drivers/char/specialix.c converted to dynamic allocation

drivers/char/vme_scc.c converted to dynamic allocation

drivers/char/serial_tx3912.c converted to dynamic allocation

drivers/char/serial167.c converted to dynamic allocation

drivers/char/dz.c converted to dynamic allocation

drivers/char/amiserial.c converted to dynamic allocation

drivers/char/istallion.c converted to dynamic allocation

drivers/char/stallion.c converted to dynamic allocation

drivers/char/sx.c converted to dynamic allocation

drivers/macintosh/macserial.c converted to dynamic allocation

drivers/sbus/char/aurora.c converted to dynamic allocation

drivers/tc/zs.c converted to dynamic allocation

drivers/sgi/char/sgiserial.c converted to dynamic allocation

drivers/serial/mcfserial.c converted to dynamic allocation

drivers/serial/68360serial.c converted to dynamic allocation

drivers/serial/68328serial.c converted to dynamic allocation

drivers/serial/core.c converted to dynamic allocation

net/bluetooth/rfcomm/tty.c converted to dynamic allocation

net/irda/ircomm/ircomm_tty.c converted to dynamic allocation

killed the last remnants of callout stuff - we don't need to mess with
storing termios privately anymore.

added helper functions for allocation and freeing tty_driver

->table[], ->termios[] and ->locked_termios[] allocated dynamically
in tty_register_driver() and freed in tty_unregister_driver().  Per-driver
arrays gone.

->refcount switched from int * to int.  Per-driver variables gone since we had
switched from int foo = 0; driver.refcount = &foo; to driver.refcount = 0;

Fixes a couple of leaks in char_dev.c

From: Samuel Thibault <Samuel.Thibault@ens-lyon.fr>

Tioclinux() uses "magic numbers" that applications should know to use it.
Here is a patch which adds an include/linux/tiocl.h which holds them and
can be used by applications to properly call iotcl(TIOCLINUX).  It might
stand for documentation as well, replacing the not up-to-date man
ioctl_list.

A structure for the selection argument is also defined.

From: Dipankar Sarma <dipankar@in.ibm.com>

Free any read channel allocated earlier if allocation of write channel
fails.  (From 2.4).

From: Dipankar Sarma <dipankar@in.ibm.com>

Fix memory leak - free on copyin failure.

From: Dipankar Sarma <dipankar@in.ibm.com>

Fix memory leak in emu10k1_audio_open.

From: Dipankar Sarma <dipankar@in.ibm.com>

Use copy_to_user to copy mpu_synth_ioctl arg.

From: Dipankar Sarma <dipankar@in.ibm.com>

Use copy_to_user/get_char with user buffers.

From: Dipankar Sarma <dipankar@in.ibm.com>

Fixed copy/user problem in lento_symlink where user address was getting
passed to presto_do_symlink.  (From 2.4)

From: Dipankar Sarma <dipankar@in.ibm.com>

Use copy_to_user, not memcpy with user buffers

From: Dipankar Sarma <dipankar@in.ibm.com>

Fix parsing of options for X.25 facilities

From: Jeff Muizelaar <muizelaar@rogers.com>

This patch against 2.5.70-bk2 removes the buffer allocation from resource.c
and lets seq_read do it instead.

From: Hugh Dickins <hugh@veritas.com>

Remove shmem_nrpages, no use is made of it (even 2.4-ac, though it counts
it, does nothing with it): reintroduce if it becomes useful.  Replace GPL
oneliner by the block from 2.4-ac, extend Copyright to 2003, remove two
white spaces.

From: Hugh Dickins <hugh@veritas.com>

Dissatisfied with earlier fix to race where swapoff sneaks page into tmpfs
page cache after truncate_inode_pages cleaned it: calling it a second time
can be too heavy, instead fix shmem_unuse_inode to check i_size.
(Actually, one part of this fix is in the previous patch: shmem_file_write
now has a hold on the page when it raises i_size.)

From: Hugh Dickins <hugh@veritas.com>

generic_file_aio_write_nolock has recently been corrected for when partial
writes hit -EFAULT: now bring shmem_file_write into line.

From: Hugh Dickins <hugh@veritas.com>

loop_get_buffer loses PF_MEMDIE if it's added while in loop_copy_bio: not a
high probability since it's not waiting there, but could happen, and sets a
bad example (compare with add_to_swap fixed a while back).

From: Hugh Dickins <hugh@veritas.com>

loop_copy_bio uses one gfp_mask for bio_alloc and alloc_page calls.  The
bio_alloc obviously can't use highmem, but the alloc_page can.  Yes, the
underlying device might be unable to use highmem, and have to use one of
its bounce buffers, with an extra copy: so be it.

(Originally I did propagate the underlying device's bounce needs down to
the loop device, to avoid that possible extra copy; but let's keep this
simple, the low end doesn't have highmem and the high end can I/O it.)

From: Hugh Dickins <hugh@veritas.com>

What purpose does loop_make_request's blk_queue_bounce serve?  None, it's
just a relic from before the kmaps were added to loop's transfers, and ties
up mempooled resources - in the file-backed case, with no guarantee they'll
soon be freed.  And what purpose does loop_set_fd's blk_queue_bounce_limit
serve?  None, blk_queue_make_request did that.