_warn(bios, "DCB version 0x%02x unknown\n", *ver);
                 return 0x0000;
         } else
         if (*ver >= 0x30) {
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 436e9efe7ef5..42d7539e6525 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -277,7 +277,6 @@ nv50_fb_dtor(struct nouveau_object *object)
                 __free_page(priv->r100c08_page);
         }
 
-        nouveau_mm_fini(&priv->base.vram);
         nouveau_fb_destroy(&priv->base);
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
index b29237970fa0..523178685180 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/fan.c
@@ -134,7 +134,7 @@ nouveau_therm_fan_sense(struct nouveau_therm *therm)
         end = ptimer->read(ptimer);
 
         if (cycles == 5) {
-                tach = (u64)60000000000;
+                tach = (u64)60000000000ULL;
                 do_div(tach, (end - start));
                 return tach;
         } else
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 259e5f1adf47..35ac57f0aab6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -456,6 +456,7 @@ static struct ttm_tt *
 nouveau_ttm_tt_create(struct ttm_bo_device *bdev, unsigned long size,
                       uint32_t page_flags, struct page *dummy_read)
 {
+#if __OS_HAS_AGP
         struct nouveau_drm *drm = nouveau_bdev(bdev);
         struct drm_device *dev = drm->dev;
 
@@ -463,6 +464,7 @@ nouveau_ttm_tt_create(struct ttm_bo_device *bdev, unsigned long size,
                 return ttm_agp_tt_create(bdev, dev->agp->bridge, size,
                                          page_flags, dummy_read);
         }
+#endif
 
         return nouveau_sgdma_create_ttm(bdev, size, page_flags, dummy_read);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index 0bf64c90aa20..5566172774df 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -52,7 +52,7 @@ nouveau_pm_perflvl_aux(struct drm_device *dev, struct nouveau_pm_level *perflvl,
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_pm *pm = nouveau_pm(dev);
-        struct nouveau_therm *therm = nouveau_therm(drm);
+        struct nouveau_therm *therm = nouveau_therm(drm->device);
         int ret;
 
         /*XXX: not on all boards, we should control based on temperature
@@ -64,7 +64,6 @@ nouveau_pm_perflvl_aux(struct drm_device *dev, struct nouveau_pm_level *perflvl,
                 ret = therm->fan_set(therm, perflvl->fanspeed);
                 if (ret && ret != -ENODEV) {
                         NV_ERROR(drm, "fanspeed set failed: %d\n", ret);
-                        return ret;
                 }
         }
 
@@ -706,8 +705,7 @@ nouveau_hwmon_init(struct drm_device *dev)
         struct device *hwmon_dev;
         int ret = 0;
 
-        if (!therm || !therm->temp_get || !therm->attr_get ||
-                !therm->attr_set || therm->temp_get(therm) < 0)
+        if (!therm || !therm->temp_get || !therm->attr_get || !therm->attr_set)
                 return -ENODEV;
 
         hwmon_dev = hwmon_device_register(&dev->pdev->dev);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 96184d02c8d9..2e566e123e9e 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1690,10 +1690,10 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                 }
                 /* all other cases */
                 pll_in_use = radeon_get_pll_use_mask(crtc);
-                if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                        return ATOM_PPLL2;
                 if (!(pll_in_use & (1 << ATOM_PPLL1)))
                         return ATOM_PPLL1;
+                if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                        return ATOM_PPLL2;
                 DRM_ERROR("unable to allocate a PPLL\n");
                 return ATOM_PPLL_INVALID;
         } else {
@@ -1715,10 +1715,10 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                         }
                         /* all other cases */
                         pll_in_use = radeon_get_pll_use_mask(crtc);
-                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
-                                return ATOM_PPLL2;
                         if (!(pll_in_use & (1 << ATOM_PPLL1)))
                                 return ATOM_PPLL1;
+                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                                return ATOM_PPLL2;
                         DRM_ERROR("unable to allocate a PPLL\n");
                         return ATOM_PPLL_INVALID;
                 } else {
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a1f49c5fd74b..14313ad43b76 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3431,9 +3431,14 @@ void evergreen_pcie_gen2_enable(struct radeon_device *rdev)
         if (!(mask & DRM_PCIE_SPEED_50))
                 return;
 
+        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
+        if (speed_cntl & LC_CURRENT_DATA_RATE) {
+                DRM_INFO("PCIE gen 2 link speeds already enabled\n");
+                return;
+        }
+
         DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
 
-        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
         if ((speed_cntl & LC_OTHER_SIDE_EVER_SENT_GEN2) ||
             (speed_cntl & LC_OTHER_SIDE_SUPPORTS_GEN2)) {
 
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 8bcb554ea0c5..8c74c729586d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -770,9 +770,13 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(0x15DC, 0);
 
         /* empty context1-7 */
+        /* Assign the pt base to something valid for now; the pts used for
+         * the VMs are determined by the application and setup and assigned
+         * on the fly in the vm part of radeon_gart.c
+         */
         for (i = 1; i < 8; i++) {
                 WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
-                WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), 0);
+                WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
                 WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
                         rdev->gart.table_addr >> 12);
         }
@@ -1572,12 +1576,6 @@ void cayman_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
         if (vm == NULL)
                 return;
 
-        radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (vm->id << 2), 0));
-        radeon_ring_write(ring, 0);
-
-        radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (vm->id << 2), 0));
-        radeon_ring_write(ring, vm->last_pfn);
-
         radeon_ring_write(ring, PACKET0(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (vm->id << 2), 0));
         radeon_ring_write(ring, vm->pd_gpu_addr >> 12);
 
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 70c800ff6190..cda280d157da 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3703,6 +3703,12 @@ static void r600_pcie_gen2_enable(struct radeon_device *rdev)
         if (!(mask & DRM_PCIE_SPEED_50))
                 return;
 
+        speed_cntl = RREG32_PCIE_P(PCIE_LC_SPEED_CNTL);
+        if (speed_cntl & LC_CURRENT_DATA_RATE) {
+                DRM_INFO("PCIE gen 2 link speeds already enabled\n");
+                return;
+        }
+
         DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
 
         /* 55 nm r6xx asics */
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b04c06444d8b..8c42d54c2e26 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -663,9 +663,14 @@ struct radeon_vm {
         struct list_head                list;
         struct list_head                va;
         unsigned                        id;
-        unsigned                        last_pfn;
-        u64                             pd_gpu_addr;
-        struct radeon_sa_bo             *sa_bo;
+
+        /* contains the page directory */
+        struct radeon_sa_bo             *page_directory;
+        uint64_t                        pd_gpu_addr;
+
+        /* array of page tables, one for each page directory entry */
+        struct radeon_sa_bo             **page_tables;
+
         struct mutex                    mutex;
         /* last fence for cs using this vm */
         struct radeon_fence             *fence;
@@ -1843,9 +1848,10 @@ extern void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size
  */
 int radeon_vm_manager_init(struct radeon_device *rdev);
 void radeon_vm_manager_fini(struct radeon_device *rdev);
-int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
+void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
 void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm);
 int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm);
+void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm);
 struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
                                        struct radeon_vm *vm, int ring);
 void radeon_vm_fence(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
index b0a5688c67f8..196d28d99570 100644
--- a/drivers/gpu/drm/radeon/radeon_acpi.c
+++ b/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -201,7 +201,7 @@ static int radeon_atif_verify_interface(acpi_handle handle,
 
         size = *(u16 *) info->buffer.pointer;
         if (size < 12) {
-                DRM_INFO("ATIF buffer is too small: %lu\n", size);
+                DRM_INFO("ATIF buffer is too small: %zu\n", size);
                 err = -EINVAL;
                 goto out;
         }
@@ -370,6 +370,7 @@ int radeon_atif_handler(struct radeon_device *rdev,
 
                         radeon_set_backlight_level(rdev, enc, req.backlight_level);
 
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
                         if (rdev->is_atom_bios) {
                                 struct radeon_encoder_atom_dig *dig = enc->enc_priv;
                                 backlight_force_update(dig->bl_dev,
@@ -379,6 +380,7 @@ int radeon_atif_handler(struct radeon_device *rdev,
                                 backlight_force_update(dig->bl_dev,
                                                        BACKLIGHT_UPDATE_HOTKEY);
                         }
+#endif
                 }
         }
         /* TODO: check other events */
@@ -485,7 +487,7 @@ static int radeon_atcs_verify_interface(acpi_handle handle,
 
         size = *(u16 *) info->buffer.pointer;
         if (size < 8) {
-                DRM_INFO("ATCS buffer is too small: %lu\n", size);
+                DRM_INFO("ATCS buffer is too small: %zu\n", size);
                 err = -EINVAL;
                 goto out;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 582e99449c12..1aa3f910b993 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -148,7 +148,7 @@ static int radeon_atpx_verify_interface(struct radeon_atpx *atpx)
 
         size = *(u16 *) info->buffer.pointer;
         if (size < 8) {
-                printk("ATPX buffer is too small: %lu\n", size);
+                printk("ATPX buffer is too small: %zu\n", size);
                 err = -EINVAL;
                 goto out;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index cb7b7c062fef..41672cc563fb 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -478,6 +478,7 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
         }
 
 out:
+        radeon_vm_add_to_lru(rdev, vm);
         mutex_unlock(&vm->mutex);
         mutex_unlock(&rdev->vm_manager.lock);
         return r;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 64a42647f08a..bd13ca09eb62 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1018,6 +1018,10 @@ int radeon_device_init(struct radeon_device *rdev,
                 return r;
         /* initialize vm here */
         mutex_init(&rdev->vm_manager.lock);
+        /* Adjust VM size here.
+         * Currently set to 4GB ((1 << 20) 4k pages).
+         * Max GPUVM size for cayman and SI is 40 bits.
+         */
         rdev->vm_manager.max_pfn = 1 << 20;
         INIT_LIST_HEAD(&rdev->vm_manager.lru_vm);
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index f0c06d196b75..a7677dd1ce98 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -423,6 +423,18 @@ void radeon_gart_fini(struct radeon_device *rdev)
  */
 
 /**
+ * radeon_vm_num_pde - return the number of page directory entries
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Calculate the number of page directory entries (cayman+).
+ */
+static unsigned radeon_vm_num_pdes(struct radeon_device *rdev)
+{
+        return rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE;
+}
+
+/**
  * radeon_vm_directory_size - returns the size of the page directory in bytes
  *
  * @rdev: radeon_device pointer
@@ -431,7 +443,7 @@ void radeon_gart_fini(struct radeon_device *rdev)
  */
 static unsigned radeon_vm_directory_size(struct radeon_device *rdev)
 {
-        return (rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE) * 8;
+        return RADEON_GPU_PAGE_ALIGN(radeon_vm_num_pdes(rdev) * 8);
 }
 
 /**
@@ -451,11 +463,11 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
 
         if (!rdev->vm_manager.enabled) {
                 /* allocate enough for 2 full VM pts */
-                size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
-                size += RADEON_GPU_PAGE_ALIGN(rdev->vm_manager.max_pfn * 8);
+                size = radeon_vm_directory_size(rdev);
+                size += rdev->vm_manager.max_pfn * 8;
                 size *= 2;
                 r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
-                                              size,
+                                              RADEON_GPU_PAGE_ALIGN(size),
                                               RADEON_GEM_DOMAIN_VRAM);
                 if (r) {
                         dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -476,7 +488,7 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
 
         /* restore page table */
         list_for_each_entry(vm, &rdev->vm_manager.lru_vm, list) {
-                if (vm->sa_bo == NULL)
+                if (vm->page_directory == NULL)
                         continue;
 
                 list_for_each_entry(bo_va, &vm->va, vm_list) {
@@ -500,16 +512,25 @@ static void radeon_vm_free_pt(struct radeon_device *rdev,
                                     struct radeon_vm *vm)
 {
         struct radeon_bo_va *bo_va;
+        int i;
 
-        if (!vm->sa_bo)
+        if (!vm->page_directory)
                 return;
 
         list_del_init(&vm->list);
-        radeon_sa_bo_free(rdev, &vm->sa_bo, vm->fence);
+        radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
 
         list_for_each_entry(bo_va, &vm->va, vm_list) {
                 bo_va->valid = false;
         }
+
+        if (vm->page_tables == NULL)
+                return;
+
+        for (i = 0; i < radeon_vm_num_pdes(rdev); i++)
+                radeon_sa_bo_free(rdev, &vm->page_tables[i], vm->fence);
+
+        kfree(vm->page_tables);
 }
 
 /**
@@ -546,63 +567,106 @@ void radeon_vm_manager_fini(struct radeon_device *rdev)
 }
 
 /**
+ * radeon_vm_evict - evict page table to make room for new one
+ *
+ * @rdev: radeon_device pointer
+ * @vm: VM we want to allocate something for
+ *
+ * Evict a VM from the lru, making sure that it isn't @vm. (cayman+).
+ * Returns 0 for success, -ENOMEM for failure.
+ *
+ * Global and local mutex must be locked!
+ */
+int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        struct radeon_vm *vm_evict;
+
+        if (list_empty(&rdev->vm_manager.lru_vm))
+                return -ENOMEM;
+
+        vm_evict = list_first_entry(&rdev->vm_manager.lru_vm,
+                                    struct radeon_vm, list);
+        if (vm_evict == vm)
+                return -ENOMEM;
+
+        mutex_lock(&vm_evict->mutex);
+        radeon_vm_free_pt(rdev, vm_evict);
+        mutex_unlock(&vm_evict->mutex);
+        return 0;
+}
+
+/**
  * radeon_vm_alloc_pt - allocates a page table for a VM
  *
  * @rdev: radeon_device pointer
  * @vm: vm to bind
  *
  * Allocate a page table for the requested vm (cayman+).
- * Also starts to populate the page table.
  * Returns 0 for success, error for failure.
  *
  * Global and local mutex must be locked!
  */
 int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm)
 {
-        struct radeon_vm *vm_evict;
-        int r;
+        unsigned pd_size, pts_size;
         u64 *pd_addr;
-        int tables_size;
+        int r;
 
         if (vm == NULL) {
                 return -EINVAL;
         }
 
-        /* allocate enough to cover the current VM size */
-        tables_size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
-        tables_size += RADEON_GPU_PAGE_ALIGN(vm->last_pfn * 8);
-
-        if (vm->sa_bo != NULL) {
-                /* update lru */
-                list_del_init(&vm->list);
-                list_add_tail(&vm->list, &rdev->vm_manager.lru_vm);
+        if (vm->page_directory != NULL) {
                 return 0;
         }
 
 retry:
-        r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager, &vm->sa_bo,
-                             tables_size, RADEON_GPU_PAGE_SIZE, false);
+        pd_size = RADEON_GPU_PAGE_ALIGN(radeon_vm_directory_size(rdev));
+        r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
+                             &vm->page_directory, pd_size,
+                             RADEON_GPU_PAGE_SIZE, false);
         if (r == -ENOMEM) {
-                if (list_empty(&rdev->vm_manager.lru_vm)) {
+                r = radeon_vm_evict(rdev, vm);
+                if (r)
                         return r;
-                }
-                vm_evict = list_first_entry(&rdev->vm_manager.lru_vm, struct radeon_vm, list);
-                mutex_lock(&vm_evict->mutex);
-                radeon_vm_free_pt(rdev, vm_evict);
-                mutex_unlock(&vm_evict->mutex);
                 goto retry;
 
         } else if (r) {
                 return r;
         }
 
-        pd_addr = radeon_sa_bo_cpu_addr(vm->sa_bo);
-        vm->pd_gpu_addr = radeon_sa_bo_gpu_addr(vm->sa_bo);
-        memset(pd_addr, 0, tables_size);
+        vm->pd_gpu_addr = radeon_sa_bo_gpu_addr(vm->page_directory);
+
+        /* Initially clear the page directory */
+        pd_addr = radeon_sa_bo_cpu_addr(vm->page_directory);
+        memset(pd_addr, 0, pd_size);
+
+        pts_size = radeon_vm_num_pdes(rdev) * sizeof(struct radeon_sa_bo *);
+        vm->page_tables = kzalloc(pts_size, GFP_KERNEL);
+
+        if (vm->page_tables == NULL) {
+                DRM_ERROR("Cannot allocate memory for page table array\n");
+                radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
 
+/**
+ * radeon_vm_add_to_lru - add VMs page table to LRU list
+ *
+ * @rdev: radeon_device pointer
+ * @vm: vm to add to LRU
+ *
+ * Add the allocated page table to the LRU list (cayman+).
+ *
+ * Global mutex must be locked!
+ */
+void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        list_del_init(&vm->list);
         list_add_tail(&vm->list, &rdev->vm_manager.lru_vm);
-        return radeon_vm_bo_update_pte(rdev, vm, rdev->ring_tmp_bo.bo,
-                                       &rdev->ring_tmp_bo.bo->tbo.mem);
 }
 
 /**
@@ -793,20 +857,6 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
         }
 
         mutex_lock(&vm->mutex);
-        if (last_pfn > vm->last_pfn) {
-                /* release mutex and lock in right order */
-                mutex_unlock(&vm->mutex);
-                mutex_lock(&rdev->vm_manager.lock);
-                mutex_lock(&vm->mutex);
-                /* and check again */
-                if (last_pfn > vm->last_pfn) {
-                        /* grow va space 32M by 32M */
-                        unsigned align = ((32 << 20) >> 12) - 1;
-                        radeon_vm_free_pt(rdev, vm);
-                        vm->last_pfn = (last_pfn + align) & ~align;
-                }
-                mutex_unlock(&rdev->vm_manager.lock);
-        }
         head = &vm->va;
         last_offset = 0;
         list_for_each_entry(tmp, &vm->va, vm_list) {
@@ -865,6 +915,155 @@ uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
 }
 
 /**
+ * radeon_vm_update_pdes - make sure that page directory is valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ *
+ * Allocates new page tables if necessary
+ * and updates the page directory (cayman+).
+ * Returns 0 for success, error for failure.
+ *
+ * Global and local mutex must be locked!
+ */
+static int radeon_vm_update_pdes(struct radeon_device *rdev,
+                                 struct radeon_vm *vm,
+                                 uint64_t start, uint64_t end)
+{
+        static const uint32_t incr = RADEON_VM_PTE_COUNT * 8;
+
+        uint64_t last_pde = ~0, last_pt = ~0;
+        unsigned count = 0;
+        uint64_t pt_idx;
+        int r;
+
+        start = (start / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+        end = (end / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+
+        /* walk over the address space and update the page directory */
+        for (pt_idx = start; pt_idx <= end; ++pt_idx) {
+                uint64_t pde, pt;
+
+                if (vm->page_tables[pt_idx])
+                        continue;
+
+retry:
+                r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
+                                     &vm->page_tables[pt_idx],
+                                     RADEON_VM_PTE_COUNT * 8,
+                                     RADEON_GPU_PAGE_SIZE, false);
+
+                if (r == -ENOMEM) {
+                        r = radeon_vm_evict(rdev, vm);
+                        if (r)
+                                return r;
+                        goto retry;
+                } else if (r) {
+                        return r;
+                }
+
+                pde = vm->pd_gpu_addr + pt_idx * 8;
+
+                pt = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
+
+                if (((last_pde + 8 * count) != pde) ||
+                    ((last_pt + incr * count) != pt)) {
+
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, last_pde,
+                                                        last_pt, count, incr,
+                                                        RADEON_VM_PAGE_VALID);
+                        }
+
+                        count = 1;
+                        last_pde = pde;
+                        last_pt = pt;
+                } else {
+                        ++count;
+                }
+        }
+
+        if (count) {
+                radeon_asic_vm_set_page(rdev, last_pde, last_pt, count,
+                                        incr, RADEON_VM_PAGE_VALID);
+
+        }
+
+        return 0;
+}
+
+/**
+ * radeon_vm_update_ptes - make sure that page tables are valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ * @dst: destination address to map to
+ * @flags: mapping flags
+ *
+ * Update the page tables in the range @start - @end (cayman+).
+ *
+ * Global and local mutex must be locked!
+ */
+static void radeon_vm_update_ptes(struct radeon_device *rdev,
+                                  struct radeon_vm *vm,
+                                  uint64_t start, uint64_t end,
+                                  uint64_t dst, uint32_t flags)
+{
+        static const uint64_t mask = RADEON_VM_PTE_COUNT - 1;
+
+        uint64_t last_pte = ~0, last_dst = ~0;
+        unsigned count = 0;
+        uint64_t addr;
+
+        start = start / RADEON_GPU_PAGE_SIZE;
+        end = end / RADEON_GPU_PAGE_SIZE;
+
+        /* walk over the address space and update the page tables */
+        for (addr = start; addr < end; ) {
+                uint64_t pt_idx = addr >> RADEON_VM_BLOCK_SIZE;
+                unsigned nptes;
+                uint64_t pte;
+
+                if ((addr & ~mask) == (end & ~mask))
+                        nptes = end - addr;
+                else
+                        nptes = RADEON_VM_PTE_COUNT - (addr & mask);
+
+                pte = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
+                pte += (addr & mask) * 8;
+
+                if (((last_pte + 8 * count) != pte) ||
+                    ((count + nptes) > 1 << 11)) {
+
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, last_pte,
+                                                        last_dst, count,
+                                                        RADEON_GPU_PAGE_SIZE,
+                                                        flags);
+                        }
+
+                        count = nptes;
+                        last_pte = pte;
+                        last_dst = dst;
+                } else {
+                        count += nptes;
+                }
+
+                addr += nptes;
+                dst += nptes * RADEON_GPU_PAGE_SIZE;
+        }
+
+        if (count) {
+                radeon_asic_vm_set_page(rdev, last_pte, last_dst, count,
+                                        RADEON_GPU_PAGE_SIZE, flags);
+        }
+}
+
+/**
  * radeon_vm_bo_update_pte - map a bo into the vm page table
  *
  * @rdev: radeon_device pointer
@@ -887,12 +1086,11 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
         struct radeon_semaphore *sem = NULL;
         struct radeon_bo_va *bo_va;
         unsigned nptes, npdes, ndw;
-        uint64_t pe, addr;
-        uint64_t pfn;
+        uint64_t addr;
         int r;
 
         /* nothing to do if vm isn't bound */
-        if (vm->sa_bo == NULL)
+        if (vm->page_directory == NULL)
                 return 0;
 
         bo_va = radeon_vm_bo_find(vm, bo);
@@ -939,25 +1137,29 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                 }
         }
 
-        /* estimate number of dw needed */
-        /* reserve space for 32-bit padding */
-        ndw = 32;
-
         nptes = radeon_bo_ngpu_pages(bo);
 
-        pfn = (bo_va->soffset / RADEON_GPU_PAGE_SIZE);
+        /* assume two extra pdes in case the mapping overlaps the borders */
+        npdes = (nptes >> RADEON_VM_BLOCK_SIZE) + 2;
 
-        /* handle cases where a bo spans several pdes  */
-        npdes = (ALIGN(pfn + nptes, RADEON_VM_PTE_COUNT) -
-                 (pfn & ~(RADEON_VM_PTE_COUNT - 1))) >> RADEON_VM_BLOCK_SIZE;
+        /* estimate number of dw needed */
+        /* semaphore, fence and padding */
+        ndw = 32;
+
+        if (RADEON_VM_BLOCK_SIZE > 11)
+                /* reserve space for one header for every 2k dwords */
+                ndw += (nptes >> 11) * 3;
+        else
+                /* reserve space for one header for
+                    every (1 << BLOCK_SIZE) entries */
+                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 3;
 
-        /* reserve space for one header for every 2k dwords */
-        ndw += (nptes >> 11) * 3;
         /* reserve space for pte addresses */
         ndw += nptes * 2;
 
         /* reserve space for one header for every 2k dwords */
         ndw += (npdes >> 11) * 3;
+
         /* reserve space for pde addresses */
         ndw += npdes * 2;
 
@@ -971,22 +1173,14 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                 radeon_fence_note_sync(vm->fence, ridx);
         }
 
-        /* update page table entries */
-        pe = vm->pd_gpu_addr;
-        pe += radeon_vm_directory_size(rdev);
-        pe += (bo_va->soffset / RADEON_GPU_PAGE_SIZE) * 8;
-
-        radeon_asic_vm_set_page(rdev, pe, addr, nptes,
-                                RADEON_GPU_PAGE_SIZE, bo_va->flags);
-
-        /* update page directory entries */
-        addr = pe;
-
-        pe = vm->pd_gpu_addr;
-        pe += ((bo_va->soffset / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE) * 8;
+        r = radeon_vm_update_pdes(rdev, vm, bo_va->soffset, bo_va->eoffset);
+        if (r) {
+                radeon_ring_unlock_undo(rdev, ring);
+                return r;
+        }
 
-        radeon_asic_vm_set_page(rdev, pe, addr, npdes,
-                                RADEON_VM_PTE_COUNT * 8, RADEON_VM_PAGE_VALID);
+        radeon_vm_update_ptes(rdev, vm, bo_va->soffset, bo_va->eoffset,
+                              addr, bo_va->flags);
 
         radeon_fence_unref(&vm->fence);
         r = radeon_fence_emit(rdev, &vm->fence, ridx);
@@ -997,6 +1191,7 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
         radeon_ring_unlock_commit(rdev, ring);
         radeon_semaphore_free(rdev, &sem, vm->fence);
         radeon_fence_unref(&vm->last_flush);
+
         return 0;
 }
 
@@ -1056,31 +1251,15 @@ void radeon_vm_bo_invalidate(struct radeon_device *rdev,
  * @rdev: radeon_device pointer
  * @vm: requested vm
  *
- * Init @vm (cayman+).
- * Map the IB pool and any other shared objects into the VM
- * by default as it's used by all VMs.
- * Returns 0 for success, error for failure.
+ * Init @vm fields (cayman+).
  */
-int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
+void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
 {
-        struct radeon_bo_va *bo_va;
-        int r;
-
         vm->id = 0;
         vm->fence = NULL;
-        vm->last_pfn = 0;
         mutex_init(&vm->mutex);
         INIT_LIST_HEAD(&vm->list);
         INIT_LIST_HEAD(&vm->va);
-
-        /* map the ib pool buffer at 0 in virtual address space, set
-         * read only
-         */
-        bo_va = radeon_vm_bo_add(rdev, vm, rdev->ring_tmp_bo.bo);
-        r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
-                                  RADEON_VM_PAGE_READABLE |
-                                  RADEON_VM_PAGE_SNOOPED);
-        return r;
 }
 
 /**
@@ -1102,17 +1281,6 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
         radeon_vm_free_pt(rdev, vm);
         mutex_unlock(&rdev->vm_manager.lock);
 
-        /* remove all bo at this point non are busy any more because unbind
-         * waited for the last vm fence to signal
-         */
-        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-        if (!r) {
-                bo_va = radeon_vm_bo_find(vm, rdev->ring_tmp_bo.bo);
-                list_del_init(&bo_va->bo_list);
-                list_del_init(&bo_va->vm_list);
-                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
-                kfree(bo_va);
-        }
         if (!list_empty(&vm->va)) {
                 dev_err(rdev->dev, "still active bo inside vm\n");
         }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 83b8d8aa71c0..dc781c49b96b 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -419,6 +419,7 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
         /* new gpu have virtual address space support */
         if (rdev->family >= CHIP_CAYMAN) {
                 struct radeon_fpriv *fpriv;
+                struct radeon_bo_va *bo_va;
                 int r;
 
                 fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
@@ -426,7 +427,15 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                         return -ENOMEM;
                 }
 
-                r = radeon_vm_init(rdev, &fpriv->vm);
+                radeon_vm_init(rdev, &fpriv->vm);
+
+                /* map the ib pool buffer read only into
+                 * virtual address space */
+                bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
+                                         rdev->ring_tmp_bo.bo);
+                r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
+                                          RADEON_VM_PAGE_READABLE |
+                                          RADEON_VM_PAGE_SNOOPED);
                 if (r) {
                         radeon_vm_fini(rdev, &fpriv->vm);
                         kfree(fpriv);
@@ -454,6 +463,17 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
         /* new gpu have virtual address space support */
         if (rdev->family >= CHIP_CAYMAN && file_priv->driver_priv) {
                 struct radeon_fpriv *fpriv = file_priv->driver_priv;
+                struct radeon_bo_va *bo_va;
+                int r;
+
+                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (!r) {
+                        bo_va = radeon_vm_bo_find(&fpriv->vm,
+                                                  rdev->ring_tmp_bo.bo);
+                        if (bo_va)
+                                radeon_vm_bo_rmv(rdev, bo_va);
+                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                }
 
                 radeon_vm_fini(rdev, &fpriv->vm);
                 kfree(fpriv);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 92487e614778..a13ad9d707cf 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -269,27 +269,6 @@ static const struct drm_encoder_helper_funcs radeon_legacy_lvds_helper_funcs = {
         .disable = radeon_legacy_encoder_disable,
 };
 
-#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
-
-static uint8_t radeon_legacy_lvds_level(struct backlight_device *bd)
-{
-        struct radeon_backlight_privdata *pdata = bl_get_data(bd);
-        uint8_t level;
-
-        /* Convert brightness to hardware level */
-        if (bd->props.brightness < 0)
-                level = 0;
-        else if (bd->props.brightness > RADEON_MAX_BL_LEVEL)
-                level = RADEON_MAX_BL_LEVEL;
-        else
-                level = bd->props.brightness;
-
-        if (pdata->negative)
-                level = RADEON_MAX_BL_LEVEL - level;
-
-        return level;
-}
-
 u8
 radeon_legacy_get_backlight_level(struct radeon_encoder *radeon_encoder)
 {
@@ -331,6 +310,27 @@ radeon_legacy_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 leve
         radeon_legacy_lvds_update(&radeon_encoder->base, dpms_mode);
 }
 
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
+
+static uint8_t radeon_legacy_lvds_level(struct backlight_device *bd)
+{
+        struct radeon_backlight_privdata *pdata = bl_get_data(bd);
+        uint8_t level;
+
+        /* Convert brightness to hardware level */
+        if (bd->props.brightness < 0)
+                level = 0;
+        else if (bd->props.brightness > RADEON_MAX_BL_LEVEL)
+                level = RADEON_MAX_BL_LEVEL;
+        else
+                level = bd->props.brightness;
+
+        if (pdata->negative)
+                level = RADEON_MAX_BL_LEVEL - level;
+
+        return level;
+}
+
 static int radeon_legacy_backlight_update_status(struct backlight_device *bd)
 {
         struct radeon_backlight_privdata *pdata = bl_get_data(bd);
@@ -991,11 +991,7 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
 static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)
 {
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
-        if (tmds) {
-                if (tmds->i2c_bus)
-                        radeon_i2c_destroy(tmds->i2c_bus);
-        }
+        /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */
         kfree(radeon_encoder->enc_priv);
         drm_encoder_cleanup(encoder);
         kfree(radeon_encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index bba66902c83b..47634f27f2e5 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -305,7 +305,7 @@ void radeon_ring_write(struct radeon_ring *ring, uint32_t v)
 {
 #if DRM_DEBUG_CODE
         if (ring->count_dw <= 0) {
-                DRM_ERROR("radeon: writting more dword to ring than expected !\n");
+                DRM_ERROR("radeon: writing more dwords to the ring than expected!\n");
         }
 #endif
         ring->ring[ring->wptr++] = v;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index f79633a036c3..df8dd7701643 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2407,12 +2407,13 @@ static int si_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(0x15DC, 0);
 
         /* empty context1-15 */
-        /* FIXME start with 4G, once using 2 level pt switch to full
-         * vm size space
-         */
         /* set vm size, must be a multiple of 4 */
         WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
         WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
+        /* Assign the pt base to something valid for now; the pts used for
+         * the VMs are determined by the application and setup and assigned
+         * on the fly in the vm part of radeon_gart.c
+         */
         for (i = 1; i < 16; i++) {
                 if (i < 8)
                         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 984a3f13923b..47b8d84b489d 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -205,8 +205,11 @@ static const struct tjmax __cpuinitconst tjmax_table[] = {
         { "CPU N455", 100000 },
         { "CPU N470", 100000 },
         { "CPU N475", 100000 },
-        { "CPU  230", 100000 },
-        { "CPU  330", 125000 },
+        { "CPU  230", 100000 },         /* Model 0x1c, stepping 2       */
+        { "CPU  330", 125000 },         /* Model 0x1c, stepping 2       */
+        { "CPU CE4110", 110000 },       /* Model 0x1c, stepping 10      */
+        { "CPU CE4150", 110000 },       /* Model 0x1c, stepping 10      */
+        { "CPU CE4170", 110000 },       /* Model 0x1c, stepping 10      */
 };
 
 static int __cpuinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id,
diff --git a/drivers/hwmon/pmbus/Kconfig b/drivers/hwmon/pmbus/Kconfig
index 2ca6a5a4f5a7..60745a535821 100644
--- a/drivers/hwmon/pmbus/Kconfig
+++ b/drivers/hwmon/pmbus/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig PMBUS
         tristate "PMBus support"
-        depends on I2C && EXPERIMENTAL
+        depends on I2C
         default n
         help
           Say yes here if you want to enable PMBus support.
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index dd13e3a4c272..4ef0d80b57f4 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -163,19 +163,21 @@ source "drivers/media/common/Kconfig"
 #
 
 config MEDIA_SUBDRV_AUTOSELECT
-        bool "Autoselect analog and hybrid tuner modules to build"
-        depends on MEDIA_TUNER
+        bool "Autoselect tuners and i2c modules to build"
+        depends on MEDIA_ANALOG_TV_SUPPORT || MEDIA_DIGITAL_TV_SUPPORT || MEDIA_CAMERA_SUPPORT
         default y
         help
-          By default, a TV driver auto-selects all possible tuners
-          thar could be used by the driver.
+          By default, a media driver auto-selects all possible i2c
+          devices that are used by any of the supported devices.
 
           This is generally the right thing to do, except when there
-          are strict constraints with regards to the kernel size.
+          are strict constraints with regards to the kernel size,
+          like on embedded systems.
 
-          Use this option with care, as deselecting tuner drivers which
-          are in fact necessary will result in TV devices which cannot
-          be tuned due to lack of the tuning driver.
+          Use this option with care, as deselecting ancillary drivers which
+          are, in fact, necessary will result in the lack of the needed
+          functionality for your device (it may not tune or may not have
+          the need demodulers).
 
           If unsure say Y.
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b721902bb6b4..b2530b002125 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1519,7 +1519,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         /* no need to lock since we're protected by rtnl_lock */
         if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
                 pr_debug("%s: NETIF_F_VLAN_CHALLENGED\n", slave_dev->name);
-                if (bond_vlan_used(bond)) {
+                if (vlan_uses_dev(bond_dev)) {
                         pr_err("%s: Error: cannot enslave VLAN challenged slave %s on VLAN enabled bond %s\n",
                                bond_dev->name, slave_dev->name, bond_dev->name);
                         return -EPERM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 24220992413f..4833b6a9031c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2957,9 +2957,13 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         skb_shinfo(skb)->nr_frags +
                         BDS_PER_TX_PKT +
                         NEXT_CNT_PER_TX_PKT(MAX_BDS_PER_TX_PKT))) {
-                bnx2x_fp_qstats(bp, txdata->parent_fp)->driver_xoff++;
-                netif_tx_stop_queue(txq);
-                BNX2X_ERR("BUG! Tx ring full when queue awake!\n");
+                /* Handle special storage cases separately */
+                if (txdata->tx_ring_size != 0) {
+                        BNX2X_ERR("BUG! Tx ring full when queue awake!\n");
+                        bnx2x_fp_qstats(bp, txdata->parent_fp)->driver_xoff++;
+                        netif_tx_stop_queue(txq);
+                }
+
                 return NETDEV_TX_BUSY;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 71971a161bd1..614981c02264 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -126,7 +126,7 @@ static inline int bnx2x_exe_queue_add(struct bnx2x *bp,
                 /* Check if this request is ok */
                 rc = o->validate(bp, o->owner, elem);
                 if (rc) {
-                        BNX2X_ERR("Preamble failed: %d\n", rc);
+                        DP(BNX2X_MSG_SP, "Preamble failed: %d\n", rc);
                         goto free_and_exit;
                 }
         }
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 72e496f1e9b0..0125524c08c4 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -37,9 +37,9 @@ struct of_bus {
         int             (*match)(struct device_node *parent);
         void            (*count_cells)(struct device_node *child,
                                        int *addrc, int *sizec);
-        u64             (*map)(u32 *addr, const __be32 *range,
+        u64             (*map)(__be32 *addr, const __be32 *range,
                                 int na, int ns, int pna);
-        int             (*translate)(u32 *addr, u64 offset, int na);
+        int             (*translate)(__be32 *addr, u64 offset, int na);
         unsigned int    (*get_flags)(const __be32 *addr);
 };
 
@@ -56,7 +56,7 @@ static void of_bus_default_count_cells(struct device_node *dev,
                 *sizec = of_n_size_cells(dev);
 }
 
-static u64 of_bus_default_map(u32 *addr, const __be32 *range,
+static u64 of_bus_default_map(__be32 *addr, const __be32 *range,
                 int na, int ns, int pna)
 {
         u64 cp, s, da;
@@ -82,7 +82,7 @@ static u64 of_bus_default_map(u32 *addr, const __be32 *range,
         return da - cp;
 }
 
-static int of_bus_default_translate(u32 *addr, u64 offset, int na)
+static int of_bus_default_translate(__be32 *addr, u64 offset, int na)
 {
         u64 a = of_read_number(addr, na);
         memset(addr, 0, na * 4);
@@ -138,7 +138,7 @@ static unsigned int of_bus_pci_get_flags(const __be32 *addr)
         return flags;
 }
 
-static u64 of_bus_pci_map(u32 *addr, const __be32 *range, int na, int ns,
+static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns,
                 int pna)
 {
         u64 cp, s, da;
@@ -165,7 +165,7 @@ static u64 of_bus_pci_map(u32 *addr, const __be32 *range, int na, int ns,
         return da - cp;
 }
 
-static int of_bus_pci_translate(u32 *addr, u64 offset, int na)
+static int of_bus_pci_translate(__be32 *addr, u64 offset, int na)
 {
         return of_bus_default_translate(addr + 1, offset, na - 1);
 }
@@ -247,7 +247,7 @@ static void of_bus_isa_count_cells(struct device_node *child,
                 *sizec = 1;
 }
 
-static u64 of_bus_isa_map(u32 *addr, const __be32 *range, int na, int ns,
+static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns,
                 int pna)
 {
         u64 cp, s, da;
@@ -270,7 +270,7 @@ static u64 of_bus_isa_map(u32 *addr, const __be32 *range, int na, int ns,
         return da - cp;
 }
 
-static int of_bus_isa_translate(u32 *addr, u64 offset, int na)
+static int of_bus_isa_translate(__be32 *addr, u64 offset, int na)
 {
         return of_bus_default_translate(addr + 1, offset, na - 1);
 }
@@ -338,7 +338,7 @@ static struct of_bus *of_match_bus(struct device_node *np)
 }
 
 static int of_translate_one(struct device_node *parent, struct of_bus *bus,
-                            struct of_bus *pbus, u32 *addr,
+                            struct of_bus *pbus, __be32 *addr,
                             int na, int ns, int pna, const char *rprop)
 {
         const __be32 *ranges;
@@ -409,12 +409,12 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
  * that can be mapped to a cpu physical address). This is not really specified
  * that way, but this is traditionally the way IBM at least do things
  */
-u64 __of_translate_address(struct device_node *dev, const __be32 *in_addr,
-                           const char *rprop)
+static u64 __of_translate_address(struct device_node *dev,
+                                  const __be32 *in_addr, const char *rprop)
 {
         struct device_node *parent = NULL;
         struct of_bus *bus, *pbus;
-        u32 addr[OF_MAX_ADDR_CELLS];
+        __be32 addr[OF_MAX_ADDR_CELLS];
         int na, ns, pna, pns;
         u64 result = OF_BAD_ADDR;
 
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index a23ec7779997..a3c1c5aae6a9 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -192,11 +192,13 @@ int of_irq_map_raw(struct device_node *parent, const __be32 *intspec,
                         /* Compare specifiers */
                         match = 1;
                         for (i = 0; i < addrsize && match; ++i) {
-                                u32 mask = imask ? imask[i] : 0xffffffffu;
+                                __be32 mask = imask ? imask[i]
+                                                    : cpu_to_be32(0xffffffffu);
                                 match = ((addr[i] ^ imap[i]) & mask) == 0;
                         }
                         for (; i < (addrsize + intsize) && match; ++i) {
-                                u32 mask = imask ? imask[i] : 0xffffffffu;
+                                __be32 mask = imask ? imask[i]
+                                                    : cpu_to_be32(0xffffffffu);
                                 match =
                                    ((intspec[i-addrsize] ^ imap[i]) & mask) == 0;
                         }
@@ -465,7 +467,7 @@ void __init of_irq_init(const struct of_device_id *matches)
                         pr_debug("of_irq_init: init %s @ %p, parent %p\n",
                                  match->compatible,
                                  desc->dev, desc->interrupt_parent);
-                        irq_init_cb = match->data;
+                        irq_init_cb = (of_irq_init_cb_t)match->data;
                         ret = irq_init_cb(desc->dev, desc->interrupt_parent);
                         if (ret) {
                                 kfree(desc);
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 9bdeaf30b17d..b80891b43816 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -76,7 +76,7 @@ void of_device_make_bus_id(struct device *dev)
 {
         static atomic_t bus_no_reg_magic;
         struct device_node *node = dev->of_node;
-        const u32 *reg;
+        const __be32 *reg;
         u64 addr;
         const __be32 *addrp;
         int magic;
diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c
index b066273b6b4f..7dd879ce514d 100644
--- a/drivers/pcmcia/pxa2xx_sharpsl.c
+++ b/drivers/pcmcia/pxa2xx_sharpsl.c
@@ -194,7 +194,7 @@ static void sharpsl_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
         sharpsl_pcmcia_init_reset(skt);
 }
 
-static struct pcmcia_low_level sharpsl_pcmcia_ops __initdata = {
+static struct pcmcia_low_level sharpsl_pcmcia_ops = {
         .owner                  = THIS_MODULE,
         .hw_init                = sharpsl_pcmcia_hw_init,
         .socket_state           = sharpsl_pcmcia_socket_state,
diff --git a/drivers/pinctrl/pinctrl-bcm2835.c b/drivers/pinctrl/pinctrl-bcm2835.c
index a4adee633fa9..7e9be18ec2d2 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -29,7 +29,6 @@
 #include <linux/irq.h>
 #include <linux/irqdesc.h>
 #include <linux/irqdomain.h>
-#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/of_address.h>
 #include <linux/of.h>
@@ -960,7 +959,7 @@ static int __devinit bcm2835_pinctrl_probe(struct platform_device *pdev)
                 return err;
         }
 
-        pc->base = devm_request_and_ioremap(&pdev->dev, &iomem);
+        pc->base = devm_request_and_ioremap(dev, &iomem);
         if (!pc->base)
                 return -EADDRNOTAVAIL;
 
@@ -1032,7 +1031,7 @@ static int __devinit bcm2835_pinctrl_probe(struct platform_device *pdev)
         pc->pctl_dev = pinctrl_register(&bcm2835_pinctrl_desc, dev, pc);
         if (!pc->pctl_dev) {
                 gpiochip_remove(&pc->gpio_chip);
-                return PTR_ERR(pc->pctl_dev);
+                return -EINVAL;
         }
 
         pc->gpio_range = bcm2835_pinctrl_gpio_range;
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index fec9c30133d4..01aea1c3b5fa 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -30,7 +30,20 @@
 #include <linux/pinctrl/pinconf.h>
 /* Since we request GPIOs from ourself */
 #include <linux/pinctrl/consumer.h>
+/*
+ * For the U8500 archs, use the PRCMU register interface, for the older
+ * Nomadik, provide some stubs. The functions using these will only be
+ * called on the U8500 series.
+ */
+#ifdef CONFIG_ARCH_U8500
 #include <linux/mfd/dbx500-prcmu.h>
+#else
+static inline u32 prcmu_read(unsigned int reg) {
+        return 0;
+}
+static inline void prcmu_write(unsigned int reg, u32 value) {}
+static inline void prcmu_write_masked(unsigned int reg, u32 mask, u32 value) {}
+#endif
 
 #include <asm/mach/irq.h>
 
@@ -1268,6 +1281,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
         struct clk *clk;
         int secondary_irq;
         void __iomem *base;
+        int irq_start = -1;
         int irq;
         int ret;
 
@@ -1371,19 +1385,11 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
 
         platform_set_drvdata(dev, nmk_chip);
 
-        if (np) {
-                /* The DT case will just grab a set of IRQ numbers */
-                nmk_chip->domain = irq_domain_add_linear(np, NMK_GPIO_PER_CHIP,
-                                &nmk_gpio_irq_simple_ops, nmk_chip);
-        } else {
-                /* Non-DT legacy mode, use hardwired IRQ numbers */
-                int irq_start;
-
+        if (!np)
                 irq_start = NOMADIK_GPIO_TO_IRQ(pdata->first_gpio);
-                nmk_chip->domain = irq_domain_add_simple(NULL,
+        nmk_chip->domain = irq_domain_add_simple(NULL,
                                 NMK_GPIO_PER_CHIP, irq_start,
                                 &nmk_gpio_irq_simple_ops, nmk_chip);
-        }
         if (!nmk_chip->domain) {
                 dev_err(&dev->dev, "failed to create irqdomain\n");
                 ret = -ENOSYS;
diff --git a/drivers/pinctrl/pinctrl-samsung.c b/drivers/pinctrl/pinctrl-samsung.c
index dd108a94acf9..861cd5f04d5e 100644
--- a/drivers/pinctrl/pinctrl-samsung.c
+++ b/drivers/pinctrl/pinctrl-samsung.c
@@ -513,7 +513,7 @@ static int samsung_gpio_direction_output(struct gpio_chip *gc, unsigned offset,
  * Parse the pin names listed in the 'samsung,pins' property and convert it
  * into a list of gpio numbers are create a pin group from it.
  */
-static int __init samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
                         struct device_node *cfg_np, struct pinctrl_desc *pctl,
                         unsigned int **pin_list, unsigned int *npins)
 {
@@ -560,7 +560,7 @@ static int __init samsung_pinctrl_parse_dt_pins(struct platform_device *pdev,
  * from device node of the pin-controller. A pin group is formed with all
  * the pins listed in the "samsung,pins" property.
  */
-static int __init samsung_pinctrl_parse_dt(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_parse_dt(struct platform_device *pdev,
                                 struct samsung_pinctrl_drv_data *drvdata)
 {
         struct device *dev = &pdev->dev;
@@ -655,7 +655,7 @@ static int __init samsung_pinctrl_parse_dt(struct platform_device *pdev,
 }
 
 /* register the pinctrl interface with the pinctrl subsystem */
-static int __init samsung_pinctrl_register(struct platform_device *pdev,
+static int __devinit samsung_pinctrl_register(struct platform_device *pdev,
                                 struct samsung_pinctrl_drv_data *drvdata)
 {
         struct pinctrl_desc *ctrldesc = &drvdata->pctl;
@@ -729,7 +729,7 @@ static int __init samsung_pinctrl_register(struct platform_device *pdev,
 }
 
 /* register the gpiolib interface with the gpiolib subsystem */
-static int __init samsung_gpiolib_register(struct platform_device *pdev,
+static int __devinit samsung_gpiolib_register(struct platform_device *pdev,
                                 struct samsung_pinctrl_drv_data *drvdata)
 {
         struct gpio_chip *gc;
@@ -762,7 +762,7 @@ static int __init samsung_gpiolib_register(struct platform_device *pdev,
 }
 
 /* unregister the gpiolib interface with the gpiolib subsystem */
-static int __init samsung_gpiolib_unregister(struct platform_device *pdev,
+static int __devinit samsung_gpiolib_unregister(struct platform_device *pdev,
                                 struct samsung_pinctrl_drv_data *drvdata)
 {
         int ret = gpiochip_remove(drvdata->gc);
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index 675497c15149..9ecacf3d0a75 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1323,41 +1323,6 @@ static inline struct sirfsoc_gpio_bank *sirfsoc_gpio_to_bank(unsigned int gpio)
         return &sgpio_bank[gpio / SIRFSOC_GPIO_BANK_SIZE];
 }
 
-void sirfsoc_gpio_set_pull(unsigned gpio, unsigned mode)
-{
-        struct sirfsoc_gpio_bank *bank = sirfsoc_gpio_to_bank(gpio);
-        int idx = sirfsoc_gpio_to_offset(gpio);
-        u32 val, offset;
-        unsigned long flags;
-
-        offset = SIRFSOC_GPIO_CTRL(bank->id, idx);
-
-        spin_lock_irqsave(&sgpio_lock, flags);
-
-        val = readl(bank->chip.regs + offset);
-
-        switch (mode) {
-        case SIRFSOC_GPIO_PULL_NONE:
-                val &= ~SIRFSOC_GPIO_CTL_PULL_MASK;
-                break;
-        case SIRFSOC_GPIO_PULL_UP:
-                val |= SIRFSOC_GPIO_CTL_PULL_MASK;
-                val |= SIRFSOC_GPIO_CTL_PULL_HIGH;
-                break;
-        case SIRFSOC_GPIO_PULL_DOWN:
-                val |= SIRFSOC_GPIO_CTL_PULL_MASK;
-                val &= ~SIRFSOC_GPIO_CTL_PULL_HIGH;
-                break;
-        default:
-                break;
-        }
-
-        writel(val, bank->chip.regs + offset);
-
-        spin_unlock_irqrestore(&sgpio_lock, flags);
-}
-EXPORT_SYMBOL(sirfsoc_gpio_set_pull);
-
 static inline struct sirfsoc_gpio_bank *sirfsoc_irqchip_to_bank(struct gpio_chip *chip)
 {
         return container_of(to_of_mm_gpio_chip(chip), struct sirfsoc_gpio_bank, chip);
diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
index f8d917d40c92..b9bcaec66223 100644
--- a/drivers/pinctrl/pinctrl-xway.c
+++ b/drivers/pinctrl/pinctrl-xway.c
@@ -17,8 +17,6 @@
 #include <linux/ioport.h>
 #include <linux/io.h>
 #include <linux/device.h>
-#include <linux/module.h>
-#include <linux/io.h>
 #include <linux/platform_device.h>
 
 #include "pinctrl-lantiq.h"
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2db409330c21..e67e0258aec5 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1141,11 +1141,12 @@ static int qeth_l2_recover(void *ptr)
                 dev_info(&card->gdev->dev,
                         "Device successfully recovered!\n");
         else {
-                rtnl_lock();
-                dev_close(card->dev);
-                rtnl_unlock();
-                dev_warn(&card->gdev->dev, "The qeth device driver "
-                        "failed to recover an error on the device\n");
+                if (rtnl_trylock()) {
+                        dev_close(card->dev);
+                        rtnl_unlock();
+                        dev_warn(&card->gdev->dev, "The qeth device driver "
+                                "failed to recover an error on the device\n");
+                }
         }
         qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
         qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 4cd310cb5bdf..5ba390658498 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3510,11 +3510,12 @@ static int qeth_l3_recover(void *ptr)
                 dev_info(&card->gdev->dev,
                         "Device successfully recovered!\n");
         else {
-                rtnl_lock();
-                dev_close(card->dev);
-                rtnl_unlock();
-                dev_warn(&card->gdev->dev, "The qeth device driver "
-                        "failed to recover an error on the device\n");
+                if (rtnl_trylock()) {
+                        dev_close(card->dev);
+                        rtnl_unlock();
+                        dev_warn(&card->gdev->dev, "The qeth device driver "
+                                "failed to recover an error on the device\n");
+                }
         }
         qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
         qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 207b7d742443..d8f990b6b332 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -157,7 +157,7 @@ static int smsg_pm_restore_thaw(struct device *dev)
 #ifdef CONFIG_PM_DEBUG
         printk(KERN_WARNING "smsg_pm_restore_thaw\n");
 #endif
-        if (smsg_path && iucv_path_connected) {
+        if (smsg_path && !iucv_path_connected) {
                 memset(smsg_path, 0, sizeof(*smsg_path));
                 smsg_path->msglim = 255;
                 smsg_path->flags = 0;
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 6206a666a8ec..737554c37d9e 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -179,6 +179,7 @@ static void print_SCp(struct scsi_pointer *SCp, const char *prefix, const char *
                 SCp->buffers_residual, suffix);
 }
 
+#ifdef CHECK_STRUCTURE
 static void fas216_dumpinfo(FAS216_Info *info)
 {
         static int used = 0;
@@ -223,7 +224,6 @@ static void fas216_dumpinfo(FAS216_Info *info)
                 info->internal_done, info->magic_end);
 }
 
-#ifdef CHECK_STRUCTURE
 static void __fas216_checkmagic(FAS216_Info *info, const char *func)
 {
         int corruption = 0;
diff --git a/drivers/scsi/arm/oak.c b/drivers/scsi/arm/oak.c
index d25f944b59c2..fc6a5aabf66e 100644
--- a/drivers/scsi/arm/oak.c
+++ b/drivers/scsi/arm/oak.c
@@ -21,6 +21,7 @@
 /*#define PSEUDO_DMA*/
 
 #define OAKSCSI_PUBLIC_RELEASE 1
+#define DONT_USE_INTR
 
 #define priv(host)                      ((struct NCR5380_hostdata *)(host)->hostdata)
 #define NCR5380_local_declare()         void __iomem *_base
diff --git a/drivers/sh/intc/access.c b/drivers/sh/intc/access.c
index f892ae1d212a..114390f967d2 100644
--- a/drivers/sh/intc/access.c
+++ b/drivers/sh/intc/access.c
@@ -75,54 +75,61 @@ unsigned long intc_get_field_from_handle(unsigned int value, unsigned int handle
 static unsigned long test_8(unsigned long addr, unsigned long h,
                             unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readb(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readb(ptr), h);
 }
 
 static unsigned long test_16(unsigned long addr, unsigned long h,
                              unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readw(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readw(ptr), h);
 }
 
 static unsigned long test_32(unsigned long addr, unsigned long h,
                              unsigned long ignore)
 {
-        return intc_get_field_from_handle(__raw_readl(addr), h);
+        void __iomem *ptr = (void __iomem *)addr;
+        return intc_get_field_from_handle(__raw_readl(ptr), h);
 }
 
 static unsigned long write_8(unsigned long addr, unsigned long h,
                              unsigned long data)
 {
-        __raw_writeb(intc_set_field_from_handle(0, data, h), addr);
-        (void)__raw_readb(addr);        /* Defeat write posting */
+        void __iomem *ptr = (void __iomem *)addr;
+        __raw_writeb(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readb(ptr); /* Defeat write posting */
         return 0;
 }
 
 static unsigned long write_16(unsigned long addr, unsigned long h,
                               unsigned long data)
 {
-        __raw_writew(intc_set_field_from_handle(0, data, h), addr);
-        (void)__raw_readw(addr);        /* Defeat write posting */
+        void __iomem *ptr = (void __iomem *)addr;
+        __raw_writew(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readw(ptr); /* Defeat write posting */
         return 0;
 }
 
 static unsigned long write_32(unsigned long addr, unsigned long h,
                               unsigned long data)
 {
-        __raw_writel(intc_set_field_from_handle(0, data, h), addr);
-        (void)__raw_readl(addr);        /* Defeat write posting */
+        void __iomem *ptr = (void __iomem *)addr;
+        __raw_writel(intc_set_field_from_handle(0, data, h), ptr);
+        (void)__raw_readl(ptr); /* Defeat write posting */
         return 0;
 }
 
 static unsigned long modify_8(unsigned long addr, unsigned long h,
                               unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
         unsigned long flags;
         unsigned int value;
         local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readb(addr), data, h);
-        __raw_writeb(value, addr);
-        (void)__raw_readb(addr);        /* Defeat write posting */
+        value = intc_set_field_from_handle(__raw_readb(ptr), data, h);
+        __raw_writeb(value, ptr);
+        (void)__raw_readb(ptr); /* Defeat write posting */
         local_irq_restore(flags);
         return 0;
 }
@@ -130,12 +137,13 @@ static unsigned long modify_8(unsigned long addr, unsigned long h,
 static unsigned long modify_16(unsigned long addr, unsigned long h,
                                unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
         unsigned long flags;
         unsigned int value;
         local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readw(addr), data, h);
-        __raw_writew(value, addr);
-        (void)__raw_readw(addr);        /* Defeat write posting */
+        value = intc_set_field_from_handle(__raw_readw(ptr), data, h);
+        __raw_writew(value, ptr);
+        (void)__raw_readw(ptr); /* Defeat write posting */
         local_irq_restore(flags);
         return 0;
 }
@@ -143,12 +151,13 @@ static unsigned long modify_16(unsigned long addr, unsigned long h,
 static unsigned long modify_32(unsigned long addr, unsigned long h,
                                unsigned long data)
 {
+        void __iomem *ptr = (void __iomem *)addr;
         unsigned long flags;
         unsigned int value;
         local_irq_save(flags);
-        value = intc_set_field_from_handle(__raw_readl(addr), data, h);
-        __raw_writel(value, addr);
-        (void)__raw_readl(addr);        /* Defeat write posting */
+        value = intc_set_field_from_handle(__raw_readl(ptr), data, h);
+        __raw_writel(value, ptr);
+        (void)__raw_readl(ptr); /* Defeat write posting */
         local_irq_restore(flags);
         return 0;
 }
diff --git a/drivers/sh/intc/chip.c b/drivers/sh/intc/chip.c
index 012df2676a26..46427b48e2f1 100644
--- a/drivers/sh/intc/chip.c
+++ b/drivers/sh/intc/chip.c
@@ -83,7 +83,7 @@ static void intc_mask_ack(struct irq_data *data)
         unsigned int irq = data->irq;
         struct intc_desc_int *d = get_intc_desc(irq);
         unsigned long handle = intc_get_ack_handle(irq);
-        unsigned long addr;
+        void __iomem *addr;
 
         intc_disable(data);
 
@@ -91,7 +91,7 @@ static void intc_mask_ack(struct irq_data *data)
         if (handle) {
                 unsigned int value;
 
-                addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+                addr = (void __iomem *)INTC_REG(d, _INTC_ADDR_D(handle), 0);
                 value = intc_set_field_from_handle(0, 1, handle);
 
                 switch (_INTC_FN(handle)) {
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 1a81c90a4a71..6e7a805d324d 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -132,7 +132,7 @@
 
 struct s3c64xx_spi_dma_data {
         unsigned                ch;
-        enum dma_data_direction direction;
+        enum dma_transfer_direction direction;
         enum dma_ch     dmach;
         struct property         *dma_prop;
 };
@@ -1067,11 +1067,11 @@ static int __devinit s3c64xx_spi_get_dmares(
 
         if (tx) {
                 dma_data = &sdd->tx_dma;
-                dma_data->direction = DMA_TO_DEVICE;
+                dma_data->direction = DMA_MEM_TO_DEV;
                 chan_str = "tx";
         } else {
                 dma_data = &sdd->rx_dma;
-                dma_data->direction = DMA_FROM_DEVICE;
+                dma_data->direction = DMA_DEV_TO_MEM;
                 chan_str = "rx";
         }
 
diff --git a/drivers/staging/dgrp/dgrp_mon_ops.c b/drivers/staging/dgrp/dgrp_mon_ops.c
index 268dcb95204b..4792d056a365 100644
--- a/drivers/staging/dgrp/dgrp_mon_ops.c
+++ b/drivers/staging/dgrp/dgrp_mon_ops.c
@@ -38,6 +38,7 @@
 #include <linux/sched.h>
 #include <asm/unaligned.h>
 #include <linux/proc_fs.h>
+#include <linux/uaccess.h>
 
 #include "dgrp_common.h"
 
diff --git a/drivers/staging/dgrp/dgrp_specproc.c b/drivers/staging/dgrp/dgrp_specproc.c
index 28f5c9ab6b43..24327c3bad83 100644
--- a/drivers/staging/dgrp/dgrp_specproc.c
+++ b/drivers/staging/dgrp/dgrp_specproc.c
@@ -39,6 +39,7 @@
 #include <linux/proc_fs.h>
 #include <linux/ctype.h>
 #include <linux/seq_file.h>
+#include <linux/uaccess.h>
 #include <linux/vmalloc.h>
 
 #include "dgrp_common.h"
@@ -228,6 +229,9 @@ static void register_proc_table(struct dgrp_proc_entry *table,
         int len;
         mode_t mode;
 
+        if (table == NULL)
+                return;
+
         for (; table->id; table++) {
                 /* Can't do anything without a proc name. */
                 if (!table->name)
@@ -296,6 +300,9 @@ static void unregister_proc_table(struct dgrp_proc_entry *table,
         struct proc_dir_entry *de;
         struct nd_struct *tmp;
 
+        if (table == NULL)
+                return;
+
         list_for_each_entry(tmp, &nd_struct_list, list) {
                 if ((table == dgrp_net_table) && (tmp->nd_net_de)) {
                         unregister_dgrp_device(tmp->nd_net_de);
diff --git a/drivers/staging/dgrp/dgrp_tty.c b/drivers/staging/dgrp/dgrp_tty.c
index 7d7de873870c..e125b03598d7 100644
--- a/drivers/staging/dgrp/dgrp_tty.c
+++ b/drivers/staging/dgrp/dgrp_tty.c
@@ -40,6 +40,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/sched.h>
+#include <linux/uaccess.h>
 
 #include "dgrp_common.h"
 
@@ -3172,6 +3173,9 @@ dgrp_tty_init(struct nd_struct *nd)
          */
 
         nd->nd_serial_ttdriver = alloc_tty_driver(CHAN_MAX);
+        if (!nd->nd_serial_ttdriver)
+                return -ENOMEM;
+
         sprintf(nd->nd_serial_name,  "tty_dgrp_%s_", id);
 
         nd->nd_serial_ttdriver->owner = THIS_MODULE;
@@ -3231,6 +3235,9 @@ dgrp_tty_init(struct nd_struct *nd)
         }
 
         nd->nd_callout_ttdriver = alloc_tty_driver(CHAN_MAX);
+        if (!nd->nd_callout_ttdriver)
+                return -ENOMEM;
+
         sprintf(nd->nd_callout_name, "cu_dgrp_%s_",  id);
 
         nd->nd_callout_ttdriver->owner = THIS_MODULE;
@@ -3268,6 +3275,9 @@ dgrp_tty_init(struct nd_struct *nd)
 
 
         nd->nd_xprint_ttdriver = alloc_tty_driver(CHAN_MAX);
+        if (!nd->nd_xprint_ttdriver)
+                return -ENOMEM;
+
         sprintf(nd->nd_xprint_name,  "pr_dgrp_%s_", id);
 
         nd->nd_xprint_ttdriver->owner = THIS_MODULE;
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index edfd67d25013..e1cb6bd75f60 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -22,6 +22,7 @@ config THERMAL_HWMON
 config CPU_THERMAL
         bool "generic cpu cooling support"
         depends on THERMAL && CPU_FREQ
+        select CPU_FREQ_TABLE
         help
           This implements the generic cpu cooling mechanism through frequency
           reduction, cpu hotplug and any other ways of reducing temperature. An
@@ -50,6 +51,7 @@ config RCAR_THERMAL
 config EXYNOS_THERMAL
         tristate "Temperature sensor on Samsung EXYNOS"
         depends on (ARCH_EXYNOS4 || ARCH_EXYNOS5) && THERMAL
+        select CPU_FREQ_TABLE
         help
           If you say yes here you get support for TMU (Thermal Managment
           Unit) on SAMSUNG EXYNOS series of SoC.
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 8c0b7b42319c..60b076cc4e20 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -73,10 +73,42 @@
 #define ECHO_OP_SET_CANON_COL 0x81
 #define ECHO_OP_ERASE_TAB 0x82
 
+struct n_tty_data {
+        unsigned int column;
+        unsigned long overrun_time;
+        int num_overrun;
+
+        unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
+        unsigned char echo_overrun:1;
+
+        DECLARE_BITMAP(process_char_map, 256);
+        DECLARE_BITMAP(read_flags, N_TTY_BUF_SIZE);
+
+        char *read_buf;
+        int read_head;
+        int read_tail;
+        int read_cnt;
+
+        unsigned char *echo_buf;
+        unsigned int echo_pos;
+        unsigned int echo_cnt;
+
+        int canon_data;
+        unsigned long canon_head;
+        unsigned int canon_column;
+
+        struct mutex atomic_read_lock;
+        struct mutex output_lock;
+        struct mutex echo_lock;
+        spinlock_t read_lock;
+};
+
 static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
                                unsigned char __user *ptr)
 {
-        tty_audit_add_data(tty, &x, 1);
+        struct n_tty_data *ldata = tty->disc_data;
+
+        tty_audit_add_data(tty, &x, 1, ldata->icanon);
         return put_user(x, ptr);
 }
 
@@ -92,17 +124,18 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
 
 static void n_tty_set_room(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int left;
         int old_left;
 
-        /* tty->read_cnt is not read locked ? */
+        /* ldata->read_cnt is not read locked ? */
         if (I_PARMRK(tty)) {
                 /* Multiply read_cnt by 3, since each byte might take up to
                  * three times as many spaces when PARMRK is set (depending on
                  * its flags, e.g. parity error). */
-                left = N_TTY_BUF_SIZE - tty->read_cnt * 3 - 1;
+                left = N_TTY_BUF_SIZE - ldata->read_cnt * 3 - 1;
         } else
-                left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+                left = N_TTY_BUF_SIZE - ldata->read_cnt - 1;
 
         /*
          * If we are doing input canonicalization, and there are no
@@ -111,44 +144,47 @@ static void n_tty_set_room(struct tty_struct *tty)
          * characters will be beeped.
          */
         if (left <= 0)
-                left = tty->icanon && !tty->canon_data;
+                left = ldata->icanon && !ldata->canon_data;
         old_left = tty->receive_room;
         tty->receive_room = left;
 
         /* Did this open up the receive buffer? We may need to flip */
-        if (left && !old_left)
-                schedule_work(&tty->buf.work);
+        if (left && !old_left) {
+                WARN_RATELIMIT(tty->port->itty == NULL,
+                                "scheduling with invalid itty");
+                schedule_work(&tty->port->buf.work);
+        }
 }
 
-static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
+static void put_tty_queue_nolock(unsigned char c, struct n_tty_data *ldata)
 {
-        if (tty->read_cnt < N_TTY_BUF_SIZE) {
-                tty->read_buf[tty->read_head] = c;
-                tty->read_head = (tty->read_head + 1) & (N_TTY_BUF_SIZE-1);
-                tty->read_cnt++;
+        if (ldata->read_cnt < N_TTY_BUF_SIZE) {
+                ldata->read_buf[ldata->read_head] = c;
+                ldata->read_head = (ldata->read_head + 1) & (N_TTY_BUF_SIZE-1);
+                ldata->read_cnt++;
         }
 }
 
 /**
  *      put_tty_queue           -       add character to tty
  *      @c: character
- *      @tty: tty device
+ *      @ldata: n_tty data
  *
  *      Add a character to the tty read_buf queue. This is done under the
  *      read_lock to serialize character addition and also to protect us
  *      against parallel reads or flushes
  */
 
-static void put_tty_queue(unsigned char c, struct tty_struct *tty)
+static void put_tty_queue(unsigned char c, struct n_tty_data *ldata)
 {
         unsigned long flags;
         /*
          *      The problem of stomping on the buffers ends here.
          *      Why didn't anyone see this one coming? --AJK
         */
-        spin_lock_irqsave(&tty->read_lock, flags);
-        put_tty_queue_nolock(c, tty);
-        spin_unlock_irqrestore(&tty->read_lock, flags);
+        spin_lock_irqsave(&ldata->read_lock, flags);
+        put_tty_queue_nolock(c, ldata);
+        spin_unlock_irqrestore(&ldata->read_lock, flags);
 }
 
 /**
@@ -179,18 +215,19 @@ static void check_unthrottle(struct tty_struct *tty)
 
 static void reset_buffer_flags(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         unsigned long flags;
 
-        spin_lock_irqsave(&tty->read_lock, flags);
-        tty->read_head = tty->read_tail = tty->read_cnt = 0;
-        spin_unlock_irqrestore(&tty->read_lock, flags);
+        spin_lock_irqsave(&ldata->read_lock, flags);
+        ldata->read_head = ldata->read_tail = ldata->read_cnt = 0;
+        spin_unlock_irqrestore(&ldata->read_lock, flags);
 
-        mutex_lock(&tty->echo_lock);
-        tty->echo_pos = tty->echo_cnt = tty->echo_overrun = 0;
-        mutex_unlock(&tty->echo_lock);
+        mutex_lock(&ldata->echo_lock);
+        ldata->echo_pos = ldata->echo_cnt = ldata->echo_overrun = 0;
+        mutex_unlock(&ldata->echo_lock);
 
-        tty->canon_head = tty->canon_data = tty->erasing = 0;
-        memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        ldata->canon_head = ldata->canon_data = ldata->erasing = 0;
+        bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
         n_tty_set_room(tty);
 }
 
@@ -235,18 +272,19 @@ static void n_tty_flush_buffer(struct tty_struct *tty)
 
 static ssize_t n_tty_chars_in_buffer(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         unsigned long flags;
         ssize_t n = 0;
 
-        spin_lock_irqsave(&tty->read_lock, flags);
-        if (!tty->icanon) {
-                n = tty->read_cnt;
-        } else if (tty->canon_data) {
-                n = (tty->canon_head > tty->read_tail) ?
-                        tty->canon_head - tty->read_tail :
-                        tty->canon_head + (N_TTY_BUF_SIZE - tty->read_tail);
+        spin_lock_irqsave(&ldata->read_lock, flags);
+        if (!ldata->icanon) {
+                n = ldata->read_cnt;
+        } else if (ldata->canon_data) {
+                n = (ldata->canon_head > ldata->read_tail) ?
+                        ldata->canon_head - ldata->read_tail :
+                        ldata->canon_head + (N_TTY_BUF_SIZE - ldata->read_tail);
         }
-        spin_unlock_irqrestore(&tty->read_lock, flags);
+        spin_unlock_irqrestore(&ldata->read_lock, flags);
         return n;
 }
 
@@ -301,6 +339,7 @@ static inline int is_continuation(unsigned char c, struct tty_struct *tty)
 
 static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int     spaces;
 
         if (!space)
@@ -309,48 +348,48 @@ static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
         switch (c) {
         case '\n':
                 if (O_ONLRET(tty))
-                        tty->column = 0;
+                        ldata->column = 0;
                 if (O_ONLCR(tty)) {
                         if (space < 2)
                                 return -1;
-                        tty->canon_column = tty->column = 0;
+                        ldata->canon_column = ldata->column = 0;
                         tty->ops->write(tty, "\r\n", 2);
                         return 2;
                 }
-                tty->canon_column = tty->column;
+                ldata->canon_column = ldata->column;
                 break;
         case '\r':
-                if (O_ONOCR(tty) && tty->column == 0)
+                if (O_ONOCR(tty) && ldata->column == 0)
                         return 0;
                 if (O_OCRNL(tty)) {
                         c = '\n';
                         if (O_ONLRET(tty))
-                                tty->canon_column = tty->column = 0;
+                                ldata->canon_column = ldata->column = 0;
                         break;
                 }
-                tty->canon_column = tty->column = 0;
+                ldata->canon_column = ldata->column = 0;
                 break;
         case '\t':
-                spaces = 8 - (tty->column & 7);
+                spaces = 8 - (ldata->column & 7);
                 if (O_TABDLY(tty) == XTABS) {
                         if (space < spaces)
                                 return -1;
-                        tty->column += spaces;
+                        ldata->column += spaces;
                         tty->ops->write(tty, "        ", spaces);
                         return spaces;
                 }
-                tty->column += spaces;
+                ldata->column += spaces;
                 break;
         case '\b':
-                if (tty->column > 0)
-                        tty->column--;
+                if (ldata->column > 0)
+                        ldata->column--;
                 break;
         default:
                 if (!iscntrl(c)) {
                         if (O_OLCUC(tty))
                                 c = toupper(c);
                         if (!is_continuation(c, tty))
-                                tty->column++;
+                                ldata->column++;
                 }
                 break;
         }
@@ -375,14 +414,15 @@ static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
 
 static int process_output(unsigned char c, struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int     space, retval;
 
-        mutex_lock(&tty->output_lock);
+        mutex_lock(&ldata->output_lock);
 
         space = tty_write_room(tty);
         retval = do_output_char(c, tty, space);
 
-        mutex_unlock(&tty->output_lock);
+        mutex_unlock(&ldata->output_lock);
         if (retval < 0)
                 return -1;
         else
@@ -411,15 +451,16 @@ static int process_output(unsigned char c, struct tty_struct *tty)
 static ssize_t process_output_block(struct tty_struct *tty,
                                     const unsigned char *buf, unsigned int nr)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int     space;
         int     i;
         const unsigned char *cp;
 
-        mutex_lock(&tty->output_lock);
+        mutex_lock(&ldata->output_lock);
 
         space = tty_write_room(tty);
         if (!space) {
-                mutex_unlock(&tty->output_lock);
+                mutex_unlock(&ldata->output_lock);
                 return 0;
         }
         if (nr > space)
@@ -431,30 +472,30 @@ static ssize_t process_output_block(struct tty_struct *tty,
                 switch (c) {
                 case '\n':
                         if (O_ONLRET(tty))
-                                tty->column = 0;
+                                ldata->column = 0;
                         if (O_ONLCR(tty))
                                 goto break_out;
-                        tty->canon_column = tty->column;
+                        ldata->canon_column = ldata->column;
                         break;
                 case '\r':
-                        if (O_ONOCR(tty) && tty->column == 0)
+                        if (O_ONOCR(tty) && ldata->column == 0)
                                 goto break_out;
                         if (O_OCRNL(tty))
                                 goto break_out;
-                        tty->canon_column = tty->column = 0;
+                        ldata->canon_column = ldata->column = 0;
                         break;
                 case '\t':
                         goto break_out;
                 case '\b':
-                        if (tty->column > 0)
-                                tty->column--;
+                        if (ldata->column > 0)
+                                ldata->column--;
                         break;
                 default:
                         if (!iscntrl(c)) {
                                 if (O_OLCUC(tty))
                                         goto break_out;
                                 if (!is_continuation(c, tty))
-                                        tty->column++;
+                                        ldata->column++;
                         }
                         break;
                 }
@@ -462,7 +503,7 @@ static ssize_t process_output_block(struct tty_struct *tty,
 break_out:
         i = tty->ops->write(tty, buf, i);
 
-        mutex_unlock(&tty->output_lock);
+        mutex_unlock(&ldata->output_lock);
         return i;
 }
 
@@ -494,21 +535,22 @@ break_out:
 
 static void process_echoes(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int     space, nr;
         unsigned char c;
         unsigned char *cp, *buf_end;
 
-        if (!tty->echo_cnt)
+        if (!ldata->echo_cnt)
                 return;
 
-        mutex_lock(&tty->output_lock);
-        mutex_lock(&tty->echo_lock);
+        mutex_lock(&ldata->output_lock);
+        mutex_lock(&ldata->echo_lock);
 
         space = tty_write_room(tty);
 
-        buf_end = tty->echo_buf + N_TTY_BUF_SIZE;
-        cp = tty->echo_buf + tty->echo_pos;
-        nr = tty->echo_cnt;
+        buf_end = ldata->echo_buf + N_TTY_BUF_SIZE;
+        cp = ldata->echo_buf + ldata->echo_pos;
+        nr = ldata->echo_cnt;
         while (nr > 0) {
                 c = *cp;
                 if (c == ECHO_OP_START) {
@@ -545,7 +587,7 @@ static void process_echoes(struct tty_struct *tty)
                                  * Otherwise, tab spacing is normal.
                                  */
                                 if (!(num_chars & 0x80))
-                                        num_chars += tty->canon_column;
+                                        num_chars += ldata->canon_column;
                                 num_bs = 8 - (num_chars & 7);
 
                                 if (num_bs > space) {
@@ -555,22 +597,22 @@ static void process_echoes(struct tty_struct *tty)
                                 space -= num_bs;
                                 while (num_bs--) {
                                         tty_put_char(tty, '\b');
-                                        if (tty->column > 0)
-                                                tty->column--;
+                                        if (ldata->column > 0)
+                                                ldata->column--;
                                 }
                                 cp += 3;
                                 nr -= 3;
                                 break;
 
                         case ECHO_OP_SET_CANON_COL:
-                                tty->canon_column = tty->column;
+                                ldata->canon_column = ldata->column;
                                 cp += 2;
                                 nr -= 2;
                                 break;
 
                         case ECHO_OP_MOVE_BACK_COL:
-                                if (tty->column > 0)
-                                        tty->column--;
+                                if (ldata->column > 0)
+                                        ldata->column--;
                                 cp += 2;
                                 nr -= 2;
                                 break;
@@ -582,7 +624,7 @@ static void process_echoes(struct tty_struct *tty)
                                         break;
                                 }
                                 tty_put_char(tty, ECHO_OP_START);
-                                tty->column++;
+                                ldata->column++;
                                 space--;
                                 cp += 2;
                                 nr -= 2;
@@ -604,7 +646,7 @@ static void process_echoes(struct tty_struct *tty)
                                 }
                                 tty_put_char(tty, '^');
                                 tty_put_char(tty, op ^ 0100);
-                                tty->column += 2;
+                                ldata->column += 2;
                                 space -= 2;
                                 cp += 2;
                                 nr -= 2;
@@ -635,20 +677,20 @@ static void process_echoes(struct tty_struct *tty)
         }
 
         if (nr == 0) {
-                tty->echo_pos = 0;
-                tty->echo_cnt = 0;
-                tty->echo_overrun = 0;
+                ldata->echo_pos = 0;
+                ldata->echo_cnt = 0;
+                ldata->echo_overrun = 0;
         } else {
-                int num_processed = tty->echo_cnt - nr;
-                tty->echo_pos += num_processed;
-                tty->echo_pos &= N_TTY_BUF_SIZE - 1;
-                tty->echo_cnt = nr;
+                int num_processed = ldata->echo_cnt - nr;
+                ldata->echo_pos += num_processed;
+                ldata->echo_pos &= N_TTY_BUF_SIZE - 1;
+                ldata->echo_cnt = nr;
                 if (num_processed > 0)
-                        tty->echo_overrun = 0;
+                        ldata->echo_overrun = 0;
         }
 
-        mutex_unlock(&tty->echo_lock);
-        mutex_unlock(&tty->output_lock);
+        mutex_unlock(&ldata->echo_lock);
+        mutex_unlock(&ldata->output_lock);
 
         if (tty->ops->flush_chars)
                 tty->ops->flush_chars(tty);
@@ -657,72 +699,70 @@ static void process_echoes(struct tty_struct *tty)
 /**
  *      add_echo_byte   -       add a byte to the echo buffer
  *      @c: unicode byte to echo
- *      @tty: terminal device
+ *      @ldata: n_tty data
  *
  *      Add a character or operation byte to the echo buffer.
  *
  *      Should be called under the echo lock to protect the echo buffer.
  */
 
-static void add_echo_byte(unsigned char c, struct tty_struct *tty)
+static void add_echo_byte(unsigned char c, struct n_tty_data *ldata)
 {
         int     new_byte_pos;
 
-        if (tty->echo_cnt == N_TTY_BUF_SIZE) {
+        if (ldata->echo_cnt == N_TTY_BUF_SIZE) {
                 /* Circular buffer is already at capacity */
-                new_byte_pos = tty->echo_pos;
+                new_byte_pos = ldata->echo_pos;
 
                 /*
                  * Since the buffer start position needs to be advanced,
                  * be sure to step by a whole operation byte group.
                  */
-                if (tty->echo_buf[tty->echo_pos] == ECHO_OP_START) {
-                        if (tty->echo_buf[(tty->echo_pos + 1) &
+                if (ldata->echo_buf[ldata->echo_pos] == ECHO_OP_START) {
+                        if (ldata->echo_buf[(ldata->echo_pos + 1) &
                                           (N_TTY_BUF_SIZE - 1)] ==
                                                 ECHO_OP_ERASE_TAB) {
-                                tty->echo_pos += 3;
-                                tty->echo_cnt -= 2;
+                                ldata->echo_pos += 3;
+                                ldata->echo_cnt -= 2;
                         } else {
-                                tty->echo_pos += 2;
-                                tty->echo_cnt -= 1;
+                                ldata->echo_pos += 2;
+                                ldata->echo_cnt -= 1;
                         }
                 } else {
-                        tty->echo_pos++;
+                        ldata->echo_pos++;
                 }
-                tty->echo_pos &= N_TTY_BUF_SIZE - 1;
+                ldata->echo_pos &= N_TTY_BUF_SIZE - 1;
 
-                tty->echo_overrun = 1;
+                ldata->echo_overrun = 1;
         } else {
-                new_byte_pos = tty->echo_pos + tty->echo_cnt;
+                new_byte_pos = ldata->echo_pos + ldata->echo_cnt;
                 new_byte_pos &= N_TTY_BUF_SIZE - 1;
-                tty->echo_cnt++;
+                ldata->echo_cnt++;
         }
 
-        tty->echo_buf[new_byte_pos] = c;
+        ldata->echo_buf[new_byte_pos] = c;
 }
 
 /**
  *      echo_move_back_col      -       add operation to move back a column
- *      @tty: terminal device
+ *      @ldata: n_tty data
  *
  *      Add an operation to the echo buffer to move back one column.
  *
  *      Locking: echo_lock to protect the echo buffer
  */
 
-static void echo_move_back_col(struct tty_struct *tty)
+static void echo_move_back_col(struct n_tty_data *ldata)
 {
-        mutex_lock(&tty->echo_lock);
-
-        add_echo_byte(ECHO_OP_START, tty);
-        add_echo_byte(ECHO_OP_MOVE_BACK_COL, tty);
-
-        mutex_unlock(&tty->echo_lock);
+        mutex_lock(&ldata->echo_lock);
+        add_echo_byte(ECHO_OP_START, ldata);
+        add_echo_byte(ECHO_OP_MOVE_BACK_COL, ldata);
+        mutex_unlock(&ldata->echo_lock);
 }
 
 /**
  *      echo_set_canon_col      -       add operation to set the canon column
- *      @tty: terminal device
+ *      @ldata: n_tty data
  *
  *      Add an operation to the echo buffer to set the canon column
  *      to the current column.
@@ -730,21 +770,19 @@ static void echo_move_back_col(struct tty_struct *tty)
  *      Locking: echo_lock to protect the echo buffer
  */
 
-static void echo_set_canon_col(struct tty_struct *tty)
+static void echo_set_canon_col(struct n_tty_data *ldata)
 {
-        mutex_lock(&tty->echo_lock);
-
-        add_echo_byte(ECHO_OP_START, tty);
-        add_echo_byte(ECHO_OP_SET_CANON_COL, tty);
-
-        mutex_unlock(&tty->echo_lock);
+        mutex_lock(&ldata->echo_lock);
+        add_echo_byte(ECHO_OP_START, ldata);
+        add_echo_byte(ECHO_OP_SET_CANON_COL, ldata);
+        mutex_unlock(&ldata->echo_lock);
 }
 
 /**
  *      echo_erase_tab  -       add operation to erase a tab
  *      @num_chars: number of character columns already used
  *      @after_tab: true if num_chars starts after a previous tab
- *      @tty: terminal device
+ *      @ldata: n_tty data
  *
  *      Add an operation to the echo buffer to erase a tab.
  *
@@ -758,12 +796,12 @@ static void echo_set_canon_col(struct tty_struct *tty)
  */
 
 static void echo_erase_tab(unsigned int num_chars, int after_tab,
-                           struct tty_struct *tty)
+                           struct n_tty_data *ldata)
 {
-        mutex_lock(&tty->echo_lock);
+        mutex_lock(&ldata->echo_lock);
 
-        add_echo_byte(ECHO_OP_START, tty);
-        add_echo_byte(ECHO_OP_ERASE_TAB, tty);
+        add_echo_byte(ECHO_OP_START, ldata);
+        add_echo_byte(ECHO_OP_ERASE_TAB, ldata);
 
         /* We only need to know this modulo 8 (tab spacing) */
         num_chars &= 7;
@@ -772,9 +810,9 @@ static void echo_erase_tab(unsigned int num_chars, int after_tab,
         if (after_tab)
                 num_chars |= 0x80;
 
-        add_echo_byte(num_chars, tty);
+        add_echo_byte(num_chars, ldata);
 
-        mutex_unlock(&tty->echo_lock);
+        mutex_unlock(&ldata->echo_lock);
 }
 
 /**
@@ -790,18 +828,16 @@ static void echo_erase_tab(unsigned int num_chars, int after_tab,
  *      Locking: echo_lock to protect the echo buffer
  */
 
-static void echo_char_raw(unsigned char c, struct tty_struct *tty)
+static void echo_char_raw(unsigned char c, struct n_tty_data *ldata)
 {
-        mutex_lock(&tty->echo_lock);
-
+        mutex_lock(&ldata->echo_lock);
         if (c == ECHO_OP_START) {
-                add_echo_byte(ECHO_OP_START, tty);
-                add_echo_byte(ECHO_OP_START, tty);
+                add_echo_byte(ECHO_OP_START, ldata);
+                add_echo_byte(ECHO_OP_START, ldata);
         } else {
-                add_echo_byte(c, tty);
+                add_echo_byte(c, ldata);
         }
-
-        mutex_unlock(&tty->echo_lock);
+        mutex_unlock(&ldata->echo_lock);
 }
 
 /**
@@ -820,30 +856,32 @@ static void echo_char_raw(unsigned char c, struct tty_struct *tty)
 
 static void echo_char(unsigned char c, struct tty_struct *tty)
 {
-        mutex_lock(&tty->echo_lock);
+        struct n_tty_data *ldata = tty->disc_data;
+
+        mutex_lock(&ldata->echo_lock);
 
         if (c == ECHO_OP_START) {
-                add_echo_byte(ECHO_OP_START, tty);
-                add_echo_byte(ECHO_OP_START, tty);
+                add_echo_byte(ECHO_OP_START, ldata);
+                add_echo_byte(ECHO_OP_START, ldata);
         } else {
                 if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
-                        add_echo_byte(ECHO_OP_START, tty);
-                add_echo_byte(c, tty);
+                        add_echo_byte(ECHO_OP_START, ldata);
+                add_echo_byte(c, ldata);
         }
 
-        mutex_unlock(&tty->echo_lock);
+        mutex_unlock(&ldata->echo_lock);
 }
 
 /**
  *      finish_erasing          -       complete erase
- *      @tty: tty doing the erase
+ *      @ldata: n_tty data
  */
 
-static inline void finish_erasing(struct tty_struct *tty)
+static inline void finish_erasing(struct n_tty_data *ldata)
 {
-        if (tty->erasing) {
-                echo_char_raw('/', tty);
-                tty->erasing = 0;
+        if (ldata->erasing) {
+                echo_char_raw('/', ldata);
+                ldata->erasing = 0;
         }
 }
 
@@ -861,12 +899,13 @@ static inline void finish_erasing(struct tty_struct *tty)
 
 static void eraser(unsigned char c, struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         enum { ERASE, WERASE, KILL } kill_type;
         int head, seen_alnums, cnt;
         unsigned long flags;
 
         /* FIXME: locking needed ? */
-        if (tty->read_head == tty->canon_head) {
+        if (ldata->read_head == ldata->canon_head) {
                 /* process_output('\a', tty); */ /* what do you think? */
                 return;
         }
@@ -876,24 +915,24 @@ static void eraser(unsigned char c, struct tty_struct *tty)
                 kill_type = WERASE;
         else {
                 if (!L_ECHO(tty)) {
-                        spin_lock_irqsave(&tty->read_lock, flags);
-                        tty->read_cnt -= ((tty->read_head - tty->canon_head) &
+                        spin_lock_irqsave(&ldata->read_lock, flags);
+                        ldata->read_cnt -= ((ldata->read_head - ldata->canon_head) &
                                           (N_TTY_BUF_SIZE - 1));
-                        tty->read_head = tty->canon_head;
-                        spin_unlock_irqrestore(&tty->read_lock, flags);
+                        ldata->read_head = ldata->canon_head;
+                        spin_unlock_irqrestore(&ldata->read_lock, flags);
                         return;
                 }
                 if (!L_ECHOK(tty) || !L_ECHOKE(tty) || !L_ECHOE(tty)) {
-                        spin_lock_irqsave(&tty->read_lock, flags);
-                        tty->read_cnt -= ((tty->read_head - tty->canon_head) &
+                        spin_lock_irqsave(&ldata->read_lock, flags);
+                        ldata->read_cnt -= ((ldata->read_head - ldata->canon_head) &
                                           (N_TTY_BUF_SIZE - 1));
-                        tty->read_head = tty->canon_head;
-                        spin_unlock_irqrestore(&tty->read_lock, flags);
-                        finish_erasing(tty);
+                        ldata->read_head = ldata->canon_head;
+                        spin_unlock_irqrestore(&ldata->read_lock, flags);
+                        finish_erasing(ldata);
                         echo_char(KILL_CHAR(tty), tty);
                         /* Add a newline if ECHOK is on and ECHOKE is off. */
                         if (L_ECHOK(tty))
-                                echo_char_raw('\n', tty);
+                                echo_char_raw('\n', ldata);
                         return;
                 }
                 kill_type = KILL;
@@ -901,14 +940,14 @@ static void eraser(unsigned char c, struct tty_struct *tty)
 
         seen_alnums = 0;
         /* FIXME: Locking ?? */
-        while (tty->read_head != tty->canon_head) {
-                head = tty->read_head;
+        while (ldata->read_head != ldata->canon_head) {
+                head = ldata->read_head;
 
                 /* erase a single possibly multibyte character */
                 do {
                         head = (head - 1) & (N_TTY_BUF_SIZE-1);
-                        c = tty->read_buf[head];
-                } while (is_continuation(c, tty) && head != tty->canon_head);
+                        c = ldata->read_buf[head];
+                } while (is_continuation(c, tty) && head != ldata->canon_head);
 
                 /* do not partially erase */
                 if (is_continuation(c, tty))
@@ -921,30 +960,31 @@ static void eraser(unsigned char c, struct tty_struct *tty)
                         else if (seen_alnums)
                                 break;
                 }
-                cnt = (tty->read_head - head) & (N_TTY_BUF_SIZE-1);
-                spin_lock_irqsave(&tty->read_lock, flags);
-                tty->read_head = head;
-                tty->read_cnt -= cnt;
-                spin_unlock_irqrestore(&tty->read_lock, flags);
+                cnt = (ldata->read_head - head) & (N_TTY_BUF_SIZE-1);
+                spin_lock_irqsave(&ldata->read_lock, flags);
+                ldata->read_head = head;
+                ldata->read_cnt -= cnt;
+                spin_unlock_irqrestore(&ldata->read_lock, flags);
                 if (L_ECHO(tty)) {
                         if (L_ECHOPRT(tty)) {
-                                if (!tty->erasing) {
-                                        echo_char_raw('\\', tty);
-                                        tty->erasing = 1;
+                                if (!ldata->erasing) {
+                                        echo_char_raw('\\', ldata);
+                                        ldata->erasing = 1;
                                 }
                                 /* if cnt > 1, output a multi-byte character */
                                 echo_char(c, tty);
                                 while (--cnt > 0) {
                                         head = (head+1) & (N_TTY_BUF_SIZE-1);
-                                        echo_char_raw(tty->read_buf[head], tty);
-                                        echo_move_back_col(tty);
+                                        echo_char_raw(ldata->read_buf[head],
+                                                        ldata);
+                                        echo_move_back_col(ldata);
                                 }
                         } else if (kill_type == ERASE && !L_ECHOE(tty)) {
                                 echo_char(ERASE_CHAR(tty), tty);
                         } else if (c == '\t') {
                                 unsigned int num_chars = 0;
                                 int after_tab = 0;
-                                unsigned long tail = tty->read_head;
+                                unsigned long tail = ldata->read_head;
 
                                 /*
                                  * Count the columns used for characters
@@ -953,9 +993,9 @@ static void eraser(unsigned char c, struct tty_struct *tty)
                                  * This info is used to go back the correct
                                  * number of columns.
                                  */
-                                while (tail != tty->canon_head) {
+                                while (tail != ldata->canon_head) {
                                         tail = (tail-1) & (N_TTY_BUF_SIZE-1);
-                                        c = tty->read_buf[tail];
+                                        c = ldata->read_buf[tail];
                                         if (c == '\t') {
                                                 after_tab = 1;
                                                 break;
@@ -966,25 +1006,25 @@ static void eraser(unsigned char c, struct tty_struct *tty)
                                                 num_chars++;
                                         }
                                 }
-                                echo_erase_tab(num_chars, after_tab, tty);
+                                echo_erase_tab(num_chars, after_tab, ldata);
                         } else {
                                 if (iscntrl(c) && L_ECHOCTL(tty)) {
-                                        echo_char_raw('\b', tty);
-                                        echo_char_raw(' ', tty);
-                                        echo_char_raw('\b', tty);
+                                        echo_char_raw('\b', ldata);
+                                        echo_char_raw(' ', ldata);
+                                        echo_char_raw('\b', ldata);
                                 }
                                 if (!iscntrl(c) || L_ECHOCTL(tty)) {
-                                        echo_char_raw('\b', tty);
-                                        echo_char_raw(' ', tty);
-                                        echo_char_raw('\b', tty);
+                                        echo_char_raw('\b', ldata);
+                                        echo_char_raw(' ', ldata);
+                                        echo_char_raw('\b', ldata);
                                 }
                         }
                 }
                 if (kill_type == ERASE)
                         break;
         }
-        if (tty->read_head == tty->canon_head && L_ECHO(tty))
-                finish_erasing(tty);
+        if (ldata->read_head == ldata->canon_head && L_ECHO(tty))
+                finish_erasing(ldata);
 }
 
 /**
@@ -1023,6 +1063,8 @@ static inline void isig(int sig, struct tty_struct *tty, int flush)
 
 static inline void n_tty_receive_break(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
+
         if (I_IGNBRK(tty))
                 return;
         if (I_BRKINT(tty)) {
@@ -1030,10 +1072,10 @@ static inline void n_tty_receive_break(struct tty_struct *tty)
                 return;
         }
         if (I_PARMRK(tty)) {
-                put_tty_queue('\377', tty);
-                put_tty_queue('\0', tty);
+                put_tty_queue('\377', ldata);
+                put_tty_queue('\0', ldata);
         }
-        put_tty_queue('\0', tty);
+        put_tty_queue('\0', ldata);
         wake_up_interruptible(&tty->read_wait);
 }
 
@@ -1052,16 +1094,17 @@ static inline void n_tty_receive_break(struct tty_struct *tty)
 
 static inline void n_tty_receive_overrun(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         char buf[64];
 
-        tty->num_overrun++;
-        if (time_before(tty->overrun_time, jiffies - HZ) ||
-                        time_after(tty->overrun_time, jiffies)) {
+        ldata->num_overrun++;
+        if (time_after(jiffies, ldata->overrun_time + HZ) ||
+                        time_after(ldata->overrun_time, jiffies)) {
                 printk(KERN_WARNING "%s: %d input overrun(s)\n",
                         tty_name(tty, buf),
-                        tty->num_overrun);
-                tty->overrun_time = jiffies;
-                tty->num_overrun = 0;
+                        ldata->num_overrun);
+                ldata->overrun_time = jiffies;
+                ldata->num_overrun = 0;
         }
 }
 
@@ -1076,16 +1119,18 @@ static inline void n_tty_receive_overrun(struct tty_struct *tty)
 static inline void n_tty_receive_parity_error(struct tty_struct *tty,
                                               unsigned char c)
 {
+        struct n_tty_data *ldata = tty->disc_data;
+
         if (I_IGNPAR(tty))
                 return;
         if (I_PARMRK(tty)) {
-                put_tty_queue('\377', tty);
-                put_tty_queue('\0', tty);
-                put_tty_queue(c, tty);
+                put_tty_queue('\377', ldata);
+                put_tty_queue('\0', ldata);
+                put_tty_queue(c, ldata);
         } else  if (I_INPCK(tty))
-                put_tty_queue('\0', tty);
+                put_tty_queue('\0', ldata);
         else
-                put_tty_queue(c, tty);
+                put_tty_queue(c, ldata);
         wake_up_interruptible(&tty->read_wait);
 }
 
@@ -1101,11 +1146,12 @@ static inline void n_tty_receive_parity_error(struct tty_struct *tty,
 
 static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         unsigned long flags;
         int parmrk;
 
-        if (tty->raw) {
-                put_tty_queue(c, tty);
+        if (ldata->raw) {
+                put_tty_queue(c, ldata);
                 return;
         }
 
@@ -1115,7 +1161,7 @@ static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
                 c = tolower(c);
 
         if (L_EXTPROC(tty)) {
-                put_tty_queue(c, tty);
+                put_tty_queue(c, ldata);
                 return;
         }
 
@@ -1143,26 +1189,26 @@ static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
          * handle specially, do shortcut processing to speed things
          * up.
          */
-        if (!test_bit(c, tty->process_char_map) || tty->lnext) {
-                tty->lnext = 0;
+        if (!test_bit(c, ldata->process_char_map) || ldata->lnext) {
+                ldata->lnext = 0;
                 parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
-                if (tty->read_cnt >= (N_TTY_BUF_SIZE - parmrk - 1)) {
+                if (ldata->read_cnt >= (N_TTY_BUF_SIZE - parmrk - 1)) {
                         /* beep if no space */
                         if (L_ECHO(tty))
                                 process_output('\a', tty);
                         return;
                 }
                 if (L_ECHO(tty)) {
-                        finish_erasing(tty);
+                        finish_erasing(ldata);
                         /* Record the column of first canon char. */
-                        if (tty->canon_head == tty->read_head)
-                                echo_set_canon_col(tty);
+                        if (ldata->canon_head == ldata->read_head)
+                                echo_set_canon_col(ldata);
                         echo_char(c, tty);
                         process_echoes(tty);
                 }
                 if (parmrk)
-                        put_tty_queue(c, tty);
-                put_tty_queue(c, tty);
+                        put_tty_queue(c, ldata);
+                put_tty_queue(c, ldata);
                 return;
         }
 
@@ -1218,7 +1264,7 @@ send_signal:
         } else if (c == '\n' && I_INLCR(tty))
                 c = '\r';
 
-        if (tty->icanon) {
+        if (ldata->icanon) {
                 if (c == ERASE_CHAR(tty) || c == KILL_CHAR(tty) ||
                     (c == WERASE_CHAR(tty) && L_IEXTEN(tty))) {
                         eraser(c, tty);
@@ -1226,12 +1272,12 @@ send_signal:
                         return;
                 }
                 if (c == LNEXT_CHAR(tty) && L_IEXTEN(tty)) {
-                        tty->lnext = 1;
+                        ldata->lnext = 1;
                         if (L_ECHO(tty)) {
-                                finish_erasing(tty);
+                                finish_erasing(ldata);
                                 if (L_ECHOCTL(tty)) {
-                                        echo_char_raw('^', tty);
-                                        echo_char_raw('\b', tty);
+                                        echo_char_raw('^', ldata);
+                                        echo_char_raw('\b', ldata);
                                         process_echoes(tty);
                                 }
                         }
@@ -1239,34 +1285,34 @@ send_signal:
                 }
                 if (c == REPRINT_CHAR(tty) && L_ECHO(tty) &&
                     L_IEXTEN(tty)) {
-                        unsigned long tail = tty->canon_head;
+                        unsigned long tail = ldata->canon_head;
 
-                        finish_erasing(tty);
+                        finish_erasing(ldata);
                         echo_char(c, tty);
-                        echo_char_raw('\n', tty);
-                        while (tail != tty->read_head) {
-                                echo_char(tty->read_buf[tail], tty);
+                        echo_char_raw('\n', ldata);
+                        while (tail != ldata->read_head) {
+                                echo_char(ldata->read_buf[tail], tty);
                                 tail = (tail+1) & (N_TTY_BUF_SIZE-1);
                         }
                         process_echoes(tty);
                         return;
                 }
                 if (c == '\n') {
-                        if (tty->read_cnt >= N_TTY_BUF_SIZE) {
+                        if (ldata->read_cnt >= N_TTY_BUF_SIZE) {
                                 if (L_ECHO(tty))
                                         process_output('\a', tty);
                                 return;
                         }
                         if (L_ECHO(tty) || L_ECHONL(tty)) {
-                                echo_char_raw('\n', tty);
+                                echo_char_raw('\n', ldata);
                                 process_echoes(tty);
                         }
                         goto handle_newline;
                 }
                 if (c == EOF_CHAR(tty)) {
-                        if (tty->read_cnt >= N_TTY_BUF_SIZE)
+                        if (ldata->read_cnt >= N_TTY_BUF_SIZE)
                                 return;
-                        if (tty->canon_head != tty->read_head)
+                        if (ldata->canon_head != ldata->read_head)
                                 set_bit(TTY_PUSH, &tty->flags);
                         c = __DISABLED_CHAR;
                         goto handle_newline;
@@ -1275,7 +1321,7 @@ send_signal:
                     (c == EOL2_CHAR(tty) && L_IEXTEN(tty))) {
                         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty))
                                  ? 1 : 0;
-                        if (tty->read_cnt >= (N_TTY_BUF_SIZE - parmrk)) {
+                        if (ldata->read_cnt >= (N_TTY_BUF_SIZE - parmrk)) {
                                 if (L_ECHO(tty))
                                         process_output('\a', tty);
                                 return;
@@ -1285,8 +1331,8 @@ send_signal:
                          */
                         if (L_ECHO(tty)) {
                                 /* Record the column of first canon char. */
-                                if (tty->canon_head == tty->read_head)
-                                        echo_set_canon_col(tty);
+                                if (ldata->canon_head == ldata->read_head)
+                                        echo_set_canon_col(ldata);
                                 echo_char(c, tty);
                                 process_echoes(tty);
                         }
@@ -1295,15 +1341,15 @@ send_signal:
                          * EOL_CHAR and EOL2_CHAR?
                          */
                         if (parmrk)
-                                put_tty_queue(c, tty);
+                                put_tty_queue(c, ldata);
 
 handle_newline:
-                        spin_lock_irqsave(&tty->read_lock, flags);
-                        set_bit(tty->read_head, tty->read_flags);
-                        put_tty_queue_nolock(c, tty);
-                        tty->canon_head = tty->read_head;
-                        tty->canon_data++;
-                        spin_unlock_irqrestore(&tty->read_lock, flags);
+                        spin_lock_irqsave(&ldata->read_lock, flags);
+                        set_bit(ldata->read_head, ldata->read_flags);
+                        put_tty_queue_nolock(c, ldata);
+                        ldata->canon_head = ldata->read_head;
+                        ldata->canon_data++;
+                        spin_unlock_irqrestore(&ldata->read_lock, flags);
                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                         if (waitqueue_active(&tty->read_wait))
                                 wake_up_interruptible(&tty->read_wait);
@@ -1312,29 +1358,29 @@ handle_newline:
         }
 
         parmrk = (c == (unsigned char) '\377' && I_PARMRK(tty)) ? 1 : 0;
-        if (tty->read_cnt >= (N_TTY_BUF_SIZE - parmrk - 1)) {
+        if (ldata->read_cnt >= (N_TTY_BUF_SIZE - parmrk - 1)) {
                 /* beep if no space */
                 if (L_ECHO(tty))
                         process_output('\a', tty);
                 return;
         }
         if (L_ECHO(tty)) {
-                finish_erasing(tty);
+                finish_erasing(ldata);
                 if (c == '\n')
-                        echo_char_raw('\n', tty);
+                        echo_char_raw('\n', ldata);
                 else {
                         /* Record the column of first canon char. */
-                        if (tty->canon_head == tty->read_head)
-                                echo_set_canon_col(tty);
+                        if (ldata->canon_head == ldata->read_head)
+                                echo_set_canon_col(ldata);
                         echo_char(c, tty);
                 }
                 process_echoes(tty);
         }
 
         if (parmrk)
-                put_tty_queue(c, tty);
+                put_tty_queue(c, ldata);
 
-        put_tty_queue(c, tty);
+        put_tty_queue(c, ldata);
 }
 
 
@@ -1369,33 +1415,31 @@ static void n_tty_write_wakeup(struct tty_struct *tty)
 static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                               char *fp, int count)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         const unsigned char *p;
         char *f, flags = TTY_NORMAL;
         int     i;
         char    buf[64];
         unsigned long cpuflags;
 
-        if (!tty->read_buf)
-                return;
-
-        if (tty->real_raw) {
-                spin_lock_irqsave(&tty->read_lock, cpuflags);
-                i = min(N_TTY_BUF_SIZE - tty->read_cnt,
-                        N_TTY_BUF_SIZE - tty->read_head);
+        if (ldata->real_raw) {
+                spin_lock_irqsave(&ldata->read_lock, cpuflags);
+                i = min(N_TTY_BUF_SIZE - ldata->read_cnt,
+                        N_TTY_BUF_SIZE - ldata->read_head);
                 i = min(count, i);
-                memcpy(tty->read_buf + tty->read_head, cp, i);
-                tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
-                tty->read_cnt += i;
+                memcpy(ldata->read_buf + ldata->read_head, cp, i);
+                ldata->read_head = (ldata->read_head + i) & (N_TTY_BUF_SIZE-1);
+                ldata->read_cnt += i;
                 cp += i;
                 count -= i;
 
-                i = min(N_TTY_BUF_SIZE - tty->read_cnt,
-                        N_TTY_BUF_SIZE - tty->read_head);
+                i = min(N_TTY_BUF_SIZE - ldata->read_cnt,
+                        N_TTY_BUF_SIZE - ldata->read_head);
                 i = min(count, i);
-                memcpy(tty->read_buf + tty->read_head, cp, i);
-                tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
-                tty->read_cnt += i;
-                spin_unlock_irqrestore(&tty->read_lock, cpuflags);
+                memcpy(ldata->read_buf + ldata->read_head, cp, i);
+                ldata->read_head = (ldata->read_head + i) & (N_TTY_BUF_SIZE-1);
+                ldata->read_cnt += i;
+                spin_unlock_irqrestore(&ldata->read_lock, cpuflags);
         } else {
                 for (i = count, p = cp, f = fp; i; i--, p++) {
                         if (f)
@@ -1426,7 +1470,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 
         n_tty_set_room(tty);
 
-        if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
+        if ((!ldata->icanon && (ldata->read_cnt >= tty->minimum_to_wake)) ||
                 L_EXTPROC(tty)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                 if (waitqueue_active(&tty->read_wait))
@@ -1470,25 +1514,25 @@ int is_ignored(int sig)
 
 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int canon_change = 1;
-        BUG_ON(!tty);
 
         if (old)
                 canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
         if (canon_change) {
-                memset(&tty->read_flags, 0, sizeof tty->read_flags);
-                tty->canon_head = tty->read_tail;
-                tty->canon_data = 0;
-                tty->erasing = 0;
+                bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
+                ldata->canon_head = ldata->read_tail;
+                ldata->canon_data = 0;
+                ldata->erasing = 0;
         }
 
-        if (canon_change && !L_ICANON(tty) && tty->read_cnt)
+        if (canon_change && !L_ICANON(tty) && ldata->read_cnt)
                 wake_up_interruptible(&tty->read_wait);
 
-        tty->icanon = (L_ICANON(tty) != 0);
+        ldata->icanon = (L_ICANON(tty) != 0);
         if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
-                tty->raw = 1;
-                tty->real_raw = 1;
+                ldata->raw = 1;
+                ldata->real_raw = 1;
                 n_tty_set_room(tty);
                 return;
         }
@@ -1496,51 +1540,51 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
             I_ICRNL(tty) || I_INLCR(tty) || L_ICANON(tty) ||
             I_IXON(tty) || L_ISIG(tty) || L_ECHO(tty) ||
             I_PARMRK(tty)) {
-                memset(tty->process_char_map, 0, 256/8);
+                bitmap_zero(ldata->process_char_map, 256);
 
                 if (I_IGNCR(tty) || I_ICRNL(tty))
-                        set_bit('\r', tty->process_char_map);
+                        set_bit('\r', ldata->process_char_map);
                 if (I_INLCR(tty))
-                        set_bit('\n', tty->process_char_map);
+                        set_bit('\n', ldata->process_char_map);
 
                 if (L_ICANON(tty)) {
-                        set_bit(ERASE_CHAR(tty), tty->process_char_map);
-                        set_bit(KILL_CHAR(tty), tty->process_char_map);
-                        set_bit(EOF_CHAR(tty), tty->process_char_map);
-                        set_bit('\n', tty->process_char_map);
-                        set_bit(EOL_CHAR(tty), tty->process_char_map);
+                        set_bit(ERASE_CHAR(tty), ldata->process_char_map);
+                        set_bit(KILL_CHAR(tty), ldata->process_char_map);
+                        set_bit(EOF_CHAR(tty), ldata->process_char_map);
+                        set_bit('\n', ldata->process_char_map);
+                        set_bit(EOL_CHAR(tty), ldata->process_char_map);
                         if (L_IEXTEN(tty)) {
                                 set_bit(WERASE_CHAR(tty),
-                                        tty->process_char_map);
+                                        ldata->process_char_map);
                                 set_bit(LNEXT_CHAR(tty),
-                                        tty->process_char_map);
+                                        ldata->process_char_map);
                                 set_bit(EOL2_CHAR(tty),
-                                        tty->process_char_map);
+                                        ldata->process_char_map);
                                 if (L_ECHO(tty))
                                         set_bit(REPRINT_CHAR(tty),
-                                                tty->process_char_map);
+                                                ldata->process_char_map);
                         }
                 }
                 if (I_IXON(tty)) {
-                        set_bit(START_CHAR(tty), tty->process_char_map);
-                        set_bit(STOP_CHAR(tty), tty->process_char_map);
+                        set_bit(START_CHAR(tty), ldata->process_char_map);
+                        set_bit(STOP_CHAR(tty), ldata->process_char_map);
                 }
                 if (L_ISIG(tty)) {
-                        set_bit(INTR_CHAR(tty), tty->process_char_map);
-                        set_bit(QUIT_CHAR(tty), tty->process_char_map);
-                        set_bit(SUSP_CHAR(tty), tty->process_char_map);
+                        set_bit(INTR_CHAR(tty), ldata->process_char_map);
+                        set_bit(QUIT_CHAR(tty), ldata->process_char_map);
+                        set_bit(SUSP_CHAR(tty), ldata->process_char_map);
                 }
-                clear_bit(__DISABLED_CHAR, tty->process_char_map);
-                tty->raw = 0;
-                tty->real_raw = 0;
+                clear_bit(__DISABLED_CHAR, ldata->process_char_map);
+                ldata->raw = 0;
+                ldata->real_raw = 0;
         } else {
-                tty->raw = 1;
+                ldata->raw = 1;
                 if ((I_IGNBRK(tty) || (!I_BRKINT(tty) && !I_PARMRK(tty))) &&
                     (I_IGNPAR(tty) || !I_INPCK(tty)) &&
                     (tty->driver->flags & TTY_DRIVER_REAL_RAW))
-                        tty->real_raw = 1;
+                        ldata->real_raw = 1;
                 else
-                        tty->real_raw = 0;
+                        ldata->real_raw = 0;
         }
         n_tty_set_room(tty);
         /* The termios change make the tty ready for I/O */
@@ -1560,15 +1604,13 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 
 static void n_tty_close(struct tty_struct *tty)
 {
+        struct n_tty_data *ldata = tty->disc_data;
+
         n_tty_flush_buffer(tty);
-        if (tty->read_buf) {
-                kfree(tty->read_buf);
-                tty->read_buf = NULL;
-        }
-        if (tty->echo_buf) {
-                kfree(tty->echo_buf);
-                tty->echo_buf = NULL;
-        }
+        kfree(ldata->read_buf);
+        kfree(ldata->echo_buf);
+        kfree(ldata);
+        tty->disc_data = NULL;
 }
 
 /**
@@ -1583,37 +1625,50 @@ static void n_tty_close(struct tty_struct *tty)
 
 static int n_tty_open(struct tty_struct *tty)
 {
-        if (!tty)
-                return -EINVAL;
+        struct n_tty_data *ldata;
+
+        ldata = kzalloc(sizeof(*ldata), GFP_KERNEL);
+        if (!ldata)
+                goto err;
+
+        ldata->overrun_time = jiffies;
+        mutex_init(&ldata->atomic_read_lock);
+        mutex_init(&ldata->output_lock);
+        mutex_init(&ldata->echo_lock);
+        spin_lock_init(&ldata->read_lock);
 
         /* These are ugly. Currently a malloc failure here can panic */
-        if (!tty->read_buf) {
-                tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
-                if (!tty->read_buf)
-                        return -ENOMEM;
-        }
-        if (!tty->echo_buf) {
-                tty->echo_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
+        ldata->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
+        ldata->echo_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
+        if (!ldata->read_buf || !ldata->echo_buf)
+                goto err_free_bufs;
 
-                if (!tty->echo_buf)
-                        return -ENOMEM;
-        }
+        tty->disc_data = ldata;
         reset_buffer_flags(tty);
         tty_unthrottle(tty);
-        tty->column = 0;
+        ldata->column = 0;
         n_tty_set_termios(tty, NULL);
         tty->minimum_to_wake = 1;
         tty->closing = 0;
+
         return 0;
+err_free_bufs:
+        kfree(ldata->read_buf);
+        kfree(ldata->echo_buf);
+        kfree(ldata);
+err:
+        return -ENOMEM;
 }
 
 static inline int input_available_p(struct tty_struct *tty, int amt)
 {
+        struct n_tty_data *ldata = tty->disc_data;
+
         tty_flush_to_ldisc(tty);
-        if (tty->icanon && !L_EXTPROC(tty)) {
-                if (tty->canon_data)
+        if (ldata->icanon && !L_EXTPROC(tty)) {
+                if (ldata->canon_data)
                         return 1;
-        } else if (tty->read_cnt >= (amt ? amt : 1))
+        } else if (ldata->read_cnt >= (amt ? amt : 1))
                 return 1;
 
         return 0;
@@ -1632,7 +1687,7 @@ static inline int input_available_p(struct tty_struct *tty, int amt)
  *      buffer, and once to drain the space from the (physical) beginning of
  *      the buffer to head pointer.
  *
- *      Called under the tty->atomic_read_lock sem
+ *      Called under the ldata->atomic_read_lock sem
  *
  */
 
@@ -1641,29 +1696,31 @@ static int copy_from_read_buf(struct tty_struct *tty,
                                       size_t *nr)
 
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int retval;
         size_t n;
         unsigned long flags;
         bool is_eof;
 
         retval = 0;
-        spin_lock_irqsave(&tty->read_lock, flags);
-        n = min(tty->read_cnt, N_TTY_BUF_SIZE - tty->read_tail);
+        spin_lock_irqsave(&ldata->read_lock, flags);
+        n = min(ldata->read_cnt, N_TTY_BUF_SIZE - ldata->read_tail);
         n = min(*nr, n);
-        spin_unlock_irqrestore(&tty->read_lock, flags);
+        spin_unlock_irqrestore(&ldata->read_lock, flags);
         if (n) {
-                retval = copy_to_user(*b, &tty->read_buf[tty->read_tail], n);
+                retval = copy_to_user(*b, &ldata->read_buf[ldata->read_tail], n);
                 n -= retval;
                 is_eof = n == 1 &&
-                        tty->read_buf[tty->read_tail] == EOF_CHAR(tty);
-                tty_audit_add_data(tty, &tty->read_buf[tty->read_tail], n);
-                spin_lock_irqsave(&tty->read_lock, flags);
-                tty->read_tail = (tty->read_tail + n) & (N_TTY_BUF_SIZE-1);
-                tty->read_cnt -= n;
+                        ldata->read_buf[ldata->read_tail] == EOF_CHAR(tty);
+                tty_audit_add_data(tty, &ldata->read_buf[ldata->read_tail], n,
+                                ldata->icanon);
+                spin_lock_irqsave(&ldata->read_lock, flags);
+                ldata->read_tail = (ldata->read_tail + n) & (N_TTY_BUF_SIZE-1);
+                ldata->read_cnt -= n;
                 /* Turn single EOF into zero-length read */
-                if (L_EXTPROC(tty) && tty->icanon && is_eof && !tty->read_cnt)
+                if (L_EXTPROC(tty) && ldata->icanon && is_eof && !ldata->read_cnt)
                         n = 0;
-                spin_unlock_irqrestore(&tty->read_lock, flags);
+                spin_unlock_irqrestore(&ldata->read_lock, flags);
                 *b += n;
                 *nr -= n;
         }
@@ -1730,6 +1787,7 @@ static int job_control(struct tty_struct *tty, struct file *file)
 static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                          unsigned char __user *buf, size_t nr)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         unsigned char __user *b = buf;
         DECLARE_WAITQUEUE(wait, current);
         int c;
@@ -1741,17 +1799,13 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
         int packet;
 
 do_it_again:
-
-        if (WARN_ON(!tty->read_buf))
-                return -EAGAIN;
-
         c = job_control(tty, file);
         if (c < 0)
                 return c;
 
         minimum = time = 0;
         timeout = MAX_SCHEDULE_TIMEOUT;
-        if (!tty->icanon) {
+        if (!ldata->icanon) {
                 time = (HZ / 10) * TIME_CHAR(tty);
                 minimum = MIN_CHAR(tty);
                 if (minimum) {
@@ -1774,10 +1828,10 @@ do_it_again:
          *      Internal serialization of reads.
          */
         if (file->f_flags & O_NONBLOCK) {
-                if (!mutex_trylock(&tty->atomic_read_lock))
+                if (!mutex_trylock(&ldata->atomic_read_lock))
                         return -EAGAIN;
         } else {
-                if (mutex_lock_interruptible(&tty->atomic_read_lock))
+                if (mutex_lock_interruptible(&ldata->atomic_read_lock))
                         return -ERESTARTSYS;
         }
         packet = tty->packet;
@@ -1830,7 +1884,6 @@ do_it_again:
                         /* FIXME: does n_tty_set_room need locking ? */
                         n_tty_set_room(tty);
                         timeout = schedule_timeout(timeout);
-                        BUG_ON(!tty->read_buf);
                         continue;
                 }
                 __set_current_state(TASK_RUNNING);
@@ -1845,45 +1898,45 @@ do_it_again:
                         nr--;
                 }
 
-                if (tty->icanon && !L_EXTPROC(tty)) {
+                if (ldata->icanon && !L_EXTPROC(tty)) {
                         /* N.B. avoid overrun if nr == 0 */
-                        spin_lock_irqsave(&tty->read_lock, flags);
-                        while (nr && tty->read_cnt) {
+                        spin_lock_irqsave(&ldata->read_lock, flags);
+                        while (nr && ldata->read_cnt) {
                                 int eol;
 
-                                eol = test_and_clear_bit(tty->read_tail,
-                                                tty->read_flags);
-                                c = tty->read_buf[tty->read_tail];
-                                tty->read_tail = ((tty->read_tail+1) &
+                                eol = test_and_clear_bit(ldata->read_tail,
+                                                ldata->read_flags);
+                                c = ldata->read_buf[ldata->read_tail];
+                                ldata->read_tail = ((ldata->read_tail+1) &
                                                   (N_TTY_BUF_SIZE-1));
-                                tty->read_cnt--;
+                                ldata->read_cnt--;
                                 if (eol) {
                                         /* this test should be redundant:
                                          * we shouldn't be reading data if
                                          * canon_data is 0
                                          */
-                                        if (--tty->canon_data < 0)
-                                                tty->canon_data = 0;
+                                        if (--ldata->canon_data < 0)
+                                                ldata->canon_data = 0;
                                 }
-                                spin_unlock_irqrestore(&tty->read_lock, flags);
+                                spin_unlock_irqrestore(&ldata->read_lock, flags);
 
                                 if (!eol || (c != __DISABLED_CHAR)) {
                                         if (tty_put_user(tty, c, b++)) {
                                                 retval = -EFAULT;
                                                 b--;
-                                                spin_lock_irqsave(&tty->read_lock, flags);
+                                                spin_lock_irqsave(&ldata->read_lock, flags);
                                                 break;
                                         }
                                         nr--;
                                 }
                                 if (eol) {
                                         tty_audit_push(tty);
-                                        spin_lock_irqsave(&tty->read_lock, flags);
+                                        spin_lock_irqsave(&ldata->read_lock, flags);
                                         break;
                                 }
-                                spin_lock_irqsave(&tty->read_lock, flags);
+                                spin_lock_irqsave(&ldata->read_lock, flags);
                         }
-                        spin_unlock_irqrestore(&tty->read_lock, flags);
+                        spin_unlock_irqrestore(&ldata->read_lock, flags);
                         if (retval)
                                 break;
                 } else {
@@ -1915,7 +1968,7 @@ do_it_again:
                 if (time)
                         timeout = time;
         }
-        mutex_unlock(&tty->atomic_read_lock);
+        mutex_unlock(&ldata->atomic_read_lock);
         remove_wait_queue(&tty->read_wait, &wait);
 
         if (!waitqueue_active(&tty->read_wait))
@@ -2076,19 +2129,19 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
         return mask;
 }
 
-static unsigned long inq_canon(struct tty_struct *tty)
+static unsigned long inq_canon(struct n_tty_data *ldata)
 {
         int nr, head, tail;
 
-        if (!tty->canon_data)
+        if (!ldata->canon_data)
                 return 0;
-        head = tty->canon_head;
-        tail = tty->read_tail;
+        head = ldata->canon_head;
+        tail = ldata->read_tail;
         nr = (head - tail) & (N_TTY_BUF_SIZE-1);
         /* Skip EOF-chars.. */
         while (head != tail) {
-                if (test_bit(tail, tty->read_flags) &&
-                    tty->read_buf[tail] == __DISABLED_CHAR)
+                if (test_bit(tail, ldata->read_flags) &&
+                    ldata->read_buf[tail] == __DISABLED_CHAR)
                         nr--;
                 tail = (tail+1) & (N_TTY_BUF_SIZE-1);
         }
@@ -2098,6 +2151,7 @@ static unsigned long inq_canon(struct tty_struct *tty)
 static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                        unsigned int cmd, unsigned long arg)
 {
+        struct n_tty_data *ldata = tty->disc_data;
         int retval;
 
         switch (cmd) {
@@ -2105,9 +2159,9 @@ static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
         case TIOCINQ:
                 /* FIXME: Locking */
-                retval = tty->read_cnt;
+                retval = ldata->read_cnt;
                 if (L_ICANON(tty))
-                        retval = inq_canon(tty);
+                        retval = inq_canon(ldata);
                 return put_user(retval, (unsigned int __user *) arg);
         default:
                 return n_tty_ioctl_helper(tty, file, cmd, arg);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index a82b39939a9c..4219f040adb8 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -4,9 +4,6 @@
  *  Added support for a Unix98-style ptmx device.
  *    -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
  *
- *  When reading this code see also fs/devpts. In particular note that the
- *  driver_data field is used by the devpts side as a binding to the devpts
- *  inode.
  */
 
 #include <linux/module.h>
@@ -59,7 +56,7 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
 #ifdef CONFIG_UNIX98_PTYS
                 if (tty->driver == ptm_driver) {
                         mutex_lock(&devpts_mutex);
-                        devpts_pty_kill(tty->link);
+                        devpts_pty_kill(tty->link->driver_data);
                         mutex_unlock(&devpts_mutex);
                 }
 #endif
@@ -96,7 +93,7 @@ static void pty_unthrottle(struct tty_struct *tty)
 
 static int pty_space(struct tty_struct *to)
 {
-        int n = 8192 - to->buf.memory_used;
+        int n = 8192 - to->port->buf.memory_used;
         if (n < 0)
                 return 0;
         return n;
@@ -348,6 +345,7 @@ static int pty_common_install(struct tty_driver *driver, struct tty_struct *tty,
         tty_port_init(ports[1]);
         o_tty->port = ports[0];
         tty->port = ports[1];
+        o_tty->port->itty = o_tty;
 
         tty_driver_kref_get(driver);
         tty->count++;
@@ -366,8 +364,15 @@ err:
         return retval;
 }
 
+/* this is called once with whichever end is closed last */
+static void pty_unix98_shutdown(struct tty_struct *tty)
+{
+        devpts_kill_index(tty->driver_data, tty->index);
+}
+
 static void pty_cleanup(struct tty_struct *tty)
 {
+        tty->port->itty = NULL;
         kfree(tty->port);
 }
 
@@ -547,7 +552,7 @@ static struct tty_struct *pts_unix98_lookup(struct tty_driver *driver,
         struct tty_struct *tty;
 
         mutex_lock(&devpts_mutex);
-        tty = devpts_get_tty(pts_inode, idx);
+        tty = devpts_get_priv(pts_inode);
         mutex_unlock(&devpts_mutex);
         /* Master must be open before slave */
         if (!tty)
@@ -581,6 +586,7 @@ static const struct tty_operations ptm_unix98_ops = {
         .set_termios = pty_set_termios,
         .ioctl = pty_unix98_ioctl,
         .resize = pty_resize,
+        .shutdown = pty_unix98_shutdown,
         .cleanup = pty_cleanup
 };
 
@@ -596,6 +602,7 @@ static const struct tty_operations pty_unix98_ops = {
         .chars_in_buffer = pty_chars_in_buffer,
         .unthrottle = pty_unthrottle,
         .set_termios = pty_set_termios,
+        .shutdown = pty_unix98_shutdown,
         .cleanup = pty_cleanup,
 };
 
@@ -614,6 +621,7 @@ static const struct tty_operations pty_unix98_ops = {
 static int ptmx_open(struct inode *inode, struct file *filp)
 {
         struct tty_struct *tty;
+        struct inode *slave_inode;
         int retval;
         int index;
 
@@ -650,15 +658,21 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 
         tty_add_file(tty, filp);
 
-        retval = devpts_pty_new(inode, tty->link);
-        if (retval)
+        slave_inode = devpts_pty_new(inode,
+                        MKDEV(UNIX98_PTY_SLAVE_MAJOR, index), index,
+                        tty->link);
+        if (IS_ERR(slave_inode)) {
+                retval = PTR_ERR(slave_inode);
                 goto err_release;
+        }
 
         retval = ptm_driver->ops->open(tty, filp);
         if (retval)
                 goto err_release;
 
         tty_unlock(tty);
+        tty->driver_data = inode;
+        tty->link->driver_data = slave_inode;
         return 0;
 err_release:
         tty_unlock(tty);
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250.c
index 3ba4234592bc..5ccbd90540cf 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250.c
@@ -2349,16 +2349,14 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
                         serial_port_out(port, UART_EFR, efr);
         }
 
-#ifdef CONFIG_ARCH_OMAP1
         /* Workaround to enable 115200 baud on OMAP1510 internal ports */
-        if (cpu_is_omap1510() && is_omap_port(up)) {
+        if (is_omap1510_8250(up)) {
                 if (baud == 115200) {
                         quot = 1;
                         serial_port_out(port, UART_OMAP_OSC_12M_SEL, 1);
                 } else
                         serial_port_out(port, UART_OMAP_OSC_12M_SEL, 0);
         }
-#endif
 
         /*
          * For NatSemi, switch to bank 2 not bank 1, to avoid resetting EXCR2,
@@ -2439,10 +2437,9 @@ static unsigned int serial8250_port_size(struct uart_8250_port *pt)
 {
         if (pt->port.iotype == UPIO_AU)
                 return 0x1000;
-#ifdef CONFIG_ARCH_OMAP1
-        if (is_omap_port(pt))
+        if (is_omap1_8250(pt))
                 return 0x16 << pt->port.regshift;
-#endif
+
         return 8 << pt->port.regshift;
 }
 
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 5a76f9c8d36b..3b4ea84898c2 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -106,3 +106,39 @@ static inline int serial8250_pnp_init(void) { return 0; }
 static inline void serial8250_pnp_exit(void) { }
 #endif
 
+#ifdef CONFIG_ARCH_OMAP1
+static inline int is_omap1_8250(struct uart_8250_port *pt)
+{
+        int res;
+
+        switch (pt->port.mapbase) {
+        case OMAP1_UART1_BASE:
+        case OMAP1_UART2_BASE:
+        case OMAP1_UART3_BASE:
+                res = 1;
+                break;
+        default:
+                res = 0;
+                break;
+        }
+
+        return res;
+}
+
+static inline int is_omap1510_8250(struct uart_8250_port *pt)
+{
+        if (!cpu_is_omap1510())
+                return 0;
+
+        return is_omap1_8250(pt);
+}
+#else
+static inline int is_omap1_8250(struct uart_8250_port *pt)
+{
+        return 0;
+}
+static inline int is_omap1510_8250(struct uart_8250_port *pt)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
index eaafb98debed..843a150ba105 100644
--- a/drivers/tty/serial/8250/8250_early.c
+++ b/drivers/tty/serial/8250/8250_early.c
@@ -140,7 +140,7 @@ static void __init init_port(struct early_serial8250_device *device)
         serial_out(port, UART_FCR, 0);          /* no fifo */
         serial_out(port, UART_MCR, 0x3);        /* DTR + RTS */
 
-        divisor = port->uartclk / (16 * device->baud);
+        divisor = DIV_ROUND_CLOSEST(port->uartclk, 16 * device->baud);
         c = serial_in(port, UART_LCR);
         serial_out(port, UART_LCR, c | UART_LCR_DLAB);
         serial_out(port, UART_DLL, divisor & 0xff);
diff --git a/drivers/tty/serial/8250/8250_hp300.c b/drivers/tty/serial/8250/8250_hp300.c
index 8f1dd2cc00a8..f3d0edf46644 100644
--- a/drivers/tty/serial/8250/8250_hp300.c
+++ b/drivers/tty/serial/8250/8250_hp300.c
@@ -162,7 +162,7 @@ int __init hp300_setup_serial_console(void)
 static int __devinit hpdca_init_one(struct dio_dev *d,
                                 const struct dio_device_id *ent)
 {
-        struct uart_port port;
+        struct uart_8250_port uart;
         int line;
 
 #ifdef CONFIG_SERIAL_8250_CONSOLE
@@ -174,19 +174,19 @@ static int __devinit hpdca_init_one(struct dio_dev *d,
         memset(&uart, 0, sizeof(uart));
 
         /* Memory mapped I/O */
-        port.iotype = UPIO_MEM;
-        port.flags = UPF_SKIP_TEST | UPF_SHARE_IRQ | UPF_BOOT_AUTOCONF;
-        port.irq = d->ipl;
-        port.uartclk = HPDCA_BAUD_BASE * 16;
-        port.mapbase = (d->resource.start + UART_OFFSET);
-        port.membase = (char *)(port.mapbase + DIO_VIRADDRBASE);
-        port.regshift = 1;
-        port.dev = &d->dev;
+        uart.port.iotype = UPIO_MEM;
+        uart.port.flags = UPF_SKIP_TEST | UPF_SHARE_IRQ | UPF_BOOT_AUTOCONF;
+        uart.port.irq = d->ipl;
+        uart.port.uartclk = HPDCA_BAUD_BASE * 16;
+        uart.port.mapbase = (d->resource.start + UART_OFFSET);
+        uart.port.membase = (char *)(uart.port.mapbase + DIO_VIRADDRBASE);
+        uart.port.regshift = 1;
+        uart.port.dev = &d->dev;
         line = serial8250_register_8250_port(&uart);
 
         if (line < 0) {
                 printk(KERN_NOTICE "8250_hp300: register_serial() DCA scode %d"
-                       " irq %d failed\n", d->scode, port.irq);
+                       " irq %d failed\n", d->scode, uart.port.irq);
                 return -ENOMEM;
         }
 
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 233fbaaf2559..2a53be5f010d 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1150,7 +1150,7 @@ config SERIAL_SC26XX_CONSOLE
           Support for Console on SC2681/SC2692 serial ports.
 
 config SERIAL_SCCNXP
-        bool "SCCNXP serial port support"
+        tristate "SCCNXP serial port support"
         depends on !SERIAL_SC26XX
         select SERIAL_CORE
         default n
@@ -1162,7 +1162,7 @@ config SERIAL_SCCNXP
 
 config SERIAL_SCCNXP_CONSOLE
         bool "Console on SCCNXP serial port"
-        depends on SERIAL_SCCNXP
+        depends on SERIAL_SCCNXP=y
         select SERIAL_CORE_CONSOLE
         help
           Support for console on SCCNXP serial ports.
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 7f04717176aa..740458ca62cc 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -530,16 +530,16 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
         switch (level) {
         case 3:
                 if (!IS_ERR(ourport->baudclk))
-                        clk_disable(ourport->baudclk);
+                        clk_disable_unprepare(ourport->baudclk);
 
-                clk_disable(ourport->clk);
+                clk_disable_unprepare(ourport->clk);
                 break;
 
         case 0:
-                clk_enable(ourport->clk);
+                clk_prepare_enable(ourport->clk);
 
                 if (!IS_ERR(ourport->baudclk))
-                        clk_enable(ourport->baudclk);
+                        clk_prepare_enable(ourport->baudclk);
 
                 break;
         default:
@@ -713,11 +713,11 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
                 s3c24xx_serial_setsource(port, clk_sel);
 
                 if (!IS_ERR(ourport->baudclk)) {
-                        clk_disable(ourport->baudclk);
+                        clk_disable_unprepare(ourport->baudclk);
                         ourport->baudclk = ERR_PTR(-EINVAL);
                 }
 
-                clk_enable(clk);
+                clk_prepare_enable(clk);
 
                 ourport->baudclk = clk;
                 ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0;
@@ -1287,9 +1287,9 @@ static int s3c24xx_serial_resume(struct device *dev)
         struct s3c24xx_uart_port *ourport = to_ourport(port);
 
         if (port) {
-                clk_enable(ourport->clk);
+                clk_prepare_enable(ourport->clk);
                 s3c24xx_serial_resetport(port, s3c24xx_port_to_cfg(port));
-                clk_disable(ourport->clk);
+                clk_disable_unprepare(ourport->clk);
 
                 uart_resume_port(&s3c24xx_uart_drv, port);
         }
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index b7086d004f5f..e821068cd95b 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -971,6 +971,7 @@ static const struct platform_device_id sccnxp_id_table[] = {
         { "sc28202",    SCCNXP_TYPE_SC28202 },
         { "sc68681",    SCCNXP_TYPE_SC68681 },
         { "sc68692",    SCCNXP_TYPE_SC68692 },
+        { },
 };
 MODULE_DEVICE_TABLE(platform, sccnxp_id_table);
 
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 9be296cf7295..6ee59001d61d 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -530,7 +530,8 @@ static inline int sci_rxd_in(struct uart_port *port)
         if (s->cfg->port_reg <= 0)
                 return 1;
 
-        return !!__raw_readb(s->cfg->port_reg);
+        /* Cast for ARM damage */
+        return !!__raw_readb((void __iomem *)s->cfg->port_reg);
 }
 
 /* ********************************************************************** *
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 05728894a88c..16ee6cee07da 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -452,6 +452,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         NULL,                           /* v */
         &sysrq_showstate_blocked_op,    /* w */
         /* x: May be registered on ppc/powerpc for xmon */
+        /* x: May be registered on sparc64 for global PMU dump */
         NULL,                           /* x */
         /* y: May be registered on sparc64 for global register dump */
         NULL,                           /* y */
diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c
index b0b39b823ccf..6953dc82850c 100644
--- a/drivers/tty/tty_audit.c
+++ b/drivers/tty/tty_audit.c
@@ -23,7 +23,7 @@ struct tty_audit_buf {
 };
 
 static struct tty_audit_buf *tty_audit_buf_alloc(int major, int minor,
-                                                 int icanon)
+                                                 unsigned icanon)
 {
         struct tty_audit_buf *buf;
 
@@ -239,7 +239,8 @@ int tty_audit_push_task(struct task_struct *tsk, kuid_t loginuid, u32 sessionid)
  *      if TTY auditing is disabled or out of memory.  Otherwise, return a new
  *      reference to the buffer.
  */
-static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty)
+static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty,
+                unsigned icanon)
 {
         struct tty_audit_buf *buf, *buf2;
 
@@ -257,7 +258,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty)
 
         buf2 = tty_audit_buf_alloc(tty->driver->major,
                                    tty->driver->minor_start + tty->index,
-                                   tty->icanon);
+                                   icanon);
         if (buf2 == NULL) {
                 audit_log_lost("out of memory in TTY auditing");
                 return NULL;
@@ -287,7 +288,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty)
  *      Audit @data of @size from @tty, if necessary.
  */
 void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
-                        size_t size)
+                        size_t size, unsigned icanon)
 {
         struct tty_audit_buf *buf;
         int major, minor;
@@ -299,7 +300,7 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
             && tty->driver->subtype == PTY_TYPE_MASTER)
                 return;
 
-        buf = tty_audit_buf_get(tty);
+        buf = tty_audit_buf_get(tty, icanon);
         if (!buf)
                 return;
 
@@ -307,11 +308,11 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
         major = tty->driver->major;
         minor = tty->driver->minor_start + tty->index;
         if (buf->major != major || buf->minor != minor
-            || buf->icanon != tty->icanon) {
+            || buf->icanon != icanon) {
                 tty_audit_buf_push_current(buf);
                 buf->major = major;
                 buf->minor = minor;
-                buf->icanon = tty->icanon;
+                buf->icanon = icanon;
         }
         do {
                 size_t run;
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 91e326ffe7db..6cf87d7afb7e 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -27,19 +27,21 @@
  *      Locking: none
  */
 
-void tty_buffer_free_all(struct tty_struct *tty)
+void tty_buffer_free_all(struct tty_port *port)
 {
+        struct tty_bufhead *buf = &port->buf;
         struct tty_buffer *thead;
-        while ((thead = tty->buf.head) != NULL) {
-                tty->buf.head = thead->next;
+
+        while ((thead = buf->head) != NULL) {
+                buf->head = thead->next;
                 kfree(thead);
         }
-        while ((thead = tty->buf.free) != NULL) {
-                tty->buf.free = thead->next;
+        while ((thead = buf->free) != NULL) {
+                buf->free = thead->next;
                 kfree(thead);
         }
-        tty->buf.tail = NULL;
-        tty->buf.memory_used = 0;
+        buf->tail = NULL;
+        buf->memory_used = 0;
 }
 
 /**
@@ -54,11 +56,11 @@ void tty_buffer_free_all(struct tty_struct *tty)
  *      Locking: Caller must hold tty->buf.lock
  */
 
-static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
+static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size)
 {
         struct tty_buffer *p;
 
-        if (tty->buf.memory_used + size > 65536)
+        if (port->buf.memory_used + size > 65536)
                 return NULL;
         p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
         if (p == NULL)
@@ -70,7 +72,7 @@ static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
         p->read = 0;
         p->char_buf_ptr = (char *)(p->data);
         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
-        tty->buf.memory_used += size;
+        port->buf.memory_used += size;
         return p;
 }
 
@@ -85,17 +87,19 @@ static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
  *      Locking: Caller must hold tty->buf.lock
  */
 
-static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
+static void tty_buffer_free(struct tty_port *port, struct tty_buffer *b)
 {
+        struct tty_bufhead *buf = &port->buf;
+
         /* Dumb strategy for now - should keep some stats */
-        tty->buf.memory_used -= b->size;
-        WARN_ON(tty->buf.memory_used < 0);
+        buf->memory_used -= b->size;
+        WARN_ON(buf->memory_used < 0);
 
         if (b->size >= 512)
                 kfree(b);
         else {
-                b->next = tty->buf.free;
-                tty->buf.free = b;
+                b->next = buf->free;
+                buf->free = b;
         }
 }
 
@@ -110,15 +114,16 @@ static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
  *      Locking: Caller must hold tty->buf.lock
  */
 
-static void __tty_buffer_flush(struct tty_struct *tty)
+static void __tty_buffer_flush(struct tty_port *port)
 {
+        struct tty_bufhead *buf = &port->buf;
         struct tty_buffer *thead;
 
-        while ((thead = tty->buf.head) != NULL) {
-                tty->buf.head = thead->next;
-                tty_buffer_free(tty, thead);
+        while ((thead = buf->head) != NULL) {
+                buf->head = thead->next;
+                tty_buffer_free(port, thead);
         }
-        tty->buf.tail = NULL;
+        buf->tail = NULL;
 }
 
 /**
@@ -134,21 +139,24 @@ static void __tty_buffer_flush(struct tty_struct *tty)
 
 void tty_buffer_flush(struct tty_struct *tty)
 {
+        struct tty_port *port = tty->port;
+        struct tty_bufhead *buf = &port->buf;
         unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
+
+        spin_lock_irqsave(&buf->lock, flags);
 
         /* If the data is being pushed to the tty layer then we can't
            process it here. Instead set a flag and the flush_to_ldisc
            path will process the flush request before it exits */
-        if (test_bit(TTY_FLUSHING, &tty->flags)) {
-                set_bit(TTY_FLUSHPENDING, &tty->flags);
-                spin_unlock_irqrestore(&tty->buf.lock, flags);
+        if (test_bit(TTYP_FLUSHING, &port->iflags)) {
+                set_bit(TTYP_FLUSHPENDING, &port->iflags);
+                spin_unlock_irqrestore(&buf->lock, flags);
                 wait_event(tty->read_wait,
-                                test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
+                                test_bit(TTYP_FLUSHPENDING, &port->iflags) == 0);
                 return;
         } else
-                __tty_buffer_flush(tty);
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
+                __tty_buffer_flush(port);
+        spin_unlock_irqrestore(&buf->lock, flags);
 }
 
 /**
@@ -163,9 +171,9 @@ void tty_buffer_flush(struct tty_struct *tty)
  *      Locking: Caller must hold tty->buf.lock
  */
 
-static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
+static struct tty_buffer *tty_buffer_find(struct tty_port *port, size_t size)
 {
-        struct tty_buffer **tbh = &tty->buf.free;
+        struct tty_buffer **tbh = &port->buf.free;
         while ((*tbh) != NULL) {
                 struct tty_buffer *t = *tbh;
                 if (t->size >= size) {
@@ -174,14 +182,14 @@ static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
                         t->used = 0;
                         t->commit = 0;
                         t->read = 0;
-                        tty->buf.memory_used += t->size;
+                        port->buf.memory_used += t->size;
                         return t;
                 }
                 tbh = &((*tbh)->next);
         }
         /* Round the buffer size out */
         size = (size + 0xFF) & ~0xFF;
-        return tty_buffer_alloc(tty, size);
+        return tty_buffer_alloc(port, size);
         /* Should possibly check if this fails for the largest buffer we
            have queued and recycle that ? */
 }
@@ -192,29 +200,31 @@ static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
  *
  *      Make at least size bytes of linear space available for the tty
  *      buffer. If we fail return the size we managed to find.
- *      Locking: Caller must hold tty->buf.lock
+ *      Locking: Caller must hold port->buf.lock
  */
-static int __tty_buffer_request_room(struct tty_struct *tty, size_t size)
+static int __tty_buffer_request_room(struct tty_port *port, size_t size)
 {
+        struct tty_bufhead *buf = &port->buf;
         struct tty_buffer *b, *n;
         int left;
         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
            remove this conditional if its worth it. This would be invisible
            to the callers */
-        if ((b = tty->buf.tail) != NULL)
+        b = buf->tail;
+        if (b != NULL)
                 left = b->size - b->used;
         else
                 left = 0;
 
         if (left < size) {
                 /* This is the slow path - looking for new buffers to use */
-                if ((n = tty_buffer_find(tty, size)) != NULL) {
+                if ((n = tty_buffer_find(port, size)) != NULL) {
                         if (b != NULL) {
                                 b->next = n;
                                 b->commit = b->used;
                         } else
-                                tty->buf.head = n;
-                        tty->buf.tail = n;
+                                buf->head = n;
+                        buf->tail = n;
                 } else
                         size = left;
         }
@@ -231,16 +241,17 @@ static int __tty_buffer_request_room(struct tty_struct *tty, size_t size)
  *      Make at least size bytes of linear space available for the tty
  *      buffer. If we fail return the size we managed to find.
  *
- *      Locking: Takes tty->buf.lock
+ *      Locking: Takes port->buf.lock
  */
 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
 {
+        struct tty_port *port = tty->port;
         unsigned long flags;
         int length;
 
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        length = __tty_buffer_request_room(tty, size);
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        spin_lock_irqsave(&port->buf.lock, flags);
+        length = __tty_buffer_request_room(port, size);
+        spin_unlock_irqrestore(&port->buf.lock, flags);
         return length;
 }
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
@@ -255,12 +266,13 @@ EXPORT_SYMBOL_GPL(tty_buffer_request_room);
  *      Queue a series of bytes to the tty buffering. All the characters
  *      passed are marked with the supplied flag. Returns the number added.
  *
- *      Locking: Called functions may take tty->buf.lock
+ *      Locking: Called functions may take port->buf.lock
  */
 
 int tty_insert_flip_string_fixed_flag(struct tty_struct *tty,
                 const unsigned char *chars, char flag, size_t size)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         int copied = 0;
         do {
                 int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
@@ -268,18 +280,18 @@ int tty_insert_flip_string_fixed_flag(struct tty_struct *tty,
                 unsigned long flags;
                 struct tty_buffer *tb;
 
-                spin_lock_irqsave(&tty->buf.lock, flags);
-                space = __tty_buffer_request_room(tty, goal);
-                tb = tty->buf.tail;
+                spin_lock_irqsave(&buf->lock, flags);
+                space = __tty_buffer_request_room(tty->port, goal);
+                tb = buf->tail;
                 /* If there is no space then tb may be NULL */
                 if (unlikely(space == 0)) {
-                        spin_unlock_irqrestore(&tty->buf.lock, flags);
+                        spin_unlock_irqrestore(&buf->lock, flags);
                         break;
                 }
                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
                 memset(tb->flag_buf_ptr + tb->used, flag, space);
                 tb->used += space;
-                spin_unlock_irqrestore(&tty->buf.lock, flags);
+                spin_unlock_irqrestore(&buf->lock, flags);
                 copied += space;
                 chars += space;
                 /* There is a small chance that we need to split the data over
@@ -300,12 +312,13 @@ EXPORT_SYMBOL(tty_insert_flip_string_fixed_flag);
  *      the flags array indicates the status of the character. Returns the
  *      number added.
  *
- *      Locking: Called functions may take tty->buf.lock
+ *      Locking: Called functions may take port->buf.lock
  */
 
 int tty_insert_flip_string_flags(struct tty_struct *tty,
                 const unsigned char *chars, const char *flags, size_t size)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         int copied = 0;
         do {
                 int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
@@ -313,18 +326,18 @@ int tty_insert_flip_string_flags(struct tty_struct *tty,
                 unsigned long __flags;
                 struct tty_buffer *tb;
 
-                spin_lock_irqsave(&tty->buf.lock, __flags);
-                space = __tty_buffer_request_room(tty, goal);
-                tb = tty->buf.tail;
+                spin_lock_irqsave(&buf->lock, __flags);
+                space = __tty_buffer_request_room(tty->port, goal);
+                tb = buf->tail;
                 /* If there is no space then tb may be NULL */
                 if (unlikely(space == 0)) {
-                        spin_unlock_irqrestore(&tty->buf.lock, __flags);
+                        spin_unlock_irqrestore(&buf->lock, __flags);
                         break;
                 }
                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
                 tb->used += space;
-                spin_unlock_irqrestore(&tty->buf.lock, __flags);
+                spin_unlock_irqrestore(&buf->lock, __flags);
                 copied += space;
                 chars += space;
                 flags += space;
@@ -342,18 +355,23 @@ EXPORT_SYMBOL(tty_insert_flip_string_flags);
  *      Takes any pending buffers and transfers their ownership to the
  *      ldisc side of the queue. It then schedules those characters for
  *      processing by the line discipline.
+ *      Note that this function can only be used when the low_latency flag
+ *      is unset. Otherwise the workqueue won't be flushed.
  *
- *      Locking: Takes tty->buf.lock
+ *      Locking: Takes port->buf.lock
  */
 
 void tty_schedule_flip(struct tty_struct *tty)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
-                tty->buf.tail->commit = tty->buf.tail->used;
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        schedule_work(&tty->buf.work);
+        WARN_ON(tty->low_latency);
+
+        spin_lock_irqsave(&buf->lock, flags);
+        if (buf->tail != NULL)
+                buf->tail->commit = buf->tail->used;
+        spin_unlock_irqrestore(&buf->lock, flags);
+        schedule_work(&buf->work);
 }
 EXPORT_SYMBOL(tty_schedule_flip);
 
@@ -369,26 +387,27 @@ EXPORT_SYMBOL(tty_schedule_flip);
  *      that need their own block copy routines into the buffer. There is no
  *      guarantee the buffer is a DMA target!
  *
- *      Locking: May call functions taking tty->buf.lock
+ *      Locking: May call functions taking port->buf.lock
  */
 
 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars,
-                                                                size_t size)
+                size_t size)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         int space;
         unsigned long flags;
         struct tty_buffer *tb;
 
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        space = __tty_buffer_request_room(tty, size);
+        spin_lock_irqsave(&buf->lock, flags);
+        space = __tty_buffer_request_room(tty->port, size);
 
-        tb = tty->buf.tail;
+        tb = buf->tail;
         if (likely(space)) {
                 *chars = tb->char_buf_ptr + tb->used;
                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
                 tb->used += space;
         }
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        spin_unlock_irqrestore(&buf->lock, flags);
         return space;
 }
 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
@@ -406,26 +425,27 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
  *      that need their own block copy routines into the buffer. There is no
  *      guarantee the buffer is a DMA target!
  *
- *      Locking: May call functions taking tty->buf.lock
+ *      Locking: May call functions taking port->buf.lock
  */
 
 int tty_prepare_flip_string_flags(struct tty_struct *tty,
                         unsigned char **chars, char **flags, size_t size)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         int space;
         unsigned long __flags;
         struct tty_buffer *tb;
 
-        spin_lock_irqsave(&tty->buf.lock, __flags);
-        space = __tty_buffer_request_room(tty, size);
+        spin_lock_irqsave(&buf->lock, __flags);
+        space = __tty_buffer_request_room(tty->port, size);
 
-        tb = tty->buf.tail;
+        tb = buf->tail;
         if (likely(space)) {
                 *chars = tb->char_buf_ptr + tb->used;
                 *flags = tb->flag_buf_ptr + tb->used;
                 tb->used += space;
         }
-        spin_unlock_irqrestore(&tty->buf.lock, __flags);
+        spin_unlock_irqrestore(&buf->lock, __flags);
         return space;
 }
 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
@@ -446,20 +466,25 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
 
 static void flush_to_ldisc(struct work_struct *work)
 {
-        struct tty_struct *tty =
-                container_of(work, struct tty_struct, buf.work);
+        struct tty_port *port = container_of(work, struct tty_port, buf.work);
+        struct tty_bufhead *buf = &port->buf;
+        struct tty_struct *tty;
         unsigned long   flags;
         struct tty_ldisc *disc;
 
+        tty = port->itty;
+        if (WARN_RATELIMIT(tty == NULL, "tty is NULL"))
+                return;
+
         disc = tty_ldisc_ref(tty);
         if (disc == NULL)       /*  !TTY_LDISC */
                 return;
 
-        spin_lock_irqsave(&tty->buf.lock, flags);
+        spin_lock_irqsave(&buf->lock, flags);
 
-        if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
+        if (!test_and_set_bit(TTYP_FLUSHING, &port->iflags)) {
                 struct tty_buffer *head;
-                while ((head = tty->buf.head) != NULL) {
+                while ((head = buf->head) != NULL) {
                         int count;
                         char *char_buf;
                         unsigned char *flag_buf;
@@ -468,14 +493,14 @@ static void flush_to_ldisc(struct work_struct *work)
                         if (!count) {
                                 if (head->next == NULL)
                                         break;
-                                tty->buf.head = head->next;
-                                tty_buffer_free(tty, head);
+                                buf->head = head->next;
+                                tty_buffer_free(port, head);
                                 continue;
                         }
                         /* Ldisc or user is trying to flush the buffers
                            we are feeding to the ldisc, stop feeding the
                            line discipline as we want to empty the queue */
-                        if (test_bit(TTY_FLUSHPENDING, &tty->flags))
+                        if (test_bit(TTYP_FLUSHPENDING, &port->iflags))
                                 break;
                         if (!tty->receive_room)
                                 break;
@@ -484,22 +509,22 @@ static void flush_to_ldisc(struct work_struct *work)
                         char_buf = head->char_buf_ptr + head->read;
                         flag_buf = head->flag_buf_ptr + head->read;
                         head->read += count;
-                        spin_unlock_irqrestore(&tty->buf.lock, flags);
+                        spin_unlock_irqrestore(&buf->lock, flags);
                         disc->ops->receive_buf(tty, char_buf,
                                                         flag_buf, count);
-                        spin_lock_irqsave(&tty->buf.lock, flags);
+                        spin_lock_irqsave(&buf->lock, flags);
                 }
-                clear_bit(TTY_FLUSHING, &tty->flags);
+                clear_bit(TTYP_FLUSHING, &port->iflags);
         }
 
         /* We may have a deferred request to flush the input buffer,
            if so pull the chain under the lock and empty the queue */
-        if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
-                __tty_buffer_flush(tty);
-                clear_bit(TTY_FLUSHPENDING, &tty->flags);
+        if (test_bit(TTYP_FLUSHPENDING, &port->iflags)) {
+                __tty_buffer_flush(port);
+                clear_bit(TTYP_FLUSHPENDING, &port->iflags);
                 wake_up(&tty->read_wait);
         }
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        spin_unlock_irqrestore(&buf->lock, flags);
 
         tty_ldisc_deref(disc);
 }
@@ -514,7 +539,8 @@ static void flush_to_ldisc(struct work_struct *work)
  */
 void tty_flush_to_ldisc(struct tty_struct *tty)
 {
-        flush_work(&tty->buf.work);
+        if (!tty->low_latency)
+                flush_work(&tty->port->buf.work);
 }
 
 /**
@@ -532,16 +558,18 @@ void tty_flush_to_ldisc(struct tty_struct *tty)
 
 void tty_flip_buffer_push(struct tty_struct *tty)
 {
+        struct tty_bufhead *buf = &tty->port->buf;
         unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
-                tty->buf.tail->commit = tty->buf.tail->used;
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
+
+        spin_lock_irqsave(&buf->lock, flags);
+        if (buf->tail != NULL)
+                buf->tail->commit = buf->tail->used;
+        spin_unlock_irqrestore(&buf->lock, flags);
 
         if (tty->low_latency)
-                flush_to_ldisc(&tty->buf.work);
+                flush_to_ldisc(&buf->work);
         else
-                schedule_work(&tty->buf.work);
+                schedule_work(&buf->work);
 }
 EXPORT_SYMBOL(tty_flip_buffer_push);
 
@@ -555,13 +583,15 @@ EXPORT_SYMBOL(tty_flip_buffer_push);
  *      Locking: none
  */
 
-void tty_buffer_init(struct tty_struct *tty)
+void tty_buffer_init(struct tty_port *port)
 {
-        spin_lock_init(&tty->buf.lock);
-        tty->buf.head = NULL;
-        tty->buf.tail = NULL;
-        tty->buf.free = NULL;
-        tty->buf.memory_used = 0;
-        INIT_WORK(&tty->buf.work, flush_to_ldisc);
+        struct tty_bufhead *buf = &port->buf;
+
+        spin_lock_init(&buf->lock);
+        buf->head = NULL;
+        buf->tail = NULL;
+        buf->free = NULL;
+        buf->memory_used = 0;
+        INIT_WORK(&buf->work, flush_to_ldisc);
 }
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 2ea176b2280e..a3eba7f359ed 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -186,7 +186,6 @@ void free_tty_struct(struct tty_struct *tty)
         if (tty->dev)
                 put_device(tty->dev);
         kfree(tty->write_buf);
-        tty_buffer_free_all(tty);
         tty->magic = 0xDEADDEAD;
         kfree(tty);
 }
@@ -1417,6 +1416,8 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
                         "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
                         __func__, tty->driver->name);
 
+        tty->port->itty = tty;
+
         /*
          * Structures all installed ... call the ldisc open routines.
          * If we fail here just call release_tty to clean up.  No need
@@ -1552,6 +1553,7 @@ static void release_tty(struct tty_struct *tty, int idx)
                 tty->ops->shutdown(tty);
         tty_free_termios(tty);
         tty_driver_remove_tty(tty->driver, tty);
+        tty->port->itty = NULL;
 
         if (tty->link)
                 tty_kref_put(tty->link);
@@ -1625,7 +1627,6 @@ int tty_release(struct inode *inode, struct file *filp)
         struct tty_struct *tty = file_tty(filp);
         struct tty_struct *o_tty;
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
-        int     devpts;
         int     idx;
         char    buf[64];
 
@@ -1640,7 +1641,6 @@ int tty_release(struct inode *inode, struct file *filp)
         idx = tty->index;
         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                       tty->driver->subtype == PTY_TYPE_MASTER);
-        devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
         /* Review: parallel close */
         o_tty = tty->link;
 
@@ -1799,9 +1799,6 @@ int tty_release(struct inode *inode, struct file *filp)
         release_tty(tty, idx);
         mutex_unlock(&tty_mutex);
 
-        /* Make this pty number available for reallocation */
-        if (devpts)
-                devpts_kill_index(inode, idx);
         return 0;
 }
 
@@ -2937,19 +2934,13 @@ void initialize_tty_struct(struct tty_struct *tty,
         tty_ldisc_init(tty);
         tty->session = NULL;
         tty->pgrp = NULL;
-        tty->overrun_time = jiffies;
-        tty_buffer_init(tty);
         mutex_init(&tty->legacy_mutex);
         mutex_init(&tty->termios_mutex);
         mutex_init(&tty->ldisc_mutex);
         init_waitqueue_head(&tty->write_wait);
         init_waitqueue_head(&tty->read_wait);
         INIT_WORK(&tty->hangup_work, do_tty_hangup);
-        mutex_init(&tty->atomic_read_lock);
         mutex_init(&tty->atomic_write_lock);
-        mutex_init(&tty->output_lock);
-        mutex_init(&tty->echo_lock);
-        spin_lock_init(&tty->read_lock);
         spin_lock_init(&tty->ctrl_lock);
         INIT_LIST_HEAD(&tty->tty_files);
         INIT_WORK(&tty->SAK_work, do_SAK_work);
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 0f2a2c5e704c..f4e6754525dc 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -512,7 +512,7 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 static int tty_ldisc_halt(struct tty_struct *tty)
 {
         clear_bit(TTY_LDISC, &tty->flags);
-        return cancel_work_sync(&tty->buf.work);
+        return cancel_work_sync(&tty->port->buf.work);
 }
 
 /**
@@ -525,7 +525,7 @@ static void tty_ldisc_flush_works(struct tty_struct *tty)
 {
         flush_work(&tty->hangup_work);
         flush_work(&tty->SAK_work);
-        flush_work(&tty->buf.work);
+        flush_work(&tty->port->buf.work);
 }
 
 /**
@@ -704,9 +704,9 @@ enable:
         /* Restart the work queue in case no characters kick it off. Safe if
            already running */
         if (work)
-                schedule_work(&tty->buf.work);
+                schedule_work(&tty->port->buf.work);
         if (o_work)
-                schedule_work(&o_tty->buf.work);
+                schedule_work(&o_tty->port->buf.work);
         mutex_unlock(&tty->ldisc_mutex);
         tty_unlock(tty);
         return retval;
@@ -817,7 +817,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          */
         clear_bit(TTY_LDISC, &tty->flags);
         tty_unlock(tty);
-        cancel_work_sync(&tty->buf.work);
+        cancel_work_sync(&tty->port->buf.work);
         mutex_unlock(&tty->ldisc_mutex);
 retry:
         tty_lock(tty);
@@ -897,6 +897,11 @@ int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
 
 static void tty_ldisc_kill(struct tty_struct *tty)
 {
+        /* There cannot be users from userspace now. But there still might be
+         * drivers holding a reference via tty_ldisc_ref. Do not steal them the
+         * ldisc until they are done. */
+        tty_ldisc_wait_idle(tty, MAX_SCHEDULE_TIMEOUT);
+
         mutex_lock(&tty->ldisc_mutex);
         /*
          * Now kill off the ldisc
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index d7bdd8d0c23f..416b42f7c346 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -21,6 +21,7 @@
 void tty_port_init(struct tty_port *port)
 {
         memset(port, 0, sizeof(*port));
+        tty_buffer_init(port);
         init_waitqueue_head(&port->open_wait);
         init_waitqueue_head(&port->close_wait);
         init_waitqueue_head(&port->delta_msr_wait);
@@ -126,6 +127,7 @@ static void tty_port_destructor(struct kref *kref)
         struct tty_port *port = container_of(kref, struct tty_port, kref);
         if (port->xmit_buf)
                 free_page((unsigned long)port->xmit_buf);
+        tty_buffer_free_all(port);
         if (port->ops->destruct)
                 port->ops->destruct(port);
         else
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 8e9b4be97a2d..60b7b6926059 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -341,15 +341,11 @@ int paste_selection(struct tty_struct *tty)
         struct  tty_ldisc *ld;
         DECLARE_WAITQUEUE(wait, current);
 
-
         console_lock();
         poke_blanked_console();
         console_unlock();
 
-        /* FIXME: wtf is this supposed to achieve ? */
-        ld = tty_ldisc_ref(tty);
-        if (!ld)
-                ld = tty_ldisc_ref_wait(tty);
+        ld = tty_ldisc_ref_wait(tty);
 
         /* FIXME: this is completely unsafe */
         add_wait_queue(&vc->paste_wait, &wait);
@@ -361,8 +357,7 @@ int paste_selection(struct tty_struct *tty)
                 }
                 count = sel_buffer_lth - pasted;
                 count = min(count, tty->receive_room);
-                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
-                                                                NULL, count);
+                ld->ops->receive_buf(tty, sel_buffer + pasted, NULL, count);
                 pasted += count;
         }
         remove_wait_queue(&vc->paste_wait, &wait);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 981f2132d128..6e49ec6f3adc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -817,10 +817,6 @@ static const __u32 acm_tty_speed[] = {
         2500000, 3000000, 3500000, 4000000
 };
 
-static const __u8 acm_tty_size[] = {
-        5, 6, 7, 8
-};
-
 static void acm_tty_set_termios(struct tty_struct *tty,
                                                 struct ktermios *termios_old)
 {
@@ -834,7 +830,21 @@ static void acm_tty_set_termios(struct tty_struct *tty,
         newline.bParityType = termios->c_cflag & PARENB ?
                                 (termios->c_cflag & PARODD ? 1 : 2) +
                                 (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
-        newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
+        switch (termios->c_cflag & CSIZE) {
+        case CS5:
+                newline.bDataBits = 5;
+                break;
+        case CS6:
+                newline.bDataBits = 6;
+                break;
+        case CS7:
+                newline.bDataBits = 7;
+                break;
+        case CS8:
+        default:
+                newline.bDataBits = 8;
+                break;
+        }
         /* FIXME: Needs to clear unsupported bits in the termios */
         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
 
@@ -1233,7 +1243,7 @@ made_compressed_probe:
 
                 if (usb_endpoint_xfer_int(epwrite))
                         usb_fill_int_urb(snd->urb, usb_dev,
-                                usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+                                usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
                                 NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
                 else
                         usb_fill_bulk_urb(snd->urb, usb_dev,
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e0356cb859b5..b78fbe222b72 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1348,6 +1348,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                                         ret = -EFAULT;
                                         goto error;
                                 }
+                                uurb->buffer += u;
                         }
                         totlen -= u;
                 }
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index ddd820d25288..6056db7af410 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -367,6 +367,10 @@ static int usb_probe_interface(struct device *dev)
         intf->condition = USB_INTERFACE_UNBOUND;
         usb_cancel_queued_reset(intf);
 
+        /* If the LPM disable succeeded, balance the ref counts. */
+        if (!lpm_disable_error)
+                usb_unlocked_enable_lpm(udev);
+
         /* Unbound interfaces are always runtime-PM-disabled and -suspended */
         if (driver->supports_autosuspend)
                 pm_runtime_disable(dev);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 673ee4696262..64854d76f529 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3241,8 +3241,7 @@ static int usb_req_set_sel(struct usb_device *udev, enum usb3_link_state state)
                         (state == USB3_LPM_U2 &&
                          (u2_sel > USB3_LPM_MAX_U2_SEL_PEL ||
                           u2_pel > USB3_LPM_MAX_U2_SEL_PEL))) {
-                dev_dbg(&udev->dev, "Device-initiated %s disabled due "
-                                "to long SEL %llu ms or PEL %llu ms\n",
+                dev_dbg(&udev->dev, "Device-initiated %s disabled due to long SEL %llu us or PEL %llu us\n",
                                 usb3_lpm_names[state], u1_sel, u1_pel);
                 return -EINVAL;
         }
@@ -3320,16 +3319,6 @@ static int usb_set_device_initiated_lpm(struct usb_device *udev,
 
         if (enable) {
                 /*
-                 * First, let the device know about the exit latencies
-                 * associated with the link state we're about to enable.
-                 */
-                ret = usb_req_set_sel(udev, state);
-                if (ret < 0) {
-                        dev_warn(&udev->dev, "Set SEL for device-initiated "
-                                        "%s failed.\n", usb3_lpm_names[state]);
-                        return -EBUSY;
-                }
-                /*
                  * Now send the control transfer to enable device-initiated LPM
                  * for either U1 or U2.
                  */
@@ -3414,7 +3403,28 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
 static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
                 enum usb3_link_state state)
 {
-        int timeout;
+        int timeout, ret;
+        __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat;
+        __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat;
+
+        /* If the device says it doesn't have *any* exit latency to come out of
+         * U1 or U2, it's probably lying.  Assume it doesn't implement that link
+         * state.
+         */
+        if ((state == USB3_LPM_U1 && u1_mel == 0) ||
+                        (state == USB3_LPM_U2 && u2_mel == 0))
+                return;
+
+        /*
+         * First, let the device know about the exit latencies
+         * associated with the link state we're about to enable.
+         */
+        ret = usb_req_set_sel(udev, state);
+        if (ret < 0) {
+                dev_warn(&udev->dev, "Set SEL for device-initiated %s failed.\n",
+                                usb3_lpm_names[state]);
+                return;
+        }
 
         /* We allow the host controller to set the U1/U2 timeout internally
          * first, so that it can change its schedule to account for the
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index b415c0c859d3..c14ebc975ba4 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -409,6 +409,10 @@ static void dwc3_core_exit(struct dwc3 *dwc)
 {
         dwc3_event_buffers_cleanup(dwc);
         dwc3_free_event_buffers(dwc);
+
+        usb_phy_shutdown(dwc->usb2_phy);
+        usb_phy_shutdown(dwc->usb3_phy);
+
 }
 
 #define DWC3_ALIGN_MASK         (16 - 1)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index c9e729a4bf65..7b7deddf6a52 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1904,7 +1904,7 @@ static void dwc3_stop_active_transfer(struct dwc3 *dwc, u32 epnum)
         ret = dwc3_send_gadget_ep_cmd(dwc, dep->number, cmd, &params);
         WARN_ON_ONCE(ret);
         dep->resource_index = 0;
-
+        dep->flags &= ~DWC3_EP_BUSY;
         udelay(100);
 }
 
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index dfb51a45496c..e0ff51b89529 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -952,6 +952,7 @@ endif
 config USB_G_WEBCAM
         tristate "USB Webcam Gadget"
         depends on VIDEO_DEV
+        select USB_LIBCOMPOSITE
         help
           The Webcam Gadget acts as a composite USB Audio and Video Class
           device. It provides a userspace API to process UVC control requests
diff --git a/drivers/usb/gadget/lpc32xx_udc.c b/drivers/usb/gadget/lpc32xx_udc.c
index f696fb9b136d..21a9861dabf0 100644
--- a/drivers/usb/gadget/lpc32xx_udc.c
+++ b/drivers/usb/gadget/lpc32xx_udc.c
@@ -2930,10 +2930,10 @@ static void vbus_work(struct work_struct *work)
 
                 /* Get the VBUS status from the transceiver */
                 value = i2c_smbus_read_byte_data(udc->isp1301_i2c_client,
-                                                 ISP1301_I2C_OTG_CONTROL_2);
+                                                 ISP1301_I2C_INTERRUPT_SOURCE);
 
                 /* VBUS on or off? */
-                if (value & OTG_B_SESS_VLD)
+                if (value & INT_SESS_VLD)
                         udc->vbus = 1;
                 else
                         udc->vbus = 0;
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 9bfde82078ec..0d2f35ca93f1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -222,7 +222,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
 
         if (pdata->controller_ver < 0) {
                 dev_warn(hcd->self.controller, "Could not get controller version\n");
-                return;
+                return -ENODEV;
         }
 
         portsc = ehci_readl(ehci, &ehci->regs->port_status[port_offset]);
diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index 8e7eca62f169..9c2717d66730 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -160,7 +160,7 @@ static const struct hc_driver ehci_orion_hc_driver = {
         .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 };
 
-static void __init
+static void __devinit
 ehci_orion_conf_mbus_windows(struct usb_hcd *hcd,
                              const struct mbus_dram_target_info *dram)
 {
diff --git a/drivers/usb/host/ehci-vt8500.c b/drivers/usb/host/ehci-vt8500.c
index 96722bfebc84..d3c9a3e397b9 100644
--- a/drivers/usb/host/ehci-vt8500.c
+++ b/drivers/usb/host/ehci-vt8500.c
@@ -85,6 +85,8 @@ static const struct hc_driver vt8500_ehci_hc_driver = {
         .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
+static u64 vt8500_ehci_dma_mask = DMA_BIT_MASK(32);
+
 static int vt8500_ehci_drv_probe(struct platform_device *pdev)
 {
         struct usb_hcd *hcd;
@@ -95,6 +97,14 @@ static int vt8500_ehci_drv_probe(struct platform_device *pdev)
         if (usb_disabled())
                 return -ENODEV;
 
+        /*
+         * Right now device-tree probed devices don't get dma_mask set.
+         * Since shared usb code relies on it, set it here for now.
+         * Once we have dma capability bindings this can go away.
+         */
+        if (!pdev->dev.dma_mask)
+                pdev->dev.dma_mask = &vt8500_ehci_dma_mask;
+
         if (pdev->resource[1].flags != IORESOURCE_IRQ) {
                 pr_debug("resource[1] is not IORESOURCE_IRQ");
                 return -ENOMEM;
diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c
index e4780491df4a..68ebf20e1519 100644
--- a/drivers/usb/host/uhci-platform.c
+++ b/drivers/usb/host/uhci-platform.c
@@ -60,6 +60,7 @@ static const struct hc_driver uhci_platform_hc_driver = {
         .hub_control =          uhci_hub_control,
 };
 
+static u64 platform_uhci_dma_mask = DMA_BIT_MASK(32);
 
 static int __devinit uhci_hcd_platform_probe(struct platform_device *pdev)
 {
@@ -71,6 +72,14 @@ static int __devinit uhci_hcd_platform_probe(struct platform_device *pdev)
         if (usb_disabled())
                 return -ENODEV;
 
+        /*
+         * Right now device-tree probed devices don't get dma_mask set.
+         * Since shared usb code relies on it, set it here for now.
+         * Once we have dma capability bindings this can go away.
+         */
+        if (!pdev->dev.dma_mask)
+                pdev->dev.dma_mask = &platform_uhci_dma_mask;
+
         hcd = usb_create_hcd(&uhci_platform_hc_driver, &pdev->dev,
                         pdev->name);
         if (!hcd)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 8d7fcbbe6ade..7d462bf20092 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -479,7 +479,8 @@ static bool compliance_mode_recovery_timer_quirk_check(void)
 
         if (strstr(dmi_product_name, "Z420") ||
                         strstr(dmi_product_name, "Z620") ||
-                        strstr(dmi_product_name, "Z820"))
+                        strstr(dmi_product_name, "Z820") ||
+                        strstr(dmi_product_name, "Z1"))
                 return true;
 
         return false;
diff --git a/drivers/usb/musb/am35x.c b/drivers/usb/musb/am35x.c
index 457f25e62c51..c964d6af178b 100644
--- a/drivers/usb/musb/am35x.c
+++ b/drivers/usb/musb/am35x.c
@@ -305,6 +305,12 @@ static irqreturn_t am35x_musb_interrupt(int irq, void *hci)
                 ret = IRQ_HANDLED;
         }
 
+        /* Drop spurious RX and TX if device is disconnected */
+        if (musb->int_usb & MUSB_INTR_DISCONNECT) {
+                musb->int_tx = 0;
+                musb->int_rx = 0;
+        }
+
         if (musb->int_tx || musb->int_rx || musb->int_usb)
                 ret |= musb_interrupt(musb);
 
diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
index 35c5208f3249..61933a90e5bf 100644
--- a/drivers/usb/renesas_usbhs/mod.c
+++ b/drivers/usb/renesas_usbhs/mod.c
@@ -273,9 +273,9 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
         usbhs_write(priv, INTSTS0, ~irq_state.intsts0 & INTSTS0_MAGIC);
         usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
 
-        usbhs_write(priv, BRDYSTS, 0);
-        usbhs_write(priv, NRDYSTS, 0);
-        usbhs_write(priv, BEMPSTS, 0);
+        usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+        usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
+        usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
 
         /*
          * call irq callback functions
diff --git a/drivers/usb/renesas_usbhs/pipe.h b/drivers/usb/renesas_usbhs/pipe.h
index 08786c06dcf1..3d80c7b1fd1b 100644
--- a/drivers/usb/renesas_usbhs/pipe.h
+++ b/drivers/usb/renesas_usbhs/pipe.h
@@ -54,7 +54,7 @@ struct usbhs_pipe_info {
  * pipe list
  */
 #define __usbhs_for_each_pipe(start, pos, info, i)      \
-        for (i = start, pos = (info)->pipe;             \
+        for (i = start, pos = (info)->pipe + i;         \
              i < (info)->size;                          \
              i++, pos = (info)->pipe + i)
 
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index cf2522c397d3..bd50a8a41a0f 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -125,9 +125,6 @@ static inline int calc_divisor(int bps)
 
 static int ark3116_attach(struct usb_serial *serial)
 {
-        struct usb_serial_port *port = serial->port[0];
-        struct ark3116_private *priv;
-
         /* make sure we have our end-points */
         if ((serial->num_bulk_in == 0) ||
             (serial->num_bulk_out == 0) ||
@@ -142,8 +139,15 @@ static int ark3116_attach(struct usb_serial *serial)
                 return -EINVAL;
         }
 
-        priv = kzalloc(sizeof(struct ark3116_private),
-                       GFP_KERNEL);
+        return 0;
+}
+
+static int ark3116_port_probe(struct usb_serial_port *port)
+{
+        struct usb_serial *serial = port->serial;
+        struct ark3116_private *priv;
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
@@ -198,18 +202,15 @@ static int ark3116_attach(struct usb_serial *serial)
         return 0;
 }
 
-static void ark3116_release(struct usb_serial *serial)
+static int ark3116_port_remove(struct usb_serial_port *port)
 {
-        struct usb_serial_port *port = serial->port[0];
         struct ark3116_private *priv = usb_get_serial_port_data(port);
 
         /* device is closed, so URBs and DMA should be down */
-
-        usb_set_serial_port_data(port, NULL);
-
         mutex_destroy(&priv->hw_lock);
-
         kfree(priv);
+
+        return 0;
 }
 
 static void ark3116_init_termios(struct tty_struct *tty)
@@ -723,7 +724,8 @@ static struct usb_serial_driver ark3116_device = {
         .id_table =             id_table,
         .num_ports =            1,
         .attach =               ark3116_attach,
-        .release =              ark3116_release,
+        .port_probe =           ark3116_port_probe,
+        .port_remove =          ark3116_port_remove,
         .set_termios =          ark3116_set_termios,
         .init_termios =         ark3116_init_termios,
         .ioctl =                ark3116_ioctl,
diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 99449424193f..ea29556f0d72 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -45,8 +45,8 @@
 #define DRIVER_DESC "USB Belkin Serial converter driver"
 
 /* function prototypes for a Belkin USB Serial Adapter F5U103 */
-static int  belkin_sa_startup(struct usb_serial *serial);
-static void belkin_sa_release(struct usb_serial *serial);
+static int belkin_sa_port_probe(struct usb_serial_port *port);
+static int belkin_sa_port_remove(struct usb_serial_port *port);
 static int  belkin_sa_open(struct tty_struct *tty,
                         struct usb_serial_port *port);
 static void belkin_sa_close(struct usb_serial_port *port);
@@ -88,8 +88,8 @@ static struct usb_serial_driver belkin_device = {
         .break_ctl =            belkin_sa_break_ctl,
         .tiocmget =             belkin_sa_tiocmget,
         .tiocmset =             belkin_sa_tiocmset,
-        .attach =               belkin_sa_startup,
-        .release =              belkin_sa_release,
+        .port_probe =           belkin_sa_port_probe,
+        .port_remove =          belkin_sa_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
@@ -118,17 +118,15 @@ struct belkin_sa_private {
                                             (c), BELKIN_SA_SET_REQUEST_TYPE, \
                                             (v), 0, NULL, 0, WDR_TIMEOUT)
 
-/* do some startup allocations not currently performed by usb_serial_probe() */
-static int belkin_sa_startup(struct usb_serial *serial)
+static int belkin_sa_port_probe(struct usb_serial_port *port)
 {
-        struct usb_device *dev = serial->dev;
+        struct usb_device *dev = port->serial->dev;
         struct belkin_sa_private *priv;
 
-        /* allocate the private data structure */
         priv = kmalloc(sizeof(struct belkin_sa_private), GFP_KERNEL);
         if (!priv)
-                return -1; /* error */
-        /* set initial values for control structures */
+                return -ENOMEM;
+
         spin_lock_init(&priv->lock);
         priv->control_state = 0;
         priv->last_lsr = 0;
@@ -140,18 +138,19 @@ static int belkin_sa_startup(struct usb_serial *serial)
                                         le16_to_cpu(dev->descriptor.bcdDevice),
                                         priv->bad_flow_control);
 
-        init_waitqueue_head(&serial->port[0]->write_wait);
-        usb_set_serial_port_data(serial->port[0], priv);
+        usb_set_serial_port_data(port, priv);
 
         return 0;
 }
 
-static void belkin_sa_release(struct usb_serial *serial)
+static int belkin_sa_port_remove(struct usb_serial_port *port)
 {
-        int i;
+        struct belkin_sa_private *priv;
 
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static int belkin_sa_open(struct tty_struct *tty,
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 28af5acc3360..eb033fc92a15 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -162,7 +162,7 @@ static const struct usb_device_id id_table[] = {
 
 MODULE_DEVICE_TABLE(usb, id_table);
 
-struct cp210x_port_private {
+struct cp210x_serial_private {
         __u8                    bInterfaceNumber;
 };
 
@@ -276,7 +276,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
                 unsigned int *data, int size)
 {
         struct usb_serial *serial = port->serial;
-        struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+        struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
         __le32 *buf;
         int result, i, length;
 
@@ -292,7 +292,7 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
         /* Issue the request, attempting to read 'size' bytes */
         result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                 request, REQTYPE_INTERFACE_TO_HOST, 0x0000,
-                                port_priv->bInterfaceNumber, buf, size,
+                                spriv->bInterfaceNumber, buf, size,
                                 USB_CTRL_GET_TIMEOUT);
 
         /* Convert data into an array of integers */
@@ -323,7 +323,7 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
                 unsigned int *data, int size)
 {
         struct usb_serial *serial = port->serial;
-        struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+        struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
         __le32 *buf;
         int result, i, length;
 
@@ -345,13 +345,13 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
                                 request, REQTYPE_HOST_TO_INTERFACE, 0x0000,
-                                port_priv->bInterfaceNumber, buf, size,
+                                spriv->bInterfaceNumber, buf, size,
                                 USB_CTRL_SET_TIMEOUT);
         } else {
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
                                 request, REQTYPE_HOST_TO_INTERFACE, data[0],
-                                port_priv->bInterfaceNumber, NULL, 0,
+                                spriv->bInterfaceNumber, NULL, 0,
                                 USB_CTRL_SET_TIMEOUT);
         }
 
@@ -845,36 +845,30 @@ static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 
 static int cp210x_startup(struct usb_serial *serial)
 {
-        struct cp210x_port_private *port_priv;
-        int i;
+        struct usb_host_interface *cur_altsetting;
+        struct cp210x_serial_private *spriv;
 
         /* cp210x buffers behave strangely unless device is reset */
         usb_reset_device(serial->dev);
 
-        for (i = 0; i < serial->num_ports; i++) {
-                port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
-                if (!port_priv)
-                        return -ENOMEM;
+        spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
+        if (!spriv)
+                return -ENOMEM;
 
-                port_priv->bInterfaceNumber =
-                    serial->interface->cur_altsetting->desc.bInterfaceNumber;
+        cur_altsetting = serial->interface->cur_altsetting;
+        spriv->bInterfaceNumber = cur_altsetting->desc.bInterfaceNumber;
 
-                usb_set_serial_port_data(serial->port[i], port_priv);
-        }
+        usb_set_serial_data(serial, spriv);
 
         return 0;
 }
 
 static void cp210x_release(struct usb_serial *serial)
 {
-        struct cp210x_port_private *port_priv;
-        int i;
+        struct cp210x_serial_private *spriv;
 
-        for (i = 0; i < serial->num_ports; i++) {
-                port_priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(port_priv);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
+        spriv = usb_get_serial_data(serial);
+        kfree(spriv);
 }
 
 module_usb_serial_driver(serial_drivers, id_table);
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 2a7aecc72237..4ee77dcbe690 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -55,9 +55,9 @@
 #define CYBERJACK_PRODUCT_ID    0x0100
 
 /* Function prototypes */
-static int cyberjack_startup(struct usb_serial *serial);
 static void cyberjack_disconnect(struct usb_serial *serial);
-static void cyberjack_release(struct usb_serial *serial);
+static int cyberjack_port_probe(struct usb_serial_port *port);
+static int cyberjack_port_remove(struct usb_serial_port *port);
 static int  cyberjack_open(struct tty_struct *tty,
         struct usb_serial_port *port);
 static void cyberjack_close(struct usb_serial_port *port);
@@ -83,9 +83,9 @@ static struct usb_serial_driver cyberjack_device = {
         .description =          "Reiner SCT Cyberjack USB card reader",
         .id_table =             id_table,
         .num_ports =            1,
-        .attach =               cyberjack_startup,
         .disconnect =           cyberjack_disconnect,
-        .release =              cyberjack_release,
+        .port_probe =           cyberjack_port_probe,
+        .port_remove =          cyberjack_port_remove,
         .open =                 cyberjack_open,
         .close =                cyberjack_close,
         .write =                cyberjack_write,
@@ -107,56 +107,45 @@ struct cyberjack_private {
         short           wrsent;         /* Data already sent */
 };
 
-/* do some startup allocations not currently performed by usb_serial_probe() */
-static int cyberjack_startup(struct usb_serial *serial)
+static int cyberjack_port_probe(struct usb_serial_port *port)
 {
         struct cyberjack_private *priv;
-        int i;
+        int result;
 
-        /* allocate the private data structure */
         priv = kmalloc(sizeof(struct cyberjack_private), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        /* set initial values */
         spin_lock_init(&priv->lock);
         priv->rdtodo = 0;
         priv->wrfilled = 0;
         priv->wrsent = 0;
-        usb_set_serial_port_data(serial->port[0], priv);
 
-        init_waitqueue_head(&serial->port[0]->write_wait);
+        usb_set_serial_port_data(port, priv);
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                int result;
-                result = usb_submit_urb(serial->port[i]->interrupt_in_urb,
-                                        GFP_KERNEL);
-                if (result)
-                        dev_err(&serial->dev->dev,
-                                "usb_submit_urb(read int) failed\n");
-                dev_dbg(&serial->dev->dev, "%s - usb_submit_urb(int urb)\n",
-                        __func__);
-        }
+        result = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
+        if (result)
+                dev_err(&port->dev, "usb_submit_urb(read int) failed\n");
 
         return 0;
 }
 
-static void cyberjack_disconnect(struct usb_serial *serial)
+static int cyberjack_port_remove(struct usb_serial_port *port)
 {
-        int i;
+        struct cyberjack_private *priv;
 
-        for (i = 0; i < serial->num_ports; ++i)
-                usb_kill_urb(serial->port[i]->interrupt_in_urb);
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
-static void cyberjack_release(struct usb_serial *serial)
+static void cyberjack_disconnect(struct usb_serial *serial)
 {
         int i;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                /* My special items, the standard routines free my urbs */
-                kfree(usb_get_serial_port_data(serial->port[i]));
-        }
+        for (i = 0; i < serial->num_ports; ++i)
+                usb_kill_urb(serial->port[i]->interrupt_in_urb);
 }
 
 static int  cyberjack_open(struct tty_struct *tty,
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 1befce21e173..f0da1279c114 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -123,10 +123,10 @@ struct cypress_private {
 };
 
 /* function prototypes for the Cypress USB to serial device */
-static int  cypress_earthmate_startup(struct usb_serial *serial);
-static int  cypress_hidcom_startup(struct usb_serial *serial);
-static int  cypress_ca42v2_startup(struct usb_serial *serial);
-static void cypress_release(struct usb_serial *serial);
+static int  cypress_earthmate_port_probe(struct usb_serial_port *port);
+static int  cypress_hidcom_port_probe(struct usb_serial_port *port);
+static int  cypress_ca42v2_port_probe(struct usb_serial_port *port);
+static int  cypress_port_remove(struct usb_serial_port *port);
 static int  cypress_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void cypress_close(struct usb_serial_port *port);
 static void cypress_dtr_rts(struct usb_serial_port *port, int on);
@@ -156,8 +156,8 @@ static struct usb_serial_driver cypress_earthmate_device = {
         .description =                  "DeLorme Earthmate USB",
         .id_table =                     id_table_earthmate,
         .num_ports =                    1,
-        .attach =                       cypress_earthmate_startup,
-        .release =                      cypress_release,
+        .port_probe =                   cypress_earthmate_port_probe,
+        .port_remove =                  cypress_port_remove,
         .open =                         cypress_open,
         .close =                        cypress_close,
         .dtr_rts =                      cypress_dtr_rts,
@@ -182,8 +182,8 @@ static struct usb_serial_driver cypress_hidcom_device = {
         .description =                  "HID->COM RS232 Adapter",
         .id_table =                     id_table_cyphidcomrs232,
         .num_ports =                    1,
-        .attach =                       cypress_hidcom_startup,
-        .release =                      cypress_release,
+        .port_probe =                   cypress_hidcom_port_probe,
+        .port_remove =                  cypress_port_remove,
         .open =                         cypress_open,
         .close =                        cypress_close,
         .dtr_rts =                      cypress_dtr_rts,
@@ -208,8 +208,8 @@ static struct usb_serial_driver cypress_ca42v2_device = {
         .description =                  "Nokia CA-42 V2 Adapter",
         .id_table =                     id_table_nokiaca42v2,
         .num_ports =                    1,
-        .attach =                       cypress_ca42v2_startup,
-        .release =                      cypress_release,
+        .port_probe =                   cypress_ca42v2_port_probe,
+        .port_remove =                  cypress_port_remove,
         .open =                         cypress_open,
         .close =                        cypress_close,
         .dtr_rts =                      cypress_dtr_rts,
@@ -438,10 +438,10 @@ static void cypress_set_dead(struct usb_serial_port *port)
  *****************************************************************************/
 
 
-static int generic_startup(struct usb_serial *serial)
+static int cypress_generic_port_probe(struct usb_serial_port *port)
 {
+        struct usb_serial *serial = port->serial;
         struct cypress_private *priv;
-        struct usb_serial_port *port = serial->port[0];
 
         priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL);
         if (!priv)
@@ -490,14 +490,16 @@ static int generic_startup(struct usb_serial *serial)
 }
 
 
-static int cypress_earthmate_startup(struct usb_serial *serial)
+static int cypress_earthmate_port_probe(struct usb_serial_port *port)
 {
+        struct usb_serial *serial = port->serial;
         struct cypress_private *priv;
-        struct usb_serial_port *port = serial->port[0];
+        int ret;
 
-        if (generic_startup(serial)) {
+        ret = cypress_generic_port_probe(port);
+        if (ret) {
                 dev_dbg(&port->dev, "%s - Failed setting up port\n", __func__);
-                return 1;
+                return ret;
         }
 
         priv = usb_get_serial_port_data(port);
@@ -518,56 +520,53 @@ static int cypress_earthmate_startup(struct usb_serial *serial)
         }
 
         return 0;
-} /* cypress_earthmate_startup */
-
+}
 
-static int cypress_hidcom_startup(struct usb_serial *serial)
+static int cypress_hidcom_port_probe(struct usb_serial_port *port)
 {
         struct cypress_private *priv;
-        struct usb_serial_port *port = serial->port[0];
+        int ret;
 
-        if (generic_startup(serial)) {
+        ret = cypress_generic_port_probe(port);
+        if (ret) {
                 dev_dbg(&port->dev, "%s - Failed setting up port\n", __func__);
-                return 1;
+                return ret;
         }
 
         priv = usb_get_serial_port_data(port);
         priv->chiptype = CT_CYPHIDCOM;
 
         return 0;
-} /* cypress_hidcom_startup */
-
+}
 
-static int cypress_ca42v2_startup(struct usb_serial *serial)
+static int cypress_ca42v2_port_probe(struct usb_serial_port *port)
 {
         struct cypress_private *priv;
-        struct usb_serial_port *port = serial->port[0];
+        int ret;
 
-        if (generic_startup(serial)) {
+        ret = cypress_generic_port_probe(port);
+        if (ret) {
                 dev_dbg(&port->dev, "%s - Failed setting up port\n", __func__);
-                return 1;
+                return ret;
         }
 
         priv = usb_get_serial_port_data(port);
         priv->chiptype = CT_CA42V2;
 
         return 0;
-} /* cypress_ca42v2_startup */
-
+}
 
-static void cypress_release(struct usb_serial *serial)
+static int cypress_port_remove(struct usb_serial_port *port)
 {
         struct cypress_private *priv;
 
-        /* all open ports are closed at this point */
-        priv = usb_get_serial_port_data(serial->port[0]);
+        priv = usb_get_serial_port_data(port);
 
-        if (priv) {
-                kfifo_free(&priv->write_fifo);
-                kfree(priv);
-        }
-}
+        kfifo_free(&priv->write_fifo);
+        kfree(priv);
 
+        return 0;
+}
 
 static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
index 244477107e2f..6e4eb57d0177 100644
--- a/drivers/usb/serial/f81232.c
+++ b/drivers/usb/serial/f81232.c
@@ -318,39 +318,30 @@ static int f81232_ioctl(struct tty_struct *tty,
         return -ENOIOCTLCMD;
 }
 
-static int f81232_startup(struct usb_serial *serial)
+static int f81232_port_probe(struct usb_serial_port *port)
 {
         struct f81232_private *priv;
-        int i;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = kzalloc(sizeof(struct f81232_private), GFP_KERNEL);
-                if (!priv)
-                        goto cleanup;
-                spin_lock_init(&priv->lock);
-                init_waitqueue_head(&priv->delta_msr_wait);
-                usb_set_serial_port_data(serial->port[i], priv);
-        }
-        return 0;
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-cleanup:
-        for (--i; i >= 0; --i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        return -ENOMEM;
+        spin_lock_init(&priv->lock);
+        init_waitqueue_head(&priv->delta_msr_wait);
+
+        usb_set_serial_port_data(port, priv);
+
+        return 0;
 }
 
-static void f81232_release(struct usb_serial *serial)
+static int f81232_port_remove(struct usb_serial_port *port)
 {
-        int i;
         struct f81232_private *priv;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-        }
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static struct usb_serial_driver f81232_device = {
@@ -373,8 +364,8 @@ static struct usb_serial_driver f81232_device = {
         .tiocmset =             f81232_tiocmset,
         .process_read_urb =     f81232_process_read_urb,
         .read_int_callback =    f81232_read_int_callback,
-        .attach =               f81232_startup,
-        .release =              f81232_release,
+        .port_probe =           f81232_port_probe,
+        .port_remove =          f81232_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 3ee92648c02d..203358d7e7bc 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1405,11 +1405,10 @@ static void timeout_handler(unsigned long data)
 
 
 
-static int garmin_attach(struct usb_serial *serial)
+static int garmin_port_probe(struct usb_serial_port *port)
 {
-        int status = 0;
-        struct usb_serial_port *port = serial->port[0];
-        struct garmin_data *garmin_data_p = NULL;
+        int status;
+        struct garmin_data *garmin_data_p;
 
         garmin_data_p = kzalloc(sizeof(struct garmin_data), GFP_KERNEL);
         if (garmin_data_p == NULL) {
@@ -1434,22 +1433,14 @@ static int garmin_attach(struct usb_serial *serial)
 }
 
 
-static void garmin_disconnect(struct usb_serial *serial)
+static int garmin_port_remove(struct usb_serial_port *port)
 {
-        struct usb_serial_port *port = serial->port[0];
         struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
 
         usb_kill_urb(port->interrupt_in_urb);
         del_timer_sync(&garmin_data_p->timer);
-}
-
-
-static void garmin_release(struct usb_serial *serial)
-{
-        struct usb_serial_port *port = serial->port[0];
-        struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
-
         kfree(garmin_data_p);
+        return 0;
 }
 
 
@@ -1466,9 +1457,8 @@ static struct usb_serial_driver garmin_device = {
         .close               = garmin_close,
         .throttle            = garmin_throttle,
         .unthrottle          = garmin_unthrottle,
-        .attach              = garmin_attach,
-        .disconnect          = garmin_disconnect,
-        .release             = garmin_release,
+        .port_probe             = garmin_port_probe,
+        .port_remove            = garmin_port_remove,
         .write               = garmin_write,
         .write_room          = garmin_write_room,
         .write_bulk_callback = garmin_write_bulk_callback,
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 8e6faaf3580c..5acc0d13864a 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -225,6 +225,8 @@ static int  edge_get_icount(struct tty_struct *tty,
 static int  edge_startup(struct usb_serial *serial);
 static void edge_disconnect(struct usb_serial *serial);
 static void edge_release(struct usb_serial *serial);
+static int edge_port_probe(struct usb_serial_port *port);
+static int edge_port_remove(struct usb_serial_port *port);
 
 #include "io_tables.h"  /* all of the devices that this driver supports */
 
@@ -2875,10 +2877,9 @@ static void load_application_firmware(struct edgeport_serial *edge_serial)
 static int edge_startup(struct usb_serial *serial)
 {
         struct edgeport_serial *edge_serial;
-        struct edgeport_port *edge_port;
         struct usb_device *dev;
         struct device *ddev = &serial->dev->dev;
-        int i, j;
+        int i;
         int response;
         bool interrupt_in_found;
         bool bulk_in_found;
@@ -2961,25 +2962,6 @@ static int edge_startup(struct usb_serial *serial)
         /* we set up the pointers to the endpoints in the edge_open function,
          * as the structures aren't created yet. */
 
-        /* set up our port private structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
-                if (edge_port == NULL) {
-                        dev_err(ddev, "%s - Out of memory\n", __func__);
-                        for (j = 0; j < i; ++j) {
-                                kfree(usb_get_serial_port_data(serial->port[j]));
-                                usb_set_serial_port_data(serial->port[j],
-                                                                        NULL);
-                        }
-                        usb_set_serial_data(serial, NULL);
-                        kfree(edge_serial);
-                        return -ENOMEM;
-                }
-                spin_lock_init(&edge_port->ep_lock);
-                edge_port->port = serial->port[i];
-                usb_set_serial_port_data(serial->port[i], edge_port);
-        }
-
         response = 0;
 
         if (edge_serial->is_epic) {
@@ -3120,14 +3102,36 @@ static void edge_disconnect(struct usb_serial *serial)
 static void edge_release(struct usb_serial *serial)
 {
         struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
-        int i;
-
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
 
         kfree(edge_serial);
 }
 
+static int edge_port_probe(struct usb_serial_port *port)
+{
+        struct edgeport_port *edge_port;
+
+        edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
+        if (!edge_port)
+                return -ENOMEM;
+
+        spin_lock_init(&edge_port->ep_lock);
+        edge_port->port = port;
+
+        usb_set_serial_port_data(port, edge_port);
+
+        return 0;
+}
+
+static int edge_port_remove(struct usb_serial_port *port)
+{
+        struct edgeport_port *edge_port;
+
+        edge_port = usb_get_serial_port_data(port);
+        kfree(edge_port);
+
+        return 0;
+}
+
 module_usb_serial_driver(serial_drivers, id_table_combined);
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
index 350afddb55ba..1511dd0ad324 100644
--- a/drivers/usb/serial/io_tables.h
+++ b/drivers/usb/serial/io_tables.h
@@ -110,6 +110,8 @@ static struct usb_serial_driver edgeport_2port_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
@@ -139,6 +141,8 @@ static struct usb_serial_driver edgeport_4port_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
@@ -168,6 +172,8 @@ static struct usb_serial_driver edgeport_8port_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
@@ -197,6 +203,8 @@ static struct usb_serial_driver epic_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index a2209cd45093..60023c2d2a31 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2532,12 +2532,7 @@ static void edge_break(struct tty_struct *tty, int break_state)
 static int edge_startup(struct usb_serial *serial)
 {
         struct edgeport_serial *edge_serial;
-        struct edgeport_port *edge_port;
-        struct usb_device *dev;
         int status;
-        int i;
-
-        dev = serial->dev;
 
         /* create our private serial structure */
         edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
@@ -2555,40 +2550,7 @@ static int edge_startup(struct usb_serial *serial)
                 return status;
         }
 
-        /* set up our port private structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
-                if (edge_port == NULL) {
-                        dev_err(&serial->dev->dev, "%s - Out of memory\n",
-                                                                __func__);
-                        goto cleanup;
-                }
-                spin_lock_init(&edge_port->ep_lock);
-                if (kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
-                                                                GFP_KERNEL)) {
-                        dev_err(&serial->dev->dev, "%s - Out of memory\n",
-                                                                __func__);
-                        kfree(edge_port);
-                        goto cleanup;
-                }
-                edge_port->port = serial->port[i];
-                edge_port->edge_serial = edge_serial;
-                usb_set_serial_port_data(serial->port[i], edge_port);
-                edge_port->bUartMode = default_uart_mode;
-        }
-
         return 0;
-
-cleanup:
-        for (--i; i >= 0; --i) {
-                edge_port = usb_get_serial_port_data(serial->port[i]);
-                kfifo_free(&edge_port->write_fifo);
-                kfree(edge_port);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        kfree(edge_serial);
-        usb_set_serial_data(serial, NULL);
-        return -ENOMEM;
 }
 
 static void edge_disconnect(struct usb_serial *serial)
@@ -2597,17 +2559,54 @@ static void edge_disconnect(struct usb_serial *serial)
 
 static void edge_release(struct usb_serial *serial)
 {
-        int i;
+        kfree(usb_get_serial_data(serial));
+}
+
+static int edge_port_probe(struct usb_serial_port *port)
+{
         struct edgeport_port *edge_port;
+        int ret;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                edge_port = usb_get_serial_port_data(serial->port[i]);
+        edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
+        if (!edge_port)
+                return -ENOMEM;
+
+        ret = kfifo_alloc(&edge_port->write_fifo, EDGE_OUT_BUF_SIZE,
+                                                                GFP_KERNEL);
+        if (ret) {
+                kfree(edge_port);
+                return -ENOMEM;
+        }
+
+        spin_lock_init(&edge_port->ep_lock);
+        edge_port->port = port;
+        edge_port->edge_serial = usb_get_serial_data(port->serial);
+        edge_port->bUartMode = default_uart_mode;
+
+        usb_set_serial_port_data(port, edge_port);
+
+        ret = edge_create_sysfs_attrs(port);
+        if (ret) {
                 kfifo_free(&edge_port->write_fifo);
                 kfree(edge_port);
+                return ret;
         }
-        kfree(usb_get_serial_data(serial));
+
+        return 0;
 }
 
+static int edge_port_remove(struct usb_serial_port *port)
+{
+        struct edgeport_port *edge_port;
+
+        edge_port = usb_get_serial_port_data(port);
+
+        edge_remove_sysfs_attrs(port);
+        kfifo_free(&edge_port->write_fifo);
+        kfree(edge_port);
+
+        return 0;
+}
 
 /* Sysfs Attributes */
 
@@ -2667,8 +2666,8 @@ static struct usb_serial_driver edgeport_1port_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
-        .port_probe             = edge_create_sysfs_attrs,
-        .port_remove            = edge_remove_sysfs_attrs,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
@@ -2698,8 +2697,8 @@ static struct usb_serial_driver edgeport_2port_device = {
         .attach                 = edge_startup,
         .disconnect             = edge_disconnect,
         .release                = edge_release,
-        .port_probe             = edge_create_sysfs_attrs,
-        .port_remove            = edge_remove_sysfs_attrs,
+        .port_probe             = edge_port_probe,
+        .port_remove            = edge_port_remove,
         .ioctl                  = edge_ioctl,
         .set_termios            = edge_set_termios,
         .tiocmget               = edge_tiocmget,
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 01da3ea36e89..cd5533e81de7 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -53,6 +53,8 @@ static int iuu_cardout;
 static bool xmas;
 static int vcc_default = 5;
 
+static int iuu_create_sysfs_attrs(struct usb_serial_port *port);
+static int iuu_remove_sysfs_attrs(struct usb_serial_port *port);
 static void read_rxcmd_callback(struct urb *urb);
 
 struct iuu_private {
@@ -72,63 +74,55 @@ struct iuu_private {
         u32 clk;
 };
 
-
-static void iuu_free_buf(struct iuu_private *priv)
-{
-        kfree(priv->buf);
-        kfree(priv->writebuf);
-}
-
-static int iuu_alloc_buf(struct usb_serial *serial, struct iuu_private *priv)
-{
-        priv->buf = kzalloc(256, GFP_KERNEL);
-        priv->writebuf = kzalloc(256, GFP_KERNEL);
-        if (!priv->buf || !priv->writebuf) {
-                iuu_free_buf(priv);
-                dev_dbg(&serial->dev->dev, "%s problem allocation buffer\n", __func__);
-                return -ENOMEM;
-        }
-        dev_dbg(&serial->dev->dev, "%s - Privates buffers allocation success\n", __func__);
-        return 0;
-}
-
-static int iuu_startup(struct usb_serial *serial)
+static int iuu_port_probe(struct usb_serial_port *port)
 {
         struct iuu_private *priv;
+        int ret;
 
         priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL);
-        dev_dbg(&serial->dev->dev, "%s- priv allocation success\n", __func__);
         if (!priv)
                 return -ENOMEM;
-        if (iuu_alloc_buf(serial, priv)) {
+
+        priv->buf = kzalloc(256, GFP_KERNEL);
+        if (!priv->buf) {
+                kfree(priv);
+                return -ENOMEM;
+        }
+
+        priv->writebuf = kzalloc(256, GFP_KERNEL);
+        if (!priv->writebuf) {
+                kfree(priv->buf);
                 kfree(priv);
                 return -ENOMEM;
         }
+
         priv->vcc = vcc_default;
         spin_lock_init(&priv->lock);
         init_waitqueue_head(&priv->delta_msr_wait);
-        usb_set_serial_port_data(serial->port[0], priv);
+
+        usb_set_serial_port_data(port, priv);
+
+        ret = iuu_create_sysfs_attrs(port);
+        if (ret) {
+                kfree(priv->writebuf);
+                kfree(priv->buf);
+                kfree(priv);
+                return ret;
+        }
+
         return 0;
 }
 
-/* Release function */
-static void iuu_release(struct usb_serial *serial)
+static int iuu_port_remove(struct usb_serial_port *port)
 {
-        struct usb_serial_port *port = serial->port[0];
         struct iuu_private *priv = usb_get_serial_port_data(port);
-        if (!port)
-                return;
 
-        if (priv) {
-                iuu_free_buf(priv);
-                dev_dbg(&port->dev, "%s - I will free all\n", __func__);
-                usb_set_serial_port_data(port, NULL);
-
-                dev_dbg(&port->dev, "%s - priv is not anymore in port structure\n", __func__);
-                kfree(priv);
+        iuu_remove_sysfs_attrs(port);
+        kfree(priv->writebuf);
+        kfree(priv->buf);
+        kfree(priv);
 
-                dev_dbg(&port->dev, "%s priv is now kfree\n", __func__);
-        }
+        return 0;
 }
 
 static int iuu_tiocmset(struct tty_struct *tty,
@@ -1215,8 +1209,6 @@ static struct usb_serial_driver iuu_device = {
         .num_ports = 1,
         .bulk_in_size = 512,
         .bulk_out_size = 512,
-        .port_probe = iuu_create_sysfs_attrs,
-        .port_remove = iuu_remove_sysfs_attrs,
         .open = iuu_open,
         .close = iuu_close,
         .write = iuu_uart_write,
@@ -1225,8 +1217,8 @@ static struct usb_serial_driver iuu_device = {
         .tiocmset = iuu_tiocmset,
         .set_termios = iuu_set_termios,
         .init_termios = iuu_init_termios,
-        .attach = iuu_startup,
-        .release = iuu_release,
+        .port_probe = iuu_port_probe,
+        .port_remove = iuu_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index ca43ecb4a2bd..bb87e29c4ac2 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -713,29 +713,33 @@ MODULE_FIRMWARE("keyspan_pda/keyspan_pda.fw");
 MODULE_FIRMWARE("keyspan_pda/xircom_pgs.fw");
 #endif
 
-static int keyspan_pda_startup(struct usb_serial *serial)
+static int keyspan_pda_port_probe(struct usb_serial_port *port)
 {
 
         struct keyspan_pda_private *priv;
 
-        /* allocate the private data structures for all ports. Well, for all
-           one ports. */
-
         priv = kmalloc(sizeof(struct keyspan_pda_private), GFP_KERNEL);
         if (!priv)
-                return 1; /* error */
-        usb_set_serial_port_data(serial->port[0], priv);
-        init_waitqueue_head(&serial->port[0]->write_wait);
+                return -ENOMEM;
+
         INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
         INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
-        priv->serial = serial;
-        priv->port = serial->port[0];
+        priv->serial = port->serial;
+        priv->port = port;
+
+        usb_set_serial_port_data(port, priv);
+
         return 0;
 }
 
-static void keyspan_pda_release(struct usb_serial *serial)
+static int keyspan_pda_port_remove(struct usb_serial_port *port)
 {
-        kfree(usb_get_serial_port_data(serial->port[0]));
+        struct keyspan_pda_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 #ifdef KEYSPAN
@@ -786,8 +790,8 @@ static struct usb_serial_driver keyspan_pda_device = {
         .break_ctl =            keyspan_pda_break_ctl,
         .tiocmget =             keyspan_pda_tiocmget,
         .tiocmset =             keyspan_pda_tiocmset,
-        .attach =               keyspan_pda_startup,
-        .release =              keyspan_pda_release,
+        .port_probe =           keyspan_pda_port_probe,
+        .port_remove =          keyspan_pda_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 3f6d7376c02d..1f4517864cd2 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -60,8 +60,8 @@
 /*
  * Function prototypes
  */
-static int  klsi_105_startup(struct usb_serial *serial);
-static void klsi_105_release(struct usb_serial *serial);
+static int klsi_105_port_probe(struct usb_serial_port *port);
+static int klsi_105_port_remove(struct usb_serial_port *port);
 static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void klsi_105_close(struct usb_serial_port *port);
 static void klsi_105_set_termios(struct tty_struct *tty,
@@ -99,8 +99,8 @@ static struct usb_serial_driver kl5kusb105d_device = {
         /*.break_ctl =          klsi_105_break_ctl,*/
         .tiocmget =             klsi_105_tiocmget,
         .tiocmset =             klsi_105_tiocmset,
-        .attach =               klsi_105_startup,
-        .release =              klsi_105_release,
+        .port_probe =           klsi_105_port_probe,
+        .port_remove =          klsi_105_port_remove,
         .throttle =             usb_serial_generic_throttle,
         .unthrottle =           usb_serial_generic_unthrottle,
         .process_read_urb =     klsi_105_process_read_urb,
@@ -223,60 +223,40 @@ static int klsi_105_get_line_state(struct usb_serial_port *port,
  * Driver's tty interface functions
  */
 
-static int klsi_105_startup(struct usb_serial *serial)
+static int klsi_105_port_probe(struct usb_serial_port *port)
 {
         struct klsi_105_private *priv;
-        int i;
 
-        /* check if we support the product id (see keyspan.c)
-         * FIXME
-         */
+        priv = kmalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-        /* allocate the private data structure */
-        for (i = 0; i < serial->num_ports; i++) {
-                priv = kmalloc(sizeof(struct klsi_105_private),
-                                                   GFP_KERNEL);
-                if (!priv) {
-                        dev_dbg(&serial->interface->dev,
-                                "%s - kmalloc for klsi_105_private failed.\n",
-                                __func__);
-                        i--;
-                        goto err_cleanup;
-                }
-                /* set initial values for control structures */
-                priv->cfg.pktlen    = 5;
-                priv->cfg.baudrate  = kl5kusb105a_sio_b9600;
-                priv->cfg.databits  = kl5kusb105a_dtb_8;
-                priv->cfg.unknown1  = 0;
-                priv->cfg.unknown2  = 1;
+        /* set initial values for control structures */
+        priv->cfg.pktlen    = 5;
+        priv->cfg.baudrate  = kl5kusb105a_sio_b9600;
+        priv->cfg.databits  = kl5kusb105a_dtb_8;
+        priv->cfg.unknown1  = 0;
+        priv->cfg.unknown2  = 1;
 
-                priv->line_state    = 0;
+        priv->line_state    = 0;
 
-                usb_set_serial_port_data(serial->port[i], priv);
+        spin_lock_init(&priv->lock);
 
-                spin_lock_init(&priv->lock);
+        /* priv->termios is left uninitialized until port opening */
 
-                /* priv->termios is left uninitialized until port opening */
-                init_waitqueue_head(&serial->port[i]->write_wait);
-        }
+        usb_set_serial_port_data(port, priv);
 
         return 0;
-
-err_cleanup:
-        for (; i >= 0; i--) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        return -ENOMEM;
 }
 
-static void klsi_105_release(struct usb_serial *serial)
+static int klsi_105_port_remove(struct usb_serial_port *port)
 {
-        int i;
+        struct klsi_105_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
 
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+        return 0;
 }
 
 static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 5c4d2fbd4e11..c9ca7a5b12e0 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -54,8 +54,8 @@
 
 
 /* Function prototypes */
-static int  kobil_startup(struct usb_serial *serial);
-static void kobil_release(struct usb_serial *serial);
+static int kobil_port_probe(struct usb_serial_port *probe);
+static int kobil_port_remove(struct usb_serial_port *probe);
 static int  kobil_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void kobil_close(struct usb_serial_port *port);
 static int  kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -89,8 +89,8 @@ static struct usb_serial_driver kobil_device = {
         .description =          "KOBIL USB smart card terminal",
         .id_table =             id_table,
         .num_ports =            1,
-        .attach =               kobil_startup,
-        .release =              kobil_release,
+        .port_probe =           kobil_port_probe,
+        .port_remove =          kobil_port_remove,
         .ioctl =                kobil_ioctl,
         .set_termios =          kobil_set_termios,
         .init_termios =         kobil_init_termios,
@@ -117,9 +117,10 @@ struct kobil_private {
 };
 
 
-static int kobil_startup(struct usb_serial *serial)
+static int kobil_port_probe(struct usb_serial_port *port)
 {
         int i;
+        struct usb_serial *serial = port->serial;
         struct kobil_private *priv;
         struct usb_device *pdev;
         struct usb_host_config *actconfig;
@@ -149,7 +150,7 @@ static int kobil_startup(struct usb_serial *serial)
                 dev_dbg(&serial->dev->dev, "KOBIL KAAN SIM detected\n");
                 break;
         }
-        usb_set_serial_port_data(serial->port[0], priv);
+        usb_set_serial_port_data(port, priv);
 
         /* search for the necessary endpoints */
         pdev = serial->dev;
@@ -179,12 +180,14 @@ static int kobil_startup(struct usb_serial *serial)
 }
 
 
-static void kobil_release(struct usb_serial *serial)
+static int kobil_port_remove(struct usb_serial_port *port)
 {
-        int i;
+        struct kobil_private *priv;
 
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static void kobil_init_termios(struct tty_struct *tty)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 30cff03e9f01..54d4148d01d1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -503,11 +503,19 @@ static const struct option_blacklist_info net_intf5_blacklist = {
         .reserved = BIT(5),
 };
 
+static const struct option_blacklist_info net_intf6_blacklist = {
+        .reserved = BIT(6),
+};
+
 static const struct option_blacklist_info zte_mf626_blacklist = {
         .sendsetup = BIT(0) | BIT(1),
         .reserved = BIT(4),
 };
 
+static const struct option_blacklist_info zte_1255_blacklist = {
+        .reserved = BIT(3) | BIT(4),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -853,13 +861,19 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
@@ -872,7 +886,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
@@ -880,13 +895,22 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
+          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1002,18 +1026,24 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&zte_1255_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
@@ -1058,8 +1088,16 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff),  /* ZTE MF91 */
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
           0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
@@ -1071,15 +1109,21 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
 
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 933241f03fd8..cee9a52ca891 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -137,8 +137,8 @@ static int oti6858_chars_in_buffer(struct tty_struct *tty);
 static int oti6858_tiocmget(struct tty_struct *tty);
 static int oti6858_tiocmset(struct tty_struct *tty,
                                 unsigned int set, unsigned int clear);
-static int oti6858_startup(struct usb_serial *serial);
-static void oti6858_release(struct usb_serial *serial);
+static int oti6858_port_probe(struct usb_serial_port *port);
+static int oti6858_port_remove(struct usb_serial_port *port);
 
 /* device info */
 static struct usb_serial_driver oti6858_device = {
@@ -161,8 +161,8 @@ static struct usb_serial_driver oti6858_device = {
         .write_bulk_callback =  oti6858_write_bulk_callback,
         .write_room =           oti6858_write_room,
         .chars_in_buffer =      oti6858_chars_in_buffer,
-        .attach =               oti6858_startup,
-        .release =              oti6858_release,
+        .port_probe =           oti6858_port_probe,
+        .port_remove =          oti6858_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
@@ -331,36 +331,33 @@ static void send_data(struct work_struct *work)
         usb_serial_port_softint(port);
 }
 
-static int oti6858_startup(struct usb_serial *serial)
+static int oti6858_port_probe(struct usb_serial_port *port)
 {
-        struct usb_serial_port *port = serial->port[0];
         struct oti6858_private *priv;
-        int i;
-
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = kzalloc(sizeof(struct oti6858_private), GFP_KERNEL);
-                if (!priv)
-                        break;
-
-                spin_lock_init(&priv->lock);
-                init_waitqueue_head(&priv->intr_wait);
-/*              INIT_WORK(&priv->setup_work, setup_line, serial->port[i]); */
-/*              INIT_WORK(&priv->write_work, send_data, serial->port[i]); */
-                priv->port = port;
-                INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
-                INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
-
-                usb_set_serial_port_data(serial->port[i], priv);
-        }
-        if (i == serial->num_ports)
-                return 0;
 
-        for (--i; i >= 0; --i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        return -ENOMEM;
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        spin_lock_init(&priv->lock);
+        init_waitqueue_head(&priv->intr_wait);
+        priv->port = port;
+        INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
+        INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
+
+        usb_set_serial_port_data(port, priv);
+
+        return 0;
+}
+
+static int oti6858_port_remove(struct usb_serial_port *port)
+{
+        struct oti6858_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static int oti6858_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -709,15 +706,6 @@ static int oti6858_ioctl(struct tty_struct *tty,
         return -ENOIOCTLCMD;
 }
 
-
-static void oti6858_release(struct usb_serial *serial)
-{
-        int i;
-
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
-}
-
 static void oti6858_read_int_callback(struct urb *urb)
 {
         struct usb_serial_port *port =  urb->context;
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 892ebdc7a364..600241901361 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -133,12 +133,15 @@ enum pl2303_type {
         HX,             /* HX version of the pl2303 chip */
 };
 
+struct pl2303_serial_private {
+        enum pl2303_type type;
+};
+
 struct pl2303_private {
         spinlock_t lock;
         wait_queue_head_t delta_msr_wait;
         u8 line_control;
         u8 line_status;
-        enum pl2303_type type;
 };
 
 static int pl2303_vendor_read(__u16 value, __u16 index,
@@ -167,14 +170,19 @@ static int pl2303_vendor_write(__u16 value, __u16 index,
 
 static int pl2303_startup(struct usb_serial *serial)
 {
-        struct pl2303_private *priv;
+        struct pl2303_serial_private *spriv;
         enum pl2303_type type = type_0;
         unsigned char *buf;
-        int i;
+
+        spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
+        if (!spriv)
+                return -ENOMEM;
 
         buf = kmalloc(10, GFP_KERNEL);
-        if (buf == NULL)
+        if (!buf) {
+                kfree(spriv);
                 return -ENOMEM;
+        }
 
         if (serial->dev->descriptor.bDeviceClass == 0x02)
                 type = type_0;
@@ -186,15 +194,8 @@ static int pl2303_startup(struct usb_serial *serial)
                 type = type_1;
         dev_dbg(&serial->interface->dev, "device type: %d\n", type);
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = kzalloc(sizeof(struct pl2303_private), GFP_KERNEL);
-                if (!priv)
-                        goto cleanup;
-                spin_lock_init(&priv->lock);
-                init_waitqueue_head(&priv->delta_msr_wait);
-                priv->type = type;
-                usb_set_serial_port_data(serial->port[i], priv);
-        }
+        spriv->type = type;
+        usb_set_serial_data(serial, spriv);
 
         pl2303_vendor_read(0x8484, 0, serial, buf);
         pl2303_vendor_write(0x0404, 0, serial);
@@ -213,15 +214,40 @@ static int pl2303_startup(struct usb_serial *serial)
 
         kfree(buf);
         return 0;
+}
 
-cleanup:
-        kfree(buf);
-        for (--i; i >= 0; --i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        return -ENOMEM;
+static void pl2303_release(struct usb_serial *serial)
+{
+        struct pl2303_serial_private *spriv;
+
+        spriv = usb_get_serial_data(serial);
+        kfree(spriv);
+}
+
+static int pl2303_port_probe(struct usb_serial_port *port)
+{
+        struct pl2303_private *priv;
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        spin_lock_init(&priv->lock);
+        init_waitqueue_head(&priv->delta_msr_wait);
+
+        usb_set_serial_port_data(port, priv);
+
+        return 0;
+}
+
+static int pl2303_port_remove(struct usb_serial_port *port)
+{
+        struct pl2303_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static int set_control_lines(struct usb_device *dev, u8 value)
@@ -240,6 +266,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
                 struct usb_serial_port *port, struct ktermios *old_termios)
 {
         struct usb_serial *serial = port->serial;
+        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
         struct pl2303_private *priv = usb_get_serial_port_data(port);
         unsigned long flags;
         unsigned int cflag;
@@ -323,7 +350,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
                 }
                 if (baud > 1228800) {
                         /* type_0, type_1 only support up to 1228800 baud */
-                        if (priv->type != HX)
+                        if (spriv->type != HX)
                                 baud = 1228800;
                         else if (baud > 6000000)
                                 baud = 6000000;
@@ -426,7 +453,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
              buf[0], buf[1], buf[2], buf[3], buf[4], buf[5], buf[6]);
 
         if (cflag & CRTSCTS) {
-                if (priv->type == HX)
+                if (spriv->type == HX)
                         pl2303_vendor_write(0x0, 0x61, serial);
                 else
                         pl2303_vendor_write(0x0, 0x41, serial);
@@ -468,10 +495,10 @@ static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct ktermios tmp_termios;
         struct usb_serial *serial = port->serial;
-        struct pl2303_private *priv = usb_get_serial_port_data(port);
+        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
         int result;
 
-        if (priv->type != HX) {
+        if (spriv->type != HX) {
                 usb_clear_halt(serial->dev, port->write_urb->pipe);
                 usb_clear_halt(serial->dev, port->read_urb->pipe);
         } else {
@@ -655,17 +682,6 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
                 dev_err(&port->dev, "error sending break = %d\n", result);
 }
 
-static void pl2303_release(struct usb_serial *serial)
-{
-        int i;
-        struct pl2303_private *priv;
-
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-        }
-}
-
 static void pl2303_update_line_status(struct usb_serial_port *port,
                                       unsigned char *data,
                                       unsigned int actual_length)
@@ -827,6 +843,8 @@ static struct usb_serial_driver pl2303_device = {
         .read_int_callback =    pl2303_read_int_callback,
         .attach =               pl2303_startup,
         .release =              pl2303_release,
+        .port_probe =           pl2303_port_probe,
+        .port_remove =          pl2303_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 9716efe92955..769c137f8975 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -157,13 +157,10 @@ struct spcp8x5_private {
         u8                      line_status;
 };
 
-/* desc : when device plug in,this function would be called.
- * thanks to usb_serial subsystem,then do almost every things for us. And what
- * we should do just alloc the buffer */
-static int spcp8x5_startup(struct usb_serial *serial)
+static int spcp8x5_port_probe(struct usb_serial_port *port)
 {
+        struct usb_serial *serial = port->serial;
         struct spcp8x5_private *priv;
-        int i;
         enum spcp8x5_type type = SPCP825_007_TYPE;
         u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
 
@@ -180,34 +177,27 @@ static int spcp8x5_startup(struct usb_serial *serial)
                 type = SPCP825_PHILIP_TYPE;
         dev_dbg(&serial->dev->dev, "device type = %d\n", (int)type);
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = kzalloc(sizeof(struct spcp8x5_private), GFP_KERNEL);
-                if (!priv)
-                        goto cleanup;
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-                spin_lock_init(&priv->lock);
-                init_waitqueue_head(&priv->delta_msr_wait);
-                priv->type = type;
-                usb_set_serial_port_data(serial->port[i] , priv);
-        }
+        spin_lock_init(&priv->lock);
+        init_waitqueue_head(&priv->delta_msr_wait);
+        priv->type = type;
+
+        usb_set_serial_port_data(port , priv);
 
         return 0;
-cleanup:
-        for (--i; i >= 0; --i) {
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-                usb_set_serial_port_data(serial->port[i] , NULL);
-        }
-        return -ENOMEM;
 }
 
-/* call when the device plug out. free all the memory alloced by probe */
-static void spcp8x5_release(struct usb_serial *serial)
+static int spcp8x5_port_remove(struct usb_serial_port *port)
 {
-        int i;
+        struct spcp8x5_private *priv;
 
-        for (i = 0; i < serial->num_ports; i++)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 /* set the modem control line of the device.
@@ -649,8 +639,8 @@ static struct usb_serial_driver spcp8x5_device = {
         .ioctl                  = spcp8x5_ioctl,
         .tiocmget               = spcp8x5_tiocmget,
         .tiocmset               = spcp8x5_tiocmset,
-        .attach                 = spcp8x5_startup,
-        .release                = spcp8x5_release,
+        .port_probe             = spcp8x5_port_probe,
+        .port_remove            = spcp8x5_port_remove,
         .process_read_urb       = spcp8x5_process_read_urb,
 };
 
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index 015810b3785b..868d1e6852e2 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -67,13 +67,6 @@ struct ssu100_port_private {
         struct async_icount icount;
 };
 
-static void ssu100_release(struct usb_serial *serial)
-{
-        struct ssu100_port_private *priv = usb_get_serial_port_data(*serial->port);
-
-        kfree(priv);
-}
-
 static inline int ssu100_control_msg(struct usb_device *dev,
                                      u8 request, u16 data, u16 index)
 {
@@ -442,21 +435,33 @@ static int ssu100_ioctl(struct tty_struct *tty,
 
 static int ssu100_attach(struct usb_serial *serial)
 {
+        return ssu100_initdevice(serial->dev);
+}
+
+static int ssu100_port_probe(struct usb_serial_port *port)
+{
         struct ssu100_port_private *priv;
-        struct usb_serial_port *port = *serial->port;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-        if (!priv) {
-                dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n", __func__,
-                        sizeof(*priv));
+        if (!priv)
                 return -ENOMEM;
-        }
 
         spin_lock_init(&priv->status_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
+
         usb_set_serial_port_data(port, priv);
 
-        return ssu100_initdevice(serial->dev);
+        return 0;
+}
+
+static int ssu100_port_remove(struct usb_serial_port *port)
+{
+        struct ssu100_port_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
 }
 
 static int ssu100_tiocmget(struct tty_struct *tty)
@@ -647,7 +652,8 @@ static struct usb_serial_driver ssu100_device = {
         .open                = ssu100_open,
         .close               = ssu100_close,
         .attach              = ssu100_attach,
-        .release             = ssu100_release,
+        .port_probe          = ssu100_port_probe,
+        .port_remove         = ssu100_port_remove,
         .dtr_rts             = ssu100_dtr_rts,
         .process_read_urb    = ssu100_process_read_urb,
         .tiocmget            = ssu100_tiocmget,
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 6f49392cda5b..f2530d2ef3c4 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -97,6 +97,8 @@ struct ti_device {
 
 static int ti_startup(struct usb_serial *serial);
 static void ti_release(struct usb_serial *serial);
+static int ti_port_probe(struct usb_serial_port *port);
+static int ti_port_remove(struct usb_serial_port *port);
 static int ti_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void ti_close(struct usb_serial_port *port);
 static int ti_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -221,6 +223,8 @@ static struct usb_serial_driver ti_1port_device = {
         .num_ports              = 1,
         .attach                 = ti_startup,
         .release                = ti_release,
+        .port_probe             = ti_port_probe,
+        .port_remove            = ti_port_remove,
         .open                   = ti_open,
         .close                  = ti_close,
         .write                  = ti_write,
@@ -249,6 +253,8 @@ static struct usb_serial_driver ti_2port_device = {
         .num_ports              = 2,
         .attach                 = ti_startup,
         .release                = ti_release,
+        .port_probe             = ti_port_probe,
+        .port_remove            = ti_port_remove,
         .open                   = ti_open,
         .close                  = ti_close,
         .write                  = ti_write,
@@ -347,11 +353,8 @@ module_exit(ti_exit);
 static int ti_startup(struct usb_serial *serial)
 {
         struct ti_device *tdev;
-        struct ti_port *tport;
         struct usb_device *dev = serial->dev;
         int status;
-        int i;
-
 
         dev_dbg(&dev->dev,
                 "%s - product 0x%4X, num configurations %d, configuration value %d",
@@ -399,42 +402,8 @@ static int ti_startup(struct usb_serial *serial)
                 goto free_tdev;
         }
 
-        /* set up port structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                tport = kzalloc(sizeof(struct ti_port), GFP_KERNEL);
-                if (tport == NULL) {
-                        dev_err(&dev->dev, "%s - out of memory\n", __func__);
-                        status = -ENOMEM;
-                        goto free_tports;
-                }
-                spin_lock_init(&tport->tp_lock);
-                tport->tp_uart_base_addr = (i == 0 ?
-                                TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
-                tport->tp_closing_wait = closing_wait;
-                init_waitqueue_head(&tport->tp_msr_wait);
-                init_waitqueue_head(&tport->tp_write_wait);
-                if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE,
-                                                                GFP_KERNEL)) {
-                        dev_err(&dev->dev, "%s - out of memory\n", __func__);
-                        kfree(tport);
-                        status = -ENOMEM;
-                        goto free_tports;
-                }
-                tport->tp_port = serial->port[i];
-                tport->tp_tdev = tdev;
-                usb_set_serial_port_data(serial->port[i], tport);
-                tport->tp_uart_mode = 0;        /* default is RS232 */
-        }
-
         return 0;
 
-free_tports:
-        for (--i; i >= 0; --i) {
-                tport = usb_get_serial_port_data(serial->port[i]);
-                kfifo_free(&tport->write_fifo);
-                kfree(tport);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
 free_tdev:
         kfree(tdev);
         usb_set_serial_data(serial, NULL);
@@ -444,21 +413,50 @@ free_tdev:
 
 static void ti_release(struct usb_serial *serial)
 {
-        int i;
         struct ti_device *tdev = usb_get_serial_data(serial);
+
+        kfree(tdev);
+}
+
+static int ti_port_probe(struct usb_serial_port *port)
+{
         struct ti_port *tport;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                tport = usb_get_serial_port_data(serial->port[i]);
-                if (tport) {
-                        kfifo_free(&tport->write_fifo);
-                        kfree(tport);
-                }
+        tport = kzalloc(sizeof(*tport), GFP_KERNEL);
+        if (!tport)
+                return -ENOMEM;
+
+        spin_lock_init(&tport->tp_lock);
+        if (port == port->serial->port[0])
+                tport->tp_uart_base_addr = TI_UART1_BASE_ADDR;
+        else
+                tport->tp_uart_base_addr = TI_UART2_BASE_ADDR;
+        tport->tp_closing_wait = closing_wait;
+        init_waitqueue_head(&tport->tp_msr_wait);
+        init_waitqueue_head(&tport->tp_write_wait);
+        if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE, GFP_KERNEL)) {
+                kfree(tport);
+                return -ENOMEM;
         }
+        tport->tp_port = port;
+        tport->tp_tdev = usb_get_serial_data(port->serial);
+        tport->tp_uart_mode = 0;        /* default is RS232 */
 
-        kfree(tdev);
+        usb_set_serial_port_data(port, tport);
+
+        return 0;
 }
 
+static int ti_port_remove(struct usb_serial_port *port)
+{
+        struct ti_port *tport;
+
+        tport = usb_get_serial_port_data(port);
+        kfifo_free(&tport->write_fifo);
+        kfree(tport);
+
+        return 0;
+}
 
 static int ti_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c
index c6915c6c3cd1..585949b57055 100644
--- a/drivers/video/backlight/lm3639_bl.c
+++ b/drivers/video/backlight/lm3639_bl.c
@@ -206,11 +206,11 @@ static ssize_t lm3639_bled_mode_store(struct device *dev,
 
 out:
         dev_err(pchip->dev, "%s:i2c access fail to register\n", __func__);
-        return size;
+        return ret;
 
 out_input:
         dev_err(pchip->dev, "%s:input conversion fail\n", __func__);
-        return size;
+        return ret;
 
 }
 
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 48220e129f85..f5dda83ad7a5 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -625,7 +625,7 @@ static struct xenbus_watch *find_watch(const char *token)
  * so if we are running on anything older than 4 do not attempt to read
  * control/platform-feature-xs_reset_watches.
  */
-static bool xen_strict_xenbus_quirk()
+static bool xen_strict_xenbus_quirk(void)
 {
         uint32_t eax, ebx, ecx, edx, base;