Merge branch 'for-rmk' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into devel-stable

Conflicts:
	arch/arm/mach-at91/include/mach/system.h
	arch/arm/mach-imx/mach-cpuimx27.c

AT91 conflict resolution:
Acked-by: Anders Larsen <al@alarsen.net>
IMX conflict resolution confirmed by Uwe Kleine-König.

92 files changed, 733 insertions, 375 deletions

diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index f7619600270a..af308d03f492 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -204,6 +204,23 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        /*
+         * There have a NVIF method in MSI GX723 DSDT need call by Nvidia
+         * driver (e.g. nouveau) when user press brightness hotkey.
+         * Currently, nouveau driver didn't do the job and it causes there
+         * have a infinite while loop in DSDT when user press hotkey.
+         * We add MSI GX723's dmi information to this table for workaround
+         * this issue.
+         * Will remove MSI GX723 from the table after nouveau grows support.
+         */
+        .callback = dmi_disable_osi_vista,
+        .ident = "MSI GX723",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "GX723"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_vista,
         .ident = "Sony VGN-NS10J_S",
         .matches = {
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index b618f888d66b..bec561c14beb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -346,4 +346,5 @@ void __init acpi_early_processor_set_pdc(void)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             early_init_pdc, NULL, NULL, NULL);
+        acpi_get_devices("ACPI0007", early_init_pdc, NULL, NULL);
 }
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ee9ddeb53417..8cb0347dec28 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3156,7 +3156,6 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
 {  
         struct atm_dev *dev;  
         IADEV *iadev;  
-        unsigned long flags;
         int ret;
 
         iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
@@ -3188,19 +3187,14 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
         ia_dev[iadev_count] = iadev;
         _ia_dev[iadev_count] = dev;
         iadev_count++;
-        spin_lock_init(&iadev->misc_lock);
-        /* First fixes first. I don't want to think about this now. */
-        spin_lock_irqsave(&iadev->misc_lock, flags); 
         if (ia_init(dev) || ia_start(dev)) {  
                 IF_INIT(printk("IA register failed!\n");)
                 iadev_count--;
                 ia_dev[iadev_count] = NULL;
                 _ia_dev[iadev_count] = NULL;
-                spin_unlock_irqrestore(&iadev->misc_lock, flags); 
                 ret = -EINVAL;
                 goto err_out_deregister_dev;
         }
-        spin_unlock_irqrestore(&iadev->misc_lock, flags); 
         IF_EVENT(printk("iadev_count = %d\n", iadev_count);)
 
         iadev->next_board = ia_boards;  
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index b2cd20f549cb..077735e0e04b 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -1022,7 +1022,7 @@ typedef struct iadev_t {
         struct dle_q rx_dle_q;  
         struct free_desc_q *rx_free_desc_qhead;  
         struct sk_buff_head rx_dma_q;  
-        spinlock_t rx_lock, misc_lock;
+        spinlock_t rx_lock;
         struct atm_vcc **rx_open;       /* list of all open VCs */  
         u16 num_rx_desc, rx_buf_sz, rxing;
         u32 rx_pkt_ram, rx_tmp_cnt;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index f916ddf63938..f46138ab38b6 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
         struct solos_card *card = atmdev->dev_data;
         struct sk_buff *skb;
+        unsigned int len;
 
         spin_lock(&card->cli_queue_lock);
         skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         if(skb == NULL)
                 return sprintf(buf, "No data.\n");
 
-        memcpy(buf, skb->data, skb->len);
-        dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+        len = skb->len;
+        memcpy(buf, skb->data, len);
+        dev_dbg(&card->dev->dev, "len: %d\n", len);
 
         kfree_skb(skb);
-        return skb->len;
+        return len;
 }
 
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2aafafca2b13..1101e251a629 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -202,6 +202,7 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         struct virtio_blk *vblk = disk->private_data;
         struct request *req;
         struct bio *bio;
+        int err;
 
         bio = bio_map_kern(vblk->disk->queue, id_str, VIRTIO_BLK_ID_BYTES,
                            GFP_KERNEL);
@@ -215,7 +216,10 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         }
 
         req->cmd_type = REQ_TYPE_SPECIAL;
-        return blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        err = blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        blk_put_request(req);
+
+        return err;
 }
 
 static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 216f9d383b5b..effd140fc042 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -879,7 +879,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_issue_pending = ioat2_issue_pending;
         dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
         dma->device_free_chan_resources = ioat2_free_chan_resources;
-        dma->device_tx_status = ioat_tx_status;
+        dma->device_tx_status = ioat_dma_tx_status;
 
         err = ioat_probe(device);
         if (err)
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c74e4e8006d4..2dd2c93ebfa3 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2231,6 +2231,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->mchdev_lock = &mchdev_lock;
         spin_unlock(&mchdev_lock);
 
+        /* XXX Prevent module unload due to memory corruption bugs. */
+        __module_get(THIS_MODULE);
+
         return 0;
 
 out_workqueue_free:
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 56ad9df2ccb5..b61966c126d3 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -238,8 +238,8 @@ int intel_fbdev_destroy(struct drm_device *dev,
 
         drm_framebuffer_cleanup(&ifb->base);
         if (ifb->obj) {
-                drm_gem_object_handle_unreference(ifb->obj);
                 drm_gem_object_unreference(ifb->obj);
+                ifb->obj = NULL;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index d2047713dc59..dbd30b2e43fd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,7 +352,6 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
 
         if (nouveau_fb->nvbo) {
                 nouveau_bo_unmap(nouveau_fb->nvbo);
-                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                 drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                 nouveau_fb->nvbo = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3c9964a8fbad..3ec181ff50ce 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,7 +79,6 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
         mutex_lock(&dev->struct_mutex);
         nouveau_bo_unpin(chan->notifier_bo);
         mutex_unlock(&dev->struct_mutex);
-        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
         drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
         drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 79082d4398ae..2f93d46ae69a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1137,7 +1137,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
 
                 WREG32(RCU_IND_INDEX, 0x203);
                 efuse_straps_3 = RREG32(RCU_IND_DATA);
-                efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
+                efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
 
                 switch(efuse_box_bit_127_124) {
                 case 0x0:
@@ -1407,6 +1407,7 @@ int evergreen_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
@@ -1520,7 +1521,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e151f16a8f86..e59422320bb6 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1030,6 +1030,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                 return r;
         }
         rdev->cp.ready = true;
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -1047,6 +1048,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
         /* Disable ring */
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->cp.ready = false;
         WREG32(RADEON_CP_CSQ_MODE, 0);
         WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2295,6 +2297,7 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
         /* FIXME we don't use the second aperture yet when we could use it */
         if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                 rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
         if (rdev->flags & RADEON_IS_IGP) {
                 uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7a04959ba0ee..7b65e4efe8af 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1248,6 +1248,7 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
         if (rdev->flags & RADEON_IS_IGP) {
@@ -1917,6 +1918,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
  */
 void r600_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
 }
 
@@ -2910,7 +2912,7 @@ static void r600_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(DxMODE_INT_MASK, 0);
         if (ASIC_IS_DCE3(rdev)) {
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 9ceb2a1ce799..3473c00781ff 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -532,6 +532,7 @@ int r600_blit_init(struct radeon_device *rdev)
         memcpy(ptr + rdev->r600_blit.ps_offset, r6xx_ps, r6xx_ps_size * 4);
         radeon_bo_kunmap(rdev->r600_blit.shader_obj);
         radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -539,6 +540,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
         int r;
 
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         if (rdev->r600_blit.shader_obj == NULL)
                 return;
         /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a168d644bf9e..9ff38c99a6ea 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -344,6 +344,7 @@ struct radeon_mc {
          * about vram size near mc fb location */
         u64                     mc_vram_size;
         u64                     visible_vram_size;
+        u64                     active_vram_size;
         u64                     gtt_size;
         u64                     gtt_start;
         u64                     gtt_end;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 68932ba7b8a4..8e43ddae70cc 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1558,39 +1558,39 @@ radeon_atombios_get_tv_info(struct radeon_device *rdev)
                 switch (tv_info->ucTV_BootUpDefaultStandard) {
                 case ATOM_TV_NTSC:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Default TV standard: NTSC\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                         break;
                 case ATOM_TV_NTSCJ:
                         tv_std = TV_STD_NTSC_J;
-                        DRM_INFO("Default TV standard: NTSC-J\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                         break;
                 case ATOM_TV_PAL:
                         tv_std = TV_STD_PAL;
-                        DRM_INFO("Default TV standard: PAL\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL\n");
                         break;
                 case ATOM_TV_PALM:
                         tv_std = TV_STD_PAL_M;
-                        DRM_INFO("Default TV standard: PAL-M\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                         break;
                 case ATOM_TV_PALN:
                         tv_std = TV_STD_PAL_N;
-                        DRM_INFO("Default TV standard: PAL-N\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-N\n");
                         break;
                 case ATOM_TV_PALCN:
                         tv_std = TV_STD_PAL_CN;
-                        DRM_INFO("Default TV standard: PAL-CN\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-CN\n");
                         break;
                 case ATOM_TV_PAL60:
                         tv_std = TV_STD_PAL_60;
-                        DRM_INFO("Default TV standard: PAL-60\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                         break;
                 case ATOM_TV_SECAM:
                         tv_std = TV_STD_SECAM;
-                        DRM_INFO("Default TV standard: SECAM\n");
+                        DRM_DEBUG_KMS("Default TV standard: SECAM\n");
                         break;
                 default:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+                        DRM_DEBUG_KMS("Unknown TV standard; defaulting to NTSC\n");
                         break;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index a04b7a6ad95f..7b7ea269549c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -913,47 +913,47 @@ radeon_combios_get_tv_info(struct radeon_device *rdev)
                         switch (RBIOS8(tv_info + 7) & 0xf) {
                         case 1:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO("Default TV standard: NTSC\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                                 break;
                         case 2:
                                 tv_std = TV_STD_PAL;
-                                DRM_INFO("Default TV standard: PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL\n");
                                 break;
                         case 3:
                                 tv_std = TV_STD_PAL_M;
-                                DRM_INFO("Default TV standard: PAL-M\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                                 break;
                         case 4:
                                 tv_std = TV_STD_PAL_60;
-                                DRM_INFO("Default TV standard: PAL-60\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                                 break;
                         case 5:
                                 tv_std = TV_STD_NTSC_J;
-                                DRM_INFO("Default TV standard: NTSC-J\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                                 break;
                         case 6:
                                 tv_std = TV_STD_SCART_PAL;
-                                DRM_INFO("Default TV standard: SCART-PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: SCART-PAL\n");
                                 break;
                         default:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO
+                                DRM_DEBUG_KMS
                                     ("Unknown TV standard; defaulting to NTSC\n");
                                 break;
                         }
 
                         switch ((RBIOS8(tv_info + 9) >> 2) & 0x3) {
                         case 0:
-                                DRM_INFO("29.498928713 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("29.498928713 MHz TV ref clk\n");
                                 break;
                         case 1:
-                                DRM_INFO("28.636360000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("28.636360000 MHz TV ref clk\n");
                                 break;
                         case 2:
-                                DRM_INFO("14.318180000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("14.318180000 MHz TV ref clk\n");
                                 break;
                         case 3:
-                                DRM_INFO("27.000000000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("27.000000000 MHz TV ref clk\n");
                                 break;
                         default:
                                 break;
@@ -1324,7 +1324,7 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
 
         if (tmds_info) {
                 ver = RBIOS8(tmds_info);
-                DRM_INFO("DFP table revision: %d\n", ver);
+                DRM_DEBUG_KMS("DFP table revision: %d\n", ver);
                 if (ver == 3) {
                         n = RBIOS8(tmds_info + 5) + 1;
                         if (n > 4)
@@ -1408,7 +1408,7 @@ bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder
                 offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
                 if (offset) {
                         ver = RBIOS8(offset);
-                        DRM_INFO("External TMDS Table revision: %d\n", ver);
+                        DRM_DEBUG_KMS("External TMDS Table revision: %d\n", ver);
                         tmds->slave_addr = RBIOS8(offset + 4 + 2);
                         tmds->slave_addr >>= 1; /* 7 bit addressing */
                         gpio = RBIOS8(offset + 4 + 3);
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 9cdf6a35bc2c..40b0c087b592 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -97,7 +97,6 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
                 radeon_bo_unpin(rbo);
                 radeon_bo_unreserve(rbo);
         }
-        drm_gem_object_handle_unreference(gobj);
         drm_gem_object_unreference_unlocked(gobj);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 0afd1e62347d..b3b5306bb578 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -69,7 +69,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
         u32 c = 0;
 
         rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = 0;
+        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
         rbo->placement.placement = rbo->placements;
         rbo->placement.busy_placement = rbo->placements;
         if (domain & RADEON_GEM_DOMAIN_VRAM)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 353998dc2c03..3481bc7f6f58 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -124,11 +124,8 @@ static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
         int r;
 
         r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
-        if (unlikely(r != 0)) {
-                if (r != -ERESTARTSYS)
-                        dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
+        if (unlikely(r != 0))
                 return r;
-        }
         spin_lock(&bo->tbo.lock);
         if (mem_type)
                 *mem_type = bo->tbo.mem.mem_type;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index cc05b230d7ef..51d5f7b5ab21 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -693,6 +693,7 @@ void rs600_mc_init(struct radeon_device *rdev)
         rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
         rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         base = RREG32_MC(R_000004_MC_FB_LOCATION);
         base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3e3f75718be3..4dc2a87ea680 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,6 +157,7 @@ void rs690_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index bfa59db374d2..9490da700749 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -267,6 +267,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
  */
 void r700_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
 }
 
@@ -992,6 +993,7 @@ int rv770_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index cb4cf7ef4d1e..db809e034cc4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -442,6 +442,43 @@ out_err:
 }
 
 /**
+ * Call bo::reserved and with the lru lock held.
+ * Will release GPU memory type usage on destruction.
+ * This is the place to put in driver specific hooks.
+ * Will release the bo::reserved lock and the
+ * lru lock on exit.
+ */
+
+static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
+{
+        struct ttm_bo_global *glob = bo->glob;
+
+        if (bo->ttm) {
+
+                /**
+                 * Release the lru_lock, since we don't want to have
+                 * an atomic requirement on ttm_tt[unbind|destroy].
+                 */
+
+                spin_unlock(&glob->lru_lock);
+                ttm_tt_unbind(bo->ttm);
+                ttm_tt_destroy(bo->ttm);
+                bo->ttm = NULL;
+                spin_lock(&glob->lru_lock);
+        }
+
+        if (bo->mem.mm_node) {
+                drm_mm_put_block(bo->mem.mm_node);
+                bo->mem.mm_node = NULL;
+        }
+
+        atomic_set(&bo->reserved, 0);
+        wake_up_all(&bo->event_queue);
+        spin_unlock(&glob->lru_lock);
+}
+
+
+/**
  * If bo idle, remove from delayed- and lru lists, and unref.
  * If not idle, and already on delayed list, do nothing.
  * If not idle, and not on delayed list, put on delayed list,
@@ -456,6 +493,7 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
         int ret;
 
         spin_lock(&bo->lock);
+retry:
         (void) ttm_bo_wait(bo, false, false, !remove_all);
 
         if (!bo->sync_obj) {
@@ -464,31 +502,52 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                 spin_unlock(&bo->lock);
 
                 spin_lock(&glob->lru_lock);
-                put_count = ttm_bo_del_from_lru(bo);
+                ret = ttm_bo_reserve_locked(bo, false, !remove_all, false, 0);
+
+                /**
+                 * Someone else has the object reserved. Bail and retry.
+                 */
 
-                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
-                BUG_ON(ret);
-                if (bo->ttm)
-                        ttm_tt_unbind(bo->ttm);
+                if (unlikely(ret == -EBUSY)) {
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        goto requeue;
+                }
+
+                /**
+                 * We can re-check for sync object without taking
+                 * the bo::lock since setting the sync object requires
+                 * also bo::reserved. A busy object at this point may
+                 * be caused by another thread starting an accelerated
+                 * eviction.
+                 */
+
+                if (unlikely(bo->sync_obj)) {
+                        atomic_set(&bo->reserved, 0);
+                        wake_up_all(&bo->event_queue);
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        if (remove_all)
+                                goto retry;
+                        else
+                                goto requeue;
+                }
+
+                put_count = ttm_bo_del_from_lru(bo);
 
                 if (!list_empty(&bo->ddestroy)) {
                         list_del_init(&bo->ddestroy);
                         ++put_count;
                 }
-                if (bo->mem.mm_node) {
-                        drm_mm_put_block(bo->mem.mm_node);
-                        bo->mem.mm_node = NULL;
-                }
-                spin_unlock(&glob->lru_lock);
 
-                atomic_set(&bo->reserved, 0);
+                ttm_bo_cleanup_memtype_use(bo);
 
                 while (put_count--)
                         kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
                 return 0;
         }
-
+requeue:
         spin_lock(&glob->lru_lock);
         if (list_empty(&bo->ddestroy)) {
                 void *sync_obj = bo->sync_obj;
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f7bd2613cecc..f2de3be35df3 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -677,6 +677,11 @@ static int __devinit cpm_i2c_probe(struct platform_device *ofdev,
         dev_dbg(&ofdev->dev, "hw routines for %s registered.\n",
                 cpm->adap.name);
 
+        /*
+         * register OF I2C devices
+         */
+        of_i2c_register_devices(&cpm->adap);
+
         return 0;
 out_shut:
         cpm_i2c_shutdown(cpm);
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 43ca32fddde2..89eedf45d30e 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -761,6 +761,9 @@ static int __devinit iic_probe(struct platform_device *ofdev,
         dev_info(&ofdev->dev, "using %s mode\n",
                  dev->fast_mode ? "fast (400 kHz)" : "standard (100 kHz)");
 
+        /* Now register all the child nodes */
+        of_i2c_register_devices(adap);
+
         return 0;
 
 error_cleanup:
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a1c419a716af..b74e6dc6886c 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -632,6 +632,7 @@ static int __devinit fsl_i2c_probe(struct platform_device *op,
                 dev_err(i2c->dev, "failed to add adapter\n");
                 goto fail_add;
         }
+        of_i2c_register_devices(&i2c->adap);
 
         return result;
 
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index bbd77603a417..29933f87d8fa 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -71,8 +71,8 @@ static int pca_isa_readbyte(void *pd, int reg)
 
 static int pca_isa_waitforcompletion(void *pd)
 {
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (irq > -1) {
                 ret = wait_event_timeout(pca_wait,
@@ -81,11 +81,15 @@ static int pca_isa_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + pca_isa_ops.timeout;
-                while (((pca_isa_readbyte(pd, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (pca_isa_readbyte(pd, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
+
         return ret > 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index ef5c78487eb7..5f6d7f89e225 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -80,8 +80,8 @@ static void i2c_pca_pf_writebyte32(void *pd, int reg, int val)
 static int i2c_pca_pf_waitforcompletion(void *pd)
 {
         struct i2c_pca_pf_data *i2c = pd;
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (i2c->irq) {
                 ret = wait_event_timeout(i2c->wait,
@@ -90,10 +90,13 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + i2c->adap.timeout;
-                while (((i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
 
         return ret > 0;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 6649176de940..bea4c5021d26 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
-#include <linux/of_i2c.h>
 #include <linux/of_device.h>
 #include <linux/completion.h>
 #include <linux/hardirq.h>
@@ -197,11 +196,12 @@ static int i2c_device_pm_suspend(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->suspend ? pm->suspend(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->suspend ? pm->suspend(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
@@ -216,12 +216,6 @@ static int i2c_device_pm_resume(struct device *dev)
         else
                 ret = i2c_legacy_resume(dev);
 
-        if (!ret) {
-                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
-                pm_runtime_enable(dev);
-        }
-
         return ret;
 }
 
@@ -229,11 +223,12 @@ static int i2c_device_pm_freeze(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->freeze ? pm->freeze(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->freeze ? pm->freeze(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
@@ -242,11 +237,12 @@ static int i2c_device_pm_thaw(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->thaw ? pm->thaw(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->thaw ? pm->thaw(dev) : 0;
+        }
 
         return i2c_legacy_resume(dev);
 }
@@ -255,11 +251,12 @@ static int i2c_device_pm_poweroff(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->poweroff ? pm->poweroff(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->poweroff ? pm->poweroff(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
@@ -876,9 +873,6 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
         if (adap->nr < __i2c_first_dynamic_bus_num)
                 i2c_scan_static_board_info(adap);
 
-        /* Register devices from the device tree */
-        of_i2c_register_devices(adap);
-
         /* Notify drivers */
         mutex_lock(&core_lock);
         bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 0906fc5b69b9..c37ef64d1465 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -157,13 +157,13 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
         { /* MWAIT C5 */ },
         { /* MWAIT C6 */
                 .name = "ATM-C6",
-                .desc = "MWAIT 0x40",
-                .driver_data = (void *) 0x40,
+                .desc = "MWAIT 0x52",
+                .driver_data = (void *) 0x52,
                 .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
-                .exit_latency = 200,
+                .exit_latency = 140,
                 .power_usage = 150,
-                .target_residency = 800,
-                .enter = NULL },        /* disabled */
+                .target_residency = 560,
+                .enter = &intel_idle },
 };
 
 /**
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index d85bd8a7967d..22239e988498 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -483,6 +483,9 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
 
         memcpy(joydev->abspam, abspam, len);
 
+        for (i = 0; i < joydev->nabs; i++)
+                joydev->absmap[joydev->abspam[i]] = i;
+
  out:
         kfree(abspam);
         return retval;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 0d4266a533a5..360698553eb5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -404,6 +404,13 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                 retval = uinput_validate_absbits(dev);
                 if (retval < 0)
                         goto exit;
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        input_mt_create_slots(dev, nslot);
+                        input_set_events_per_packet(dev, 6 * nslot);
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
         }
 
         udev->state = UIST_SETUP_COMPLETE;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 42ba3691d908..b35876ee6908 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -103,27 +103,26 @@ static void wacom_sys_irq(struct urb *urb)
 static int wacom_open(struct input_dev *dev)
 {
         struct wacom *wacom = input_get_drvdata(dev);
+        int retval = 0;
 
-        mutex_lock(&wacom->lock);
-
-        wacom->irq->dev = wacom->usbdev;
-
-        if (usb_autopm_get_interface(wacom->intf) < 0) {
-                mutex_unlock(&wacom->lock);
+        if (usb_autopm_get_interface(wacom->intf) < 0)
                 return -EIO;
-        }
+
+        mutex_lock(&wacom->lock);
 
         if (usb_submit_urb(wacom->irq, GFP_KERNEL)) {
-                usb_autopm_put_interface(wacom->intf);
-                mutex_unlock(&wacom->lock);
-                return -EIO;
+                retval = -EIO;
+                goto out;
         }
 
         wacom->open = true;
         wacom->intf->needs_remote_wakeup = 1;
 
+out:
         mutex_unlock(&wacom->lock);
-        return 0;
+        if (retval)
+                usb_autopm_put_interface(wacom->intf);
+        return retval;
 }
 
 static void wacom_close(struct input_dev *dev)
@@ -135,6 +134,8 @@ static void wacom_close(struct input_dev *dev)
         wacom->open = false;
         wacom->intf->needs_remote_wakeup = 0;
         mutex_unlock(&wacom->lock);
+
+        usb_autopm_put_interface(wacom->intf);
 }
 
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 6e29badb969e..47fd7a041c52 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -442,8 +442,10 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
         /* general pen packet */
         if ((data[1] & 0xb8) == 0xa0) {
                 t = (data[6] << 2) | ((data[7] >> 6) & 3);
-                if (features->type >= INTUOS4S && features->type <= INTUOS4L)
+                if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
+                    features->type == WACOM_21UX2) {
                         t = (t << 1) | (data[1] & 1);
+                }
                 input_report_abs(input, ABS_PRESSURE, t);
                 input_report_abs(input, ABS_TILT_X,
                                 ((data[7] << 1) & 0x7e) | (data[8] >> 7));
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                         }
                         else if(callid>=0x0000 && callid<=0x7FFF)
                         {
+                                int len;
+
                                 pr_debug("%s: Got Incoming Call\n",
                                                 sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-                                strcpy(setup.eazmsn,
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
+                                                sizeof(setup.phone));
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                 setup.si1 = 7;
                                 setup.si2 = 0;
                                 setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                  * Handle a GetMyNumber Rsp
                  */
                 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                         continue;
                 }
                         
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed4900ade93a..e4fb58db5454 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1000,10 +1000,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 page = bitmap->sb_page;
                                 offset = sizeof(bitmap_super_t);
                                 if (!file)
-                                        read_sb_page(bitmap->mddev,
-                                                     bitmap->mddev->bitmap_info.offset,
-                                                     page,
-                                                     index, count);
+                                        page = read_sb_page(
+                                                bitmap->mddev,
+                                                bitmap->mddev->bitmap_info.offset,
+                                                page,
+                                                index, count);
                         } else if (file) {
                                 page = read_page(file, index, bitmap, count);
                                 offset = 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ad83a4dcadc3..0b830bbe1d8b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1839,7 +1839,9 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
 
                 /* take from bio_init */
                 bio->bi_next = NULL;
+                bio->bi_flags &= ~(BIO_POOL_MASK-1);
                 bio->bi_flags |= 1 << BIO_UPTODATE;
+                bio->bi_comp_cpu = -1;
                 bio->bi_rw = READ;
                 bio->bi_vcnt = 0;
                 bio->bi_idx = 0;
@@ -1912,7 +1914,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                 break;
                         BUG_ON(sync_blocks < (PAGE_SIZE>>9));
-                        if (len > (sync_blocks<<9))
+                        if ((len >> 9) > sync_blocks)
                                 len = sync_blocks<<9;
                 }
 
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index 7e82a9df726b..7961d59f5cac 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -319,7 +319,7 @@ static void ir_timer_keyup(unsigned long cookie)
          * a keyup event might follow immediately after the keydown.
          */
         spin_lock_irqsave(&ir->keylock, flags);
-        if (time_is_after_eq_jiffies(ir->keyup_jiffies))
+        if (time_is_before_eq_jiffies(ir->keyup_jiffies))
                 ir_keyup(ir);
         spin_unlock_irqrestore(&ir->keylock, flags);
 }
@@ -510,6 +510,13 @@ int __ir_input_register(struct input_dev *input_dev,
                    (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_IR_RAW) ?
                         " in raw mode" : "");
 
+        /*
+         * Default delay of 250ms is too short for some protocols, expecially
+         * since the timeout is currently set to 250ms. Increase it to 500ms,
+         * to avoid wrong repetition of the keycodes.
+         */
+        input_dev->rep[REP_DELAY] = 500;
+
         return 0;
 
 out_event:
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c
index 77b5946413c0..e63f757d5d72 100644
--- a/drivers/media/IR/ir-lirc-codec.c
+++ b/drivers/media/IR/ir-lirc-codec.c
@@ -267,7 +267,7 @@ static int ir_lirc_register(struct input_dev *input_dev)
                         features |= LIRC_CAN_SET_SEND_CARRIER;
 
                 if (ir_dev->props->s_tx_duty_cycle)
-                        features |= LIRC_CAN_SET_REC_DUTY_CYCLE;
+                        features |= LIRC_CAN_SET_SEND_DUTY_CYCLE;
         }
 
         if (ir_dev->props->s_rx_carrier_range)
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccfa..8e0e1b1f8c87 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
                         "rc%u",  (unsigned int)ir->devno);
 
         if (IS_ERR(ir->raw->thread)) {
+                int ret = PTR_ERR(ir->raw->thread);
+
                 kfree(ir->raw);
                 ir->raw = NULL;
-                return PTR_ERR(ir->raw->thread);
+                return ret;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index 96dafc425c8e..46d42467f9b4 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d,
         char *tmp = buf;
         int i;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 enabled = ir_dev->rc_tab.ir_type;
                 allowed = ir_dev->props->allowed_protos;
-        } else {
+        } else if (ir_dev->raw) {
                 enabled = ir_dev->raw->enabled_protocols;
                 allowed = ir_raw_get_allowed_protocols();
-        }
+        } else
+                return sprintf(tmp, "[builtin]\n");
 
         IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                    (long long)allowed,
@@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d,
         int rc, i, count = 0;
         unsigned long flags;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                 type = ir_dev->rc_tab.ir_type;
-        else
+        else if (ir_dev->raw)
                 type = ir_dev->raw->enabled_protocols;
+        else {
+                IR_dprintk(1, "Protocol switching not supported\n");
+                return -EINVAL;
+        }
 
         while ((tmp = strsep((char **) &data, " \n")) != NULL) {
                 if (!*tmp)
@@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d,
                 }
         }
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 spin_lock_irqsave(&ir_dev->rc_tab.lock, flags);
                 ir_dev->rc_tab.ir_type = type;
                 spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);
diff --git a/drivers/media/IR/keymaps/rc-rc6-mce.c b/drivers/media/IR/keymaps/rc-rc6-mce.c
index 64264f7f838f..39557ad401b6 100644
--- a/drivers/media/IR/keymaps/rc-rc6-mce.c
+++ b/drivers/media/IR/keymaps/rc-rc6-mce.c
@@ -19,6 +19,7 @@ static struct ir_scancode rc6_mce[] = {
 
         { 0x800f0416, KEY_PLAY },
         { 0x800f0418, KEY_PAUSE },
+        { 0x800f046e, KEY_PLAYPAUSE },
         { 0x800f0419, KEY_STOP },
         { 0x800f0417, KEY_RECORD },
 
@@ -37,6 +38,8 @@ static struct ir_scancode rc6_mce[] = {
         { 0x800f0411, KEY_VOLUMEDOWN },
         { 0x800f0412, KEY_CHANNELUP },
         { 0x800f0413, KEY_CHANNELDOWN },
+        { 0x800f043a, KEY_BRIGHTNESSUP },
+        { 0x800f0480, KEY_BRIGHTNESSDOWN },
 
         { 0x800f0401, KEY_NUMERIC_1 },
         { 0x800f0402, KEY_NUMERIC_2 },
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
index ac6bb2c01a48..bc620e10ef77 100644
--- a/drivers/media/IR/mceusb.c
+++ b/drivers/media/IR/mceusb.c
@@ -120,6 +120,10 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
         /* Philips eHome Infrared Transceiver */
         { USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
         /* Realtek MCE IR Receiver */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
         /* SMK/Toshiba G83C0004D410 */
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index fe818348b8a3..48397f103d32 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -673,9 +673,6 @@ static int dib0700_probe(struct usb_interface *intf,
                         else
                                 dev->props.rc.core.bulk_mode = false;
 
-                        /* Need a higher delay, to avoid wrong repeat */
-                        dev->rc_input_dev->rep[REP_DELAY] = 500;
-
                         dib0700_rc_setup(dev);
 
                         return 0;
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index f634d2e784b2..e06acd1fecb6 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -940,6 +940,58 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
         return adap->fe == NULL ? -ENODEV : 0;
 }
 
+/* STK7770P */
+static struct dib7000p_config dib7770p_dib7000p_config = {
+        .output_mpeg2_in_188_bytes = 1,
+
+        .agc_config_count = 1,
+        .agc = &dib7070_agc_config,
+        .bw  = &dib7070_bw_config_12_mhz,
+        .tuner_is_baseband = 1,
+        .spur_protect = 1,
+
+        .gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
+        .gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
+        .gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
+
+        .hostbus_diversity = 1,
+        .enable_current_mirror = 1,
+        .disable_sample_and_hold = 0,
+};
+
+static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+{
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+        else
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+
+        dib0700_ctrl_clock(adap->dev, 72, 1);
+
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+
+        if (dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
+                                     &dib7770p_dib7000p_config) != 0) {
+                err("%s: dib7000p_i2c_enumeration failed.  Cannot continue\n",
+                    __func__);
+                return -ENODEV;
+        }
+
+        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
+                &dib7770p_dib7000p_config);
+        return adap->fe == NULL ? -ENODEV : 0;
+}
+
 /* DIB807x generic */
 static struct dibx000_agc_config dib807x_agc_config[2] = {
         {
@@ -1781,7 +1833,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_XXS_2) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
-        { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x000, 0x3f00) },
         { USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
 /* 65 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV73ESE) },
         { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV282E) },
@@ -2406,7 +2458,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                                 .pid_filter_count = 32,
                                 .pid_filter       = stk70x0p_pid_filter,
                                 .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
-                                .frontend_attach  = stk7070p_frontend_attach,
+                                .frontend_attach  = stk7770p_frontend_attach,
                                 .tuner_attach     = dib7770p_tuner_attach,
 
                                 DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c
index 6b22ec64ab0c..f896337b4535 100644
--- a/drivers/media/dvb/dvb-usb/opera1.c
+++ b/drivers/media/dvb/dvb-usb/opera1.c
@@ -483,9 +483,7 @@ static int opera1_xilinx_load_firmware(struct usb_device *dev,
                 }
         }
         kfree(p);
-        if (fw) {
-                release_firmware(fw);
-        }
+        release_firmware(fw);
         return ret;
 }
 
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 2e28b973dfd3..3aed0d433921 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -260,6 +260,9 @@ static void dib7000p_set_adc_state(struct dib7000p_state *state, enum dibx000_ad
 
 //      dprintk( "908: %x, 909: %x\n", reg_908, reg_909);
 
+        reg_909 |= (state->cfg.disable_sample_and_hold & 1) << 4;
+        reg_908 |= (state->cfg.enable_current_mirror & 1) << 7;
+
         dib7000p_write_word(state, 908, reg_908);
         dib7000p_write_word(state, 909, reg_909);
 }
@@ -778,7 +781,10 @@ static void dib7000p_set_channel(struct dib7000p_state *state, struct dvb_fronte
                 default:
                 case GUARD_INTERVAL_1_32: value *= 1; break;
         }
-        state->div_sync_wait = (value * 3) / 2 + 32; // add 50% SFN margin + compensate for one DVSY-fifo TODO
+        if (state->cfg.diversity_delay == 0)
+                state->div_sync_wait = (value * 3) / 2 + 48; // add 50% SFN margin + compensate for one DVSY-fifo
+        else
+                state->div_sync_wait = (value * 3) / 2 + state->cfg.diversity_delay; // add 50% SFN margin + compensate for one DVSY-fifo
 
         /* deactive the possibility of diversity reception if extended interleaver */
         state->div_force_off = !1 && ch->u.ofdm.transmission_mode != TRANSMISSION_MODE_8K;
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 805dd13a97ee..da17345bf5bd 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -33,6 +33,11 @@ struct dib7000p_config {
         int (*agc_control) (struct dvb_frontend *, u8 before);
 
         u8 output_mode;
+        u8 disable_sample_and_hold : 1;
+
+        u8 enable_current_mirror : 1;
+        u8 diversity_delay;
+
 };
 
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index d93468cd3a85..ff3b0fa901b3 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1098,33 +1098,26 @@ EXPORT_SYMBOL_GPL(smscore_onresponse);
  *
  * @return pointer to descriptor on success, NULL on error.
  */
-struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+
+struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
 {
         struct smscore_buffer_t *cb = NULL;
         unsigned long flags;
 
-        DEFINE_WAIT(wait);
-
         spin_lock_irqsave(&coredev->bufferslock, flags);
-
-        /* This function must return a valid buffer, since the buffer list is
-         * finite, we check that there is an available buffer, if not, we wait
-         * until such buffer become available.
-         */
-
-        prepare_to_wait(&coredev->buffer_mng_waitq, &wait, TASK_INTERRUPTIBLE);
-        if (list_empty(&coredev->buffers)) {
-                spin_unlock_irqrestore(&coredev->bufferslock, flags);
-                schedule();
-                spin_lock_irqsave(&coredev->bufferslock, flags);
+        if (!list_empty(&coredev->buffers)) {
+                cb = (struct smscore_buffer_t *) coredev->buffers.next;
+                list_del(&cb->entry);
         }
+        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        return cb;
+}
 
-        finish_wait(&coredev->buffer_mng_waitq, &wait);
-
-        cb = (struct smscore_buffer_t *) coredev->buffers.next;
-        list_del(&cb->entry);
+struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+{
+        struct smscore_buffer_t *cb = NULL;
 
-        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        wait_event(coredev->buffer_mng_waitq, (cb = get_entry(coredev)));
 
         return cb;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 67a4ec8768a6..4ce541a5eb47 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -395,7 +395,7 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
         radio->registers[POWERCFG] = POWERCFG_ENABLE;
         if (si470x_set_register(radio, POWERCFG) < 0) {
                 retval = -EIO;
-                goto err_all;
+                goto err_video;
         }
         msleep(110);
 
diff --git a/drivers/media/video/cx231xx/Makefile b/drivers/media/video/cx231xx/Makefile
index 755dd0ce65ff..6f2b57384488 100644
--- a/drivers/media/video/cx231xx/Makefile
+++ b/drivers/media/video/cx231xx/Makefile
@@ -11,4 +11,5 @@ EXTRA_CFLAGS += -Idrivers/media/video
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-usb
 
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 6bdc0ef18119..f2a4900014bc 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-chip-ident.h>
 
 #include <media/cx25840.h>
+#include "dvb-usb-ids.h"
 #include "xc5000.h"
 
 #include "cx231xx.h"
@@ -175,6 +176,8 @@ struct usb_device_id cx231xx_id_table[] = {
          .driver_info = CX231XX_BOARD_CNXT_RDE_250},
         {USB_DEVICE(0x0572, 0x58A1),
          .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+        {USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x4000,0x4fff),
+         .driver_info = CX231XX_BOARD_UNKNOWN},
         {},
 };
 
@@ -226,14 +229,16 @@ void cx231xx_pre_card_setup(struct cx231xx *dev)
                      dev->board.name, dev->model);
 
         /* set the direction for GPIO pins */
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
+        if (dev->board.tuner_gpio) {
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
 
-        /* request some modules if any required */
+                /* request some modules if any required */
 
-        /* reset the Tuner */
-        cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+                /* reset the Tuner */
+                cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+        }
 
         /* set the mode to Analog mode initially */
         cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 86ca8c2359dd..f5a3e74c3c7c 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1996,7 +1996,7 @@ static int cx25840_probe(struct i2c_client *client,
 
                 state->volume = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_VOLUME,
-                        0, 65335, 65535 / 100, default_volume);
+                        0, 65535, 65535 / 100, default_volume);
                 state->mute = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_MUTE,
                         0, 1, 1, 0);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 99dbae117591..0fa85cbefbb1 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -17,7 +17,7 @@ config VIDEO_CX88
 
 config VIDEO_CX88_ALSA
         tristate "Conexant 2388x DMA audio support"
-        depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        depends on VIDEO_CX88 && SND
         select SND_PCM
         ---help---
           This is a video4linux driver for direct (DMA) audio on
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index b9846106913e..78abc1c1f9d5 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                 usb_rcvintpipe(dev, ep->bEndpointAddress),
                 buffer, buffer_len,
                 int_irq, (void *)gspca_dev, interval);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
         gspca_dev->int_urb = urb;
         ret = usb_submit_urb(urb, GFP_KERNEL);
         if (ret < 0) {
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 83a718f0f3f9..9052d5702556 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2357,8 +2357,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                             (data[33] << 10);
                 avg_lum >>= 9;
                 atomic_set(&sd->avg_lum, avg_lum);
-                gspca_frame_add(gspca_dev, LAST_PACKET,
-                                data, len);
+                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
                 return;
         }
         if (gspca_dev->last_packet_type == LAST_PACKET) {
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index be03a712731c..f0316d02f09f 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -466,6 +466,8 @@ static int ivtvfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long ar
                         struct fb_vblank vblank;
                         u32 trace;
 
+                        memset(&vblank, 0, sizeof(struct fb_vblank));
+
                         vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT |
                                         FB_VBLANK_HAVE_VSYNC;
                         trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16;
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 4525335f9bd4..a7210d981388 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -239,7 +239,7 @@ static int device_process(struct m2mtest_ctx *ctx,
                 return -EFAULT;
         }
 
-        if (in_buf->vb.size < out_buf->vb.size) {
+        if (in_buf->vb.size > out_buf->vb.size) {
                 v4l2_err(&dev->v4l2_dev, "Output buffer is too small\n");
                 return -EINVAL;
         }
@@ -1014,6 +1014,7 @@ static int m2mtest_remove(struct platform_device *pdev)
         v4l2_m2m_release(dev->m2m_dev);
         del_timer_sync(&dev->timer);
         video_unregister_device(dev->vfd);
+        video_device_release(dev->vfd);
         v4l2_device_unregister(&dev->v4l2_dev);
         kfree(dev);
 
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 758a4db27d65..c71af4e0e517 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -447,6 +447,9 @@ static int mt9m111_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
         dev_dbg(&client->dev, "%s left=%d, top=%d, width=%d, height=%d\n",
                 __func__, rect.left, rect.top, rect.width, rect.height);
 
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         ret = mt9m111_make_rect(client, &rect);
         if (!ret)
                 mt9m111->rect = rect;
@@ -466,12 +469,14 @@ static int mt9m111_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 
 static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 {
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         a->bounds.left                  = MT9M111_MIN_DARK_COLS;
         a->bounds.top                   = MT9M111_MIN_DARK_ROWS;
         a->bounds.width                 = MT9M111_MAX_WIDTH;
         a->bounds.height                = MT9M111_MAX_HEIGHT;
         a->defrect                      = a->bounds;
-        a->type                         = V4L2_BUF_TYPE_VIDEO_CAPTURE;
         a->pixelaspect.numerator        = 1;
         a->pixelaspect.denominator      = 1;
 
@@ -487,6 +492,7 @@ static int mt9m111_g_fmt(struct v4l2_subdev *sd,
         mf->width       = mt9m111->rect.width;
         mf->height      = mt9m111->rect.height;
         mf->code        = mt9m111->fmt->code;
+        mf->colorspace  = mt9m111->fmt->colorspace;
         mf->field       = V4L2_FIELD_NONE;
 
         return 0;
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index e7cd23cd6394..b48473c7896b 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -402,9 +402,6 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd,
                 if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
                         return -EINVAL;
                 break;
-        case 0:
-                /* No format change, only geometry */
-                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 66ff174151b5..b6ea67221d1d 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -378,6 +378,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         spin_lock_irqsave(&pcdev->lock, flags);
 
+        if (*fb_active == NULL)
+                goto out;
+
         vb = &(*fb_active)->vb;
         dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                 vb, vb->baddr, vb->bsize);
@@ -402,6 +405,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         *fb_active = buf;
 
+out:
         spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
index 1b992b847198..55ea914c7fcd 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
@@ -513,7 +513,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bool) {
                         ret = parse_token(ptr,len,valptr,boolNames,
                                           ARRAY_SIZE(boolNames));
@@ -522,7 +522,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         } else if (ret == 0) {
                                 *valptr = (*valptr & 1) ? !0 : 0;
                         }
-                        if (maskptr) *maskptr = 1;
+                        *maskptr = 1;
                 } else if (cptr->info->type == pvr2_ctl_enum) {
                         ret = parse_token(
                                 ptr,len,valptr,
@@ -531,7 +531,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bitmask) {
                         ret = parse_tlist(
                                 ptr,len,maskptr,valptr,
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index b151c7be8a50..6961c55baf9b 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -393,6 +393,37 @@ static void fimc_set_yuv_order(struct fimc_ctx *ctx)
         dbg("ctx->out_order_1p= %d", ctx->out_order_1p);
 }
 
+static void fimc_prepare_dma_offset(struct fimc_ctx *ctx, struct fimc_frame *f)
+{
+        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
+
+        f->dma_offset.y_h = f->offs_h;
+        if (!variant->pix_hoff)
+                f->dma_offset.y_h *= (f->fmt->depth >> 3);
+
+        f->dma_offset.y_v = f->offs_v;
+
+        f->dma_offset.cb_h = f->offs_h;
+        f->dma_offset.cb_v = f->offs_v;
+
+        f->dma_offset.cr_h = f->offs_h;
+        f->dma_offset.cr_v = f->offs_v;
+
+        if (!variant->pix_hoff) {
+                if (f->fmt->planes_cnt == 3) {
+                        f->dma_offset.cb_h >>= 1;
+                        f->dma_offset.cr_h >>= 1;
+                }
+                if (f->fmt->color == S5P_FIMC_YCBCR420) {
+                        f->dma_offset.cb_v >>= 1;
+                        f->dma_offset.cr_v >>= 1;
+                }
+        }
+
+        dbg("in_offset: color= %d, y_h= %d, y_v= %d",
+            f->fmt->color, f->dma_offset.y_h, f->dma_offset.y_v);
+}
+
 /**
  * fimc_prepare_config - check dimensions, operation and color mode
  *                       and pre-calculate offset and the scaling coefficients.
@@ -406,7 +437,6 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
 {
         struct fimc_frame *s_frame, *d_frame;
         struct fimc_vid_buffer *buf = NULL;
-        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
         int ret = 0;
 
         s_frame = &ctx->s_frame;
@@ -419,61 +449,16 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
                         swap(d_frame->width, d_frame->height);
                 }
 
-                /* Prepare the output offset ratios for scaler. */
-                d_frame->dma_offset.y_h = d_frame->offs_h;
-                if (!variant->pix_hoff)
-                        d_frame->dma_offset.y_h *= (d_frame->fmt->depth >> 3);
-
-                d_frame->dma_offset.y_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cb_h = d_frame->offs_h;
-                d_frame->dma_offset.cb_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cr_h = d_frame->offs_h;
-                d_frame->dma_offset.cr_v = d_frame->offs_v;
+                /* Prepare the DMA offset ratios for scaler. */
+                fimc_prepare_dma_offset(ctx, &ctx->s_frame);
+                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
 
-                if (!variant->pix_hoff && d_frame->fmt->planes_cnt == 3) {
-                        d_frame->dma_offset.cb_h >>= 1;
-                        d_frame->dma_offset.cb_v >>= 1;
-                        d_frame->dma_offset.cr_h >>= 1;
-                        d_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("out offset: color= %d, y_h= %d, y_v= %d",
-                        d_frame->fmt->color,
-                        d_frame->dma_offset.y_h, d_frame->dma_offset.y_v);
-
-                /* Prepare the input offset ratios for scaler. */
-                s_frame->dma_offset.y_h = s_frame->offs_h;
-                if (!variant->pix_hoff)
-                        s_frame->dma_offset.y_h *= (s_frame->fmt->depth >> 3);
-                s_frame->dma_offset.y_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cb_h = s_frame->offs_h;
-                s_frame->dma_offset.cb_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cr_h = s_frame->offs_h;
-                s_frame->dma_offset.cr_v = s_frame->offs_v;
-
-                if (!variant->pix_hoff && s_frame->fmt->planes_cnt == 3) {
-                        s_frame->dma_offset.cb_h >>= 1;
-                        s_frame->dma_offset.cb_v >>= 1;
-                        s_frame->dma_offset.cr_h >>= 1;
-                        s_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("in offset: color= %d, y_h= %d, y_v= %d",
-                        s_frame->fmt->color, s_frame->dma_offset.y_h,
-                        s_frame->dma_offset.y_v);
-
-                fimc_set_yuv_order(ctx);
-
-                /* Check against the scaler ratio. */
                 if (s_frame->height > (SCALER_MAX_VRATIO * d_frame->height) ||
                     s_frame->width > (SCALER_MAX_HRATIO * d_frame->width)) {
                         err("out of scaler range");
                         return -EINVAL;
                 }
+                fimc_set_yuv_order(ctx);
         }
 
         /* Input DMA mode is not allowed when the scaler is disabled. */
@@ -822,7 +807,8 @@ static int fimc_m2m_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
         } else {
                 v4l2_err(&ctx->fimc_dev->m2m.v4l2_dev,
                          "Wrong buffer/video queue type (%d)\n", f->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto s_fmt_out;
         }
 
         pix = &f->fmt.pix;
@@ -1414,8 +1400,10 @@ static int fimc_probe(struct platform_device *pdev)
         }
 
         fimc->work_queue = create_workqueue(dev_name(&fimc->pdev->dev));
-        if (!fimc->work_queue)
+        if (!fimc->work_queue) {
+                ret = -ENOMEM;
                 goto err_irq;
+        }
 
         ret = fimc_register_m2m_device(fimc);
         if (ret)
@@ -1492,6 +1480,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
 };
 
 static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
+        .pix_hoff       = 1,
         .has_inp_rot    = 1,
         .has_out_rot    = 1,
         .min_inp_pixsize = 16,
@@ -1506,6 +1495,7 @@ static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
 };
 
 static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
+        .pix_hoff        = 1,
         .min_inp_pixsize = 16,
         .min_out_pixsize = 32,
 
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index ec697fcd406e..bb8d83d8ddaf 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4323,13 +4323,13 @@ struct saa7134_board saa7134_boards[] = {
         },
         [SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM] = {
                 /*       Beholder Intl. Ltd. 2008      */
-                /*Dmitry Belimov <d.belimov@gmail.com> */
-                .name           = "Beholder BeholdTV Columbus TVFM",
+                /* Dmitry Belimov <d.belimov@gmail.com> */
+                .name           = "Beholder BeholdTV Columbus TV/FM",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_ALPS_TSBE5_PAL,
-                .radio_type     = UNSET,
-                .tuner_addr     = ADDR_UNSET,
-                .radio_addr     = ADDR_UNSET,
+                .radio_type     = TUNER_TEA5767,
+                .tuner_addr     = 0xc2 >> 1,
+                .radio_addr     = 0xc0 >> 1,
                 .tda9887_conf   = TDA9887_PRESENT,
                 .gpiomask       = 0x000A8004,
                 .inputs         = {{
diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c
index 5713f3a4b76c..ddd25d32723d 100644
--- a/drivers/media/video/saa7164/saa7164-buffer.c
+++ b/drivers/media/video/saa7164/saa7164-buffer.c
@@ -136,10 +136,11 @@ ret:
 int saa7164_buffer_dealloc(struct saa7164_tsport *port,
         struct saa7164_buffer *buf)
 {
-        struct saa7164_dev *dev = port->dev;
+        struct saa7164_dev *dev;
 
-        if ((buf == 0) || (port == 0))
+        if (!buf || !port)
                 return SAA_ERR_BAD_PARAMETER;
+        dev = port->dev;
 
         dprintk(DBGLVL_BUF, "%s() deallocating buffer @ 0x%p\n", __func__, buf);
 
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8bdd940f32e6..2ac85d8984f0 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -486,6 +486,12 @@ static int uvc_parse_format(struct uvc_device *dev,
                             max(frame->dwFrameInterval[0],
                                 frame->dwDefaultFrameInterval));
 
+                if (dev->quirks & UVC_QUIRK_RESTRICT_FRAME_RATE) {
+                        frame->bFrameIntervalType = 1;
+                        frame->dwFrameInterval[0] =
+                                frame->dwDefaultFrameInterval;
+                }
+
                 uvc_trace(UVC_TRACE_DESCR, "- %ux%u (%u.%u fps)\n",
                         frame->wWidth, frame->wHeight,
                         10000000/frame->dwDefaultFrameInterval,
@@ -2026,6 +2032,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceClass      = USB_CLASS_VENDOR_SPEC,
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0 },
+        /* Chicony CNF7129 (Asus EEE 100HE) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x04f2,
+          .idProduct            = 0xb071,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_RESTRICT_FRAME_RATE },
         /* Alcor Micro AU3820 (Future Boy PC USB Webcam) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2091,6 +2106,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                 | UVC_QUIRK_PROBE_DEF },
+        /* IMC Networks (Medion Akoya) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x13d3,
+          .idProduct            = 0x5103,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
         /* Syntek (HP Spartan) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bdacf3beabf5..892e0e51916c 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -182,6 +182,7 @@ struct uvc_xu_control {
 #define UVC_QUIRK_IGNORE_SELECTOR_UNIT  0x00000020
 #define UVC_QUIRK_FIX_BANDWIDTH         0x00000080
 #define UVC_QUIRK_PROBE_DEF             0x00000100
+#define UVC_QUIRK_RESTRICT_FRAME_RATE   0x00000200
 
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED         0x00000001
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 372b87efcd05..6ff9e4bac3ea 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -393,8 +393,10 @@ void videobuf_dma_contig_free(struct videobuf_queue *q,
         }
 
         /* read() method */
-        dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
-        mem->vaddr = NULL;
+        if (mem->vaddr) {
+                dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+                mem->vaddr = NULL;
+        }
 }
 EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
 
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 06f9a9c2a39a..2ad0bc252b0e 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -94,7 +94,7 @@ err:
  * must free the memory.
  */
 static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
-                                                int nr_pages, int offset)
+                                        int nr_pages, int offset, size_t size)
 {
         struct scatterlist *sglist;
         int i;
@@ -110,12 +110,14 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
                 /* DMA to highmem pages might not work */
                 goto highmem;
         sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
+        size -= PAGE_SIZE - offset;
         for (i = 1; i < nr_pages; i++) {
                 if (NULL == pages[i])
                         goto nopage;
                 if (PageHighMem(pages[i]))
                         goto highmem;
-                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
+                sg_set_page(&sglist[i], pages[i], min(PAGE_SIZE, size), 0);
+                size -= min(PAGE_SIZE, size);
         }
         return sglist;
 
@@ -170,7 +172,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
 
         first = (data          & PAGE_MASK) >> PAGE_SHIFT;
         last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
-        dma->offset   = data & ~PAGE_MASK;
+        dma->offset = data & ~PAGE_MASK;
+        dma->size = size;
         dma->nr_pages = last-first+1;
         dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
         if (NULL == dma->pages)
@@ -252,7 +255,7 @@ int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
 
         if (dma->pages) {
                 dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
-                                                   dma->offset);
+                                                   dma->offset, dma->size);
         }
         if (dma->vaddr) {
                 dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 714c6b487313..d5f3a3fd2319 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -190,7 +190,6 @@ static int __devexit bh1780_remove(struct i2c_client *client)
 
         ddata = i2c_get_clientdata(client);
         sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        i2c_set_clientdata(client, NULL);
         kfree(ddata);
 
         return 0;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 1c767ade7ef8..77efe462b921 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2431,7 +2431,7 @@ config UGETH_TX_ON_DEMAND
 
 config MV643XX_ETH
         tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
         select INET_LRO
         select PHYLIB
         help
@@ -2806,7 +2806,7 @@ config NIU
 
 config PASEMI_MAC
         tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
         select PHYLIB
         select INET_LRO
         help
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1e620e287ae0..efeffdf9e5fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2170,8 +2170,6 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
         dev->irq = sdev->irq;
         SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
 
-        netif_carrier_off(dev);
-
         err = ssb_bus_powerup(sdev->bus, 0);
         if (err) {
                 dev_err(sdev->dev,
@@ -2213,6 +2211,8 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
                 goto err_out_powerdown;
         }
 
+        netif_carrier_off(dev);
+
         ssb_set_drvdata(sdev, dev);
 
         /* Chip reset provides power to the b44 MAC & PCI cores, which
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                 res = dev_alloc_name(bond_dev, "bond%d");
                 if (res < 0)
                         goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
         }
 
         res = register_netdevice(bond_dev);
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a333b42111b8..6372610ed240 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -533,8 +533,15 @@ static inline void ehea_fill_skb(struct net_device *dev,
         int length = cqe->num_bytes_transfered - 4;     /*remove CRC */
 
         skb_put(skb, length);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
         skb->protocol = eth_type_trans(skb, dev);
+
+        /* The packet was not an IPV4 packet so a complemented checksum was
+           calculated. The value is found in the Internet Checksum field. */
+        if (cqe->status & EHEA_CQE_BLIND_CKSUM) {
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum = csum_unfold(~cqe->inet_checksum_value);
+        } else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
 static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
index f608a6c54af5..38104734a3be 100644
--- a/drivers/net/ehea/ehea_qmr.h
+++ b/drivers/net/ehea/ehea_qmr.h
@@ -150,6 +150,7 @@ struct ehea_rwqe {
 #define EHEA_CQE_TYPE_RQ           0x60
 #define EHEA_CQE_STAT_ERR_MASK     0x700F
 #define EHEA_CQE_STAT_FAT_ERR_MASK 0xF
+#define EHEA_CQE_BLIND_CKSUM       0x8000
 #define EHEA_CQE_STAT_ERR_TCP      0x4000
 #define EHEA_CQE_STAT_ERR_IP       0x2000
 #define EHEA_CQE_STAT_ERR_CRC      0x1000
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 768b840aeb6b..cce32d43175f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -678,24 +678,37 @@ static int fec_enet_mii_probe(struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         struct phy_device *phy_dev = NULL;
-        int ret;
+        char mdio_bus_id[MII_BUS_ID_SIZE];
+        char phy_name[MII_BUS_ID_SIZE + 3];
+        int phy_id;
 
         fep->phy_dev = NULL;
 
-        /* find the first phy */
-        phy_dev = phy_find_first(fep->mii_bus);
-        if (!phy_dev) {
-                printk(KERN_ERR "%s: no PHY found\n", dev->name);
-                return -ENODEV;
+        /* check for attached phy */
+        for (phy_id = 0; (phy_id < PHY_MAX_ADDR); phy_id++) {
+                if ((fep->mii_bus->phy_mask & (1 << phy_id)))
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id] == NULL)
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id]->phy_id == 0)
+                        continue;
+                strncpy(mdio_bus_id, fep->mii_bus->id, MII_BUS_ID_SIZE);
+                break;
         }
 
-        /* attach the mac to the phy */
-        ret = phy_connect_direct(dev, phy_dev,
-                             &fec_enet_adjust_link, 0,
-                             PHY_INTERFACE_MODE_MII);
-        if (ret) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return ret;
+        if (phy_id >= PHY_MAX_ADDR) {
+                printk(KERN_INFO "%s: no PHY, assuming direct connection "
+                        "to switch\n", dev->name);
+                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE);
+                phy_id = 0;
+        }
+
+        snprintf(phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        phy_dev = phy_connect(dev, phy_name, &fec_enet_adjust_link, 0,
+                PHY_INTERFACE_MODE_MII);
+        if (IS_ERR(phy_dev)) {
+                printk(KERN_ERR "%s: could not attach to PHY\n", dev->name);
+                return PTR_ERR(phy_dev);
         }
 
         /* mask with MAC supported features */
@@ -738,7 +751,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         fep->mii_bus->read = fec_enet_mdio_read;
         fep->mii_bus->write = fec_enet_mdio_write;
         fep->mii_bus->reset = fec_enet_mdio_reset;
-        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id);
+        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id + 1);
         fep->mii_bus->priv = fep;
         fep->mii_bus->parent = &pdev->dev;
 
@@ -1311,6 +1324,9 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_mii_init;
 
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(ndev);
+
         ret = register_netdev(ndev);
         if (ret)
                 goto failed_register;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index a0da4a17b025..992db2fa136e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1212,7 +1212,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
                 return;
 
-        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
+        counters = dma_alloc_coherent(&tp->pci_dev->dev, sizeof(*counters),
+                                      &paddr, GFP_KERNEL);
         if (!counters)
                 return;
 
@@ -1233,7 +1234,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
+        dma_free_coherent(&tp->pci_dev->dev, sizeof(*counters), counters,
+                          paddr);
 }
 
 static void rtl8169_get_ethtool_stats(struct net_device *dev,
@@ -3292,15 +3294,15 @@ static int rtl8169_open(struct net_device *dev)
 
         /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
-         * pci_alloc_consistent provides more.
+         * dma_alloc_coherent provides more.
          */
-        tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
-                                               &tp->TxPhyAddr);
+        tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES,
+                                             &tp->TxPhyAddr, GFP_KERNEL);
         if (!tp->TxDescArray)
                 goto err_pm_runtime_put;
 
-        tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
-                                               &tp->RxPhyAddr);
+        tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES,
+                                             &tp->RxPhyAddr, GFP_KERNEL);
         if (!tp->RxDescArray)
                 goto err_free_tx_0;
 
@@ -3334,12 +3336,12 @@ out:
 err_release_ring_2:
         rtl8169_rx_clear(tp);
 err_free_rx_1:
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
         tp->RxDescArray = NULL;
 err_free_tx_0:
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
 err_pm_runtime_put:
         pm_runtime_put_noidle(&pdev->dev);
@@ -3975,7 +3977,7 @@ static void rtl8169_free_rx_skb(struct rtl8169_private *tp,
 {
         struct pci_dev *pdev = tp->pci_dev;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
                          PCI_DMA_FROMDEVICE);
         dev_kfree_skb(*sk_buff);
         *sk_buff = NULL;
@@ -4000,7 +4002,7 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
 static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
                                             struct net_device *dev,
                                             struct RxDesc *desc, int rx_buf_sz,
-                                            unsigned int align)
+                                            unsigned int align, gfp_t gfp)
 {
         struct sk_buff *skb;
         dma_addr_t mapping;
@@ -4008,13 +4010,13 @@ static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
 
         pad = align ? align : NET_IP_ALIGN;
 
-        skb = netdev_alloc_skb(dev, rx_buf_sz + pad);
+        skb = __netdev_alloc_skb(dev, rx_buf_sz + pad, gfp);
         if (!skb)
                 goto err_out;
 
         skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad);
 
-        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
+        mapping = dma_map_single(&pdev->dev, skb->data, rx_buf_sz,
                                  PCI_DMA_FROMDEVICE);
 
         rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
@@ -4039,7 +4041,7 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp)
 }
 
 static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
-                           u32 start, u32 end)
+                           u32 start, u32 end, gfp_t gfp)
 {
         u32 cur;
 
@@ -4054,7 +4056,7 @@ static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
 
                 skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev,
                                            tp->RxDescArray + i,
-                                           tp->rx_buf_sz, tp->align);
+                                           tp->rx_buf_sz, tp->align, gfp);
                 if (!skb)
                         break;
 
@@ -4082,7 +4084,7 @@ static int rtl8169_init_ring(struct net_device *dev)
         memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info));
         memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
 
-        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
+        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC, GFP_KERNEL) != NUM_RX_DESC)
                 goto err_out;
 
         rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
@@ -4099,7 +4101,8 @@ static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb,
 {
         unsigned int len = tx_skb->len;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), len,
+                         PCI_DMA_TODEVICE);
         desc->opts1 = 0x00;
         desc->opts2 = 0x00;
         desc->addr = 0x00;
@@ -4243,7 +4246,8 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
                 txd = tp->TxDescArray + entry;
                 len = frag->size;
                 addr = ((void *) page_address(frag->page)) + frag->page_offset;
-                mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE);
+                mapping = dma_map_single(&tp->pci_dev->dev, addr, len,
+                                         PCI_DMA_TODEVICE);
 
                 /* anti gcc 2.95.3 bugware (sic) */
                 status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC));
@@ -4313,7 +4317,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
                 tp->tx_skb[entry].skb = skb;
         }
 
-        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
+        mapping = dma_map_single(&tp->pci_dev->dev, skb->data, len,
+                                 PCI_DMA_TODEVICE);
 
         tp->tx_skb[entry].len = len;
         txd->addr = cpu_to_le64(mapping);
@@ -4477,8 +4482,8 @@ static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
         if (!skb)
                 goto out;
 
-        pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size,
-                                    PCI_DMA_FROMDEVICE);
+        dma_sync_single_for_cpu(&tp->pci_dev->dev, addr, pkt_size,
+                                PCI_DMA_FROMDEVICE);
         skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size);
         *sk_buff = skb;
         done = true;
@@ -4549,11 +4554,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         rtl8169_rx_csum(skb, desc);
 
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
-                                pci_dma_sync_single_for_device(pdev, addr,
+                                dma_sync_single_for_device(&pdev->dev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
                                 rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
                         } else {
-                                pci_unmap_single(pdev, addr, tp->rx_buf_sz,
+                                dma_unmap_single(&pdev->dev, addr, tp->rx_buf_sz,
                                                  PCI_DMA_FROMDEVICE);
                                 tp->Rx_skbuff[entry] = NULL;
                         }
@@ -4583,7 +4588,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
         count = cur_rx - tp->cur_rx;
         tp->cur_rx = cur_rx;
 
-        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
+        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx, GFP_ATOMIC);
         if (!delta && count)
                 netif_info(tp, intr, dev, "no Rx buffer allocated\n");
         tp->dirty_rx += delta;
@@ -4769,10 +4774,10 @@ static int rtl8169_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
         tp->RxDescArray = NULL;
 
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
         netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
 
+static int only_32bit_dma;
+
 static int __devinit skge_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                 using_dac = 1;
                 err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
         } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
         .shutdown =     skge_shutdown,
 };
 
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
+
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
         skge_debug_init();
         return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc3af78a869f..1ec4b9e0239a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4666,7 +4666,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                                        desc_idx, *post_ptr);
                 drop_it_no_recycle:
                         /* Other statistics kept track of by card. */
-                        tp->net_stats.rx_dropped++;
+                        tp->rx_dropped++;
                         goto next_pkt;
                 }
 
@@ -4726,7 +4726,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 if (len > (tp->dev->mtu + ETH_HLEN) &&
                     skb->protocol != htons(ETH_P_8021Q)) {
                         dev_kfree_skb(skb);
-                        goto next_pkt;
+                        goto drop_it_no_recycle;
                 }
 
                 if (desc->type_flags & RXD_FLAG_VLAN &&
@@ -9240,6 +9240,8 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
+        stats->rx_dropped = tp->rx_dropped;
+
         return stats;
 }
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..be7ff138a7f9 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2759,7 +2759,7 @@ struct tg3 {
 
 
         /* begin "everything else" cacheline(s) section */
-        struct rtnl_link_stats64        net_stats;
+        unsigned long                   rx_dropped;
         struct rtnl_link_stats64        net_stats_prev;
         struct tg3_ethtool_stats        estats;
         struct tg3_ethtool_stats        estats_prev;
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 8cc9e319f435..1737d1488b35 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         int i, result;
         struct device *dev = i2400m_dev(i2400m);
         const struct i2400m_msg_hdr *msg_hdr;
-        size_t pl_itr, pl_size, skb_len;
+        size_t pl_itr, pl_size;
         unsigned long flags;
-        unsigned num_pls, single_last;
+        unsigned num_pls, single_last, skb_len;
 
         skb_len = skb->len;
-        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
                   i2400m, skb, skb_len);
         result = -EIO;
         msg_hdr = (void *) skb->data;
-        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
         if (result < 0)
                 goto error_msg_hdr_check;
         result = -EIO;
@@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
                 num_pls * sizeof(msg_hdr->pld[0]);
         pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
-        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+        if (pl_itr > skb_len) { /* got all the payload descriptors? */
                 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
                         "%u payload descriptors (%zu each, total %zu)\n",
-                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                        skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
                 goto error_pl_descr_short;
         }
         /* Walk each payload payload--check we really got it */
@@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
                 /* work around old gcc warnings */
                 pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
                 result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
-                                                  pl_itr, skb->len);
+                                                  pl_itr, skb_len);
                 if (result < 0)
                         goto error_pl_descr_check;
                 single_last = num_pls == 1 || i == num_pls - 1;
@@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         if (i < i2400m->rx_pl_min)
                 i2400m->rx_pl_min = i;
         i2400m->rx_num++;
-        i2400m->rx_size_acc += skb->len;
-        if (skb->len < i2400m->rx_size_min)
-                i2400m->rx_size_min = skb->len;
-        if (skb->len > i2400m->rx_size_max)
-                i2400m->rx_size_max = skb->len;
+        i2400m->rx_size_acc += skb_len;
+        if (skb_len < i2400m->rx_size_min)
+                i2400m->rx_size_min = skb_len;
+        if (skb_len > i2400m->rx_size_max)
+                i2400m->rx_size_max = skb_len;
         spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 error_pl_descr_check:
 error_pl_descr_short:
 error_msg_hdr_check:
-        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+        d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
                 i2400m, skb, skb_len, result);
         return result;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..a3d95cca8f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -543,7 +543,7 @@ static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
         if (conf_is_ht40(conf))
                 return clockrate * 2;
 
-        return clockrate * 2;
+        return clockrate;
 }
 
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 9024480a8228..c44a5e8b8b82 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -51,7 +51,6 @@
  * TODO:
  *   - handle CPU hotplug
  *   - provide turbo enable/disable api
- *   - make sure we can write turbo enable/disable reg based on MISC_EN
  *
  * Related documents:
  *   - CDI 403777, 403778 - Auburndale EDS vol 1 & 2
@@ -230,7 +229,7 @@
 #define THM_TC2         0xac
 #define THM_DTV         0xb0
 #define THM_ITV         0xd8
-#define   ITV_ME_SEQNO_MASK 0x000f0000 /* ME should update every ~200ms */
+#define   ITV_ME_SEQNO_MASK 0x00ff0000 /* ME should update every ~200ms */
 #define   ITV_ME_SEQNO_SHIFT (16)
 #define   ITV_MCH_TEMP_MASK 0x0000ff00
 #define   ITV_MCH_TEMP_SHIFT (8)
@@ -325,6 +324,7 @@ struct ips_driver {
         bool gpu_preferred;
         bool poll_turbo_status;
         bool second_cpu;
+        bool turbo_toggle_allowed;
         struct ips_mcp_limits *limits;
 
         /* Optional MCH interfaces for if i915 is in use */
@@ -415,7 +415,7 @@ static void ips_cpu_lower(struct ips_driver *ips)
         new_limit = cur_limit - 8; /* 1W decrease */
 
         /* Clamp to SKU TDP limit */
-        if (((new_limit * 10) / 8) < (ips->orig_turbo_limit & TURBO_TDP_MASK))
+        if (new_limit  < (ips->orig_turbo_limit & TURBO_TDP_MASK))
                 new_limit = ips->orig_turbo_limit & TURBO_TDP_MASK;
 
         thm_writew(THM_MPCPC, (new_limit * 10) / 8);
@@ -461,7 +461,8 @@ static void ips_enable_cpu_turbo(struct ips_driver *ips)
         if (ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_enable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_enable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = true;
 }
@@ -498,7 +499,8 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
         if (!ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_disable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_disable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = false;
 }
@@ -598,17 +600,29 @@ static bool mcp_exceeded(struct ips_driver *ips)
 {
         unsigned long flags;
         bool ret = false;
+        u32 temp_limit;
+        u32 avg_power;
+        const char *msg = "MCP limit exceeded: ";
 
         spin_lock_irqsave(&ips->turbo_status_lock, flags);
-        if (ips->mcp_avg_temp > (ips->mcp_temp_limit * 100))
-                ret = true;
-        if (ips->cpu_avg_power + ips->mch_avg_power > ips->mcp_power_limit)
+
+        temp_limit = ips->mcp_temp_limit * 100;
+        if (ips->mcp_avg_temp > temp_limit) {
+                dev_info(&ips->dev->dev,
+                        "%sAvg temp %u, limit %u\n", msg, ips->mcp_avg_temp,
+                        temp_limit);
                 ret = true;
-        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
+        }
 
-        if (ret)
+        avg_power = ips->cpu_avg_power + ips->mch_avg_power;
+        if (avg_power > ips->mcp_power_limit) {
                 dev_info(&ips->dev->dev,
-                         "MCP power or thermal limit exceeded\n");
+                        "%sAvg power %u, limit %u\n", msg, avg_power,
+                        ips->mcp_power_limit);
+                ret = true;
+        }
+
+        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
 
         return ret;
 }
@@ -663,6 +677,27 @@ static bool mch_exceeded(struct ips_driver *ips)
 }
 
 /**
+ * verify_limits - verify BIOS provided limits
+ * @ips: IPS structure
+ *
+ * BIOS can optionally provide non-default limits for power and temp.  Check
+ * them here and use the defaults if the BIOS values are not provided or
+ * are otherwise unusable.
+ */
+static void verify_limits(struct ips_driver *ips)
+{
+        if (ips->mcp_power_limit < ips->limits->mcp_power_limit ||
+            ips->mcp_power_limit > 35000)
+                ips->mcp_power_limit = ips->limits->mcp_power_limit;
+
+        if (ips->mcp_temp_limit < ips->limits->core_temp_limit ||
+            ips->mcp_temp_limit < ips->limits->mch_temp_limit ||
+            ips->mcp_temp_limit > 150)
+                ips->mcp_temp_limit = min(ips->limits->core_temp_limit,
+                                          ips->limits->mch_temp_limit);
+}
+
+/**
  * update_turbo_limits - get various limits & settings from regs
  * @ips: IPS driver struct
  *
@@ -680,12 +715,21 @@ static void update_turbo_limits(struct ips_driver *ips)
         u32 hts = thm_readl(THM_HTS);
 
         ips->cpu_turbo_enabled = !(hts & HTS_PCTD_DIS);
-        ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+        /* 
+         * Disable turbo for now, until we can figure out why the power figures
+         * are wrong
+         */
+        ips->cpu_turbo_enabled = false;
+
+        if (ips->gpu_busy)
+                ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+
         ips->core_power_limit = thm_readw(THM_MPCPC);
         ips->mch_power_limit = thm_readw(THM_MMGPC);
         ips->mcp_temp_limit = thm_readw(THM_PTL);
         ips->mcp_power_limit = thm_readw(THM_MPPC);
 
+        verify_limits(ips);
         /* Ignore BIOS CPU vs GPU pref */
 }
 
@@ -858,7 +902,7 @@ static u32 get_cpu_power(struct ips_driver *ips, u32 *last, int period)
         ret = (ret * 1000) / 65535;
         *last = val;
 
-        return ret;
+        return 0;
 }
 
 static const u16 temp_decay_factor = 2;
@@ -940,7 +984,6 @@ static int ips_monitor(void *data)
                 kfree(mch_samples);
                 kfree(cpu_samples);
                 kfree(mchp_samples);
-                kthread_stop(ips->adjust);
                 return -ENOMEM;
         }
 
@@ -948,7 +991,7 @@ static int ips_monitor(void *data)
                 ITV_ME_SEQNO_SHIFT;
         seqno_timestamp = get_jiffies_64();
 
-        old_cpu_power = thm_readl(THM_CEC) / 65535;
+        old_cpu_power = thm_readl(THM_CEC);
         schedule_timeout_interruptible(msecs_to_jiffies(IPS_SAMPLE_PERIOD));
 
         /* Collect an initial average */
@@ -1150,11 +1193,18 @@ static irqreturn_t ips_irq_handler(int irq, void *arg)
                                 STS_GPL_SHIFT;
                         /* ignore EC CPU vs GPU pref */
                         ips->cpu_turbo_enabled = !(sts & STS_PCTD_DIS);
-                        ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
+                        /* 
+                         * Disable turbo for now, until we can figure
+                         * out why the power figures are wrong
+                         */
+                        ips->cpu_turbo_enabled = false;
+                        if (ips->gpu_busy)
+                                ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
                         ips->mcp_temp_limit = (sts & STS_PTL_MASK) >>
                                 STS_PTL_SHIFT;
                         ips->mcp_power_limit = (tc1 & STS_PPL_MASK) >>
                                 STS_PPL_SHIFT;
+                        verify_limits(ips);
                         spin_unlock(&ips->turbo_status_lock);
 
                         thm_writeb(THM_SEC, SEC_ACK);
@@ -1333,8 +1383,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
          * turbo manually or we'll get an illegal MSR access, even though
          * turbo will still be available.
          */
-        if (!(misc_en & IA32_MISC_TURBO_EN))
-                ; /* add turbo MSR write allowed flag if necessary */
+        if (misc_en & IA32_MISC_TURBO_EN)
+                ips->turbo_toggle_allowed = true;
+        else
+                ips->turbo_toggle_allowed = false;
 
         if (strstr(boot_cpu_data.x86_model_id, "CPU       M"))
                 limits = &ips_sv_limits;
@@ -1351,9 +1403,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
         tdp = turbo_power & TURBO_TDP_MASK;
 
         /* Sanity check TDP against CPU */
-        if (limits->mcp_power_limit != (tdp / 8) * 1000) {
-                dev_warn(&ips->dev->dev, "Warning: CPU TDP doesn't match expected value (found %d, expected %d)\n",
-                         tdp / 8, limits->mcp_power_limit / 1000);
+        if (limits->core_power_limit != (tdp / 8) * 1000) {
+                dev_info(&ips->dev->dev, "CPU TDP doesn't match expected value (found %d, expected %d)\n",
+                         tdp / 8, limits->core_power_limit / 1000);
+                limits->core_power_limit = (tdp / 8) * 1000;
         }
 
 out:
@@ -1390,7 +1443,7 @@ static bool ips_get_i915_syms(struct ips_driver *ips)
         return true;
 
 out_put_busy:
-        symbol_put(i915_gpu_turbo_disable);
+        symbol_put(i915_gpu_busy);
 out_put_lower:
         symbol_put(i915_gpu_lower);
 out_put_raise:
@@ -1532,22 +1585,27 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         /* Save turbo limits & ratios */
         rdmsrl(TURBO_POWER_CURRENT_LIMIT, ips->orig_turbo_limit);
 
-        ips_enable_cpu_turbo(ips);
-        ips->cpu_turbo_enabled = true;
+        ips_disable_cpu_turbo(ips);
+        ips->cpu_turbo_enabled = false;
 
-        /* Set up the work queue and monitor/adjust threads */
-        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
-        if (IS_ERR(ips->monitor)) {
+        /* Create thermal adjust thread */
+        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
+        if (IS_ERR(ips->adjust)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal monitor thread, aborting\n");
+                        "failed to create thermal adjust thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_free_irq;
+
         }
 
-        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
-        if (IS_ERR(ips->adjust)) {
+        /*
+         * Set up the work queue and monitor thread. The monitor thread
+         * will wake up ips_adjust thread.
+         */
+        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        if (IS_ERR(ips->monitor)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal adjust thread, aborting\n");
+                        "failed to create thermal monitor thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_thread_cleanup;
         }
@@ -1566,7 +1624,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         return ret;
 
 error_thread_cleanup:
-        kthread_stop(ips->monitor);
+        kthread_stop(ips->adjust);
 error_free_irq:
         free_irq(ips->dev->irq, ips);
 error_unmap:
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index df1fb53c09d2..a4be41614eeb 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -256,7 +256,6 @@ static int __devexit ad5398_remove(struct i2c_client *client)
 
         regulator_unregister(chip->rdev);
         kfree(chip);
-        i2c_set_clientdata(client, NULL);
 
         return 0;
 }
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index d61ecb885a8c..b8cc6389a541 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -191,8 +191,6 @@ static int __devexit isl6271a_remove(struct i2c_client *i2c)
         struct isl_pmic *pmic = i2c_get_clientdata(i2c);
         int i;
 
-        i2c_set_clientdata(i2c, NULL);
-
         for (i = 0; i < 3; i++)
                 regulator_unregister(pmic->rdev[i]);
 
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 9daed8db83d3..9de8516e3531 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -268,7 +268,6 @@ out_irq:
                 free_irq(client->irq, client);
 
 out_free:
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return ret;
 }
@@ -287,7 +286,6 @@ static int __devexit ds3232_remove(struct i2c_client *client)
         }
 
         rtc_device_unregister(ds3232->rtc);
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return 0;
 }
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 12900f7083b0..3198c5335f0b 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -458,6 +458,7 @@ config SERIAL_SAMSUNG_UARTS
         int
         depends on ARM && PLAT_SAMSUNG
         default 2 if ARCH_S3C2400
+        default 6 if ARCH_S5P6450
         default 4 if SERIAL_SAMSUNG_UARTS_4
         default 3
         help
@@ -526,12 +527,12 @@ config SERIAL_S3C24A0
           Serial port support for the Samsung S3C24A0 SoC
 
 config SERIAL_S3C6400
-        tristate "Samsung S3C6400/S3C6410/S5P6440/S5PC100 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440 || CPU_S5PC100)
+        tristate "Samsung S3C6400/S3C6410/S5P6440/S5P6450/S5PC100 Serial port support"
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440 || CPU_S5P6450 || CPU_S5PC100)
         select SERIAL_SAMSUNG_UARTS_4
         default y
         help
-          Serial port support for the Samsung S3C6400, S3C6410, S5P6440
+          Serial port support for the Samsung S3C6400, S3C6410, S5P6440, S5P6450
           and S5PC100 SoCs
 
 config SERIAL_S5PV210
diff --git a/drivers/serial/samsung.c b/drivers/serial/samsung.c
index b1156ba8ad14..7ac2bf5167cd 100644
--- a/drivers/serial/samsung.c
+++ b/drivers/serial/samsung.c
@@ -1101,7 +1101,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
         dbg("resource %p (%lx..%lx)\n", res, res->start, res->end);
 
         port->mapbase = res->start;
-        port->membase = S3C_VA_UART + res->start - (S3C_PA_UART & 0xfff00000);
+        port->membase = S3C_VA_UART + (res->start & 0xfffff);
         ret = platform_get_irq(platdev, 0);
         if (ret < 0)
                 port->irq = 0;
diff --git a/drivers/staging/tm6000/Kconfig b/drivers/staging/tm6000/Kconfig
index c725356cc346..de7ebb99d8f6 100644
--- a/drivers/staging/tm6000/Kconfig
+++ b/drivers/staging/tm6000/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_TM6000
         tristate "TV Master TM5600/6000/6010 driver"
-        depends on VIDEO_DEV && I2C && INPUT && USB && EXPERIMENTAL
+        depends on VIDEO_DEV && I2C && INPUT && IR_CORE && USB && EXPERIMENTAL
         select VIDEO_TUNER
         select MEDIA_TUNER_XC2028
         select MEDIA_TUNER_XC5000
diff --git a/drivers/staging/tm6000/tm6000-input.c b/drivers/staging/tm6000/tm6000-input.c
index 32f7a0af6938..54f7667cc706 100644
--- a/drivers/staging/tm6000/tm6000-input.c
+++ b/drivers/staging/tm6000/tm6000-input.c
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(enable_ir, "enable ir (default is enable");
         }
 
 struct tm6000_ir_poll_result {
-        u8 rc_data[4];
+        u16 rc_data;
 };
 
 struct tm6000_IR {
@@ -60,9 +60,9 @@ struct tm6000_IR {
         int                     polling;
         struct delayed_work     work;
         u8                      wait:1;
+        u8                      key:1;
         struct urb              *int_urb;
         u8                      *urb_data;
-        u8                      key:1;
 
         int (*get_key) (struct tm6000_IR *, struct tm6000_ir_poll_result *);
 
@@ -122,13 +122,14 @@ static void tm6000_ir_urb_received(struct urb *urb)
 
         if (urb->status != 0)
                 printk(KERN_INFO "not ready\n");
-        else if (urb->actual_length > 0)
+        else if (urb->actual_length > 0) {
                 memcpy(ir->urb_data, urb->transfer_buffer, urb->actual_length);
 
-        dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
-        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
+                dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
+                        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
 
-        ir->key = 1;
+                ir->key = 1;
+        }
 
         rc = usb_submit_urb(urb, GFP_ATOMIC);
 }
@@ -140,30 +141,47 @@ static int default_polling_getkey(struct tm6000_IR *ir,
         int rc;
         u8 buf[2];
 
-        if (ir->wait && !&dev->int_in) {
-                poll_result->rc_data[0] = 0xff;
+        if (ir->wait && !&dev->int_in)
                 return 0;
-        }
 
         if (&dev->int_in) {
-                poll_result->rc_data[0] = ir->urb_data[0];
-                poll_result->rc_data[1] = ir->urb_data[1];
+                if (ir->ir.ir_type == IR_TYPE_RC5)
+                        poll_result->rc_data = ir->urb_data[0];
+                else
+                        poll_result->rc_data = ir->urb_data[0] | ir->urb_data[1] << 8;
         } else {
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 0);
                 msleep(10);
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 1);
                 msleep(10);
 
-                rc = tm6000_read_write_usb(dev, USB_DIR_IN | USB_TYPE_VENDOR |
-                 USB_RECIP_DEVICE, REQ_02_GET_IR_CODE, 0, 0, buf, 1);
+                if (ir->ir.ir_type == IR_TYPE_RC5) {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 1);
 
-                msleep(10);
+                        msleep(10);
 
-                dprintk("read data=%02x\n", buf[0]);
-                if (rc < 0)
-                        return rc;
+                        dprintk("read data=%02x\n", buf[0]);
+                        if (rc < 0)
+                                return rc;
 
-                poll_result->rc_data[0] = buf[0];
+                        poll_result->rc_data = buf[0];
+                } else {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 2);
+
+                        msleep(10);
+
+                        dprintk("read data=%04x\n", buf[0] | buf[1] << 8);
+                        if (rc < 0)
+                                return rc;
+
+                        poll_result->rc_data = buf[0] | buf[1] << 8;
+                }
+                if ((poll_result->rc_data & 0x00ff) != 0xff)
+                        ir->key = 1;
         }
         return 0;
 }
@@ -180,12 +198,11 @@ static void tm6000_ir_handle_key(struct tm6000_IR *ir)
                 return;
         }
 
-        dprintk("ir->get_key result data=%02x %02x\n",
-                poll_result.rc_data[0], poll_result.rc_data[1]);
+        dprintk("ir->get_key result data=%04x\n", poll_result.rc_data);
 
-        if (poll_result.rc_data[0] != 0xff && ir->key == 1) {
+        if (ir->key) {
                 ir_input_keydown(ir->input->input_dev, &ir->ir,
-                        poll_result.rc_data[0] | poll_result.rc_data[1] << 8);
+                                (u32)poll_result.rc_data);
 
                 ir_input_nokey(ir->input->input_dev, &ir->ir);
                 ir->key = 0;