Index: linux-2.6.21/drivers/char/ts0710.h
===================================================================
--- linux-2.6.21.orig/drivers/char/ts0710.h	2007-04-27 20:35:44.000000000 -0300
+++ linux-2.6.21/drivers/char/ts0710.h	2007-04-27 20:36:03.000000000 -0300
@@ -45,7 +45,6 @@
  *  11/18/2002  Modified
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 
 #include <linux/errno.h>
@@ -58,7 +57,6 @@
 #include <linux/major.h>
 #include <linux/mm.h>
 #include <linux/init.h>
-#include <linux/devfs_fs_kernel.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
Index: linux-2.6.21/drivers/char/ts0710_mux.c
===================================================================
--- linux-2.6.21.orig/drivers/char/ts0710_mux.c	2007-04-27 20:35:44.000000000 -0300
+++ linux-2.6.21/drivers/char/ts0710_mux.c	2007-04-27 20:36:03.000000000 -0300
@@ -46,7 +46,6 @@
  *  11/18/2002  Second version
  *  04/21/2004  Add GPRS PROC
  */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/types.h>
 
@@ -70,15 +69,12 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-#include <linux/devfs_fs_kernel.h>
-//#include <syslog.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <asm/bitops.h>
 
 #ifdef USB_FOR_MUX
-//#include <linux/usb.h>
 #include "ts0710_mux_usb.h"
 #endif
 
@@ -268,8 +264,8 @@
 static struct work_struct post_recv_tqueue;
 
 static struct tty_struct *mux_table[NR_MUXS];
-static struct termios *mux_termios[NR_MUXS];
-static struct termios *mux_termios_locked[NR_MUXS];
+static struct ktermios *mux_termios[NR_MUXS];
+static struct ktermios *mux_termios_locked[NR_MUXS];
 static volatile short int mux_tty[NR_MUXS];
 
 #ifdef min
@@ -1894,11 +1890,7 @@
 				if (test_bit(TTY_THROTTLED, &tty->flags)) {
 					queue_data = 1;
 				} else {
-					if (test_bit
-					    (TTY_DONT_FLIP, &tty->flags)) {
-						queue_data = 1;
-						post_recv = 1;
-					} else if (recv_info->total) {
+					if (recv_info->total) {
 						queue_data = 1;
 						post_recv = 1;
 					} else if (recv_room < uih_len) {
@@ -3149,10 +3141,10 @@
 
 /*For BP UART problem End*/
 
-static void receive_worker(void *private_)
+static void receive_worker(struct work_struct *work)
 {
 	struct tty_struct *tty = COMM_FOR_MUX_TTY;
-	int i, count, tbuf_free, tbuf_read;
+	int count, tbuf_free, tbuf_read;
 	static unsigned char tbuf[TS0710MUX_MAX_BUF_SIZE];
 	static unsigned char *tbuf_ptr = &tbuf[0];
 	static unsigned char *start_flag = 0;
@@ -3168,7 +3160,7 @@
 	__u32 uih_len;
 	/*For BP UART problem End */
 
-	UNUSED_PARAM(private_);
+	UNUSED_PARAM(work);
 
   	if (!tty)
   		return;
@@ -3440,7 +3432,7 @@
 	clear_bit(RECV_RUNNING, &mux_recv_flags);
 }
 
-static void post_recv_worker(void *private_)
+static void post_recv_worker(struct work_struct *work)
 {
 	ts0710_con *ts0710 = &ts0710_connection;
 	int tty_idx;
@@ -3453,7 +3445,7 @@
 	mux_recv_packet *recv_packet, *recv_packet2;
 	__u8 j;
 
-	UNUSED_PARAM(private_);
+	UNUSED_PARAM(work);
 
 	if (test_and_set_bit(RECV_RUNNING, &mux_recv_flags)) {
 		schedule_work(&post_recv_tqueue);
@@ -3499,10 +3491,6 @@
 		if (test_bit(TTY_THROTTLED, &tty->flags)) {
 			add_post_recv_queue(&post_recv_q, recv_info);
 			continue;
-		} else if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
-			post_recv = 1;
-			add_post_recv_queue(&post_recv_q, recv_info);
-			continue;
 		}
 
 		flow_control = 0;
@@ -3635,7 +3623,7 @@
 	}
 }
 
-static void send_worker(void *private_)
+static void send_worker(struct work_struct *work)
 {
 	ts0710_con *ts0710 = &ts0710_connection;
 	__u8 j;
@@ -3644,7 +3632,7 @@
 	struct tty_struct *tty;
 	__u8 dlci;
 
-	UNUSED_PARAM(private_);
+	UNUSED_PARAM(work);
 
 	TS0710_DEBUG("Enter into send_worker");
 
@@ -3819,7 +3807,8 @@
 	gprsData[TS0710MUX_GPRS_SESSION_MAX - 1].sentBytes =
 	    get_count(TS0710MUX_GPRS2_SEND_COUNT_IDX);
 
-	copy_to_user(buf, gprsData, bufLen);
+	if(copy_to_user(buf, gprsData, bufLen))
+		return -EFAULT;
 
 	return bufLen;
 }
@@ -3836,7 +3825,8 @@
 
 	memset(gprsData, 0, bufLen);
 
-	copy_from_user(gprsData, buf, bufLen);
+	if(copy_from_user(gprsData, buf, bufLen))
+		return -EFAULT;
 
 	set_count(TS0710MUX_GPRS1_RECV_COUNT_IDX, gprsData[0].recvBytes);
 	set_count(TS0710MUX_GPRS1_SEND_COUNT_IDX, gprsData[0].sentBytes);
@@ -3893,9 +3883,9 @@
 	}
 	post_recv_count_flag = 0;
 
-	INIT_WORK(&send_tqueue, send_worker, NULL);
-	INIT_WORK(&receive_tqueue, receive_worker, NULL);
-	INIT_WORK(&post_recv_tqueue, post_recv_worker, NULL);
+	INIT_WORK(&send_tqueue, send_worker);
+	INIT_WORK(&receive_tqueue, receive_worker);
+	INIT_WORK(&post_recv_tqueue, post_recv_worker);
 
 	mux_driver = alloc_tty_driver(NR_MUXS);
 	if (!mux_driver)
@@ -3904,12 +3894,11 @@
 	mux_driver->owner = THIS_MODULE;
 	mux_driver->driver_name = "ts0710mux";
 	mux_driver->name = "mux";
-	mux_driver->devfs_name = "mux";
 	mux_driver->major = TS0710MUX_MAJOR;
 	mux_driver->minor_start = TS0710MUX_MINOR_START;
 	mux_driver->type = TTY_DRIVER_TYPE_SERIAL;
 	mux_driver->subtype = SERIAL_TYPE_NORMAL;
-	mux_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW;
+	mux_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
 
 	mux_driver->init_termios = tty_std_termios;
 	mux_driver->init_termios.c_iflag = 0;
@@ -3917,10 +3906,10 @@
 	mux_driver->init_termios.c_cflag = B38400 | CS8 | CREAD;
 	mux_driver->init_termios.c_lflag = 0;
 
-//	mux_driver.ttys = mux_table;
+	//mux_driver.ttys = mux_table;
 	mux_driver->termios = mux_termios;
 	mux_driver->termios_locked = mux_termios_locked;
-//  mux_driver.driver_state = mux_state;
+	//mux_driver.driver_state = mux_state;
 	mux_driver->other = NULL;
 
 	mux_driver->open = mux_open;
Index: linux-2.6.21/drivers/char/ts0710_mux_usb.c
===================================================================
--- linux-2.6.21.orig/drivers/char/ts0710_mux_usb.c	2007-04-27 20:35:44.000000000 -0300
+++ linux-2.6.21/drivers/char/ts0710_mux_usb.c	2007-04-27 22:34:31.000000000 -0300
@@ -188,7 +188,8 @@
 	buf_list_t *inbuf;
 	int count = urb->actual_length;
 
-	inbuf = kmalloc(sizeof(buf_list_t), GFP_KERNEL);
+	// we are called from interrupt context.
+	inbuf = kmalloc(sizeof(buf_list_t), GFP_ATOMIC);
 	if (!inbuf) {
 		printk("append_to_inbuf_list: (%d) out of memory!\n",
 			sizeof(buf_list_t));
@@ -196,7 +197,7 @@
 	}
 
 	inbuf->size = count;
-	inbuf->body = kmalloc(sizeof(char)*count, GFP_KERNEL);
+	inbuf->body = kmalloc(sizeof(char)*count, GFP_ATOMIC);
 	if (!inbuf->body) {
 		kfree(inbuf);
 		printk("append_to_inbuf_list: (%d) out of memory!\n",
@@ -222,7 +223,7 @@
 		inbuf = list_entry(ptr, buf_list_t, list);
 		src_count = inbuf->size;
 		if (dst_count >= src_count) {
-			memcpy(buf, inbuf->body, src_count);
+			memcpy((unsigned char *)buf, inbuf->body, src_count);
 			ret = src_count;
 			list_del(ptr);
 			kfree(inbuf->body);
@@ -282,9 +283,8 @@
 	spin_unlock(&bvd_ipc->in_buf_lock);
 }
 
-static void usb_ipc_read_bulk(struct urb *urb, struct pt_regs *regs)
+static void usb_ipc_read_bulk(struct urb *urb)
 {
-	buf_list_t *inbuf;
 	int count = urb->actual_length;
 	struct tty_struct *tty = &ipcusb_tty;
 
@@ -319,7 +319,7 @@
 	bvd_dbg("usb_ipc_read_bulk: completed!!!");
 }
 
-static void usb_ipc_write_bulk(struct urb *urb, struct pt_regs *regs)
+static void usb_ipc_write_bulk(struct urb *urb)
 {
 	callback_times++;
 	bvd_ipc->write_finished_flag = 1;
@@ -437,7 +437,7 @@
 			/*send IN token*/
 			bvd_ipc->readurb_mux.actual_length = 0;
 			bvd_ipc->readurb_mux.dev = bvd_ipc->ipc_dev;
-			if (ret = usb_submit_urb(&bvd_ipc->readurb_mux, GFP_ATOMIC))
+			if ((ret = usb_submit_urb(&bvd_ipc->readurb_mux, GFP_ATOMIC)))
 				printk("ipcusb_xmit_data: usb_submit_urb(read mux bulk)"
 					"failed! status=%d\n", ret);
 			bvd_dbg("ipcusb_xmit_data: Send a IN token successfully!");
@@ -447,7 +447,7 @@
 		bvd_ipc->write_finished_flag = 0;
 		//printk("%s: clear write_finished_flag:%d\n", __FUNCTION__, bvd_ipc->write_finished_flag);
 		bvd_ipc->writeurb_mux.dev = bvd_ipc->ipc_dev;
-		if (result = usb_submit_urb(&bvd_ipc->writeurb_mux, GFP_ATOMIC))
+		if ((result = usb_submit_urb(&bvd_ipc->writeurb_mux, GFP_ATOMIC)))
 			warn("ipcusb_xmit_data: funky result! result=%d\n", result);
 
 		bvd_dbg("ipcusb_xmit_data: usb_submit_urb finished! result:%d", result);
@@ -498,7 +498,7 @@
 		return 0;
 
 	if (*ipcusb_ap_to_bp != NULL)
-		(*ipcusb_ap_to_bp)(buf, count);
+		(*ipcusb_ap_to_bp)((unsigned char *)buf, count);
 
 	bvd_ipc->suspend_flag = 1;
 
@@ -602,6 +602,7 @@
 	}
 
 	ep_cnt = have_bulk_in_mux = have_bulk_out_mux = 0;
+	readsize = writesize = 0;
 
 	while (ep_cnt < interface->bNumEndpoints) {
 		endpoint = &intf->cur_altsetting->endpoint[ep_cnt].desc;
@@ -792,6 +793,8 @@
 	bvd_ipc->ipc_dev = NULL;
 	bvd_ipc->xmit.head = bvd_ipc->xmit.tail = 0;
 	bvd_ipc->write_flag = IPC_USB_WRITE_INIT;
+	spin_lock_init(&bvd_ipc->lock);
+	spin_lock_init(&bvd_ipc->in_buf_lock);
 
 	ipcusb_tty_driver.write = usb_ipc_write;
 	ipcusb_tty_driver.chars_in_buffer = usb_ipc_chars_in_buffer;