ALSA: usb-audio: parse more format descriptors with structs
[safe/jmp/linux-2.6] / drivers / isdn / capi / capi.c
index 3e4997a..ee58375 100644 (file)
@@ -45,7 +45,6 @@ MODULE_DESCRIPTION("CAPI4Linux: Userspace /dev/capi20 interface");
 MODULE_AUTHOR("Carsten Paeth");
 MODULE_LICENSE("GPL");
 
-#undef _DEBUG_REFCOUNT         /* alloc/free and open/close debug */
 #undef _DEBUG_TTYFUNCS         /* call to tty_driver */
 #undef _DEBUG_DATAFLOW         /* data flow */
 
@@ -77,7 +76,7 @@ struct capidev;
 struct capincci;
 struct capiminor;
 
-struct datahandle_queue {
+struct ackqueue_entry {
        struct list_head        list;
        u16                     datahandle;
 };
@@ -85,25 +84,24 @@ struct datahandle_queue {
 struct capiminor {
        struct kref kref;
 
-       struct capincci  *nccip;
        unsigned int      minor;
        struct dentry *capifs_dentry;
 
-       struct capi20_appl *ap;
-       u32              ncci;
-       u16              datahandle;
-       u16              msgid;
+       struct capi20_appl      *ap;
+       u32                     ncci;
+       atomic_t                datahandle;
+       atomic_t                msgid;
 
-       struct tty_struct *tty;
+       struct tty_port port;
        int                ttyinstop;
        int                ttyoutstop;
-       struct sk_buff    *ttyskb;
-       atomic_t           ttyopencount;
 
-       struct sk_buff_head inqueue;
-       int                 inbytes;
-       struct sk_buff_head outqueue;
-       int                 outbytes;
+       struct sk_buff_head     inqueue;
+
+       struct sk_buff_head     outqueue;
+       int                     outbytes;
+       struct sk_buff          *outskb;
+       spinlock_t              outlock;
 
        /* transmit path */
        struct list_head ackqueue;
@@ -111,15 +109,6 @@ struct capiminor {
        spinlock_t ackqlock;
 };
 
-/* FIXME: The following lock is a sledgehammer-workaround to a
- * locking issue with the capiminor (and maybe other) data structure(s).
- * Access to this data is done in a racy way and crashes the machine with
- * a FritzCard DSL driver; sooner or later. This is a workaround
- * which trades scalability vs stability, so it doesn't crash the kernel anymore.
- * The correct (and scalable) fix for the issue seems to require
- * an API change to the drivers... . */
-static DEFINE_SPINLOCK(workaround_lock);
-
 struct capincci {
        struct list_head list;
        u32              ncci;
@@ -150,7 +139,7 @@ static LIST_HEAD(capidev_list);
 
 #ifdef CONFIG_ISDN_CAPI_MIDDLEWARE
 
-static DEFINE_RWLOCK(capiminors_lock);
+static DEFINE_SPINLOCK(capiminors_lock);
 static struct capiminor **capiminors;
 
 static struct tty_driver *capinc_tty_driver;
@@ -159,8 +148,7 @@ static struct tty_driver *capinc_tty_driver;
 
 static int capiminor_add_ack(struct capiminor *mp, u16 datahandle)
 {
-       struct datahandle_queue *n;
-       unsigned long flags;
+       struct ackqueue_entry *n;
 
        n = kmalloc(sizeof(*n), GFP_ATOMIC);
        if (unlikely(!n)) {
@@ -169,55 +157,52 @@ static int capiminor_add_ack(struct capiminor *mp, u16 datahandle)
        }
        n->datahandle = datahandle;
        INIT_LIST_HEAD(&n->list);
-       spin_lock_irqsave(&mp->ackqlock, flags);
+       spin_lock_bh(&mp->ackqlock);
        list_add_tail(&n->list, &mp->ackqueue);
        mp->nack++;
-       spin_unlock_irqrestore(&mp->ackqlock, flags);
+       spin_unlock_bh(&mp->ackqlock);
        return 0;
 }
 
 static int capiminor_del_ack(struct capiminor *mp, u16 datahandle)
 {
-       struct datahandle_queue *p, *tmp;
-       unsigned long flags;
+       struct ackqueue_entry *p, *tmp;
 
-       spin_lock_irqsave(&mp->ackqlock, flags);
+       spin_lock_bh(&mp->ackqlock);
        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
                if (p->datahandle == datahandle) {
                        list_del(&p->list);
-                       kfree(p);
                        mp->nack--;
-                       spin_unlock_irqrestore(&mp->ackqlock, flags);
+                       spin_unlock_bh(&mp->ackqlock);
+                       kfree(p);
                        return 0;
                }
        }
-       spin_unlock_irqrestore(&mp->ackqlock, flags);
+       spin_unlock_bh(&mp->ackqlock);
        return -1;
 }
 
 static void capiminor_del_all_ack(struct capiminor *mp)
 {
-       struct datahandle_queue *p, *tmp;
-       unsigned long flags;
+       struct ackqueue_entry *p, *tmp;
 
-       spin_lock_irqsave(&mp->ackqlock, flags);
        list_for_each_entry_safe(p, tmp, &mp->ackqueue, list) {
                list_del(&p->list);
                kfree(p);
                mp->nack--;
        }
-       spin_unlock_irqrestore(&mp->ackqlock, flags);
 }
 
 
 /* -------- struct capiminor ---------------------------------------- */
 
+static const struct tty_port_operations capiminor_port_ops; /* we have none */
+
 static struct capiminor *capiminor_alloc(struct capi20_appl *ap, u32 ncci)
 {
        struct capiminor *mp;
        struct device *dev;
        unsigned int minor;
-       unsigned long flags;
 
        mp = kzalloc(sizeof(*mp), GFP_KERNEL);
        if (!mp) {
@@ -229,22 +214,24 @@ static struct capiminor *capiminor_alloc(struct capi20_appl *ap, u32 ncci)
 
        mp->ap = ap;
        mp->ncci = ncci;
-       mp->msgid = 0;
-       atomic_set(&mp->ttyopencount,0);
        INIT_LIST_HEAD(&mp->ackqueue);
        spin_lock_init(&mp->ackqlock);
 
        skb_queue_head_init(&mp->inqueue);
        skb_queue_head_init(&mp->outqueue);
+       spin_lock_init(&mp->outlock);
+
+       tty_port_init(&mp->port);
+       mp->port.ops = &capiminor_port_ops;
 
        /* Allocate the least unused minor number. */
-       write_lock_irqsave(&capiminors_lock, flags);
+       spin_lock(&capiminors_lock);
        for (minor = 0; minor < capi_ttyminors; minor++)
                if (!capiminors[minor]) {
                        capiminors[minor] = mp;
                        break;
                }
-       write_unlock_irqrestore(&capiminors_lock, flags);
+       spin_unlock(&capiminors_lock);
 
        if (minor == capi_ttyminors) {
                printk(KERN_NOTICE "capi: out of minors\n");
@@ -260,9 +247,9 @@ static struct capiminor *capiminor_alloc(struct capi20_appl *ap, u32 ncci)
        return mp;
 
 err_out2:
-       write_lock_irqsave(&capiminors_lock, flags);
+       spin_lock(&capiminors_lock);
        capiminors[minor] = NULL;
-       write_unlock_irqrestore(&capiminors_lock, flags);
+       spin_unlock(&capiminors_lock);
 
 err_out1:
        kfree(mp);
@@ -273,7 +260,7 @@ static void capiminor_destroy(struct kref *kref)
 {
        struct capiminor *mp = container_of(kref, struct capiminor, kref);
 
-       kfree_skb(mp->ttyskb);
+       kfree_skb(mp->outskb);
        skb_queue_purge(&mp->inqueue);
        skb_queue_purge(&mp->outqueue);
        capiminor_del_all_ack(mp);
@@ -284,11 +271,11 @@ static struct capiminor *capiminor_get(unsigned int minor)
 {
        struct capiminor *mp;
 
-       read_lock(&capiminors_lock);
+       spin_lock(&capiminors_lock);
        mp = capiminors[minor];
        if (mp)
                kref_get(&mp->kref);
-       read_unlock(&capiminors_lock);
+       spin_unlock(&capiminors_lock);
 
        return mp;
 }
@@ -300,13 +287,11 @@ static inline void capiminor_put(struct capiminor *mp)
 
 static void capiminor_free(struct capiminor *mp)
 {
-       unsigned long flags;
-
        tty_unregister_device(capinc_tty_driver, mp->minor);
 
-       write_lock_irqsave(&capiminors_lock, flags);
+       spin_lock(&capiminors_lock);
        capiminors[mp->minor] = NULL;
-       write_unlock_irqrestore(&capiminors_lock, flags);
+       spin_unlock(&capiminors_lock);
 
        capiminor_put(mp);
 }
@@ -323,10 +308,6 @@ static void capincci_alloc_minor(struct capidev *cdev, struct capincci *np)
 
        mp = np->minorp = capiminor_alloc(&cdev->ap, np->ncci);
        if (mp) {
-               mp->nccip = np;
-#ifdef _DEBUG_REFCOUNT
-               printk(KERN_DEBUG "set mp->nccip\n");
-#endif
                device = MKDEV(capinc_tty_driver->major, mp->minor);
                mp->capifs_dentry = capifs_new_ncci(mp->minor, device);
        }
@@ -335,26 +316,35 @@ static void capincci_alloc_minor(struct capidev *cdev, struct capincci *np)
 static void capincci_free_minor(struct capincci *np)
 {
        struct capiminor *mp = np->minorp;
+       struct tty_struct *tty;
 
        if (mp) {
                capifs_free_ncci(mp->capifs_dentry);
-               if (mp->tty) {
-                       mp->nccip = NULL;
-#ifdef _DEBUG_REFCOUNT
-                       printk(KERN_DEBUG "reset mp->nccip\n");
-#endif
-                       tty_hangup(mp->tty);
-               } else {
-                       capiminor_free(mp);
+
+               tty = tty_port_tty_get(&mp->port);
+               if (tty) {
+                       tty_vhangup(tty);
+                       tty_kref_put(tty);
                }
+
+               capiminor_free(mp);
        }
 }
 
 static inline unsigned int capincci_minor_opencount(struct capincci *np)
 {
        struct capiminor *mp = np->minorp;
+       unsigned int count = 0;
+       struct tty_struct *tty;
 
-       return mp ? atomic_read(&mp->ttyopencount) : 0;
+       if (mp) {
+               tty = tty_port_tty_get(&mp->port);
+               if (tty) {
+                       count = tty->count;
+                       tty_kref_put(tty);
+               }
+       }
+       return count;
 }
 
 #else /* !CONFIG_ISDN_CAPI_MIDDLEWARE */
@@ -416,7 +406,7 @@ static struct sk_buff *
 gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
 {
        struct sk_buff *nskb;
-       nskb = alloc_skb(CAPI_DATA_B3_RESP_LEN, GFP_ATOMIC);
+       nskb = alloc_skb(CAPI_DATA_B3_RESP_LEN, GFP_KERNEL);
        if (nskb) {
                u16 datahandle = CAPIMSG_U16(skb->data,CAPIMSG_BASELEN+4+4+2);
                unsigned char *s = skb_put(nskb, CAPI_DATA_B3_RESP_LEN);
@@ -424,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
                capimsg_setu16(s, 2, mp->ap->applid);
                capimsg_setu8 (s, 4, CAPI_DATA_B3);
                capimsg_setu8 (s, 5, CAPI_RESP);
-               capimsg_setu16(s, 6, mp->msgid++);
+               capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
                capimsg_setu32(s, 8, mp->ncci);
                capimsg_setu16(s, 12, datahandle);
        }
@@ -433,106 +423,138 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
 
 static int handle_recv_skb(struct capiminor *mp, struct sk_buff *skb)
 {
+       unsigned int datalen = skb->len - CAPIMSG_LEN(skb->data);
+       struct tty_struct *tty;
        struct sk_buff *nskb;
-       int datalen;
        u16 errcode, datahandle;
        struct tty_ldisc *ld;
-       
-       datalen = skb->len - CAPIMSG_LEN(skb->data);
-       if (mp->tty == NULL)
-       {
+       int ret = -1;
+
+       tty = tty_port_tty_get(&mp->port);
+       if (!tty) {
 #ifdef _DEBUG_DATAFLOW
                printk(KERN_DEBUG "capi: currently no receiver\n");
 #endif
                return -1;
        }
        
-       ld = tty_ldisc_ref(mp->tty);
-       if (ld == NULL)
-               return -1;
+       ld = tty_ldisc_ref(tty);
+       if (!ld) {
+               /* fatal error, do not requeue */
+               ret = 0;
+               kfree_skb(skb);
+               goto deref_tty;
+       }
+
        if (ld->ops->receive_buf == NULL) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: ldisc has no receive_buf function\n");
 #endif
-               goto bad;
+               /* fatal error, do not requeue */
+               goto free_skb;
        }
        if (mp->ttyinstop) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: recv tty throttled\n");
 #endif
-               goto bad;
+               goto deref_ldisc;
        }
-       if (mp->tty->receive_room < datalen) {
+
+       if (tty->receive_room < datalen) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: no room in tty\n");
 #endif
-               goto bad;
+               goto deref_ldisc;
        }
-       if ((nskb = gen_data_b3_resp_for(mp, skb)) == NULL) {
+
+       nskb = gen_data_b3_resp_for(mp, skb);
+       if (!nskb) {
                printk(KERN_ERR "capi: gen_data_b3_resp failed\n");
-               goto bad;
+               goto deref_ldisc;
        }
-       datahandle = CAPIMSG_U16(skb->data,CAPIMSG_BASELEN+4);
+
+       datahandle = CAPIMSG_U16(skb->data, CAPIMSG_BASELEN + 4);
+
        errcode = capi20_put_message(mp->ap, nskb);
-       if (errcode != CAPI_NOERROR) {
+
+       if (errcode == CAPI_NOERROR) {
+               skb_pull(skb, CAPIMSG_LEN(skb->data));
+#ifdef _DEBUG_DATAFLOW
+               printk(KERN_DEBUG "capi: DATA_B3_RESP %u len=%d => ldisc\n",
+                                       datahandle, skb->len);
+#endif
+               ld->ops->receive_buf(tty, skb->data, NULL, skb->len);
+       } else {
                printk(KERN_ERR "capi: send DATA_B3_RESP failed=%x\n",
                                errcode);
                kfree_skb(nskb);
-               goto bad;
+
+               if (errcode == CAPI_SENDQUEUEFULL)
+                       goto deref_ldisc;
        }
-       (void)skb_pull(skb, CAPIMSG_LEN(skb->data));
-#ifdef _DEBUG_DATAFLOW
-       printk(KERN_DEBUG "capi: DATA_B3_RESP %u len=%d => ldisc\n",
-                               datahandle, skb->len);
-#endif
-       ld->ops->receive_buf(mp->tty, skb->data, NULL, skb->len);
+
+free_skb:
+       ret = 0;
        kfree_skb(skb);
+
+deref_ldisc:
        tty_ldisc_deref(ld);
-       return 0;
-bad:
-       tty_ldisc_deref(ld);
-       return -1;
+
+deref_tty:
+       tty_kref_put(tty);
+       return ret;
 }
 
 static void handle_minor_recv(struct capiminor *mp)
 {
        struct sk_buff *skb;
-       while ((skb = skb_dequeue(&mp->inqueue)) != NULL) {
-               unsigned int len = skb->len;
-               mp->inbytes -= len;
+
+       while ((skb = skb_dequeue(&mp->inqueue)) != NULL)
                if (handle_recv_skb(mp, skb) < 0) {
                        skb_queue_head(&mp->inqueue, skb);
-                       mp->inbytes += len;
                        return;
                }
-       }
 }
 
-static int handle_minor_send(struct capiminor *mp)
+static void handle_minor_send(struct capiminor *mp)
 {
+       struct tty_struct *tty;
        struct sk_buff *skb;
        u16 len;
-       int count = 0;
        u16 errcode;
        u16 datahandle;
 
-       if (mp->tty && mp->ttyoutstop) {
+       tty = tty_port_tty_get(&mp->port);
+       if (!tty)
+               return;
+
+       if (mp->ttyoutstop) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: send: tty stopped\n");
 #endif
-               return 0;
+               tty_kref_put(tty);
+               return;
        }
 
-       while ((skb = skb_dequeue(&mp->outqueue)) != NULL) {
-               datahandle = mp->datahandle;
+       while (1) {
+               spin_lock_bh(&mp->outlock);
+               skb = __skb_dequeue(&mp->outqueue);
+               if (!skb) {
+                       spin_unlock_bh(&mp->outlock);
+                       break;
+               }
                len = (u16)skb->len;
+               mp->outbytes -= len;
+               spin_unlock_bh(&mp->outlock);
+
+               datahandle = atomic_inc_return(&mp->datahandle);
                skb_push(skb, CAPI_DATA_B3_REQ_LEN);
                memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
                capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
                capimsg_setu16(skb->data, 2, mp->ap->applid);
                capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
                capimsg_setu8 (skb->data, 5, CAPI_REQ);
-               capimsg_setu16(skb->data, 6, mp->msgid++);
+               capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
                capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
                capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
                capimsg_setu16(skb->data, 16, len);     /* Data length */
@@ -541,14 +563,16 @@ static int handle_minor_send(struct capiminor *mp)
 
                if (capiminor_add_ack(mp, datahandle) < 0) {
                        skb_pull(skb, CAPI_DATA_B3_REQ_LEN);
-                       skb_queue_head(&mp->outqueue, skb);
-                       return count;
+
+                       spin_lock_bh(&mp->outlock);
+                       __skb_queue_head(&mp->outqueue, skb);
+                       mp->outbytes += len;
+                       spin_unlock_bh(&mp->outlock);
+
+                       break;
                }
                errcode = capi20_put_message(mp->ap, skb);
                if (errcode == CAPI_NOERROR) {
-                       mp->datahandle++;
-                       count++;
-                       mp->outbytes -= len;
 #ifdef _DEBUG_DATAFLOW
                        printk(KERN_DEBUG "capi: DATA_B3_REQ %u len=%u\n",
                                                        datahandle, len);
@@ -559,16 +583,20 @@ static int handle_minor_send(struct capiminor *mp)
 
                if (errcode == CAPI_SENDQUEUEFULL) {
                        skb_pull(skb, CAPI_DATA_B3_REQ_LEN);
-                       skb_queue_head(&mp->outqueue, skb);
+
+                       spin_lock_bh(&mp->outlock);
+                       __skb_queue_head(&mp->outqueue, skb);
+                       mp->outbytes += len;
+                       spin_unlock_bh(&mp->outlock);
+
                        break;
                }
 
                /* ups, drop packet */
                printk(KERN_ERR "capi: put_message = %x\n", errcode);
-               mp->outbytes -= len;
                kfree_skb(skb);
        }
-       return count;
+       tty_kref_put(tty);
 }
 
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
@@ -578,11 +606,11 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 {
        struct capidev *cdev = ap->private;
 #ifdef CONFIG_ISDN_CAPI_MIDDLEWARE
+       struct tty_struct *tty;
        struct capiminor *mp;
        u16 datahandle;
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
        struct capincci *np;
-       unsigned long flags;
 
        mutex_lock(&cdev->lock);
 
@@ -594,7 +622,6 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
        if (CAPIMSG_CMD(skb->data) == CAPI_CONNECT_B3_IND)
                capincci_alloc(cdev, CAPIMSG_NCCI(skb->data));
 
-       spin_lock_irqsave(&workaround_lock, flags);
        if (CAPIMSG_COMMAND(skb->data) != CAPI_DATA_B3) {
                skb_queue_tail(&cdev->recvqueue, skb);
                wake_up_interruptible(&cdev->recvwait);
@@ -628,7 +655,7 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
                                datahandle, skb->len-CAPIMSG_LEN(skb->data));
 #endif
                skb_queue_tail(&mp->inqueue, skb);
-               mp->inbytes += skb->len;
+
                handle_minor_recv(mp);
 
        } else if (CAPIMSG_SUBCOMMAND(skb->data) == CAPI_CONF) {
@@ -640,10 +667,13 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
                                CAPIMSG_U16(skb->data, CAPIMSG_BASELEN+4+2));
 #endif
                kfree_skb(skb);
-               (void)capiminor_del_ack(mp, datahandle);
-               if (mp->tty)
-                       tty_wakeup(mp->tty);
-               (void)handle_minor_send(mp);
+               capiminor_del_ack(mp, datahandle);
+               tty = tty_port_tty_get(&mp->port);
+               if (tty) {
+                       tty_wakeup(tty);
+                       tty_kref_put(tty);
+               }
+               handle_minor_send(mp);
 
        } else {
                /* ups, let capi application handle it :-) */
@@ -653,7 +683,6 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
 
 unlock_out:
-       spin_unlock_irqrestore(&workaround_lock, flags);
        mutex_unlock(&cdev->lock);
 }
 
@@ -1029,171 +1058,135 @@ static void capinc_tty_cleanup(struct tty_struct *tty)
        capiminor_put(mp);
 }
 
-static int capinc_tty_open(struct tty_struct * tty, struct file * file)
+static int capinc_tty_open(struct tty_struct *tty, struct file *filp)
 {
        struct capiminor *mp = tty->driver_data;
-       unsigned long flags;
-
-       spin_lock_irqsave(&workaround_lock, flags);
-       if (atomic_read(&mp->ttyopencount) == 0)
-               mp->tty = tty;
-       atomic_inc(&mp->ttyopencount);
-#ifdef _DEBUG_REFCOUNT
-       printk(KERN_DEBUG "capinc_tty_open ocount=%d\n", atomic_read(&mp->ttyopencount));
-#endif
+       int err;
+
+       err = tty_port_open(&mp->port, tty, filp);
+       if (err)
+               return err;
+
        handle_minor_recv(mp);
-       spin_unlock_irqrestore(&workaround_lock, flags);
        return 0;
 }
 
-static void capinc_tty_close(struct tty_struct * tty, struct file * file)
+static void capinc_tty_close(struct tty_struct *tty, struct file *filp)
 {
        struct capiminor *mp = tty->driver_data;
 
-               if (atomic_dec_and_test(&mp->ttyopencount)) {
-#ifdef _DEBUG_REFCOUNT
-                       printk(KERN_DEBUG "capinc_tty_close lastclose\n");
-#endif
-                       mp->tty = NULL;
-               }
-#ifdef _DEBUG_REFCOUNT
-               printk(KERN_DEBUG "capinc_tty_close ocount=%d\n", atomic_read(&mp->ttyopencount));
-#endif
-               if (mp->nccip == NULL)
-                       capiminor_free(mp);
-
-#ifdef _DEBUG_REFCOUNT
-       printk(KERN_DEBUG "capinc_tty_close\n");
-#endif
+       tty_port_close(&mp->port, tty, filp);
 }
 
-static int capinc_tty_write(struct tty_struct * tty,
+static int capinc_tty_write(struct tty_struct *tty,
                            const unsigned char *buf, int count)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
        struct sk_buff *skb;
-       unsigned long flags;
 
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_write(count=%d)\n", count);
 #endif
 
-       if (!mp || !mp->nccip) {
-#ifdef _DEBUG_TTYFUNCS
-               printk(KERN_DEBUG "capinc_tty_write: mp or mp->ncci NULL\n");
-#endif
-               return 0;
-       }
-
-       spin_lock_irqsave(&workaround_lock, flags);
-       skb = mp->ttyskb;
+       spin_lock_bh(&mp->outlock);
+       skb = mp->outskb;
        if (skb) {
-               mp->ttyskb = NULL;
-               skb_queue_tail(&mp->outqueue, skb);
+               mp->outskb = NULL;
+               __skb_queue_tail(&mp->outqueue, skb);
                mp->outbytes += skb->len;
        }
 
        skb = alloc_skb(CAPI_DATA_B3_REQ_LEN+count, GFP_ATOMIC);
        if (!skb) {
                printk(KERN_ERR "capinc_tty_write: alloc_skb failed\n");
-               spin_unlock_irqrestore(&workaround_lock, flags);
+               spin_unlock_bh(&mp->outlock);
                return -ENOMEM;
        }
 
        skb_reserve(skb, CAPI_DATA_B3_REQ_LEN);
        memcpy(skb_put(skb, count), buf, count);
 
-       skb_queue_tail(&mp->outqueue, skb);
+       __skb_queue_tail(&mp->outqueue, skb);
        mp->outbytes += skb->len;
-       (void)handle_minor_send(mp);
-       (void)handle_minor_recv(mp);
-       spin_unlock_irqrestore(&workaround_lock, flags);
+       spin_unlock_bh(&mp->outlock);
+
+       handle_minor_send(mp);
+
        return count;
 }
 
 static int capinc_tty_put_char(struct tty_struct *tty, unsigned char ch)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
+       bool invoke_send = false;
        struct sk_buff *skb;
-       unsigned long flags;
        int ret = 1;
 
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_put_char(%u)\n", ch);
 #endif
 
-       if (!mp || !mp->nccip) {
-#ifdef _DEBUG_TTYFUNCS
-               printk(KERN_DEBUG "capinc_tty_put_char: mp or mp->ncci NULL\n");
-#endif
-               return 0;
-       }
-
-       spin_lock_irqsave(&workaround_lock, flags);
-       skb = mp->ttyskb;
+       spin_lock_bh(&mp->outlock);
+       skb = mp->outskb;
        if (skb) {
                if (skb_tailroom(skb) > 0) {
                        *(skb_put(skb, 1)) = ch;
-                       spin_unlock_irqrestore(&workaround_lock, flags);
-                       return 1;
+                       goto unlock_out;
                }
-               mp->ttyskb = NULL;
-               skb_queue_tail(&mp->outqueue, skb);
+               mp->outskb = NULL;
+               __skb_queue_tail(&mp->outqueue, skb);
                mp->outbytes += skb->len;
-               (void)handle_minor_send(mp);
+               invoke_send = true;
        }
+
        skb = alloc_skb(CAPI_DATA_B3_REQ_LEN+CAPI_MAX_BLKSIZE, GFP_ATOMIC);
        if (skb) {
                skb_reserve(skb, CAPI_DATA_B3_REQ_LEN);
                *(skb_put(skb, 1)) = ch;
-               mp->ttyskb = skb;
+               mp->outskb = skb;
        } else {
                printk(KERN_ERR "capinc_put_char: char %u lost\n", ch);
                ret = 0;
        }
-       spin_unlock_irqrestore(&workaround_lock, flags);
+
+unlock_out:
+       spin_unlock_bh(&mp->outlock);
+
+       if (invoke_send)
+               handle_minor_send(mp);
+
        return ret;
 }
 
 static void capinc_tty_flush_chars(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
        struct sk_buff *skb;
-       unsigned long flags;
 
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_flush_chars\n");
 #endif
 
-       if (!mp || !mp->nccip) {
-#ifdef _DEBUG_TTYFUNCS
-               printk(KERN_DEBUG "capinc_tty_flush_chars: mp or mp->ncci NULL\n");
-#endif
-               return;
-       }
-
-       spin_lock_irqsave(&workaround_lock, flags);
-       skb = mp->ttyskb;
+       spin_lock_bh(&mp->outlock);
+       skb = mp->outskb;
        if (skb) {
-               mp->ttyskb = NULL;
-               skb_queue_tail(&mp->outqueue, skb);
+               mp->outskb = NULL;
+               __skb_queue_tail(&mp->outqueue, skb);
                mp->outbytes += skb->len;
-               (void)handle_minor_send(mp);
-       }
-       (void)handle_minor_recv(mp);
-       spin_unlock_irqrestore(&workaround_lock, flags);
+               spin_unlock_bh(&mp->outlock);
+
+               handle_minor_send(mp);
+       } else
+               spin_unlock_bh(&mp->outlock);
+
+       handle_minor_recv(mp);
 }
 
 static int capinc_tty_write_room(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
        int room;
-       if (!mp || !mp->nccip) {
-#ifdef _DEBUG_TTYFUNCS
-               printk(KERN_DEBUG "capinc_tty_write_room: mp or mp->ncci NULL\n");
-#endif
-               return 0;
-       }
+
        room = CAPINC_MAX_SENDQUEUE-skb_queue_len(&mp->outqueue);
        room *= CAPI_MAX_BLKSIZE;
 #ifdef _DEBUG_TTYFUNCS
@@ -1204,13 +1197,8 @@ static int capinc_tty_write_room(struct tty_struct *tty)
 
 static int capinc_tty_chars_in_buffer(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
-       if (!mp || !mp->nccip) {
-#ifdef _DEBUG_TTYFUNCS
-               printk(KERN_DEBUG "capinc_tty_chars_in_buffer: mp or mp->ncci NULL\n");
-#endif
-               return 0;
-       }
+       struct capiminor *mp = tty->driver_data;
+
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_chars_in_buffer = %d nack=%d sq=%d rq=%d\n",
                        mp->outbytes, mp->nack,
@@ -1239,62 +1227,55 @@ static void capinc_tty_set_termios(struct tty_struct *tty, struct ktermios * old
 #endif
 }
 
-static void capinc_tty_throttle(struct tty_struct * tty)
+static void capinc_tty_throttle(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_throttle\n");
 #endif
-       if (mp)
-               mp->ttyinstop = 1;
+       mp->ttyinstop = 1;
 }
 
-static void capinc_tty_unthrottle(struct tty_struct * tty)
+static void capinc_tty_unthrottle(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
-       unsigned long flags;
+       struct capiminor *mp = tty->driver_data;
+
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_unthrottle\n");
 #endif
-       if (mp) {
-               spin_lock_irqsave(&workaround_lock, flags);
-               mp->ttyinstop = 0;
-               handle_minor_recv(mp);
-               spin_unlock_irqrestore(&workaround_lock, flags);
-       }
+       mp->ttyinstop = 0;
+       handle_minor_recv(mp);
 }
 
 static void capinc_tty_stop(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
+       struct capiminor *mp = tty->driver_data;
+
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_stop\n");
 #endif
-       if (mp) {
-               mp->ttyoutstop = 1;
-       }
+       mp->ttyoutstop = 1;
 }
 
 static void capinc_tty_start(struct tty_struct *tty)
 {
-       struct capiminor *mp = (struct capiminor *)tty->driver_data;
-       unsigned long flags;
+       struct capiminor *mp = tty->driver_data;
+
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_start\n");
 #endif
-       if (mp) {
-               spin_lock_irqsave(&workaround_lock, flags);
-               mp->ttyoutstop = 0;
-               (void)handle_minor_send(mp);
-               spin_unlock_irqrestore(&workaround_lock, flags);
-       }
+       mp->ttyoutstop = 0;
+       handle_minor_send(mp);
 }
 
 static void capinc_tty_hangup(struct tty_struct *tty)
 {
+       struct capiminor *mp = tty->driver_data;
+
 #ifdef _DEBUG_TTYFUNCS
        printk(KERN_DEBUG "capinc_tty_hangup\n");
 #endif
+       tty_port_hangup(&mp->port);
 }
 
 static int capinc_tty_break_ctl(struct tty_struct *tty, int state)