57 files changed, 447 insertions, 442 deletions
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index 0a5f6b2114c..d672cfe7ca5 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -376,6 +376,8 @@ int braille_register_console(struct console *console, int index,
        console->flags |= CON_ENABLED;
        console->index = index;
        braille_co = console;
+        register_keyboard_notifier(&keyboard_notifier_block);
+        register_vt_notifier(&vt_notifier_block);
        return 0;
 }
@@ -383,15 +385,8 @@ int braille_unregister_console(struct console *console)
 {
        if (braille_co != console)
                return -EINVAL;
+        unregister_keyboard_notifier(&keyboard_notifier_block);
+        unregister_vt_notifier(&vt_notifier_block);
        braille_co = NULL;
        return 0;
 }
-static int __init braille_init(void)
-{
-        register_keyboard_notifier(&keyboard_notifier_block);
-        register_vt_notifier(&vt_notifier_block);
-        return 0;
-}
-console_initcall(braille_init);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 084109507c9..8dd3336efd7 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -165,8 +165,11 @@ static int acpi_bind_one(struct device *dev, acpi_handle handle)
                                "firmware_node");
                ret = sysfs_create_link(&acpi_dev->dev.kobj, &dev->kobj,
                                "physical_node");
-                if (acpi_dev->wakeup.flags.valid)
+                if (acpi_dev->wakeup.flags.valid) {
                        device_set_wakeup_capable(dev, true);
+                        device_set_wakeup_enable(dev,
+                                                acpi_dev->wakeup.state.enabled);
+                }
        }
        return 0;
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 4ebbba2b6b1..bf5b04de02d 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -377,6 +377,14 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
        return 0;
 }
+static void physical_device_enable_wakeup(struct acpi_device *adev)
+{
+        struct device *dev = acpi_get_physical_device(adev->handle);
+        if (dev && device_can_wakeup(dev))
+                device_set_wakeup_enable(dev, adev->wakeup.state.enabled);
+}
 static ssize_t
 acpi_system_write_wakeup_device(struct file *file,
                                const char __user * buffer,
@@ -411,6 +419,7 @@ acpi_system_write_wakeup_device(struct file *file,
                }
        }
        if (found_dev) {
+                physical_device_enable_wakeup(found_dev);
                list_for_each_safe(node, next, &acpi_wakeup_device_list) {
                        struct acpi_device *dev = container_of(node,
                                                               struct
@@ -428,6 +437,7 @@ acpi_system_write_wakeup_device(struct file *file,
                                       dev->pnp.bus_id, found_dev->pnp.bus_id);
                                dev->wakeup.state.enabled =
                                    found_dev->wakeup.state.enabled;
+                                physical_device_enable_wakeup(dev);
                        }
                }
        }
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index 94df9177124..0778d99aea7 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -364,7 +364,7 @@ static void dw_dma_tasklet(unsigned long data)
        int i;
        status_block = dma_readl(dw, RAW.BLOCK);
-        status_xfer = dma_readl(dw, RAW.BLOCK);
+        status_xfer = dma_readl(dw, RAW.XFER);
        status_err = dma_readl(dw, RAW.ERROR);
        dev_vdbg(dw->dma.dev, "tasklet: status_block=%x status_err=%x\n",
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 8e93a797c93..052879a6f85 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -780,10 +780,6 @@ config BLK_DEV_IDEDMA_PMAC
          to transfer data to and from memory.  Saying Y is safe and improves
          performance.
-config BLK_DEV_IDE_SWARM
-        tristate "IDE for Sibyte evaluation boards"
-        depends on SIBYTE_SB1xxx_SOC
 config BLK_DEV_IDE_AU1XXX
       bool "IDE for AMD Alchemy Au1200"
       depends on SOC_AU1200
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 49a8c589e34..f16bb466723 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1661,7 +1661,9 @@ static int ide_cdrom_probe_capabilities(ide_drive_t *drive)
                cdi->mask &= ~CDC_PLAY_AUDIO;
        mechtype = buf[8 + 6] >> 5;
-        if (mechtype == mechtype_caddy || mechtype == mechtype_popup)
+        if (mechtype == mechtype_caddy ||
+            mechtype == mechtype_popup ||
+            (drive->atapi_flags & IDE_AFLAG_NO_AUTOCLOSE))
                cdi->mask |= CDC_CLOSE_TRAY;
        if (cdi->sanyo_slot > 0) {
@@ -1859,6 +1861,8 @@ static const struct cd_list_entry ide_cd_quirks_list[] = {
        { "MATSHITADVD-ROM SR-8176", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
        { "MATSHITADVD-ROM SR-8174", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
        { "Optiarc DVD RW AD-5200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
+        { "Optiarc DVD RW AD-7200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
+        { "Optiarc DVD RW AD-7543A", NULL,   IDE_AFLAG_NO_AUTOCLOSE          },
        { NULL, NULL, 0 }
 };
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index adc68275585..3fa07c0aeaa 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -211,7 +211,7 @@ int ide_build_dmatable (ide_drive_t *drive, struct request *rq)
                                xcount = bcount & 0xffff;
                                if (is_trm290)
                                        xcount = ((xcount >> 2) - 1) << 16;
-                                if (xcount == 0x0000) {
+                                else if (xcount == 0x0000) {
        /* 
         * Most chipsets correctly interpret a length of 0x0000 as 64KB,
         * but at least one (e.g. CS5530) misinterprets it as zero (!).
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 994e41099b4..a51a30e9eab 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1492,7 +1492,7 @@ static struct device_attribute *ide_port_attrs[] = {
 static int ide_sysfs_register_port(ide_hwif_t *hwif)
 {
-        int i, rc;
+        int i, uninitialized_var(rc);
        for (i = 0; ide_port_attrs[i]; i++) {
                rc = device_create_file(hwif->portdev, ide_port_attrs[i]);
diff --git a/drivers/ide/mips/Makefile b/drivers/ide/mips/Makefile
index 677c7b2bac9..5873fa0b876 100644
--- a/drivers/ide/mips/Makefile
+++ b/drivers/ide/mips/Makefile
@@ -1,4 +1,3 @@
-obj-$(CONFIG_BLK_DEV_IDE_SWARM)         += swarm.o
 obj-$(CONFIG_BLK_DEV_IDE_AU1XXX)        += au1xxx-ide.o
 EXTRA_CFLAGS    := -Idrivers/ide
diff --git a/drivers/ide/mips/swarm.c b/drivers/ide/mips/swarm.c
deleted file mode 100644
index 39c9ee99585..00000000000
--- a/drivers/ide/mips/swarm.c
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
- * Copyright (C) 2001, 2002, 2003 Broadcom Corporation
- * Copyright (C) 2004 MontaVista Software Inc.
- *      Author: Manish Lachwani, mlachwani@mvista.com
- * Copyright (C) 2004  MIPS Technologies, Inc.  All rights reserved.
- *      Author: Maciej W. Rozycki <macro@mips.com>
- * Copyright (c) 2006, 2008  Maciej W. Rozycki
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- */
-/*
- *  Derived loosely from ide-pmac.c, so:
- *  Copyright (C) 1998 Paul Mackerras.
- *  Copyright (C) 1995-1998 Mark Lord
- */
-/*
- * Boards with SiByte processors so far have supported IDE devices via
- * the Generic Bus, PCI bus, and built-in PCMCIA interface.  In all
- * cases, byte-swapping must be avoided for these devices (whereas
- * other PCI devices, for example, will require swapping).  Any
- * SiByte-targetted kernel including IDE support will include this
- * file.  Probing of a Generic Bus for an IDE device is controlled by
- * the definition of "SIBYTE_HAVE_IDE", which is provided by
- * <asm/sibyte/board.h> for Broadcom boards.
- */
-#include <linux/ide.h>
-#include <linux/ioport.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/platform_device.h>
-#include <asm/io.h>
-#include <asm/sibyte/board.h>
-#include <asm/sibyte/sb1250_genbus.h>
-#include <asm/sibyte/sb1250_regs.h>
-#define DRV_NAME "ide-swarm"
-static char swarm_ide_string[] = DRV_NAME;
-static struct resource swarm_ide_resource = {
-        .name   = "SWARM GenBus IDE",
-        .flags  = IORESOURCE_MEM,
-};
-static struct platform_device *swarm_ide_dev;
-static const struct ide_port_info swarm_port_info = {
-        .name                   = DRV_NAME,
-        .host_flags             = IDE_HFLAG_MMIO | IDE_HFLAG_NO_DMA,
-};
-/*
- * swarm_ide_probe - if the board header indicates the existence of
- * Generic Bus IDE, allocate a HWIF for it.
- */
-static int __devinit swarm_ide_probe(struct device *dev)
-{
-        u8 __iomem *base;
-        struct ide_host *host;
-        phys_t offset, size;
-        int i, rc;
-        hw_regs_t hw, *hws[] = { &hw, NULL, NULL, NULL };
-        if (!SIBYTE_HAVE_IDE)
-                return -ENODEV;
-        base = ioremap(A_IO_EXT_BASE, 0x800);
-        offset = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_START_ADDR, IDE_CS));
-        size = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_MULT_SIZE, IDE_CS));
-        iounmap(base);
-        offset = G_IO_START_ADDR(offset) << S_IO_ADDRBASE;
-        size = (G_IO_MULT_SIZE(size) + 1) << S_IO_REGSIZE;
-        if (offset < A_PHYS_GENBUS || offset >= A_PHYS_GENBUS_END) {
-                printk(KERN_INFO DRV_NAME
-                       ": IDE interface at GenBus disabled\n");
-                return -EBUSY;
-        }
-        printk(KERN_INFO DRV_NAME ": IDE interface at GenBus slot %i\n",
-               IDE_CS);
-        swarm_ide_resource.start = offset;
-        swarm_ide_resource.end = offset + size - 1;
-        if (request_resource(&iomem_resource, &swarm_ide_resource)) {
-                printk(KERN_ERR DRV_NAME
-                       ": can't request I/O memory resource\n");
-                return -EBUSY;
-        }
-        base = ioremap(offset, size);
-        memset(&hw, 0, sizeof(hw));
-        for (i = 0; i <= 7; i++)
-                hw.io_ports_array[i] =
-                                (unsigned long)(base + ((0x1f0 + i) << 5));
-        hw.io_ports.ctl_addr =
-                                (unsigned long)(base + (0x3f6 << 5));
-        hw.irq = K_INT_GB_IDE;
-        hw.chipset = ide_generic;
-        rc = ide_host_add(&swarm_port_info, hws, &host);
-        if (rc)
-                goto err;
-        dev_set_drvdata(dev, host);
-        return 0;
-err:
-        release_resource(&swarm_ide_resource);
-        iounmap(base);
-        return rc;
-}
-static struct device_driver swarm_ide_driver = {
-        .name   = swarm_ide_string,
-        .bus    = &platform_bus_type,
-        .probe  = swarm_ide_probe,
-};
-static void swarm_ide_platform_release(struct device *device)
-{
-        struct platform_device *pldev;
-        /* free device */
-        pldev = to_platform_device(device);
-        kfree(pldev);
-}
-static int __devinit swarm_ide_init_module(void)
-{
-        struct platform_device *pldev;
-        int err;
-        printk(KERN_INFO "SWARM IDE driver\n");
-        if (driver_register(&swarm_ide_driver)) {
-                printk(KERN_ERR "Driver registration failed\n");
-                err = -ENODEV;
-                goto out;
-        }
-        if (!(pldev = kzalloc(sizeof (*pldev), GFP_KERNEL))) {
-                err = -ENOMEM;
-                goto out_unregister_driver;
-        }
-        pldev->name             = swarm_ide_string;
-        pldev->id               = 0;
-        pldev->dev.release      = swarm_ide_platform_release;
-        if (platform_device_register(pldev)) {
-                err = -ENODEV;
-                goto out_free_pldev;
-        }
-        if (!pldev->dev.driver) {
-                /*
-                 * The driver was not bound to this device, there was
-                 * no hardware at this address. Unregister it, as the
-                 * release fuction will take care of freeing the
-                 * allocated structure
-                 */
-                platform_device_unregister (pldev);
-        }
-        swarm_ide_dev = pldev;
-        return 0;
-out_free_pldev:
-        kfree(pldev);
-out_unregister_driver:
-        driver_unregister(&swarm_ide_driver);
-out:
-        return err;
-}
-module_init(swarm_ide_init_module);
diff --git a/drivers/leds/leds-fsg.c b/drivers/leds/leds-fsg.c
index be0e12144b8..34935155c1c 100644
--- a/drivers/leds/leds-fsg.c
+++ b/drivers/leds/leds-fsg.c
@@ -161,6 +161,16 @@ static int fsg_led_probe(struct platform_device *pdev)
 {
        int ret;
+        /* Map the LED chip select address space */
+        latch_address = (unsigned short *) ioremap(IXP4XX_EXP_BUS_BASE(2), 512);
+        if (!latch_address) {
+                ret = -ENOMEM;
+                goto failremap;
+        }
+        latch_value = 0xffff;
+        *latch_address = latch_value;
        ret = led_classdev_register(&pdev->dev, &fsg_wlan_led);
        if (ret < 0)
                goto failwlan;
@@ -185,20 +195,8 @@ static int fsg_led_probe(struct platform_device *pdev)
        if (ret < 0)
                goto failring;
-        /* Map the LED chip select address space */
-        latch_address = (unsigned short *) ioremap(IXP4XX_EXP_BUS_BASE(2), 512);
-        if (!latch_address) {
-                ret = -ENOMEM;
-                goto failremap;
-        }
-        latch_value = 0xffff;
-        *latch_address = latch_value;
        return ret;
- failremap:
-        led_classdev_unregister(&fsg_ring_led);
 failring:
        led_classdev_unregister(&fsg_sync_led);
 failsync:
@@ -210,14 +208,14 @@ static int fsg_led_probe(struct platform_device *pdev)
 failwan:
        led_classdev_unregister(&fsg_wlan_led);
 failwlan:
+        iounmap(latch_address);
+ failremap:
        return ret;
 }
 static int fsg_led_remove(struct platform_device *pdev)
 {
-        iounmap(latch_address);
        led_classdev_unregister(&fsg_wlan_led);
        led_classdev_unregister(&fsg_wan_led);
        led_classdev_unregister(&fsg_sata_led);
@@ -225,6 +223,8 @@ static int fsg_led_remove(struct platform_device *pdev)
        led_classdev_unregister(&fsg_sync_led);
        led_classdev_unregister(&fsg_ring_led);
+        iounmap(latch_address);
        return 0;
 }
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 146c0697286..f508729123b 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -248,11 +248,10 @@ static int __devinit pca955x_probe(struct i2c_client *client,
                                        const struct i2c_device_id *id)
 {
        struct pca955x_led *pca955x;
-        int i;
-        int err = -ENODEV;
        struct pca955x_chipdef *chip;
        struct i2c_adapter *adapter;
        struct led_platform_data *pdata;
+        int i, err;
        chip = &pca955x_chipdefs[id->driver_data];
        adapter = to_i2c_adapter(client->dev.parent);
@@ -282,43 +281,41 @@ static int __devinit pca955x_probe(struct i2c_client *client,
                }
        }
+        pca955x = kzalloc(sizeof(*pca955x) * chip->bits, GFP_KERNEL);
+        if (!pca955x)
+                return -ENOMEM;
+        i2c_set_clientdata(client, pca955x);
        for (i = 0; i < chip->bits; i++) {
-                pca955x = kzalloc(sizeof(struct pca955x_led), GFP_KERNEL);
+                pca955x[i].chipdef = chip;
-                if (!pca955x) {
+                pca955x[i].client = client;
-                        err = -ENOMEM;
+                pca955x[i].led_num = i;
-                        goto exit;
-                }
-                pca955x->chipdef = chip;
-                pca955x->client = client;
-                pca955x->led_num = i;
                /* Platform data can specify LED names and default triggers */
                if (pdata) {
                        if (pdata->leds[i].name)
-                                snprintf(pca955x->name, 32, "pca955x:%s",
+                                snprintf(pca955x[i].name,
-                                                        pdata->leds[i].name);
+                                         sizeof(pca955x[i].name), "pca955x:%s",
+                                         pdata->leds[i].name);
                        if (pdata->leds[i].default_trigger)
-                                pca955x->led_cdev.default_trigger =
+                                pca955x[i].led_cdev.default_trigger =
                                        pdata->leds[i].default_trigger;
                } else {
-                        snprintf(pca955x->name, 32, "pca955x:%d", i);
+                        snprintf(pca955x[i].name, sizeof(pca955x[i].name),
+                                 "pca955x:%d", i);
                }
-                spin_lock_init(&pca955x->lock);
-                pca955x->led_cdev.name = pca955x->name;
+                spin_lock_init(&pca955x[i].lock);
-                pca955x->led_cdev.brightness_set =
-                                pca955x_led_set;
-                /*
+                pca955x[i].led_cdev.name = pca955x[i].name;
-                 * Client data is a pointer to the _first_ pca955x_led
+                pca955x[i].led_cdev.brightness_set = pca955x_led_set;
-                 * struct
-                 */
-                if (i == 0)
-                        i2c_set_clientdata(client, pca955x);
-                INIT_WORK(&(pca955x->work), pca955x_led_work);
+                INIT_WORK(&pca955x[i].work, pca955x_led_work);
-                led_classdev_register(&client->dev, &(pca955x->led_cdev));
+                err = led_classdev_register(&client->dev, &pca955x[i].led_cdev);
+                if (err < 0)
+                        goto exit;
        }
        /* Turn off LEDs */
@@ -336,23 +333,32 @@ static int __devinit pca955x_probe(struct i2c_client *client,
        pca955x_write_psc(client, 1, 0);
        return 0;
 exit:
+        while (i--) {
+                led_classdev_unregister(&pca955x[i].led_cdev);
+                cancel_work_sync(&pca955x[i].work);
+        }
+        kfree(pca955x);
+        i2c_set_clientdata(client, NULL);
        return err;
 }
 static int __devexit pca955x_remove(struct i2c_client *client)
 {
        struct pca955x_led *pca955x = i2c_get_clientdata(client);
-        int leds = pca955x->chipdef->bits;
        int i;
-        for (i = 0; i < leds; i++) {
+        for (i = 0; i < pca955x->chipdef->bits; i++) {
-                led_classdev_unregister(&(pca955x->led_cdev));
+                led_classdev_unregister(&pca955x[i].led_cdev);
-                cancel_work_sync(&(pca955x->work));
+                cancel_work_sync(&pca955x[i].work);
-                kfree(pca955x);
-                pca955x = pca955x + 1;
        }
+        kfree(pca955x);
+        i2c_set_clientdata(client, NULL);
        return 0;
 }
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 71dd65aa31b..c2fcf28b4c7 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -63,6 +63,7 @@ struct multipath {
        const char *hw_handler_name;
        struct work_struct activate_path;
+        struct pgpath *pgpath_to_activate;
        unsigned nr_priority_groups;
        struct list_head priority_groups;
        unsigned pg_init_required;      /* pg_init needs calling? */
@@ -146,6 +147,7 @@ static struct priority_group *alloc_priority_group(void)
 static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
 {
+        unsigned long flags;
        struct pgpath *pgpath, *tmp;
        struct multipath *m = ti->private;
@@ -154,6 +156,10 @@ static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
                if (m->hw_handler_name)
                        scsi_dh_detach(bdev_get_queue(pgpath->path.dev->bdev));
                dm_put_device(ti, pgpath->path.dev);
+                spin_lock_irqsave(&m->lock, flags);
+                if (m->pgpath_to_activate == pgpath)
+                        m->pgpath_to_activate = NULL;
+                spin_unlock_irqrestore(&m->lock, flags);
                free_pgpath(pgpath);
        }
 }
@@ -421,6 +427,7 @@ static void process_queued_ios(struct work_struct *work)
                __choose_pgpath(m);
        pgpath = m->current_pgpath;
+        m->pgpath_to_activate = m->current_pgpath;
        if ((pgpath && !m->queue_io) ||
            (!pgpath && !m->queue_if_no_path))
@@ -1093,8 +1100,15 @@ static void activate_path(struct work_struct *work)
        int ret;
        struct multipath *m =
                container_of(work, struct multipath, activate_path);
-        struct dm_path *path = &m->current_pgpath->path;
+        struct dm_path *path;
+        unsigned long flags;
+        spin_lock_irqsave(&m->lock, flags);
+        path = &m->pgpath_to_activate->path;
+        m->pgpath_to_activate = NULL;
+        spin_unlock_irqrestore(&m->lock, flags);
+        if (!path)
+                return;
        ret = scsi_dh_activate(bdev_get_queue(path->dev->bdev));
        pg_init_done(path, ret);
 }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index bca448e1187..ace998ce59f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -837,12 +837,14 @@ static int dm_merge_bvec(struct request_queue *q,
        struct dm_table *map = dm_get_table(md);
        struct dm_target *ti;
        sector_t max_sectors;
-        int max_size;
+        int max_size = 0;
        if (unlikely(!map))
-                return 0;
+                goto out;
        ti = dm_table_find_target(map, bvm->bi_sector);
+        if (!dm_target_is_valid(ti))
+                goto out_table;
        /*
         * Find maximum amount of I/O that won't need splitting
@@ -861,14 +863,16 @@ static int dm_merge_bvec(struct request_queue *q,
        if (max_size && ti->type->merge)
                max_size = ti->type->merge(ti, bvm, biovec, max_size);
+out_table:
+        dm_table_put(map);
+out:
        /*
         * Always allow an entire first page
         */
        if (max_size <= biovec->bv_len && !(bvm->bi_size >> SECTOR_SHIFT))
                max_size = biovec->bv_len;
-        dm_table_put(map);
        return max_size;
 }
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 216025cf5d4..2c5b6282b56 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -10,6 +10,7 @@
 #include "dvb_frontend.h"
 #define XC2028_DEFAULT_FIRMWARE "xc3028-v27.fw"
+#define XC3028L_DEFAULT_FIRMWARE "xc3028L-v36.fw"
 /*      Dmoduler                IF (kHz) */
 #define XC3028_FE_DEFAULT       0               /* Don't load SCODE */
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index 4eed783f4bc..a127a4175c4 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -491,6 +491,7 @@ static struct s5h1420_config skystar2_rev2_7_s5h1420_config = {
        .demod_address = 0x53,
        .invert = 1,
        .repeated_start_workaround = 1,
+        .serial_mpeg = 1,
 };
 static struct itd1000_config skystar2_rev2_7_itd1000_config = {
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 069d847ba88..0c733c66a44 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -364,15 +364,16 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                                       enum dmx_success success)
 {
        struct dmxdev_filter *dmxdevfilter = filter->priv;
+        unsigned long flags;
        int ret;
        if (dmxdevfilter->buffer.error) {
                wake_up(&dmxdevfilter->buffer.queue);
                return 0;
        }
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
        if (dmxdevfilter->state != DMXDEV_STATE_GO) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                return 0;
        }
        del_timer(&dmxdevfilter->timer);
@@ -391,7 +392,7 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
        }
        if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
                dmxdevfilter->state = DMXDEV_STATE_DONE;
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
        wake_up(&dmxdevfilter->buffer.queue);
        return 0;
 }
@@ -403,11 +404,12 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
 {
        struct dmxdev_filter *dmxdevfilter = feed->priv;
        struct dvb_ringbuffer *buffer;
+        unsigned long flags;
        int ret;
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
        if (dmxdevfilter->params.pes.output == DMX_OUT_DECODER) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                return 0;
        }
@@ -417,7 +419,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
        else
                buffer = &dmxdevfilter->dev->dvr_buffer;
        if (buffer->error) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                wake_up(&buffer->queue);
                return 0;
        }
@@ -428,7 +430,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                dvb_ringbuffer_flush(buffer);
                buffer->error = ret;
        }
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
        wake_up(&buffer->queue);
        return 0;
 }
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index e2eca0b1fe7..a2c1fd5d2f6 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -399,7 +399,9 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                              size_t count)
 {
-        spin_lock(&demux->lock);
+        unsigned long flags;
+        spin_lock_irqsave(&demux->lock, flags);
        while (count--) {
                if (buf[0] == 0x47)
@@ -407,16 +409,17 @@ void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                buf += 188;
        }
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);
 void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
        int p = 0, i, j;
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -449,17 +452,18 @@ void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter);
 void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
        int p = 0, i, j;
        u8 tmppack[188];
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -500,7 +504,7 @@ void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_204);
diff --git a/drivers/media/dvb/frontends/s5h1420.c b/drivers/media/dvb/frontends/s5h1420.c
index 747d3fa2e5e..2e9fd2893ed 100644
--- a/drivers/media/dvb/frontends/s5h1420.c
+++ b/drivers/media/dvb/frontends/s5h1420.c
@@ -59,7 +59,7 @@ struct s5h1420_state {
         * it does not support repeated-start, workaround: write addr-1
         * and then read
         */
-        u8 shadow[255];
+        u8 shadow[256];
 };
 static u32 s5h1420_getsymbolrate(struct s5h1420_state* state);
@@ -94,8 +94,11 @@ static u8 s5h1420_readreg(struct s5h1420_state *state, u8 reg)
                if (ret != 3)
                        return ret;
        } else {
-                ret = i2c_transfer(state->i2c, &msg[1], 2);
+                ret = i2c_transfer(state->i2c, &msg[1], 1);
-                if (ret != 2)
+                if (ret != 1)
+                        return ret;
+                ret = i2c_transfer(state->i2c, &msg[2], 1);
+                if (ret != 1)
                        return ret;
        }
@@ -823,7 +826,7 @@ static int s5h1420_init (struct dvb_frontend* fe)
        struct s5h1420_state* state = fe->demodulator_priv;
        /* disable power down and do reset */
-        state->CON_1_val = 0x10;
+        state->CON_1_val = state->config->serial_mpeg << 4;
        s5h1420_writereg(state, 0x02, state->CON_1_val);
        msleep(10);
        s5h1420_reset(state);
diff --git a/drivers/media/dvb/frontends/s5h1420.h b/drivers/media/dvb/frontends/s5h1420.h
index 4c913f142bc..ff308136d86 100644
--- a/drivers/media/dvb/frontends/s5h1420.h
+++ b/drivers/media/dvb/frontends/s5h1420.h
@@ -32,10 +32,12 @@ struct s5h1420_config
        u8 demod_address;
        /* does the inversion require inversion? */
-        u8 invert : 1;
+        u8 invert:1;
-        u8 repeated_start_workaround : 1;
+        u8 repeated_start_workaround:1;
-        u8 cdclk_polarity : 1; /* 1 == falling edge, 0 == raising edge */
+        u8 cdclk_polarity:1; /* 1 == falling edge, 0 == raising edge */
+        u8 serial_mpeg:1;
 };
 #if defined(CONFIG_DVB_S5H1420) || (defined(CONFIG_DVB_S5H1420_MODULE) && defined(MODULE))
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index cc5efb643f3..9da260fe3fd 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -40,6 +40,8 @@ struct usb_device_id smsusb_id_table[] = {
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_OKEMO_B },
        { USB_DEVICE(0x2040, 0x5500),
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+        { USB_DEVICE(0x2040, 0x5510),
+                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
        { USB_DEVICE(0x2040, 0x5580),
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
        { USB_DEVICE(0x2040, 0x5590),
@@ -87,7 +89,7 @@ static struct sms_board sms_boards[] = {
                .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-nova-b-dvbt-01.fw",
        },
        [SMS1XXX_BOARD_HAUPPAUGE_WINDHAM] = {
-                .name   = "Hauppauge WinTV-Nova-T-MiniStick",
+                .name   = "Hauppauge WinTV MiniStick",
                .type   = SMS_NOVA_B0,
                .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-hcw-55xxx-dvbt-01.fw",
        },
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 6ae4cc860ef..933eaef41ea 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3431,7 +3431,7 @@ static int radio_open(struct inode *inode, struct file *file)
        dprintk("bttv: open minor=%d\n",minor);
        for (i = 0; i < bttv_num; i++) {
-                if (bttvs[i].radio_dev->minor == minor) {
+                if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
                        btv = &bttvs[i];
                        break;
                }
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index c149b7d712e..5405c30dbb0 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
 #include <linux/pci.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
diff --git a/drivers/media/video/cpia2/cpia2_usb.c b/drivers/media/video/cpia2/cpia2_usb.c
index a4574740350..a8a199047cb 100644
--- a/drivers/media/video/cpia2/cpia2_usb.c
+++ b/drivers/media/video/cpia2/cpia2_usb.c
@@ -632,7 +632,7 @@ int cpia2_usb_transfer_cmd(struct camera_data *cam,
 static int submit_urbs(struct camera_data *cam)
 {
        struct urb *urb;
-        int fx, err, i;
+        int fx, err, i, j;
        for(i=0; i<NUM_SBUF; ++i) {
                if (cam->sbuf[i].data)
@@ -657,6 +657,9 @@ static int submit_urbs(struct camera_data *cam)
                }
                urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                if (!urb) {
+                        ERR("%s: usb_alloc_urb error!\n", __func__);
+                        for (j = 0; j < i; j++)
+                                usb_free_urb(cam->sbuf[j].urb);
                        return -ENOMEM;
                }
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 8fe5f38c4d7..3cb9734ec07 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -163,7 +163,7 @@ static const struct cx18_card cx18_card_h900 = {
        },
        .audio_inputs = {
                { CX18_CARD_INPUT_AUD_TUNER,
-                  CX18_AV_AUDIO8, 0 },
+                  CX18_AV_AUDIO5, 0 },
                { CX18_CARD_INPUT_LINE_IN1,
                  CX18_AV_AUDIO_SERIAL1, 0 },
        },
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 3c006103c1e..ac3292d7646 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -117,10 +117,10 @@ static void em28xx_audio_isocirq(struct urb *urb)
                        if (oldptr + length >= runtime->buffer_size) {
                                unsigned int cnt =
-                                    runtime->buffer_size - oldptr - 1;
+                                    runtime->buffer_size - oldptr;
                                memcpy(runtime->dma_area + oldptr * stride, cp,
                                       cnt * stride);
-                                memcpy(runtime->dma_area, cp + cnt,
+                                memcpy(runtime->dma_area, cp + cnt * stride,
                                       length * stride - cnt * stride);
                        } else {
                                memcpy(runtime->dma_area + oldptr * stride, cp,
@@ -161,8 +161,14 @@ static int em28xx_init_audio_isoc(struct em28xx *dev)
                memset(dev->adev->transfer_buffer[i], 0x80, sb_size);
                urb = usb_alloc_urb(EM28XX_NUM_AUDIO_PACKETS, GFP_ATOMIC);
-                if (!urb)
+                if (!urb) {
+                        em28xx_errdev("usb_alloc_urb failed!\n");
+                        for (j = 0; j < i; j++) {
+                                usb_free_urb(dev->adev->urb[j]);
+                                kfree(dev->adev->transfer_buffer[j]);
+                        }
                        return -ENOMEM;
+                }
                urb->dev = dev->udev;
                urb->context = dev;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 452da70e719..de943cf6c16 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -93,28 +93,6 @@ struct em28xx_board em28xx_boards[] = {
                        .amux     = 0,
                } },
        },
-        [EM2800_BOARD_KWORLD_USB2800] = {
-                .name         = "Kworld USB2800",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .is_em2800    = 1,
-                .vchannels    = 3,
-                .tuner_type   = TUNER_PHILIPS_FCV1236D,
-                .tda9887_conf = TDA9887_PRESENT,
-                .decoder      = EM28XX_SAA7113,
-                .input          = { {
-                        .type     = EM28XX_VMUX_TELEVISION,
-                        .vmux     = SAA7115_COMPOSITE2,
-                        .amux     = 0,
-                }, {
-                        .type     = EM28XX_VMUX_COMPOSITE1,
-                        .vmux     = SAA7115_COMPOSITE0,
-                        .amux     = 1,
-                }, {
-                        .type     = EM28XX_VMUX_SVIDEO,
-                        .vmux     = SAA7115_SVIDEO3,
-                        .amux     = 1,
-                } },
-        },
        [EM2820_BOARD_KWORLD_PVRTV2800RF] = {
                .name         = "Kworld PVR TV 2800 RF",
                .is_em2800    = 0,
@@ -599,7 +577,7 @@ struct em28xx_board em28xx_boards[] = {
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
+                        .amux     = 3,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
@@ -952,22 +930,23 @@ struct em28xx_board em28xx_boards[] = {
        },
        [EM2880_BOARD_KWORLD_DVB_310U] = {
                .name         = "KWorld DVB-T 310U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                .vchannels    = 3,
                .tuner_type   = TUNER_XC2028,
+                .has_dvb      = 1,
+                .mts_firmware = 1,
                .decoder      = EM28XX_TVP5150,
                .input          = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
-                        .amux     = 0,
+                        .amux     = EM28XX_AMUX_VIDEO,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
-                }, {
+                }, {    /* S-video has not been tested yet */
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
-                        .amux     = 1,
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
                } },
        },
        [EM2881_BOARD_DNT_DA2_HYBRID] = {
@@ -1282,6 +1261,7 @@ static struct em28xx_reg_seq em2882_terratec_hybrid_xs_digital[] = {
 static struct em28xx_hash_table em28xx_eeprom_hash [] = {
        /* P/N: SA 60002070465 Tuner: TVF7533-MF */
        {0x6ce05a8f, EM2820_BOARD_PROLINK_PLAYTV_USB2, TUNER_YMEC_TVF_5533MF},
+        {0x966a0441, EM2880_BOARD_KWORLD_DVB_310U, TUNER_XC2028},
 };
 /* I2C devicelist hash table for devices with generic USB IDs */
@@ -1552,9 +1532,12 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                /* djh - Not sure which demod we need here */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
+        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
+                ctl->demod = XC3028_FE_DEFAULT;
+                ctl->fname = XC3028L_DEFAULT_FIRMWARE;
+                break;
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
        case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                /* FIXME: Better to specify the needed IF */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
@@ -1764,6 +1747,20 @@ void em28xx_card_setup(struct em28xx *dev)
                break;
        case EM2820_BOARD_UNKNOWN:
        case EM2800_BOARD_UNKNOWN:
+                /*
+                 * The K-WORLD DVB-T 310U is detected as an MSI Digivox AD.
+                 *
+                 * This occurs because they share identical USB vendor and
+                 * product IDs.
+                 *
+                 * What we do here is look up the EEPROM hash of the K-WORLD
+                 * and if it is found then we decide that we do not have
+                 * a DIGIVOX and reset the device to the K-WORLD instead.
+                 *
+                 * This solution is only valid if they do not share eeprom
+                 * hash identities which has not been determined as yet.
+                 */
+        case EM2880_BOARD_MSI_DIGIVOX_AD:
                if (!em28xx_hint_board(dev))
                        em28xx_set_model(dev);
                break;
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 4b992bc0083..d2b1a1a5268 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -452,6 +452,15 @@ static int dvb_init(struct em28xx *dev)
                        goto out_free;
                }
                break;
+        case EM2880_BOARD_KWORLD_DVB_310U:
+                dvb->frontend = dvb_attach(zl10353_attach,
+                                                &em28xx_zl10353_with_xc3028,
+                                                &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
        default:
                printk(KERN_ERR "%s/2: The frontend of your DVB/ATSC card"
                                " isn't supported yet\n",
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 7be69284da0..ac95c55887d 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -459,6 +459,7 @@ static int create_urbs(struct gspca_dev *gspca_dev,
                urb = usb_alloc_urb(npkt, GFP_KERNEL);
                if (!urb) {
                        err("usb_alloc_urb failed");
+                        destroy_urbs(gspca_dev);
                        return -ENOMEM;
                }
                urb->transfer_buffer = usb_buffer_alloc(gspca_dev->dev,
@@ -468,8 +469,8 @@ static int create_urbs(struct gspca_dev *gspca_dev,
                if (urb->transfer_buffer == NULL) {
                        usb_free_urb(urb);
-                        destroy_urbs(gspca_dev);
                        err("usb_buffer_urb failed");
+                        destroy_urbs(gspca_dev);
                        return -ENOMEM;
                }
                gspca_dev->urb[n] = urb;
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index d4be5184328..ba865b7f1ed 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -1063,6 +1063,7 @@ static __devinitdata struct usb_device_id device_table[] = {
        {USB_DEVICE(0x093a, 0x2621), .driver_info = SENSOR_PAC7302},
        {USB_DEVICE(0x093a, 0x2624), .driver_info = SENSOR_PAC7302},
        {USB_DEVICE(0x093a, 0x2626), .driver_info = SENSOR_PAC7302},
+        {USB_DEVICE(0x093a, 0x262a), .driver_info = SENSOR_PAC7302},
        {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 5dd78c6766e..12b81ae526b 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -232,7 +232,7 @@ static struct ctrl sd_ctrls[] = {
 static struct v4l2_pix_format vga_mode[] = {
        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                .bytesperline = 160,
-                .sizeimage = 160 * 120 * 5 / 4,
+                .sizeimage = 160 * 120,
                .colorspace = V4L2_COLORSPACE_SRGB,
                .priv = 2 | MODE_RAW},
        {160, 120, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
@@ -264,7 +264,7 @@ static struct v4l2_pix_format sif_mode[] = {
                .priv = 1 | MODE_REDUCED_SIF},
        {176, 144, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                .bytesperline = 176,
-                .sizeimage = 176 * 144 * 5 / 4,
+                .sizeimage = 176 * 144,
                .colorspace = V4L2_COLORSPACE_SRGB,
                .priv = 1 | MODE_RAW},
        {176, 144, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index d75b1d20b31..572b0f363b6 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -707,6 +707,7 @@ static void i2c_w8(struct gspca_dev *gspca_dev,
                        0x08, 0,                /* value, index */
                        gspca_dev->usb_buf, 8,
                        500);
+        msleep(2);
 }
 /* read 5 bytes in gspca_dev->usb_buf */
@@ -976,13 +977,13 @@ static int sd_init(struct gspca_dev *gspca_dev)
        case BRIDGE_SN9C105:
                if (regF1 != 0x11)
                        return -ENODEV;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                break;
        case BRIDGE_SN9C120:
                if (regF1 != 0x12)
                        return -ENODEV;
                regGpio[1] = 0x70;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                break;
        default:
 /*      case BRIDGE_SN9C110: */
@@ -1183,7 +1184,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
        static const __u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
        static const __u8 CE[] = { 0x32, 0xdd, 0x2d, 0xdd };    /* MI0360 */
        static const __u8 CE_ov76xx[] =
-                        { 0x32, 0xdd, 0x32, 0xdd };     /* OV7630/48 */
+                                { 0x32, 0xdd, 0x32, 0xdd };
        sn9c1xx = sn_tb[(int) sd->sensor];
        configure_gpio(gspca_dev, sn9c1xx);
@@ -1223,8 +1224,15 @@ static void sd_start(struct gspca_dev *gspca_dev)
        reg_w(gspca_dev, 0x20, gamma_def, sizeof gamma_def);
        for (i = 0; i < 8; i++)
                reg_w(gspca_dev, 0x84, reg84, sizeof reg84);
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+                reg_w1(gspca_dev, 0x9a, 0x05);
+                break;
+        default:
                reg_w1(gspca_dev, 0x9a, 0x08);
                reg_w1(gspca_dev, 0x99, 0x59);
+                break;
+        }
        mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
        if (mode)
@@ -1275,8 +1283,8 @@ static void sd_start(struct gspca_dev *gspca_dev)
 /*                      reg1 = 0x44; */
 /*                      reg1 = 0x46;    (done) */
                } else {
-                        reg17 = 0x22;   /* 640 MCKSIZE */
+                        reg17 = 0xa2;   /* 640 */
-                        reg1 = 0x06;
+                        reg1 = 0x44;
                }
                break;
        }
@@ -1285,6 +1293,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
        switch (sd->sensor) {
        case SENSOR_OV7630:
        case SENSOR_OV7648:
+        case SENSOR_OV7660:
                reg_w(gspca_dev, 0xce, CE_ov76xx, 4);
                break;
        default:
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index cfbc9ebc5c5..95fcfcb9e31 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -225,7 +225,7 @@ static int i2c_read(struct gspca_dev *gspca_dev, __u16 reg, __u8 mode)
        reg_w_val(gspca_dev->dev, 0x8802, (mode | 0x01));
        do {
                reg_r(gspca_dev, 0x8803, 1);
-                if (!gspca_dev->usb_buf)
+                if (!gspca_dev->usb_buf[0])
                        break;
        } while (--retry);
        if (retry == 0)
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 8d7c27e6ac7..d61ef727e0c 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -6576,8 +6576,8 @@ static int setlightfreq(struct gspca_dev *gspca_dev)
                 cs2102_60HZ, cs2102_60HZScale},
 /* SENSOR_CS2102K 1 */
                {cs2102_NoFliker, cs2102_NoFlikerScale,
-                 cs2102_50HZ, cs2102_50HZScale,
+                 NULL, NULL, /* currently disabled */
-                 cs2102_60HZ, cs2102_60HZScale},
+                 NULL, NULL},
 /* SENSOR_GC0305 2 */
                {gc0305_NoFliker, gc0305_NoFliker,
                 gc0305_50HZ, gc0305_50HZ,
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index 3d3c48db45d..c6852402c5e 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -3591,7 +3591,7 @@ static int
 ov51x_init_isoc(struct usb_ov511 *ov)
 {
        struct urb *urb;
-        int fx, err, n, size;
+        int fx, err, n, i, size;
        PDEBUG(3, "*** Initializing capture ***");
@@ -3662,6 +3662,8 @@ ov51x_init_isoc(struct usb_ov511 *ov)
                urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                if (!urb) {
                        err("init isoc: usb_alloc_urb ret. NULL");
+                        for (i = 0; i < n; i++)
+                                usb_free_urb(ov->sbuf[i].urb);
                        return -ENOMEM;
                }
                ov->sbuf[n].urb = urb;
@@ -5651,7 +5653,7 @@ static ssize_t show_exposure(struct device *cd,
        if (!ov->dev)
                return -ENODEV;
        sensor_get_exposure(ov, &exp);
-        return sprintf(buf, "%d\n", exp >> 8);
+        return sprintf(buf, "%d\n", exp);
 }
 static DEVICE_ATTR(exposure, S_IRUGO, show_exposure, NULL);
diff --git a/drivers/media/video/pvrusb2/pvrusb2-devattr.c b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
index 88e17516843..cbe2a341785 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
@@ -489,6 +489,8 @@ static const struct pvr2_device_desc pvr2_device_751xx = {
 struct usb_device_id pvr2_device_table[] = {
        { USB_DEVICE(0x2040, 0x2900),
          .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
+        { USB_DEVICE(0x2040, 0x2950), /* Logically identical to 2900 */
+          .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
        { USB_DEVICE(0x2040, 0x2400),
          .driver_info = (kernel_ulong_t)&pvr2_device_24xxx},
        { USB_DEVICE(0x1164, 0x0622),
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index b1d09d8e2b8..92b83feae36 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -669,7 +669,7 @@ static void s2255_fillbuff(struct s2255_dev *dev, struct s2255_buffer *buf,
                (unsigned long)vbuf, pos);
        /* tell v4l buffer was filled */
-        buf->vb.field_count++;
+        buf->vb.field_count = dev->frame_count[chn] * 2;
        do_gettimeofday(&ts);
        buf->vb.ts = ts;
        buf->vb.state = VIDEOBUF_DONE;
@@ -1268,6 +1268,7 @@ static int vidioc_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
        dev->last_frame[chn] = -1;
        dev->bad_payload[chn] = 0;
        dev->cur_frame[chn] = 0;
+        dev->frame_count[chn] = 0;
        for (j = 0; j < SYS_FRAMES; j++) {
                dev->buffer[chn].frame[j].ulState = 0;
                dev->buffer[chn].frame[j].cur_size = 0;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 6ef3e5297de..feab12aa2c7 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video_device *video,
        if (ctrl == NULL)
                return -EINVAL;
-        data = kmalloc(8, GFP_KERNEL);
+        data = kmalloc(ctrl->info->size, GFP_KERNEL);
        if (data == NULL)
                return -ENOMEM;
diff --git a/drivers/media/video/w9968cf.c b/drivers/media/video/w9968cf.c
index 168baabe465..11edf79f57b 100644
--- a/drivers/media/video/w9968cf.c
+++ b/drivers/media/video/w9968cf.c
@@ -911,7 +911,6 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
        for (i = 0; i < W9968CF_URBS; i++) {
                urb = usb_alloc_urb(W9968CF_ISO_PACKETS, GFP_KERNEL);
-                cam->urb[i] = urb;
                if (!urb) {
                        for (j = 0; j < i; j++)
                                usb_free_urb(cam->urb[j]);
@@ -919,6 +918,7 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
                        return -ENOMEM;
                }
+                cam->urb[i] = urb;
                urb->dev = udev;
                urb->context = (void*)cam;
                urb->pipe = usb_rcvisocpipe(udev, 1);
diff --git a/drivers/media/video/wm8739.c b/drivers/media/video/wm8739.c
index 95c79ad8048..54ac3fe26ec 100644
--- a/drivers/media/video/wm8739.c
+++ b/drivers/media/video/wm8739.c
@@ -274,10 +274,8 @@ static int wm8739_probe(struct i2c_client *client,
                        client->addr << 1, client->adapter->name);
        state = kmalloc(sizeof(struct wm8739_state), GFP_KERNEL);
-        if (state == NULL) {
+        if (state == NULL)
-                kfree(client);
                return -ENOMEM;
-        }
        state->vol_l = 0x17; /* 0dB */
        state->vol_r = 0x17; /* 0dB */
        state->muted = 0;
diff --git a/drivers/media/video/zoran_card.c b/drivers/media/video/zoran_card.c
index d842a7cb99d..3282be73029 100644
--- a/drivers/media/video/zoran_card.c
+++ b/drivers/media/video/zoran_card.c
@@ -988,7 +988,7 @@ zoran_open_init_params (struct zoran *zr)
        zr->v4l_grab_seq = 0;
        zr->v4l_settings.width = 192;
        zr->v4l_settings.height = 144;
-        zr->v4l_settings.format = &zoran_formats[4];    /* YUY2 - YUV-4:2:2 packed */
+        zr->v4l_settings.format = &zoran_formats[7];    /* YUY2 - YUV-4:2:2 packed */
        zr->v4l_settings.bytesperline =
            zr->v4l_settings.width *
            ((zr->v4l_settings.format->depth + 7) / 8);
diff --git a/drivers/media/video/zoran_driver.c b/drivers/media/video/zoran_driver.c
index ec6f59674b1..2dab9eea4de 100644
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -134,7 +134,7 @@ const struct zoran_format zoran_formats[] = {
        }, {
                .name = "16-bit RGB BE",
                ZFMT(-1,
-                     V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
+                     V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
                .depth = 16,
                .flags = ZORAN_FORMAT_CAPTURE |
                         ZORAN_FORMAT_OVERLAY,
@@ -2737,7 +2737,8 @@ zoran_do_ioctl (struct inode *inode,
                                    fh->v4l_settings.format->fourcc;
                                fmt->fmt.pix.colorspace =
                                    fh->v4l_settings.format->colorspace;
-                                fmt->fmt.pix.bytesperline = 0;
+                                fmt->fmt.pix.bytesperline =
+                                    fh->v4l_settings.bytesperline;
                                if (BUZ_MAX_HEIGHT <
                                    (fh->v4l_settings.height * 2))
                                        fmt->fmt.pix.field =
@@ -2833,13 +2834,6 @@ zoran_do_ioctl (struct inode *inode,
                                fmt->fmt.pix.pixelformat,
                                (char *) &printformat);
-                        if (fmt->fmt.pix.bytesperline > 0) {
-                                dprintk(5,
-                                        KERN_ERR "%s: bpl not supported\n",
-                                        ZR_DEVNAME(zr));
-                                return -EINVAL;
-                        }
                        /* we can be requested to do JPEG/raw playback/capture */
                        if (!
                            (fmt->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ||
@@ -2923,6 +2917,7 @@ zoran_do_ioctl (struct inode *inode,
                                fh->jpg_buffers.buffer_size =
                                    zoran_v4l2_calc_bufsize(&fh->
                                                            jpg_settings);
+                                fmt->fmt.pix.bytesperline = 0;
                                fmt->fmt.pix.sizeimage =
                                    fh->jpg_buffers.buffer_size;
@@ -2979,6 +2974,8 @@ zoran_do_ioctl (struct inode *inode,
                                /* tell the user the
                                 * results/missing stuff */
+                                fmt->fmt.pix.bytesperline =
+                                        fh->v4l_settings.bytesperline;
                                fmt->fmt.pix.sizeimage =
                                        fh->v4l_settings.height *
                                        fh->v4l_settings.bytesperline;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 10c44d3fe01..68dc8d9eb24 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -21,7 +21,7 @@ config MFD_SM501
 config MFD_SM501_GPIO
        bool "Export GPIO via GPIO layer"
-        depends on MFD_SM501 && HAVE_GPIO_LIB
+        depends on MFD_SM501 && GPIOLIB
         ---help---
         This option uses the gpio library layer to export the 64 GPIO
         lines on the SM501. The platform data is used to supply the
@@ -29,7 +29,7 @@ config MFD_SM501_GPIO
 config MFD_ASIC3
        bool "Support for Compaq ASIC3"
-        depends on GENERIC_HARDIRQS && HAVE_GPIO_LIB && ARM
+        depends on GENERIC_HARDIRQS && GPIOLIB && ARM
         ---help---
          This driver supports the ASIC3 multifunction chip found on many
          PDAs (mainly iPAQ and HTC based ones)
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index bc2a807f210..ba5aa200827 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -312,7 +312,6 @@ static int __init asic3_irq_probe(struct platform_device *pdev)
        struct asic3 *asic = platform_get_drvdata(pdev);
        unsigned long clksel = 0;
        unsigned int irq, irq_base;
-        int map_size;
        int ret;
        ret = platform_get_irq(pdev, 0);
@@ -534,6 +533,7 @@ static int __init asic3_probe(struct platform_device *pdev)
        struct asic3 *asic;
        struct resource *mem;
        unsigned long clksel;
+        int map_size;
        int ret = 0;
        asic = kzalloc(sizeof(struct asic3), GFP_KERNEL);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 917035e16da..00008967ef7 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -426,8 +426,6 @@ static u32 atmci_submit_data(struct mmc_host *mmc, struct mmc_data *data)
        host->sg = NULL;
        host->data = data;
-        mci_writel(host, BLKR, MCI_BCNT(data->blocks)
-                        | MCI_BLKLEN(data->blksz));
        dev_vdbg(&mmc->class_dev, "BLKR=0x%08x\n",
                        MCI_BCNT(data->blocks) | MCI_BLKLEN(data->blksz));
@@ -483,6 +481,10 @@ static void atmci_request(struct mmc_host *mmc, struct mmc_request *mrq)
                if (data->blocks > 1 && data->blksz & 3)
                        goto fail;
                atmci_set_timeout(host, data);
+                /* Must set block count/size before sending command */
+                mci_writel(host, BLKR, MCI_BCNT(data->blocks)
+                                | MCI_BLKLEN(data->blksz));
        }
        iflags = MCI_CMDRDY;
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index ac4e506b4f8..5ea6b60fa37 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -257,7 +257,6 @@ struct e1000_adapter {
        struct net_device *netdev;
        struct pci_dev *pdev;
        struct net_device_stats net_stats;
-        spinlock_t stats_lock;      /* prevent concurrent stats updates */
        /* structs defined in e1000_hw.h */
        struct e1000_hw hw;
@@ -284,6 +283,8 @@ struct e1000_adapter {
        unsigned long led_status;
        unsigned int flags;
+        struct work_struct downshift_task;
+        struct work_struct update_phy_task;
 };
 struct e1000_info {
@@ -305,6 +306,7 @@ struct e1000_info {
 #define FLAG_HAS_CTRLEXT_ON_LOAD          (1 << 5)
 #define FLAG_HAS_SWSM_ON_LOAD             (1 << 6)
 #define FLAG_HAS_JUMBO_FRAMES             (1 << 7)
+#define FLAG_READ_ONLY_NVM                (1 << 8)
 #define FLAG_IS_ICH                       (1 << 9)
 #define FLAG_HAS_SMART_POWER_DOWN         (1 << 11)
 #define FLAG_IS_QUAD_PORT_A               (1 << 12)
@@ -385,6 +387,7 @@ extern bool e1000e_enable_mng_pass_thru(struct e1000_hw *hw);
 extern bool e1000e_get_laa_state_82571(struct e1000_hw *hw);
 extern void e1000e_set_laa_state_82571(struct e1000_hw *hw, bool state);
+extern void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw);
 extern void e1000e_set_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw,
                                                 bool state);
 extern void e1000e_igp3_phy_powerdown_workaround_ich8lan(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index e21c9e0f373..33a3ff17b5d 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -432,6 +432,10 @@ static void e1000_get_regs(struct net_device *netdev,
        regs_buff[11] = er32(TIDV);
        regs_buff[12] = adapter->hw.phy.type;  /* PHY type (IGP=1, M88=0) */
+        /* ethtool doesn't use anything past this point, so all this
+         * code is likely legacy junk for apps that may or may not
+         * exist */
        if (hw->phy.type == e1000_phy_m88) {
                e1e_rphy(hw, M88E1000_PHY_SPEC_STATUS, &phy_data);
                regs_buff[13] = (u32)phy_data; /* cable length */
@@ -447,7 +451,7 @@ static void e1000_get_regs(struct net_device *netdev,
                regs_buff[22] = adapter->phy_stats.receive_errors;
                regs_buff[23] = regs_buff[13]; /* mdix mode */
        }
-        regs_buff[21] = adapter->phy_stats.idle_errors;  /* phy idle errors */
+        regs_buff[21] = 0; /* was idle_errors */
        e1e_rphy(hw, PHY_1000T_STATUS, &phy_data);
        regs_buff[24] = (u32)phy_data;  /* phy local receiver status */
        regs_buff[25] = regs_buff[24];  /* phy remote receiver status */
@@ -529,6 +533,9 @@ static int e1000_set_eeprom(struct net_device *netdev,
        if (eeprom->magic != (adapter->pdev->vendor | (adapter->pdev->device << 16)))
                return -EFAULT;
+        if (adapter->flags & FLAG_READ_ONLY_NVM)
+                return -EINVAL;
        max_len = hw->nvm.word_size * 2;
        first_word = eeprom->offset >> 1;
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 9e38452a738..bcd2bc477af 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -58,6 +58,7 @@
 #define ICH_FLASH_HSFCTL                0x0006
 #define ICH_FLASH_FADDR                 0x0008
 #define ICH_FLASH_FDATA0                0x0010
+#define ICH_FLASH_PR0                   0x0074
 #define ICH_FLASH_READ_COMMAND_TIMEOUT  500
 #define ICH_FLASH_WRITE_COMMAND_TIMEOUT 500
@@ -150,6 +151,19 @@ union ich8_hws_flash_regacc {
        u16 regval;
 };
+/* ICH Flash Protected Region */
+union ich8_flash_protected_range {
+        struct ich8_pr {
+                u32 base:13;     /* 0:12 Protected Range Base */
+                u32 reserved1:2; /* 13:14 Reserved */
+                u32 rpe:1;       /* 15 Read Protection Enable */
+                u32 limit:13;    /* 16:28 Protected Range Limit */
+                u32 reserved2:2; /* 29:30 Reserved */
+                u32 wpe:1;       /* 31 Write Protection Enable */
+        } range;
+        u32 regval;
+};
 static s32 e1000_setup_link_ich8lan(struct e1000_hw *hw);
 static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw);
 static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw);
@@ -366,6 +380,9 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
        return 0;
 }
+static DEFINE_MUTEX(nvm_mutex);
+static pid_t nvm_owner = -1;
 /**
 *  e1000_acquire_swflag_ich8lan - Acquire software control flag
 *  @hw: pointer to the HW structure
@@ -379,6 +396,15 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        u32 extcnf_ctrl;
        u32 timeout = PHY_CFG_TIMEOUT;
+        might_sleep();
+        if (!mutex_trylock(&nvm_mutex)) {
+                WARN(1, KERN_ERR "e1000e mutex contention. Owned by pid %d\n",
+                     nvm_owner);
+                mutex_lock(&nvm_mutex);
+        }
+        nvm_owner = current->pid;
        while (timeout) {
                extcnf_ctrl = er32(EXTCNF_CTRL);
                extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
@@ -393,6 +419,8 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        if (!timeout) {
                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                nvm_owner = -1;
+                mutex_unlock(&nvm_mutex);
                return -E1000_ERR_CONFIG;
        }
@@ -414,6 +442,9 @@ static void e1000_release_swflag_ich8lan(struct e1000_hw *hw)
        extcnf_ctrl = er32(EXTCNF_CTRL);
        extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        nvm_owner = -1;
+        mutex_unlock(&nvm_mutex);
 }
 /**
@@ -1284,6 +1315,7 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
         * programming failed.
         */
        if (ret_val) {
+                /* Possibly read-only, see e1000e_write_protect_nvm_ich8lan() */
                hw_dbg(hw, "Flash commit failed.\n");
                e1000_release_swflag_ich8lan(hw);
                return ret_val;
@@ -1374,6 +1406,49 @@ static s32 e1000_validate_nvm_checksum_ich8lan(struct e1000_hw *hw)
 }
 /**
+ *  e1000e_write_protect_nvm_ich8lan - Make the NVM read-only
+ *  @hw: pointer to the HW structure
+ *
+ *  To prevent malicious write/erase of the NVM, set it to be read-only
+ *  so that the hardware ignores all write/erase cycles of the NVM via
+ *  the flash control registers.  The shadow-ram copy of the NVM will
+ *  still be updated, however any updates to this copy will not stick
+ *  across driver reloads.
+ **/
+void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw)
+{
+        union ich8_flash_protected_range pr0;
+        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg;
+        s32 ret_val;
+        ret_val = e1000_acquire_swflag_ich8lan(hw);
+        if (ret_val)
+                return;
+        gfpreg = er32flash(ICH_FLASH_GFPREG);
+        /* Write-protect GbE Sector of NVM */
+        pr0.regval = er32flash(ICH_FLASH_PR0);
+        pr0.range.base = gfpreg & FLASH_GFPREG_BASE_MASK;
+        pr0.range.limit = ((gfpreg >> 16) & FLASH_GFPREG_BASE_MASK);
+        pr0.range.wpe = true;
+        ew32flash(ICH_FLASH_PR0, pr0.regval);
+        /*
+         * Lock down a subset of GbE Flash Control Registers, e.g.
+         * PR0 to prevent the write-protection from being lifted.
+         * Once FLOCKDN is set, the registers protected by it cannot
+         * be written until FLOCKDN is cleared by a hardware reset.
+         */
+        hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
+        hsfsts.hsf_status.flockdn = true;
+        ew32flash(ICH_FLASH_HSFSTS, hsfsts.regval);
+        e1000_release_swflag_ich8lan(hw);
+}
+/**
 *  e1000_write_flash_data_ich8lan - Writes bytes to the NVM
 *  @hw: pointer to the HW structure
 *  @offset: The offset (in bytes) of the byte/word to read.
@@ -1720,6 +1795,9 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
        ew32(CTRL, (ctrl | E1000_CTRL_RST));
        msleep(20);
+        /* release the swflag because it is not reset by hardware reset */
+        e1000_release_swflag_ich8lan(hw);
        ret_val = e1000e_get_auto_rd_done(hw);
        if (ret_val) {
                /*
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index d266510c8a9..b81c4237b5d 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -47,7 +47,7 @@
 #include "e1000.h"
-#define DRV_VERSION "0.3.3.3-k2"
+#define DRV_VERSION "0.3.3.3-k6"
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
@@ -1115,6 +1115,14 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
        writel(0, adapter->hw.hw_addr + rx_ring->tail);
 }
+static void e1000e_downshift_workaround(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, downshift_task);
+        e1000e_gig_downshift_workaround_ich8lan(&adapter->hw);
+}
 /**
 * e1000_intr_msi - Interrupt Handler
 * @irq: interrupt number
@@ -1139,7 +1147,7 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                 */
                if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                    (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
                /*
                 * 80003ES2LAN workaround-- For packet buffer work-around on
@@ -1205,7 +1213,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
                 */
                if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                    (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
                /*
                 * 80003ES2LAN workaround--
@@ -2592,8 +2600,6 @@ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
        /* Explicitly disable IRQ since the NIC can be in any state. */
        e1000_irq_disable(adapter);
-        spin_lock_init(&adapter->stats_lock);
        set_bit(__E1000_DOWN, &adapter->state);
        return 0;
@@ -2912,6 +2918,21 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
        return 0;
 }
+/**
+ * e1000e_update_phy_task - work thread to update phy
+ * @work: pointer to our work struct
+ *
+ * this worker thread exists because we must acquire a
+ * semaphore to read the phy, which we could msleep while
+ * waiting for it, and we can't msleep in a timer.
+ **/
+static void e1000e_update_phy_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, update_phy_task);
+        e1000_get_phy_info(&adapter->hw);
+}
 /*
 * Need to wait a few seconds after link up to get diagnostic information from
 * the phy
@@ -2919,7 +2940,7 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
 static void e1000_update_phy_info(unsigned long data)
 {
        struct e1000_adapter *adapter = (struct e1000_adapter *) data;
-        e1000_get_phy_info(&adapter->hw);
+        schedule_work(&adapter->update_phy_task);
 }
 /**
@@ -2930,10 +2951,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 {
        struct e1000_hw *hw = &adapter->hw;
        struct pci_dev *pdev = adapter->pdev;
-        unsigned long irq_flags;
-        u16 phy_tmp;
-#define PHY_IDLE_ERROR_COUNT_MASK 0x00FF
        /*
         * Prevent stats update while adapter is being reset, or if the pci
@@ -2944,14 +2961,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
        if (pci_channel_offline(pdev))
                return;
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
-        /*
-         * these counters are modified from e1000_adjust_tbi_stats,
-         * called from the interrupt context, so they must only
-         * be written while holding adapter->stats_lock
-         */
        adapter->stats.crcerrs += er32(CRCERRS);
        adapter->stats.gprc += er32(GPRC);
        adapter->stats.gorc += er32(GORCL);
@@ -3022,21 +3031,10 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
        /* Tx Dropped needs to be maintained elsewhere */
-        /* Phy Stats */
-        if (hw->phy.media_type == e1000_media_type_copper) {
-                if ((adapter->link_speed == SPEED_1000) &&
-                   (!e1e_rphy(hw, PHY_1000T_STATUS, &phy_tmp))) {
-                        phy_tmp &= PHY_IDLE_ERROR_COUNT_MASK;
-                        adapter->phy_stats.idle_errors += phy_tmp;
-                }
-        }
        /* Management Stats */
        adapter->stats.mgptc += er32(MGTPTC);
        adapter->stats.mgprc += er32(MGTPRC);
        adapter->stats.mgpdc += er32(MGTPDC);
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 /**
@@ -3048,10 +3046,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
        struct e1000_hw *hw = &adapter->hw;
        struct e1000_phy_regs *phy = &adapter->phy_regs;
        int ret_val;
-        unsigned long irq_flags;
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
        if ((er32(STATUS) & E1000_STATUS_LU) &&
            (adapter->hw.phy.media_type == e1000_media_type_copper)) {
@@ -3082,8 +3076,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
                phy->stat1000 = 0;
                phy->estatus = (ESTATUS_1000_TFULL | ESTATUS_1000_THALF);
        }
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 static void e1000_print_link_info(struct e1000_adapter *adapter)
@@ -4467,6 +4459,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        adapter->bd_number = cards_found++;
+        e1000e_check_options(adapter);
        /* setup adapter struct */
        err = e1000_sw_init(adapter);
        if (err)
@@ -4482,6 +4476,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        if (err)
                goto err_hw_init;
+        if ((adapter->flags & FLAG_IS_ICH) &&
+            (adapter->flags & FLAG_READ_ONLY_NVM))
+                e1000e_write_protect_nvm_ich8lan(&adapter->hw);
        hw->mac.ops.get_bus_info(&adapter->hw);
        adapter->hw.phy.autoneg_wait_to_complete = 0;
@@ -4572,8 +4570,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        INIT_WORK(&adapter->reset_task, e1000_reset_task);
        INIT_WORK(&adapter->watchdog_task, e1000_watchdog_task);
+        INIT_WORK(&adapter->downshift_task, e1000e_downshift_workaround);
-        e1000e_check_options(adapter);
+        INIT_WORK(&adapter->update_phy_task, e1000e_update_phy_task);
        /* Initialize link parameters. User can change them with ethtool */
        adapter->hw.mac.autoneg = 1;
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index ed912e023a7..d91dbf7ba43 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -133,6 +133,15 @@ E1000_PARAM(SmartPowerDownEnable, "Enable PHY smart power down");
 */
 E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
+/*
+ * Write Protect NVM
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+E1000_PARAM(WriteProtectNVM, "Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]");
 struct e1000_option {
        enum { enable_option, range_option, list_option } type;
        const char *name;
@@ -388,4 +397,25 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                                                       opt.def);
                }
        }
+        { /* Write-protect NVM */
+                const struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "Write-protect NVM",
+                        .err  = "defaulting to Enabled",
+                        .def  = OPTION_ENABLED
+                };
+                if (adapter->flags & FLAG_IS_ICH) {
+                        if (num_WriteProtectNVM > bd) {
+                                unsigned int write_protect_nvm = WriteProtectNVM[bd];
+                                e1000_validate_option(&write_protect_nvm, &opt,
+                                                      adapter);
+                                if (write_protect_nvm)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        } else {
+                                if (opt.def)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        }
+                }
+        }
 }
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 9c718583a23..77baff022f7 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/stat.h>
 #include <linux/topology.h>
@@ -484,6 +485,21 @@ pci_mmap_legacy_mem(struct kobject *kobj, struct bin_attribute *attr,
 #endif /* HAVE_PCI_LEGACY */
 #ifdef HAVE_PCI_MMAP
+static int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
+{
+        unsigned long nr, start, size;
+        nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        start = vma->vm_pgoff;
+        size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
+        if (start < size && size - start >= nr)
+                return 1;
+        WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
+                current->comm, start, start+nr, pci_name(pdev), resno, size);
+        return 0;
+}
 /**
 * pci_mmap_resource - map a PCI resource into user memory space
 * @kobj: kobject for mapping
@@ -510,6 +526,9 @@ pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
        if (i >= PCI_ROM_RESOURCE)
                return -ENODEV;
+        if (!pci_mmap_fits(pdev, i, vma))
+                return -EINVAL;
        /* pci_mmap_page_range() expects the same kind of entry as coming
         * from /proc/bus/pci/ which is a "user visible" value. If this is
         * different from the resource itself, arch will do necessary fixup.
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index f118252f3a9..52e2743b04e 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -422,6 +422,12 @@ done:
        return err;
 }
+static int rtc_dev_fasync(int fd, struct file *file, int on)
+{
+        struct rtc_device *rtc = file->private_data;
+        return fasync_helper(fd, file, on, &rtc->async_queue);
+}
 static int rtc_dev_release(struct inode *inode, struct file *file)
 {
        struct rtc_device *rtc = file->private_data;
@@ -434,16 +440,13 @@ static int rtc_dev_release(struct inode *inode, struct file *file)
        if (rtc->ops->release)
                rtc->ops->release(rtc->dev.parent);
+        if (file->f_flags & FASYNC)
+                rtc_dev_fasync(-1, file, 0);
        clear_bit_unlock(RTC_DEV_BUSY, &rtc->flags);
        return 0;
 }
-static int rtc_dev_fasync(int fd, struct file *file, int on)
-{
-        struct rtc_device *rtc = file->private_data;
-        return fasync_helper(fd, file, on, &rtc->async_queue);
-}
 static const struct file_operations rtc_dev_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 1679e2f91c9..a0b6b46e746 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -447,51 +447,36 @@ void qdio_print_subchannel_info(struct qdio_irq *irq_ptr,
 {
        char s[80];
-        sprintf(s, "%s sc:%x ", cdev->dev.bus_id, irq_ptr->schid.sch_no);
+        sprintf(s, "qdio: %s ", dev_name(&cdev->dev));
        switch (irq_ptr->qib.qfmt) {
        case QDIO_QETH_QFMT:
-                sprintf(s + strlen(s), "OSADE ");
+                sprintf(s + strlen(s), "OSA ");
                break;
        case QDIO_ZFCP_QFMT:
                sprintf(s + strlen(s), "ZFCP ");
                break;
        case QDIO_IQDIO_QFMT:
-                sprintf(s + strlen(s), "HiperSockets ");
+                sprintf(s + strlen(s), "HS ");
                break;
        }
-        sprintf(s + strlen(s), "using: ");
+        sprintf(s + strlen(s), "on SC %x using ", irq_ptr->schid.sch_no);
+        sprintf(s + strlen(s), "AI:%d ", is_thinint_irq(irq_ptr));
-        if (!is_thinint_irq(irq_ptr))
+        sprintf(s + strlen(s), "QEBSM:%d ", (irq_ptr->sch_token) ? 1 : 0);
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "PCI:%d ",
-        sprintf(s + strlen(s), "AdapterInterrupts ");
+                (irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED) ? 1 : 0);
-        if (!(irq_ptr->sch_token != 0))
+        sprintf(s + strlen(s), "TDD:%d ", css_general_characteristics.aif_tdd);
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "SIGA:");
-        sprintf(s + strlen(s), "QEBSM ");
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.input) ? "R" : " ");
-        if (!(irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED))
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.output) ? "W" : " ");
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.sync) ? "S" : " ");
-        sprintf(s + strlen(s), "OutboundPCI ");
+        sprintf(s + strlen(s), "%s",
-        if (!css_general_characteristics.aif_tdd)
+                (!irq_ptr->siga_flag.no_sync_ti) ? "A" : " ");
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "%s",
-        sprintf(s + strlen(s), "TDD\n");
+                (!irq_ptr->siga_flag.no_sync_out_ti) ? "O" : " ");
-        printk(KERN_INFO "qdio: %s", s);
+        sprintf(s + strlen(s), "%s",
+                (!irq_ptr->siga_flag.no_sync_out_pci) ? "P" : " ");
-        memset(s, 0, sizeof(s));
-        sprintf(s, "%s SIGA required: ", cdev->dev.bus_id);
-        if (irq_ptr->siga_flag.input)
-                sprintf(s + strlen(s), "Read ");
-        if (irq_ptr->siga_flag.output)
-                sprintf(s + strlen(s), "Write ");
-        if (irq_ptr->siga_flag.sync)
-                sprintf(s + strlen(s), "Sync ");
-        if (!irq_ptr->siga_flag.no_sync_ti)
-                sprintf(s + strlen(s), "SyncAI ");
-        if (!irq_ptr->siga_flag.no_sync_out_ti)
-                sprintf(s + strlen(s), "SyncOutAI ");
-        if (!irq_ptr->siga_flag.no_sync_out_pci)
-                sprintf(s + strlen(s), "SyncOutPCI");
        sprintf(s + strlen(s), "\n");
-        printk(KERN_INFO "qdio: %s", s);
+        printk(KERN_INFO "%s", s);
 }
 int __init qdio_setup_init(void)
diff --git a/drivers/spi/orion_spi.c b/drivers/spi/orion_spi.c
index c4eaacd6e55..b872bfaf4bd 100644
--- a/drivers/spi/orion_spi.c
+++ b/drivers/spi/orion_spi.c
@@ -427,7 +427,7 @@ static int orion_spi_transfer(struct spi_device *spi, struct spi_message *m)
                        goto msg_rejected;
                }
-                if (t->speed_hz < orion_spi->min_speed) {
+                if (t->speed_hz && t->speed_hz < orion_spi->min_speed) {
                        dev_err(&spi->dev,
                                "message rejected : "
                                "device min speed (%d Hz) exceeds "
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 0e53354c1cf..d47d3636227 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -49,7 +49,7 @@ MODULE_ALIAS("platform:pxa2xx-spi");
 #define DMA_INT_MASK            (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
 #define RESET_DMA_CHANNEL       (DCSR_NODESC | DMA_INT_MASK)
-#define IS_DMA_ALIGNED(x)       (((x) & 0x07) == 0)
+#define IS_DMA_ALIGNED(x)       ((((u32)(x)) & 0x07) == 0)
 #define MAX_DMA_LEN             8191
 /*
@@ -896,7 +896,7 @@ static void pump_transfers(unsigned long data)
                                || transfer->rx_dma || transfer->tx_dma) {
                        dev_err(&drv_data->pdev->dev,
                                "pump_transfers: mapped transfer length "
-                                "of %lu is greater than %d\n",
+                                "of %u is greater than %d\n",
                                transfer->len, MAX_DMA_LEN);
                        message->status = -EINVAL;
                        giveback(drv_data);
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index c6299e8a041..9cbff84b787 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2400,11 +2400,15 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
        if (!fbcon_is_inactive(vc, info)) {
                if (ops->blank_state != blank) {
+                        int ret = 1;
                        ops->blank_state = blank;
                        fbcon_cursor(vc, blank ? CM_ERASE : CM_DRAW);
                        ops->cursor_flash = (!blank);
-                        if (fb_blank(info, blank))
+                        if (info->fbops->fb_blank)
+                                ret = info->fbops->fb_blank(blank, info);
+                        if (ret)
                                fbcon_generic_blank(vc, info, blank);
                }
diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index a6e38e9ea73..89a346880ec 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -110,7 +110,7 @@ static inline int mono_col(const struct fb_info *info)
        __u32 max_len;
        max_len = max(info->var.green.length, info->var.red.length);
        max_len = max(info->var.blue.length, max_len);
-        return ~(0xfff << (max_len & 0xff));
+        return (~(0xfff << max_len)) & 0xff;
 }
 static inline int attr_col_ec(int shift, struct vc_data *vc,