174 files changed, 3322 insertions, 1452 deletions
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index bfd55b085ae6..9f029595f454 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -44,6 +44,7 @@
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
+#include <linux/dmi.h>
 #define DRV_NAME        "sata_sil"
 #define DRV_VERSION     "2.4"
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 55e530942ab0..f3eae630e589 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1280,7 +1280,7 @@ EXPORT_SYMBOL_GPL(__root_device_register);
 /**
 * root_device_unregister - unregister and free a root device
- * @root: device going away.
+ * @dev: device going away
 *
 * This function unregisters and cleans up a device that was created by
 * root_device_register().
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index f29fbe9b8ed7..cb8ca5698963 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
        /* Allocate a new buffer before freeing the old one ... */
        multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
-        bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
+        bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
        if (!bp) {
                printk(KERN_WARNING "selection: kmalloc() failed\n");
                clear_selection();
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 6bd91a15d5e6..7be2cf3514e7 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -232,7 +232,7 @@ fw_card_bm_work(struct work_struct *work)
        root_id = root_node->node_id;
        grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
-        if (card->bm_generation + 1 == generation ||
+        if (is_next_generation(generation, card->bm_generation) ||
            (card->bm_generation != generation && grace)) {
                /*
                 * This first step is to figure out who is IRM and
@@ -512,7 +512,7 @@ fw_core_remove_card(struct fw_card *card)
        fw_core_initiate_bus_reset(card, 1);
        mutex_lock(&card_mutex);
-        list_del(&card->link);
+        list_del_init(&card->link);
        mutex_unlock(&card_mutex);
        /* Set up the dummy driver. */
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index 2af5a8d1e012..bf53acb45652 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -25,6 +25,7 @@
 #include <linux/device.h>
 #include <linux/delay.h>
 #include <linux/idr.h>
+#include <linux/jiffies.h>
 #include <linux/string.h>
 #include <linux/rwsem.h>
 #include <linux/semaphore.h>
@@ -634,12 +635,39 @@ struct fw_device *fw_device_get_by_devt(dev_t devt)
        return device;
 }
+/*
+ * These defines control the retry behavior for reading the config
+ * rom.  It shouldn't be necessary to tweak these; if the device
+ * doesn't respond to a config rom read within 10 seconds, it's not
+ * going to respond at all.  As for the initial delay, a lot of
+ * devices will be able to respond within half a second after bus
+ * reset.  On the other hand, it's not really worth being more
+ * aggressive than that, since it scales pretty well; if 10 devices
+ * are plugged in, they're all getting read within one second.
+ */
+#define MAX_RETRIES     10
+#define RETRY_DELAY     (3 * HZ)
+#define INITIAL_DELAY   (HZ / 2)
+#define SHUTDOWN_DELAY  (2 * HZ)
 static void fw_device_shutdown(struct work_struct *work)
 {
        struct fw_device *device =
                container_of(work, struct fw_device, work.work);
        int minor = MINOR(device->device.devt);
+        if (time_is_after_jiffies(device->card->reset_jiffies + SHUTDOWN_DELAY)
+            && !list_empty(&device->card->link)) {
+                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
+                return;
+        }
+        if (atomic_cmpxchg(&device->state,
+                           FW_DEVICE_GONE,
+                           FW_DEVICE_SHUTDOWN) != FW_DEVICE_GONE)
+                return;
        fw_device_cdev_remove(device);
        device_for_each_child(&device->device, NULL, shutdown_unit);
        device_unregister(&device->device);
@@ -647,6 +675,7 @@ static void fw_device_shutdown(struct work_struct *work)
        down_write(&fw_device_rwsem);
        idr_remove(&fw_device_idr, minor);
        up_write(&fw_device_rwsem);
        fw_device_put(device);
 }
@@ -654,25 +683,63 @@ static struct device_type fw_device_type = {
        .release        = fw_device_release,
 };
+static void fw_device_update(struct work_struct *work);
 /*
- * These defines control the retry behavior for reading the config
+ * If a device was pending for deletion because its node went away but its
- * rom.  It shouldn't be necessary to tweak these; if the device
+ * bus info block and root directory header matches that of a newly discovered
- * doesn't respond to a config rom read within 10 seconds, it's not
+ * device, revive the existing fw_device.
- * going to respond at all.  As for the initial delay, a lot of
+ * The newly allocated fw_device becomes obsolete instead.
- * devices will be able to respond within half a second after bus
- * reset.  On the other hand, it's not really worth being more
- * aggressive than that, since it scales pretty well; if 10 devices
- * are plugged in, they're all getting read within one second.
 */
+static int lookup_existing_device(struct device *dev, void *data)
+{
+        struct fw_device *old = fw_device(dev);
+        struct fw_device *new = data;
+        struct fw_card *card = new->card;
+        int match = 0;
+        down_read(&fw_device_rwsem); /* serialize config_rom access */
+        spin_lock_irq(&card->lock);  /* serialize node access */
+        if (memcmp(old->config_rom, new->config_rom, 6 * 4) == 0 &&
+            atomic_cmpxchg(&old->state,
+                           FW_DEVICE_GONE,
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
+                struct fw_node *current_node = new->node;
+                struct fw_node *obsolete_node = old->node;
+                new->node = obsolete_node;
+                new->node->data = new;
+                old->node = current_node;
+                old->node->data = old;
+                old->max_speed = new->max_speed;
+                old->node_id = current_node->node_id;
+                smp_wmb();  /* update node_id before generation */
+                old->generation = card->generation;
+                old->config_rom_retries = 0;
+                fw_notify("rediscovered device %s\n", dev_name(dev));
-#define MAX_RETRIES     10
+                PREPARE_DELAYED_WORK(&old->work, fw_device_update);
-#define RETRY_DELAY     (3 * HZ)
+                schedule_delayed_work(&old->work, 0);
-#define INITIAL_DELAY   (HZ / 2)
+                if (current_node == card->root_node)
+                        fw_schedule_bm_work(card, 0);
+                match = 1;
+        }
+        spin_unlock_irq(&card->lock);
+        up_read(&fw_device_rwsem);
+        return match;
+}
 static void fw_device_init(struct work_struct *work)
 {
        struct fw_device *device =
                container_of(work, struct fw_device, work.work);
+        struct device *revived_dev;
        int minor, err;
        /*
@@ -696,6 +763,15 @@ static void fw_device_init(struct work_struct *work)
                return;
        }
+        revived_dev = device_find_child(device->card->device,
+                                        device, lookup_existing_device);
+        if (revived_dev) {
+                put_device(revived_dev);
+                fw_device_release(&device->device);
+                return;
+        }
        device_initialize(&device->device);
        fw_device_get(device);
@@ -734,9 +810,10 @@ static void fw_device_init(struct work_struct *work)
         * fw_node_event().
         */
        if (atomic_cmpxchg(&device->state,
-                    FW_DEVICE_INITIALIZING,
+                           FW_DEVICE_INITIALIZING,
-                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN) {
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
-                fw_device_shutdown(work);
+                PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
        } else {
                if (device->config_rom_retries)
                        fw_notify("created device %s: GUID %08x%08x, S%d00, "
@@ -847,8 +924,8 @@ static void fw_device_refresh(struct work_struct *work)
        case REREAD_BIB_UNCHANGED:
                if (atomic_cmpxchg(&device->state,
-                            FW_DEVICE_INITIALIZING,
+                                   FW_DEVICE_INITIALIZING,
-                            FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+                                   FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
                        goto gone;
                fw_device_update(work);
@@ -879,8 +956,8 @@ static void fw_device_refresh(struct work_struct *work)
        create_units(device);
        if (atomic_cmpxchg(&device->state,
-                    FW_DEVICE_INITIALIZING,
+                           FW_DEVICE_INITIALIZING,
-                    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+                           FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
                goto gone;
        fw_notify("refreshed device %s\n", dev_name(&device->device));
@@ -890,8 +967,9 @@ static void fw_device_refresh(struct work_struct *work)
 give_up:
        fw_notify("giving up on refresh of device %s\n", dev_name(&device->device));
 gone:
-        atomic_set(&device->state, FW_DEVICE_SHUTDOWN);
+        atomic_set(&device->state, FW_DEVICE_GONE);
-        fw_device_shutdown(work);
+        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+        schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
 out:
        if (node_id == card->root_node->node_id)
                fw_schedule_bm_work(card, 0);
@@ -995,9 +1073,10 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 */
                device = node->data;
                if (atomic_xchg(&device->state,
-                                FW_DEVICE_SHUTDOWN) == FW_DEVICE_RUNNING) {
+                                FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
                        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
-                        schedule_delayed_work(&device->work, 0);
+                        schedule_delayed_work(&device->work,
+                                list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                }
                break;
        }
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index df51732608d9..8ef6ec2ca21c 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -28,6 +28,7 @@
 enum fw_device_state {
        FW_DEVICE_INITIALIZING,
        FW_DEVICE_RUNNING,
+        FW_DEVICE_GONE,
        FW_DEVICE_SHUTDOWN,
 };
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index ab9c01e462ef..6d19828a93a5 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -226,7 +226,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
 #define CONTEXT_DEAD    0x0800
 #define CONTEXT_ACTIVE  0x0400
-#define OHCI1394_MAX_AT_REQ_RETRIES     0x2
+#define OHCI1394_MAX_AT_REQ_RETRIES     0xf
 #define OHCI1394_MAX_AT_RESP_RETRIES    0x2
 #define OHCI1394_MAX_PHYS_RESP_RETRIES  0x8
@@ -896,11 +896,11 @@ static void context_stop(struct context *ctx)
        for (i = 0; i < 10; i++) {
                reg = reg_read(ctx->ohci, CONTROL_SET(ctx->regs));
                if ((reg & CONTEXT_ACTIVE) == 0)
-                        break;
+                        return;
-                fw_notify("context_stop: still active (0x%08x)\n", reg);
                mdelay(1);
        }
+        fw_error("Error: DMA context still active (0x%08x)\n", reg);
 }
 struct driver_data {
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index e88d5067448c..c71c4419d9e8 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -168,6 +168,7 @@ struct sbp2_target {
        int address_high;
        unsigned int workarounds;
        unsigned int mgt_orb_timeout;
+        unsigned int max_payload;
        int dont_block; /* counter for each logical unit */
        int blocked;    /* ditto */
@@ -310,14 +311,16 @@ struct sbp2_command_orb {
        dma_addr_t page_table_bus;
 };
+#define SBP2_ROM_VALUE_WILDCARD ~0         /* match all */
+#define SBP2_ROM_VALUE_MISSING  0xff000000 /* not present in the unit dir. */
 /*
 * List of devices with known bugs.
 *
 * The firmware_revision field, masked with 0xffff00, is the best
 * indicator for the type of bridge chip of a device.  It yields a few
 * false positives but this did not break correctly behaving devices
- * so far.  We use ~0 as a wildcard, since the 24 bit values we get
+ * so far.
- * from the config rom can never match that.
 */
 static const struct {
        u32 firmware_revision;
@@ -339,33 +342,35 @@ static const struct {
        },
        /* Initio bridges, actually only needed for some older ones */ {
                .firmware_revision      = 0x000200,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
        },
        /* PL-3507 bridge with Prolific firmware */ {
                .firmware_revision      = 0x012800,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Symbios bridge */ {
                .firmware_revision      = 0xa0b800,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
                .firmware_revision      = 0x002600,
-                .model                  = ~0,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /*
-         * There are iPods (2nd gen, 3rd gen) with model_id == 0, but
+         * iPod 2nd generation: needs 128k max transfer size workaround
-         * these iPods do not feature the read_capacity bug according
+         * iPod 3rd generation: needs fix capacity workaround
-         * to one report.  Read_capacity behaviour as well as model_id
-         * could change due to Apple-supplied firmware updates though.
         */
+        {
-        /* iPod 4th generation. */ {
+                .firmware_revision      = 0x0a2700,
+                .model                  = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
+                                          SBP2_WORKAROUND_FIX_CAPACITY,
+        },
+        /* iPod 4th generation */ {
                .firmware_revision      = 0x0a2700,
                .model                  = 0x000021,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
@@ -1092,7 +1097,7 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
                        continue;
                if (sbp2_workarounds_table[i].model != model &&
-                    sbp2_workarounds_table[i].model != ~0)
+                    sbp2_workarounds_table[i].model != SBP2_ROM_VALUE_WILDCARD)
                        continue;
                w |= sbp2_workarounds_table[i].workarounds;
@@ -1142,20 +1147,28 @@ static int sbp2_probe(struct device *dev)
        fw_device_get(device);
        fw_unit_get(unit);
-        /* Initialize to values that won't match anything in our table. */
-        firmware_revision = 0xff000000;
-        model = 0xff000000;
        /* implicit directory ID */
        tgt->directory_id = ((unit->directory - device->config_rom) * 4
                             + CSR_CONFIG_ROM) & 0xffffff;
+        firmware_revision = SBP2_ROM_VALUE_MISSING;
+        model             = SBP2_ROM_VALUE_MISSING;
        if (sbp2_scan_unit_dir(tgt, unit->directory, &model,
                               &firmware_revision) < 0)
                goto fail_tgt_put;
        sbp2_init_workarounds(tgt, model, firmware_revision);
+        /*
+         * At S100 we can do 512 bytes per packet, at S200 1024 bytes,
+         * and so on up to 4096 bytes.  The SBP-2 max_payload field
+         * specifies the max payload size as 2 ^ (max_payload + 2), so
+         * if we set this to max_speed + 7, we get the right value.
+         */
+        tgt->max_payload = min(device->max_speed + 7, 10U);
+        tgt->max_payload = min(tgt->max_payload, device->card->max_receive - 1);
        /* Do the login in a workqueue so we can easily reschedule retries. */
        list_for_each_entry(lu, &tgt->lu_list, link)
                sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
@@ -1273,6 +1286,19 @@ static struct fw_driver sbp2_driver = {
        .id_table = sbp2_id_table,
 };
+static void sbp2_unmap_scatterlist(struct device *card_device,
+                                   struct sbp2_command_orb *orb)
+{
+        if (scsi_sg_count(orb->cmd))
+                dma_unmap_sg(card_device, scsi_sglist(orb->cmd),
+                             scsi_sg_count(orb->cmd),
+                             orb->cmd->sc_data_direction);
+        if (orb->request.misc & cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT))
+                dma_unmap_single(card_device, orb->page_table_bus,
+                                 sizeof(orb->page_table), DMA_TO_DEVICE);
+}
 static unsigned int
 sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
 {
@@ -1352,15 +1378,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
        dma_unmap_single(device->card->device, orb->base.request_bus,
                         sizeof(orb->request), DMA_TO_DEVICE);
+        sbp2_unmap_scatterlist(device->card->device, orb);
-        if (scsi_sg_count(orb->cmd) > 0)
-                dma_unmap_sg(device->card->device, scsi_sglist(orb->cmd),
-                             scsi_sg_count(orb->cmd),
-                             orb->cmd->sc_data_direction);
-        if (orb->page_table_bus != 0)
-                dma_unmap_single(device->card->device, orb->page_table_bus,
-                                 sizeof(orb->page_table), DMA_TO_DEVICE);
        orb->cmd->result = result;
        orb->done(orb->cmd);
@@ -1434,7 +1452,6 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        struct sbp2_logical_unit *lu = cmd->device->hostdata;
        struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
        struct sbp2_command_orb *orb;
-        unsigned int max_payload;
        int generation, retval = SCSI_MLQUEUE_HOST_BUSY;
        /*
@@ -1462,17 +1479,9 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        orb->done = done;
        orb->cmd  = cmd;
-        orb->request.next.high   = cpu_to_be32(SBP2_ORB_NULL);
+        orb->request.next.high = cpu_to_be32(SBP2_ORB_NULL);
-        /*
-         * At speed 100 we can do 512 bytes per packet, at speed 200,
-         * 1024 bytes per packet etc.  The SBP-2 max_payload field
-         * specifies the max payload size as 2 ^ (max_payload + 2), so
-         * if we set this to max_speed + 7, we get the right value.
-         */
-        max_payload = min(device->max_speed + 7,
-                          device->card->max_receive - 1);
        orb->request.misc = cpu_to_be32(
-                COMMAND_ORB_MAX_PAYLOAD(max_payload) |
+                COMMAND_ORB_MAX_PAYLOAD(lu->tgt->max_payload) |
                COMMAND_ORB_SPEED(device->max_speed) |
                COMMAND_ORB_NOTIFY);
@@ -1491,8 +1500,10 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
        orb->base.request_bus =
                dma_map_single(device->card->device, &orb->request,
                               sizeof(orb->request), DMA_TO_DEVICE);
-        if (dma_mapping_error(device->card->device, orb->base.request_bus))
+        if (dma_mapping_error(device->card->device, orb->base.request_bus)) {
+                sbp2_unmap_scatterlist(device->card->device, orb);
                goto out;
+        }
        sbp2_send_orb(&orb->base, lu, lu->tgt->node_id, generation,
                      lu->command_block_agent_address + SBP2_ORB_POINTER);
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
index c9be6e6948c4..8dd6703b55cd 100644
--- a/drivers/firewire/fw-topology.c
+++ b/drivers/firewire/fw-topology.c
@@ -518,6 +518,18 @@ fw_core_handle_bus_reset(struct fw_card *card,
        struct fw_node *local_node;
        unsigned long flags;
+        /*
+         * If the selfID buffer is not the immediate successor of the
+         * previously processed one, we cannot reliably compare the
+         * old and new topologies.
+         */
+        if (!is_next_generation(generation, card->generation) &&
+            card->local_node != NULL) {
+                fw_notify("skipped bus generations, destroying all nodes\n");
+                fw_destroy_nodes(card);
+                card->bm_retries = 0;
+        }
        spin_lock_irqsave(&card->lock, flags);
        card->node_id = node_id;
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index c9ab12a15f6e..1d78e9cc5940 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -276,6 +276,15 @@ static inline void fw_card_put(struct fw_card *card)
 extern void fw_schedule_bm_work(struct fw_card *card, unsigned long delay);
 /*
+ * Check whether new_generation is the immediate successor of old_generation.
+ * Take counter roll-over at 255 (as per to OHCI) into account.
+ */
+static inline bool is_next_generation(int new_generation, int old_generation)
+{
+        return (new_generation & 0xff) == ((old_generation + 1) & 0xff);
+}
+/*
 * The iso packet format allows for an immediate header/payload part
 * stored in 'header' immediately after the packet info plus an
 * indirect payload part that is pointer to by the 'payload' field.
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 35e7aea4222c..42fb2fd24c0c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -789,6 +789,7 @@ int gpio_request(unsigned gpio, const char *label)
        } else {
                status = -EBUSY;
                module_put(chip->owner);
+                goto done;
        }
        if (chip->request) {
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 9da581452874..6915fb82d0b0 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -136,7 +136,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
        obj = kcalloc(1, sizeof(*obj), GFP_KERNEL);
        obj->dev = dev;
-        obj->filp = shmem_file_setup("drm mm object", size, 0);
+        obj->filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
        if (IS_ERR(obj->filp)) {
                kfree(obj);
                return NULL;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6b1148fc2cbe..b36a5214d8df 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -311,7 +311,7 @@ static int intel_lvds_get_modes(struct drm_connector *connector)
        if (dev_priv->panel_fixed_mode != NULL) {
                struct drm_display_mode *mode;
-                mutex_unlock(&dev->mode_config.mutex);
+                mutex_lock(&dev->mode_config.mutex);
                mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
                drm_mode_probed_add(connector, mode);
                mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5d7640e49dc5..6cad69ed21c5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1218,6 +1218,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
 }
 EXPORT_SYMBOL_GPL(hid_connect);
+/* a list of devices for which there is a specialized driver on HID bus */
 static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
        { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
@@ -1476,6 +1477,7 @@ static struct bus_type hid_bus_type = {
        .uevent         = hid_uevent,
 };
+/* a list of devices that shouldn't be handled by HID core at all */
 static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_FLAIR) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_302) },
@@ -1606,6 +1608,8 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index acc1abc834a4..e899f510ebeb 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -362,6 +362,8 @@
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD       0x0038
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2      0x0036
 #define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3      0x0034
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4      0x0044
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5      0x0045
 #define USB_VENDOR_ID_SUN               0x0430
 #define USB_DEVICE_ID_RARITAN_KVM_DONGLE        0xcdab
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index d718b1607d0f..25b10dcad90d 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -30,7 +30,7 @@
 #define MS_NOGET        0x10
 /*
- * Microsoft Wireless Desktop Receiver (Model 1028) has several
+ * Microsoft Wireless Desktop Receiver (Model 1028) has
 * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
 */
 static void ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -38,17 +38,12 @@ static void ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 {
        unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
-        if ((quirks & MS_RDESC) && rsize == 571 && rdesc[284] == 0x19 &&
+        if ((quirks & MS_RDESC) && rsize == 571 && rdesc[557] == 0x19 &&
-                        rdesc[286] == 0x2a && rdesc[304] == 0x19 &&
-                        rdesc[306] == 0x29 && rdesc[352] == 0x1a &&
-                        rdesc[355] == 0x2a && rdesc[557] == 0x19 &&
                        rdesc[559] == 0x29) {
                dev_info(&hdev->dev, "fixing up Microsoft Wireless Receiver "
                                "Model 1028 report descriptor\n");
-                rdesc[284] = rdesc[304] = rdesc[557] = 0x35;
+                rdesc[557] = 0x35;
-                rdesc[352] = 0x36;
+                rdesc[559] = 0x45;
-                rdesc[286] = rdesc[355] = 0x46;
-                rdesc[306] = rdesc[559] = 0x45;
        }
 }
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index d73eea382ab3..4940e4d70c2d 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -656,7 +656,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case HIDIOCGSTRING:
                mutex_lock(&hiddev->existancelock);
-                if (!hiddev->exist)
+                if (hiddev->exist)
                        r = hiddev_ioctl_string(hiddev, cmd, user_arg);
                else
                        r = -ENODEV;
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index e30186236588..678e34b01e52 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -83,7 +83,7 @@
 /*
 * Temperature sensors keys (sp78 - 2 bytes).
 */
-static const char* temperature_sensors_sets[][36] = {
+static const char *temperature_sensors_sets[][41] = {
 /* Set 0: Macbook Pro */
        { "TA0P", "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "Th0H",
          "Th1H", "Tm0P", "Ts0P", "Ts1P", NULL },
@@ -135,6 +135,13 @@ static const char* temperature_sensors_sets[][36] = {
        { "TB0T", "TB1S", "TB1T", "TB2S", "TB2T", "TC0D", "TN0D", "TTF0",
          "TV0P", "TVFP", "TW0P", "Th0P", "Tp0P", "Tp1P", "TpFP", "Ts0P",
          "Ts0S", NULL },
+/* Set 16: Mac Pro 3,1 (2 x Quad-Core) */
+        { "TA0P", "TCAG", "TCAH", "TCBG", "TCBH", "TC0C", "TC0D", "TC0P",
+          "TC1C", "TC1D", "TC2C", "TC2D", "TC3C", "TC3D", "TH0P", "TH1P",
+          "TH2P", "TH3P", "TMAP", "TMAS", "TMBS", "TM0P", "TM0S", "TM1P",
+          "TM1S", "TM2P", "TM2S", "TM3S", "TM8P", "TM8S", "TM9P", "TM9S",
+          "TN0C", "TN0D", "TN0H", "TS0C", "Tp0C", "Tp1C", "Tv0S", "Tv1S",
+          NULL },
 };
 /* List of keys used to read/write fan speeds */
@@ -1153,6 +1160,16 @@ static SENSOR_DEVICE_ATTR(temp34_input, S_IRUGO,
                                        applesmc_show_temperature, NULL, 33);
 static SENSOR_DEVICE_ATTR(temp35_input, S_IRUGO,
                                        applesmc_show_temperature, NULL, 34);
+static SENSOR_DEVICE_ATTR(temp36_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 35);
+static SENSOR_DEVICE_ATTR(temp37_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 36);
+static SENSOR_DEVICE_ATTR(temp38_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 37);
+static SENSOR_DEVICE_ATTR(temp39_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 38);
+static SENSOR_DEVICE_ATTR(temp40_input, S_IRUGO,
+                                        applesmc_show_temperature, NULL, 39);
 static struct attribute *temperature_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
@@ -1190,6 +1207,11 @@ static struct attribute *temperature_attributes[] = {
        &sensor_dev_attr_temp33_input.dev_attr.attr,
        &sensor_dev_attr_temp34_input.dev_attr.attr,
        &sensor_dev_attr_temp35_input.dev_attr.attr,
+        &sensor_dev_attr_temp36_input.dev_attr.attr,
+        &sensor_dev_attr_temp37_input.dev_attr.attr,
+        &sensor_dev_attr_temp38_input.dev_attr.attr,
+        &sensor_dev_attr_temp39_input.dev_attr.attr,
+        &sensor_dev_attr_temp40_input.dev_attr.attr,
        NULL
 };
@@ -1312,6 +1334,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
        { .accelerometer = 0, .light = 0, .temperature_set = 14 },
 /* MacBook Air 2,1: accelerometer, backlight and temperature set 15 */
        { .accelerometer = 1, .light = 1, .temperature_set = 15 },
+/* MacPro3,1: temperature set 16 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 16 },
 };
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1369,6 +1393,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
          DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
          DMI_MATCH(DMI_PRODUCT_NAME,"MacPro2") },
                &applesmc_dmi_data[4]},
+        { applesmc_dmi_match, "Apple MacPro3", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacPro3") },
+                &applesmc_dmi_data[16]},
        { applesmc_dmi_match, "Apple MacPro", {
          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
          DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index b1c6f68d98ce..3dad2299d9c5 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -465,6 +465,16 @@ config BLK_DEV_CS5535
          It is safe to say Y to this question.
+config BLK_DEV_CS5536
+        tristate "CS5536 chipset support"
+        depends on X86_32
+        select BLK_DEV_IDEDMA_PCI
+        help
+          This option enables support for the AMD CS5536
+          companion chip used with the Geode LX processor family.
+          If unsure, say N.
 config BLK_DEV_HPT366
        tristate "HPT36X/37X chipset support"
        select BLK_DEV_IDEDMA_PCI
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index c2b9c93f0095..d0e3d7d5b467 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -43,6 +43,7 @@ obj-$(CONFIG_BLK_DEV_CMD64X)		+= cmd64x.o
 obj-$(CONFIG_BLK_DEV_CS5520)            += cs5520.o
 obj-$(CONFIG_BLK_DEV_CS5530)            += cs5530.o
 obj-$(CONFIG_BLK_DEV_CS5535)            += cs5535.o
+obj-$(CONFIG_BLK_DEV_CS5536)            += cs5536.o
 obj-$(CONFIG_BLK_DEV_SC1200)            += sc1200.o
 obj-$(CONFIG_BLK_DEV_CY82C693)          += cy82c693.o
 obj-$(CONFIG_BLK_DEV_DELKIN)            += delkin_cb.o
diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
new file mode 100644
index 000000000000..7a62db719a46
--- /dev/null
+++ b/drivers/ide/cs5536.c
@@ -0,0 +1,308 @@
+/*
+ * CS5536 PATA support
+ * (C) 2007 Martin K. Petersen <mkp@mkp.net>
+ * (C) 2009 Bartlomiej Zolnierkiewicz
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Documentation:
+ *      Available from AMD web site.
+ *
+ * The IDE timing registers for the CS5536 live in the Geode Machine
+ * Specific Register file and not PCI config space.  Most BIOSes
+ * virtualize the PCI registers so the chip looks like a standard IDE
+ * controller.  Unfortunately not all implementations get this right.
+ * In particular some have problems with unaligned accesses to the
+ * virtualized PCI registers.  This driver always does full dword
+ * writes to work around the issue.  Also, in case of a bad BIOS this
+ * driver can be loaded with the "msr=1" parameter which forces using
+ * the Machine Specific Registers to configure the device.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/ide.h>
+#include <asm/msr.h>
+#define DRV_NAME        "cs5536"
+enum {
+        MSR_IDE_CFG             = 0x51300010,
+        PCI_IDE_CFG             = 0x40,
+        CFG                     = 0,
+        DTC                     = 2,
+        CAST                    = 3,
+        ETC                     = 4,
+        IDE_CFG_CHANEN          = (1 << 1),
+        IDE_CFG_CABLE           = (1 << 17) | (1 << 16),
+        IDE_D0_SHIFT            = 24,
+        IDE_D1_SHIFT            = 16,
+        IDE_DRV_MASK            = 0xff,
+        IDE_CAST_D0_SHIFT       = 6,
+        IDE_CAST_D1_SHIFT       = 4,
+        IDE_CAST_DRV_MASK       = 0x3,
+        IDE_CAST_CMD_SHIFT      = 24,
+        IDE_CAST_CMD_MASK       = 0xff,
+        IDE_ETC_UDMA_MASK       = 0xc0,
+};
+static int use_msr;
+static int cs5536_read(struct pci_dev *pdev, int reg, u32 *val)
+{
+        if (unlikely(use_msr)) {
+                u32 dummy;
+                rdmsr(MSR_IDE_CFG + reg, *val, dummy);
+                return 0;
+        }
+        return pci_read_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+static int cs5536_write(struct pci_dev *pdev, int reg, int val)
+{
+        if (unlikely(use_msr)) {
+                wrmsr(MSR_IDE_CFG + reg, val, 0);
+                return 0;
+        }
+        return pci_write_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+static void cs5536_program_dtc(ide_drive_t *drive, u8 tim)
+{
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 dtc;
+        cs5536_read(pdev, DTC, &dtc);
+        dtc &= ~(IDE_DRV_MASK << dshift);
+        dtc |= tim << dshift;
+        cs5536_write(pdev, DTC, dtc);
+}
+/**
+ *      cs5536_cable_detect     -       detect cable type
+ *      @hwif: Port to detect on
+ *
+ *      Perform cable detection for ATA66 capable cable.
+ *
+ *      Returns a cable type.
+ */
+static u8 cs5536_cable_detect(ide_hwif_t *hwif)
+{
+        struct pci_dev *pdev = to_pci_dev(hwif->dev);
+        u32 cfg;
+        cs5536_read(pdev, CFG, &cfg);
+        if (cfg & IDE_CFG_CABLE)
+                return ATA_CBL_PATA80;
+        else
+                return ATA_CBL_PATA40;
+}
+/**
+ *      cs5536_set_pio_mode             -       PIO timing setup
+ *      @drive: ATA device
+ *      @pio: PIO mode number
+ */
+static void cs5536_set_pio_mode(ide_drive_t *drive, const u8 pio)
+{
+        static const u8 drv_timings[5] = {
+                0x98, 0x55, 0x32, 0x21, 0x20,
+        };
+        static const u8 addr_timings[5] = {
+                0x2, 0x1, 0x0, 0x0, 0x0,
+        };
+        static const u8 cmd_timings[5] = {
+                0x99, 0x92, 0x90, 0x22, 0x20,
+        };
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        ide_drive_t *pair = ide_get_pair_dev(drive);
+        int cshift = (drive->dn & 1) ? IDE_CAST_D1_SHIFT : IDE_CAST_D0_SHIFT;
+        u32 cast;
+        u8 cmd_pio = pio;
+        if (pair)
+                cmd_pio = min(pio, ide_get_best_pio_mode(pair, 255, 4));
+        drive->drive_data &= (IDE_DRV_MASK << 8);
+        drive->drive_data |= drv_timings[pio];
+        cs5536_program_dtc(drive, drv_timings[pio]);
+        cs5536_read(pdev, CAST, &cast);
+        cast &= ~(IDE_CAST_DRV_MASK << cshift);
+        cast |= addr_timings[pio] << cshift;
+        cast &= ~(IDE_CAST_CMD_MASK << IDE_CAST_CMD_SHIFT);
+        cast |= cmd_timings[cmd_pio] << IDE_CAST_CMD_SHIFT;
+        cs5536_write(pdev, CAST, cast);
+}
+/**
+ *      cs5536_set_dma_mode             -       DMA timing setup
+ *      @drive: ATA device
+ *      @mode: DMA mode
+ */
+static void cs5536_set_dma_mode(ide_drive_t *drive, const u8 mode)
+{
+        static const u8 udma_timings[6] = {
+                0xc2, 0xc1, 0xc0, 0xc4, 0xc5, 0xc6,
+        };
+        static const u8 mwdma_timings[3] = {
+                0x67, 0x21, 0x20,
+        };
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 etc;
+        cs5536_read(pdev, ETC, &etc);
+        if (mode >= XFER_UDMA_0) {
+                etc &= ~(IDE_DRV_MASK << dshift);
+                etc |= udma_timings[mode - XFER_UDMA_0] << dshift;
+        } else { /* MWDMA */
+                etc &= ~(IDE_ETC_UDMA_MASK << dshift);
+                drive->drive_data &= IDE_DRV_MASK;
+                drive->drive_data |= mwdma_timings[mode - XFER_MW_DMA_0] << 8;
+        }
+        cs5536_write(pdev, ETC, etc);
+}
+static void cs5536_dma_start(ide_drive_t *drive)
+{
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data >> 8);
+        ide_dma_start(drive);
+}
+static int cs5536_dma_end(ide_drive_t *drive)
+{
+        int ret = ide_dma_end(drive);
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data & IDE_DRV_MASK);
+        return ret;
+}
+static const struct ide_port_ops cs5536_port_ops = {
+        .set_pio_mode           = cs5536_set_pio_mode,
+        .set_dma_mode           = cs5536_set_dma_mode,
+        .cable_detect           = cs5536_cable_detect,
+};
+static const struct ide_dma_ops cs5536_dma_ops = {
+        .dma_host_set           = ide_dma_host_set,
+        .dma_setup              = ide_dma_setup,
+        .dma_exec_cmd           = ide_dma_exec_cmd,
+        .dma_start              = cs5536_dma_start,
+        .dma_end                = cs5536_dma_end,
+        .dma_test_irq           = ide_dma_test_irq,
+        .dma_lost_irq           = ide_dma_lost_irq,
+        .dma_timeout            = ide_dma_timeout,
+};
+static const struct ide_port_info cs5536_info = {
+        .name           = DRV_NAME,
+        .port_ops       = &cs5536_port_ops,
+        .dma_ops        = &cs5536_dma_ops,
+        .host_flags     = IDE_HFLAG_SINGLE,
+        .pio_mask       = ATA_PIO4,
+        .mwdma_mask     = ATA_MWDMA2,
+        .udma_mask      = ATA_UDMA5,
+};
+/**
+ *      cs5536_init_one
+ *      @dev: PCI device
+ *      @id: Entry in match table
+ */
+static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+{
+        u32 cfg;
+        if (use_msr)
+                printk(KERN_INFO DRV_NAME ": Using MSR regs instead of PCI\n");
+        cs5536_read(dev, CFG, &cfg);
+        if ((cfg & IDE_CFG_CHANEN) == 0) {
+                printk(KERN_ERR DRV_NAME ": disabled by BIOS\n");
+                return -ENODEV;
+        }
+        return ide_pci_init_one(dev, &cs5536_info, NULL);
+}
+static const struct pci_device_id cs5536_pci_tbl[] = {
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), },
+        { },
+};
+static struct pci_driver cs5536_pci_driver = {
+        .name           = DRV_NAME,
+        .id_table       = cs5536_pci_tbl,
+        .probe          = cs5536_init_one,
+        .remove         = ide_pci_remove,
+        .suspend        = ide_pci_suspend,
+        .resume         = ide_pci_resume,
+};
+static int __init cs5536_init(void)
+{
+        return pci_register_driver(&cs5536_pci_driver);
+}
+static void __exit cs5536_exit(void)
+{
+        pci_unregister_driver(&cs5536_pci_driver);
+}
+MODULE_AUTHOR("Martin K. Petersen, Bartlomiej Zolnierkiewicz");
+MODULE_DESCRIPTION("low-level driver for the CS5536 IDE controller");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, cs5536_pci_tbl);
+module_param_named(msr, use_msr, int, 0644);
+MODULE_PARM_DESC(msr, "Force using MSR to configure IDE function (Default: 0)");
+module_init(cs5536_init);
+module_exit(cs5536_exit);
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 97a35c667aee..415d7e24f2b6 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -534,7 +534,7 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
                d.dma_ops = NULL;
        }
-        ret = ide_host_register(host, NULL, hws);
+        ret = ide_host_register(host, &d, hws);
        if (ret)
                goto err_free;
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index d8f295bdad76..ec7d07fa570a 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -282,7 +282,7 @@ static int do_drive_get_GTF(ide_drive_t *drive,
        port = hwif->channel ? drive->dn - 2: drive->dn;
        DEBPRINT("ENTER: %s at %s, port#: %d, hard_port#: %d\n",
-                 hwif->name, dev->bus_id, port, hwif->channel);
+                 hwif->name, dev_name(dev), port, hwif->channel);
        if ((drive->dev_flags & IDE_DFLAG_PRESENT) == 0) {
                DEBPRINT("%s drive %d:%d not present\n",
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index cae69372cf45..0bfeb0c79d6e 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -787,6 +787,9 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
                if (blk_fs_request(rq)) {
                        ide_end_request(drive, 1, rq->nr_sectors);
                        return ide_stopped;
+                } else if (rq->cmd_type == REQ_TYPE_ATA_PC && !rq->bio) {
+                        ide_end_request(drive, 1, 1);
+                        return ide_stopped;
                }
                goto end_request;
        }
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index cc163319dfbd..9ee51adf567f 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -418,11 +418,14 @@ void ide_map_sg(ide_drive_t *drive, struct request *rq)
        ide_hwif_t *hwif = drive->hwif;
        struct scatterlist *sg = hwif->sg_table;
-        if (rq->cmd_type != REQ_TYPE_ATA_TASKFILE) {
+        if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
-                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
-        } else {
                sg_init_one(sg, rq->buffer, rq->nr_sectors * SECTOR_SIZE);
                hwif->sg_nents = 1;
+        } else if (!rq->bio) {
+                sg_init_one(sg, rq->data, rq->data_len);
+                hwif->sg_nents = 1;
+        } else {
+                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
        }
 }
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 0db1ed9f5fc2..ce0818a993f6 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1467,6 +1467,30 @@ struct ide_host *ide_host_alloc(const struct ide_port_info *d, hw_regs_t **hws)
 }
 EXPORT_SYMBOL_GPL(ide_host_alloc);
+static void ide_port_free(ide_hwif_t *hwif)
+{
+        ide_port_free_devices(hwif);
+        ide_free_port_slot(hwif->index);
+        kfree(hwif);
+}
+static void ide_disable_port(ide_hwif_t *hwif)
+{
+        struct ide_host *host = hwif->host;
+        int i;
+        printk(KERN_INFO "%s: disabling port\n", hwif->name);
+        for (i = 0; i < MAX_HOST_PORTS; i++) {
+                if (host->ports[i] == hwif) {
+                        host->ports[i] = NULL;
+                        host->n_ports--;
+                }
+        }
+        ide_port_free(hwif);
+}
 int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                      hw_regs_t **hws)
 {
@@ -1507,8 +1531,12 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                        hwif->present = 1;
                if (hwif->chipset != ide_4drives || !hwif->mate ||
-                    !hwif->mate->present)
+                    !hwif->mate->present) {
-                        ide_register_port(hwif);
+                        if (ide_register_port(hwif)) {
+                                ide_disable_port(hwif);
+                                continue;
+                        }
+                }
                if (hwif->present)
                        ide_port_tune_devices(hwif);
@@ -1521,7 +1549,8 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                if (hwif_init(hwif) == 0) {
                        printk(KERN_INFO "%s: failed to initialize IDE "
                                         "interface\n", hwif->name);
-                        hwif->present = 0;
+                        device_unregister(&hwif->gendev);
+                        ide_disable_port(hwif);
                        continue;
                }
@@ -1660,12 +1689,8 @@ void ide_host_free(struct ide_host *host)
        int i;
        ide_host_for_each_port(i, hwif, host) {
-                if (hwif == NULL)
+                if (hwif)
-                        continue;
+                        ide_port_free(hwif);
-                ide_port_free_devices(hwif);
-                ide_free_port_slot(hwif->index);
-                kfree(hwif);
        }
        kfree(host);
diff --git a/drivers/ide/tx4939ide.c b/drivers/ide/tx4939ide.c
index 882f6f07c476..40b0812a045c 100644
--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -261,9 +261,9 @@ static int tx4939ide_build_dmatable(ide_drive_t *drive, struct request *rq)
                                bcount = cur_len;
                        /*
                         * This workaround for zero count seems required.
-                         * (standard ide_build_dmatable do it too)
+                         * (standard ide_build_dmatable does it too)
                         */
-                        if ((bcount & 0xffff) == 0x0000)
+                        if (bcount == 0x10000)
                                bcount = 0x8000;
                        *table++ = bcount & 0xffff;
                        *table++ = cur_addr;
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index 703c3eeb20a8..6092fe3f409d 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -448,6 +448,11 @@ static int __devinit via_init_one(struct pci_dev *dev, const struct pci_device_i
                d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
 #endif
+#ifdef CONFIG_AMIGAONE
+        if (machine_is(amigaone))
+                d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
+#endif
        d.udma_mask = via_config->udma_mask;
        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
diff --git a/drivers/ieee1394/ieee1394.h b/drivers/ieee1394/ieee1394.h
index e0ae0d3d747f..af320e2c5079 100644
--- a/drivers/ieee1394/ieee1394.h
+++ b/drivers/ieee1394/ieee1394.h
@@ -54,9 +54,7 @@
 #define IEEE1394_SPEED_800      0x03
 #define IEEE1394_SPEED_1600     0x04
 #define IEEE1394_SPEED_3200     0x05
+#define IEEE1394_SPEED_MAX      IEEE1394_SPEED_3200
-/* The current highest tested speed supported by the subsystem */
-#define IEEE1394_SPEED_MAX      IEEE1394_SPEED_800
 /* Maps speed values above to a string representation */
 extern const char *hpsb_speedto_str[];
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index dcdb71a7718d..2beb8d94f7bd 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -338,6 +338,7 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
        u8 cldcnt[nodecount];
        u8 *map = host->speed_map;
        u8 *speedcap = host->speed;
+        u8 local_link_speed = host->csr.lnk_spd;
        struct selfid *sid;
        struct ext_selfid *esid;
        int i, j, n;
@@ -373,8 +374,8 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
                        if (sid->port2 == SELFID_PORT_CHILD) cldcnt[n]++;
                        speedcap[n] = sid->speed;
-                        if (speedcap[n] > host->csr.lnk_spd)
+                        if (speedcap[n] > local_link_speed)
-                                speedcap[n] = host->csr.lnk_spd;
+                                speedcap[n] = local_link_speed;
                        n--;
                }
        }
@@ -407,12 +408,11 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
                }
        }
-#if SELFID_SPEED_UNKNOWN != IEEE1394_SPEED_MAX
+        /* assume a maximum speed for 1394b PHYs, nodemgr will correct it */
-        /* assume maximum speed for 1394b PHYs, nodemgr will correct it */
+        if (local_link_speed > SELFID_SPEED_UNKNOWN)
-        for (n = 0; n < nodecount; n++)
+                for (i = 0; i < nodecount; i++)
-                if (speedcap[n] == SELFID_SPEED_UNKNOWN)
+                        if (speedcap[i] == SELFID_SPEED_UNKNOWN)
-                        speedcap[n] = IEEE1394_SPEED_MAX;
+                                speedcap[i] = local_link_speed;
-#endif
 }
diff --git a/drivers/ieee1394/ohci1394.h b/drivers/ieee1394/ohci1394.h
index 4320bf010495..7fb8ab9780ae 100644
--- a/drivers/ieee1394/ohci1394.h
+++ b/drivers/ieee1394/ohci1394.h
@@ -26,7 +26,7 @@
 #define OHCI1394_DRIVER_NAME      "ohci1394"
-#define OHCI1394_MAX_AT_REQ_RETRIES     0x2
+#define OHCI1394_MAX_AT_REQ_RETRIES     0xf
 #define OHCI1394_MAX_AT_RESP_RETRIES    0x2
 #define OHCI1394_MAX_PHYS_RESP_RETRIES  0x8
 #define OHCI1394_MAX_SELF_ID_ERRORS     16
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index ab1034ccb7fb..f3fd8657ce4b 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -115,8 +115,8 @@
 */
 static int sbp2_max_speed = IEEE1394_SPEED_MAX;
 module_param_named(max_speed, sbp2_max_speed, int, 0644);
-MODULE_PARM_DESC(max_speed, "Force max speed "
+MODULE_PARM_DESC(max_speed, "Limit data transfer speed (5 <= 3200, "
-                 "(3 = 800Mb/s, 2 = 400Mb/s, 1 = 200Mb/s, 0 = 100Mb/s)");
+                 "4 <= 1600, 3 <= 800, 2 <= 400, 1 <= 200, 0 = 100 Mb/s)");
 /*
 * Set serialize_io to 0 or N to use dynamically appended lists of command ORBs.
@@ -256,7 +256,7 @@ static int sbp2_set_busy_timeout(struct sbp2_lu *);
 static int sbp2_max_speed_and_size(struct sbp2_lu *);
-static const u8 sbp2_speedto_max_payload[] = { 0x7, 0x8, 0x9, 0xA, 0xB, 0xC };
+static const u8 sbp2_speedto_max_payload[] = { 0x7, 0x8, 0x9, 0xa, 0xa, 0xa };
 static DEFINE_RWLOCK(sbp2_hi_logical_units_lock);
@@ -347,8 +347,8 @@ static struct scsi_host_template sbp2_shost_template = {
        .sdev_attrs              = sbp2_sysfs_sdev_attrs,
 };
-/* for match-all entries in sbp2_workarounds_table */
+#define SBP2_ROM_VALUE_WILDCARD ~0         /* match all */
-#define SBP2_ROM_VALUE_WILDCARD 0x1000000
+#define SBP2_ROM_VALUE_MISSING  0xff000000 /* not present in the unit dir. */
 /*
 * List of devices with known bugs.
@@ -359,60 +359,70 @@ static struct scsi_host_template sbp2_shost_template = {
 */
 static const struct {
        u32 firmware_revision;
-        u32 model_id;
+        u32 model;
        unsigned workarounds;
 } sbp2_workarounds_table[] = {
        /* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
                .firmware_revision      = 0x002800,
-                .model_id               = 0x001010,
+                .model                  = 0x001010,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
                                          SBP2_WORKAROUND_MODE_SENSE_8 |
                                          SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
                .firmware_revision      = 0x002800,
-                .model_id               = 0x000000,
+                .model                  = 0x000000,
                .workarounds            = SBP2_WORKAROUND_DELAY_INQUIRY |
                                          SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Initio bridges, actually only needed for some older ones */ {
                .firmware_revision      = 0x000200,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
        },
        /* PL-3507 bridge with Prolific firmware */ {
                .firmware_revision      = 0x012800,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_POWER_CONDITION,
        },
        /* Symbios bridge */ {
                .firmware_revision      = 0xa0b800,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
        /* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
                .firmware_revision      = 0x002600,
-                .model_id               = SBP2_ROM_VALUE_WILDCARD,
+                .model                  = SBP2_ROM_VALUE_WILDCARD,
                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
        },
+        /*
+         * iPod 2nd generation: needs 128k max transfer size workaround
+         * iPod 3rd generation: needs fix capacity workaround
+         */
+        {
+                .firmware_revision      = 0x0a2700,
+                .model                  = 0x000000,
+                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS |
+                                          SBP2_WORKAROUND_FIX_CAPACITY,
+        },
        /* iPod 4th generation */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000021,
+                .model                  = 0x000021,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod mini */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000022,
+                .model                  = 0x000022,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod mini */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x000023,
+                .model                  = 0x000023,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        },
        /* iPod Photo */ {
                .firmware_revision      = 0x0a2700,
-                .model_id               = 0x00007e,
+                .model                  = 0x00007e,
                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
        }
 };
@@ -1341,13 +1351,15 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
        struct csr1212_keyval *kv;
        struct csr1212_dentry *dentry;
        u64 management_agent_addr;
-        u32 unit_characteristics, firmware_revision;
+        u32 unit_characteristics, firmware_revision, model;
        unsigned workarounds;
        int i;
        management_agent_addr = 0;
        unit_characteristics = 0;
-        firmware_revision = 0;
+        firmware_revision = SBP2_ROM_VALUE_MISSING;
+        model = ud->flags & UNIT_DIRECTORY_MODEL_ID ?
+                                ud->model_id : SBP2_ROM_VALUE_MISSING;
        csr1212_for_each_dir_entry(ud->ne->csr, kv, ud->ud_kv, dentry) {
                switch (kv->key.id) {
@@ -1388,9 +1400,9 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
                            sbp2_workarounds_table[i].firmware_revision !=
                            (firmware_revision & 0xffff00))
                                continue;
-                        if (sbp2_workarounds_table[i].model_id !=
+                        if (sbp2_workarounds_table[i].model !=
                            SBP2_ROM_VALUE_WILDCARD &&
-                            sbp2_workarounds_table[i].model_id != ud->model_id)
+                            sbp2_workarounds_table[i].model != model)
                                continue;
                        workarounds |= sbp2_workarounds_table[i].workarounds;
                        break;
@@ -1403,7 +1415,7 @@ static void sbp2_parse_unit_directory(struct sbp2_lu *lu,
                          NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid),
                          workarounds, firmware_revision,
                          ud->vendor_id ? ud->vendor_id : ud->ne->vendor_id,
-                          ud->model_id);
+                          model);
        /* We would need one SCSI host template for each target to adjust
         * max_sectors on the fly, therefore warn only. */
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
index 90663e01a56e..60156dfdc608 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -224,7 +224,7 @@ int run_guest(struct lg_cpu *cpu, unsigned long __user *user)
                        break;
                /* If the Guest asked to be stopped, we sleep.  The Guest's
-                 * clock timer or LHCALL_BREAK from the Waker will wake us. */
+                 * clock timer or LHREQ_BREAK from the Waker will wake us. */
                if (cpu->halted) {
                        set_current_state(TASK_INTERRUPTIBLE);
                        schedule();
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 34bc017b8b3c..b8ee103eed5f 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -307,9 +307,8 @@ static int close(struct inode *inode, struct file *file)
         * kmalloc()ed string, either of which is ok to hand to kfree(). */
        if (!IS_ERR(lg->dead))
                kfree(lg->dead);
-        /* We clear the entire structure, which also marks it as free for the
+        /* Free the memory allocated to the lguest_struct */
-         * next user. */
+        kfree(lg);
-        memset(lg, 0, sizeof(*lg));
        /* Release lock and exit. */
        mutex_unlock(&lguest_lock);
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 6098b626811f..47fee05eaefb 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -576,6 +576,7 @@ static int set_control(struct saa7146_fh *fh, struct v4l2_control *c)
                vv->vflip = c->value;
                break;
        default: {
+                mutex_unlock(&dev->lock);
                return -EINVAL;
        }
        }
diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
index 64379f2bf237..3ec28945c26f 100644
--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -657,7 +657,7 @@ static int mxl5007t_get_status(struct dvb_frontend *fe, u32 *status)
 {
        struct mxl5007t_state *state = fe->tuner_priv;
        int rf_locked, ref_locked;
-        s32 rf_input_level;
+        s32 rf_input_level = 0;
        int ret;
        if (fe->ops.i2c_gate_ctrl)
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
index 98ee16773ff2..7e3aeaa7370f 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
@@ -93,6 +93,9 @@ struct dvb_ca_slot {
        /* current state of the CAM */
        int slot_state;
+        /* mutex used for serializing access to one CI slot */
+        struct mutex slot_lock;
        /* Number of CAMCHANGES that have occurred since last processing */
        atomic_t camchange_count;
@@ -711,14 +714,20 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * b
        dprintk("%s\n", __func__);
-        // sanity check
+        /* sanity check */
        if (bytes_write > ca->slot_info[slot].link_buf_size)
                return -EINVAL;
-        /* check if interface is actually waiting for us to read from it, or if a read is in progress */
+        /* it is possible we are dealing with a single buffer implementation,
+           thus if there is data available for read or if there is even a read
+           already in progress, we do nothing but awake the kernel thread to
+           process the data if necessary. */
        if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
                goto exitnowrite;
        if (status & (STATUSREG_DA | STATUSREG_RE)) {
+                if (status & STATUSREG_DA)
+                        dvb_ca_en50221_thread_wakeup(ca);
                status = -EAGAIN;
                goto exitnowrite;
        }
@@ -987,6 +996,8 @@ static int dvb_ca_en50221_thread(void *data)
                /* go through all the slots processing them */
                for (slot = 0; slot < ca->slot_count; slot++) {
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        // check the cam status + deal with CAMCHANGEs
                        while (dvb_ca_en50221_check_camstatus(ca, slot)) {
                                /* clear down an old CI slot if necessary */
@@ -1122,7 +1133,7 @@ static int dvb_ca_en50221_thread(void *data)
                        case DVB_CA_SLOTSTATE_RUNNING:
                                if (!ca->open)
-                                        continue;
+                                        break;
                                // poll slots for data
                                pktcount = 0;
@@ -1146,6 +1157,8 @@ static int dvb_ca_en50221_thread(void *data)
                                }
                                break;
                        }
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                }
        }
@@ -1181,6 +1194,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
        switch (cmd) {
        case CA_RESET:
                for (slot = 0; slot < ca->slot_count; slot++) {
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE) {
                                dvb_ca_en50221_slot_shutdown(ca, slot);
                                if (ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)
@@ -1188,6 +1202,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
                                                                     slot,
                                                                     DVB_CA_EN50221_CAMCHANGE_INSERTED);
                        }
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                }
                ca->next_read_slot = 0;
                dvb_ca_en50221_thread_wakeup(ca);
@@ -1308,7 +1323,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
                                goto exit;
                        }
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                        status = dvb_ca_en50221_write_data(ca, slot, fragbuf, fraglen + 2);
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                        if (status == (fraglen + 2)) {
                                written = 1;
                                break;
@@ -1664,6 +1681,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
                ca->slot_info[i].slot_state = DVB_CA_SLOTSTATE_NONE;
                atomic_set(&ca->slot_info[i].camchange_count, 0);
                ca->slot_info[i].camchange_type = DVB_CA_EN50221_CAMCHANGE_REMOVED;
+                mutex_init(&ca->slot_info[i].slot_lock);
        }
        if (signal_pending(current)) {
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
index 8467e63ddc0d..7df2e141187a 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
@@ -45,8 +45,10 @@ struct dvb_ca_en50221 {
        /* the module owning this structure */
        struct module* owner;
-        /* NOTE: the read_*, write_* and poll_slot_status functions must use locks as
+        /* NOTE: the read_*, write_* and poll_slot_status functions will be
-         * they may be called from several threads at once */
+         * called for different slots concurrently and need to use locks where
+         * and if appropriate. There will be no concurrent access to one slot.
+         */
        /* functions for accessing attribute memory on the CAM */
        int (*read_attribute_mem)(struct dvb_ca_en50221* ca, int slot, int address);
diff --git a/drivers/media/dvb/dvb-usb/af9005-fe.c b/drivers/media/dvb/dvb-usb/af9005-fe.c
index b1a9c4cdec93..199ece0d4883 100644
--- a/drivers/media/dvb/dvb-usb/af9005-fe.c
+++ b/drivers/media/dvb/dvb-usb/af9005-fe.c
@@ -220,7 +220,7 @@ static int af9005_get_post_vit_ber(struct dvb_frontend *fe,
                                   u16 * abort_count)
 {
        u32 loc_cw_count = 0, loc_err_count;
-        u16 loc_abort_count;
+        u16 loc_abort_count = 0;
        int ret;
        ret =
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index e1e9aa5c6b84..6a97a40d3dfb 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -694,7 +694,12 @@ static int af9015_read_config(struct usb_device *udev)
        /* IR remote controller */
        req.addr = AF9015_EEPROM_IR_MODE;
-        ret = af9015_rw_udev(udev, &req);
+        /* first message will timeout often due to possible hw bug */
+        for (i = 0; i < 4; i++) {
+                ret = af9015_rw_udev(udev, &req);
+                if (!ret)
+                        break;
+        }
        if (ret)
                goto error;
        deb_info("%s: IR mode:%d\n", __func__, val);
@@ -835,18 +840,19 @@ static int af9015_read_config(struct usb_device *udev)
        if (!dvb_usb_af9015_dual_mode)
                af9015_config.dual_mode = 0;
-        /* set buffer size according to USB port speed */
+        /* Set adapter0 buffer size according to USB port speed, adapter1 buffer
+           size can be static because it is enabled only USB2.0 */
        for (i = 0; i < af9015_properties_count; i++) {
                /* USB1.1 set smaller buffersize and disable 2nd adapter */
                if (udev->speed == USB_SPEED_FULL) {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
-                                TS_USB11_MAX_PACKET_SIZE;
+                                = TS_USB11_MAX_PACKET_SIZE;
                        /* disable 2nd adapter because we don't have
                           PID-filters */
                        af9015_config.dual_mode = 0;
                } else {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
-                                TS_USB20_MAX_PACKET_SIZE;
+                                = TS_USB20_MAX_PACKET_SIZE;
                }
        }
@@ -1254,6 +1260,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                        .type = USB_BULK,
                                        .count = 6,
                                        .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                },
                        }
                },
@@ -1353,6 +1365,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                        .type = USB_BULK,
                                        .count = 6,
                                        .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                },
                        }
                },
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 391732788911..635d30a55078 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -1393,6 +1393,9 @@ struct usb_device_id dib0700_usb_id_table[] = {
        { USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3000H) },
 /* 40 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E) },
        { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E_SE) },
+        { USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_EXPRESS) },
+        { USB_DEVICE(USB_VID_TERRATEC,
+                        USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2) },
        { 0 }           /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -1537,7 +1540,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "DiBcom STK7700D reference design",
                                { &dib0700_usb_id_table[14], NULL },
                                { NULL },
-                        }
+                        },
                },
                .rc_interval      = DEFAULT_RC_INTERVAL,
@@ -1557,7 +1561,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        },
                },
-                .num_device_descs = 2,
+                .num_device_descs = 3,
                .devices = {
                        {   "ASUS My Cinema U3000 Mini DVBT Tuner",
                                { &dib0700_usb_id_table[23], NULL },
@@ -1566,6 +1570,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "Yuan EC372S",
                                { &dib0700_usb_id_table[31], NULL },
                                { NULL },
+                        },
+                        {   "Terratec Cinergy T Express",
+                                { &dib0700_usb_id_table[42], NULL },
+                                { NULL },
                        }
                },
@@ -1653,7 +1661,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        }
                },
-                .num_device_descs = 4,
+                .num_device_descs = 5,
                .devices = {
                        {   "DiBcom STK7070PD reference design",
                                { &dib0700_usb_id_table[17], NULL },
@@ -1670,6 +1678,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {   "Hauppauge Nova-TD-500 (84xxx)",
                                { &dib0700_usb_id_table[36], NULL },
                                { NULL },
+                        },
+                        {  "Terratec Cinergy DT USB XS Diversity",
+                                { &dib0700_usb_id_table[43], NULL },
+                                { NULL },
                        }
                }
        }, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index a4fca3fca5ee..0db0c06ee6f2 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -162,8 +162,10 @@
 #define USB_PID_AVERMEDIA_A309                          0xa309
 #define USB_PID_TECHNOTREND_CONNECT_S2400               0x3006
 #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY        0x005a
+#define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2      0x0081
 #define USB_PID_TERRATEC_CINERGY_HT_USB_XE              0x0058
 #define USB_PID_TERRATEC_CINERGY_HT_EXPRESS             0x0060
+#define USB_PID_TERRATEC_CINERGY_T_EXPRESS              0x0062
 #define USB_PID_TERRATEC_CINERGY_T_XXS                  0x0078
 #define USB_PID_PINNACLE_EXPRESSCARD_320CX              0x022e
 #define USB_PID_PINNACLE_PCTV2000E                      0x022c
diff --git a/drivers/media/dvb/frontends/drx397xD.c b/drivers/media/dvb/frontends/drx397xD.c
index ec4e08dbc699..1e81e713df63 100644
--- a/drivers/media/dvb/frontends/drx397xD.c
+++ b/drivers/media/dvb/frontends/drx397xD.c
@@ -646,7 +646,7 @@ static int drx_tune(struct drx397xD_state *s,
        u32 edi = 0, ebx = 0, ebp = 0, edx = 0;
        u16 v20 = 0, v1E = 0, v16 = 0, v14 = 0, v12 = 0, v10 = 0, v0E = 0;
-        int rc, df_tuner;
+        int rc, df_tuner = 0;
        int a, b, c, d;
        pr_debug("%s %d\n", __func__, s->config.d60);
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index cf4d8936bb83..3e08d985d6e5 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -545,9 +545,6 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
        s5h1409_enable_modulation(fe, p->u.vsb.modulation);
-        /* Allow the demod to settle */
-        msleep(100);
        if (fe->ops.tuner_ops.set_params) {
                if (fe->ops.i2c_gate_ctrl)
                        fe->ops.i2c_gate_ctrl(fe, 1);
@@ -562,6 +559,10 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
                s5h1409_set_qam_interleave_mode(fe);
        }
+        /* Issue a reset to the demod so it knows to resync against the
+           newly tuned frequency */
+        s5h1409_softreset(fe);
        return 0;
 }
diff --git a/drivers/media/dvb/frontends/stb0899_algo.c b/drivers/media/dvb/frontends/stb0899_algo.c
index 83dc7e12d5f0..a67d1775a43c 100644
--- a/drivers/media/dvb/frontends/stb0899_algo.c
+++ b/drivers/media/dvb/frontends/stb0899_algo.c
@@ -31,6 +31,8 @@ inline u32 stb0899_do_div(u64 n, u32 d)
        return n;
 }
+#if 0
+/* These functions are currently unused */
 /*
 * stb0899_calc_srate
 * Compute symbol rate
@@ -63,6 +65,7 @@ static u32 stb0899_get_srate(struct stb0899_state *state)
        return stb0899_calc_srate(internal->master_clk, sfr);
 }
+#endif
 /*
 * stb0899_set_srate
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 1638e1d9f538..83e9e7750c8c 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -470,6 +470,7 @@ static void frontend_init(struct budget *budget)
                budget->dvb_frontend = dvb_attach(l64781_attach, &grundig_29504_401_config, &budget->i2c_adap);
                if (budget->dvb_frontend) {
                        budget->dvb_frontend->ops.tuner_ops.set_params = grundig_29504_401_tuner_set_params;
+                        budget->dvb_frontend->tuner_priv = NULL;
                        break;
                }
                break;
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 0aa96df80fc2..d91e0638448f 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1384,7 +1384,7 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
 {
        int result;
-        unsigned int mode, model, version;
+        unsigned int mode = 0, model = 0, version = 0;
        dprintk("%s\n", __func__);
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 0747dc8862b0..fdfc7bf86b9e 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -194,10 +194,10 @@ static int amradio_start(struct amradio_device *radio)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->muted = 0;
+        mutex_unlock(&radio->lock);
        return retval;
 }
@@ -230,10 +230,10 @@ static int amradio_stop(struct amradio_device *radio)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->muted = 1;
+        mutex_unlock(&radio->lock);
        return retval;
 }
@@ -284,10 +284,10 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
                return retval;
        }
-        mutex_unlock(&radio->lock);
        radio->stereo = 0;
+        mutex_unlock(&radio->lock);
        return retval;
 }
diff --git a/drivers/media/video/cs5345.c b/drivers/media/video/cs5345.c
index 14bebf8a116f..87e91072627a 100644
--- a/drivers/media/video/cs5345.c
+++ b/drivers/media/video/cs5345.c
@@ -18,7 +18,6 @@
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 8f1db57bd1dd..bfe25841dbf4 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1586,7 +1586,8 @@ static int mpeg_open(struct file *file)
        lock_kernel();
        list_for_each(list, &cx23885_devlist) {
                h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->v4l_device->minor == minor) {
+                if (h->v4l_device &&
+                    h->v4l_device->minor == minor) {
                        dev = h;
                        break;
                }
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 2d81c4d04340..eaa11893bfe9 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -730,12 +730,13 @@ static int video_open(struct file *file)
        lock_kernel();
        list_for_each(list, &cx23885_devlist) {
                h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->video_dev->minor == minor) {
+                if (h->video_dev &&
+                    h->video_dev->minor == minor) {
                        dev  = h;
                        type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
                }
                if (h->vbi_dev &&
-                   h->vbi_dev->minor == minor) {
+                    h->vbi_dev->minor == minor) {
                        dev  = h;
                        type = V4L2_BUF_TYPE_VBI_CAPTURE;
                }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 88f2fd32bfe3..25eb3bec9e5d 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1382,6 +1382,14 @@ static int cx25840_log_status(struct v4l2_subdev *sd)
 static int cx25840_command(struct i2c_client *client, unsigned cmd, void *arg)
 {
+        /* ignore this command */
+        if (cmd == TUNER_SET_TYPE_ADDR || cmd == TUNER_SET_CONFIG)
+                return 0;
+        /* Old-style drivers rely on initialization on first use, so
+           call the init whenever a command is issued to this driver.
+           New-style drivers using v4l2_subdev should call init explicitly. */
+        cx25840_init(i2c_get_clientdata(client), 0);
        return v4l2_subdev_command(i2c_get_clientdata(client), cmd, arg);
 }
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index 613dfea4ff3e..aef5297534af 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -614,34 +614,41 @@ static struct stv0288_config tevii_tuner_earda_config = {
        .set_ts_params = cx24116_set_ts_param,
 };
-static int dvb_register(struct cx8802_dev *dev)
+static int cx8802_alloc_frontends(struct cx8802_dev *dev)
 {
        struct cx88_core *core = dev->core;
-        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
+        struct videobuf_dvb_frontend *fe = NULL;
-        int mfe_shared = 0; /* bus not shared by default */
        int i;
-        if (0 != core->i2c_rc) {
-                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
-                goto frontend_detach;
-        }
-        if (!core->board.num_frontends)
-                return -EINVAL;
        mutex_init(&dev->frontends.lock);
        INIT_LIST_HEAD(&dev->frontends.felist);
+        if (!core->board.num_frontends)
+                return -ENODEV;
        printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__,
                         core->board.num_frontends);
        for (i = 1; i <= core->board.num_frontends; i++) {
-                fe0 = videobuf_dvb_alloc_frontend(&dev->frontends, i);
+                fe = videobuf_dvb_alloc_frontend(&dev->frontends, i);
-                if (!fe0) {
+                if (!fe) {
                        printk(KERN_ERR "%s() failed to alloc\n", __func__);
                        videobuf_dvb_dealloc_frontends(&dev->frontends);
-                        goto frontend_detach;
+                        return -ENOMEM;
                }
        }
+        return 0;
+}
+static int dvb_register(struct cx8802_dev *dev)
+{
+        struct cx88_core *core = dev->core;
+        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
+        int mfe_shared = 0; /* bus not shared by default */
+        if (0 != core->i2c_rc) {
+                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
+                goto frontend_detach;
+        }
        /* Get the first frontend */
        fe0 = videobuf_dvb_get_frontend(&dev->frontends, 1);
@@ -1243,6 +1250,8 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
        struct cx88_core *core = drv->core;
        struct cx8802_dev *dev = drv->core->dvbdev;
        int err;
+        struct videobuf_dvb_frontend *fe;
+        int i;
        dprintk( 1, "%s\n", __func__);
        dprintk( 1, " ->being probed by Card=%d Name=%s, PCI %02x:%02x\n",
@@ -1258,39 +1267,34 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
        /* If vp3054 isn't enabled, a stub will just return 0 */
        err = vp3054_i2c_probe(dev);
        if (0 != err)
-                goto fail_probe;
+                goto fail_core;
        /* dvb stuff */
        printk(KERN_INFO "%s/2: cx2388x based DVB/ATSC card\n", core->name);
        dev->ts_gen_cntrl = 0x0c;
+        err = cx8802_alloc_frontends(dev);
+        if (err)
+                goto fail_core;
        err = -ENODEV;
-        if (core->board.num_frontends) {
+        for (i = 1; i <= core->board.num_frontends; i++) {
-                struct videobuf_dvb_frontend *fe;
+                fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
-                int i;
+                if (fe == NULL) {
+                        printk(KERN_ERR "%s() failed to get frontend(%d)\n",
-                for (i = 1; i <= core->board.num_frontends; i++) {
-                        fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
-                        if (fe == NULL) {
-                                printk(KERN_ERR "%s() failed to get frontend(%d)\n",
                                        __func__, i);
-                                goto fail_probe;
+                        goto fail_probe;
-                        }
+                }
-                        videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
+                videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
                                    &dev->pci->dev, &dev->slock,
                                    V4L2_BUF_TYPE_VIDEO_CAPTURE,
                                    V4L2_FIELD_TOP,
                                    sizeof(struct cx88_buffer),
                                    dev);
-                        /* init struct videobuf_dvb */
+                /* init struct videobuf_dvb */
-                        fe->dvb.name = dev->core->name;
+                fe->dvb.name = dev->core->name;
-                }
-        } else {
-                /* no frontends allocated */
-                printk(KERN_ERR "%s/2 .num_frontends should be non-zero\n",
-                        core->name);
-                goto fail_core;
        }
        err = dvb_register(dev);
        if (err)
                /* frontends/adapter de-allocated in dvb_register */
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index 60a8b3187f14..6025fdd23344 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -336,8 +336,8 @@ struct cx88_core {
        /* config info -- dvb */
 #if defined(CONFIG_VIDEO_CX88_DVB) || defined(CONFIG_VIDEO_CX88_DVB_MODULE)
        int                        (*prev_set_voltage)(struct dvb_frontend *fe, fe_sec_voltage_t voltage);
-        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
 #endif
+        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
        /* state info */
        struct task_struct         *kthread;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb7505..5d882a44e3ee 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -62,9 +62,15 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
        dprintk("Stopping isoc\n");
        for (i = 0; i < EM28XX_AUDIO_BUFS; i++) {
-                usb_unlink_urb(dev->adev.urb[i]);
+                if (!irqs_disabled())
+                        usb_kill_urb(dev->adev.urb[i]);
+                else
+                        usb_unlink_urb(dev->adev.urb[i]);
                usb_free_urb(dev->adev.urb[i]);
                dev->adev.urb[i] = NULL;
+                kfree(dev->adev.transfer_buffer[i]);
+                dev->adev.transfer_buffer[i] = NULL;
        }
        return 0;
@@ -389,11 +395,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
                                                    *substream)
 {
-        struct em28xx *dev;
+       unsigned long flags;
+        struct em28xx *dev;
        snd_pcm_uframes_t hwptr_done;
        dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
        hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
        return hwptr_done;
 }
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ef9bf008a924..3b3ca3f46d52 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -102,6 +102,18 @@ static struct em28xx_reg_seq em2880_msi_digivox_ad_analog[] = {
 /* Board  - EM2870 Kworld 355u
   Analog - No input analog */
+static struct em28xx_reg_seq kworld_330u_analog[] = {
+        {EM28XX_R08_GPIO,       0x6d,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x00,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
+static struct em28xx_reg_seq kworld_330u_digital[] = {
+        {EM28XX_R08_GPIO,       0x6e,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x08,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
 /* Callback for the most boards */
 static struct em28xx_reg_seq default_tuner_gpio[] = {
        {EM28XX_R08_GPIO,       EM_GPIO_4,      EM_GPIO_4,      10},
@@ -1177,29 +1189,33 @@ struct em28xx_board em28xx_boards[] = {
                        .gpio     = hauppauge_wintv_hvr_900_analog,
                } },
        },
-        [EM2883_BOARD_KWORLD_HYBRID_A316] = {
+        [EM2883_BOARD_KWORLD_HYBRID_330U] = {
                .name         = "Kworld PlusTV HD Hybrid 330",
                .tuner_type   = TUNER_XC2028,
                .tuner_gpio   = default_tuner_gpio,
                .decoder      = EM28XX_TVP5150,
                .mts_firmware = 1,
                .has_dvb      = 1,
-                .dvb_gpio     = default_digital,
+                .dvb_gpio     = kworld_330u_digital,
+                .xclk             = EM28XX_XCLK_FREQUENCY_12MHZ,
+                .i2c_speed        = EM28XX_I2C_CLK_WAIT_ENABLE | EM28XX_I2C_EEPROM_ON_BOARD | EM28XX_I2C_EEPROM_KEY_VALID,
                .input        = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
                        .amux     = EM28XX_AMUX_VIDEO,
-                        .gpio     = default_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
                        .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
                        .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
                } },
        },
        [EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU] = {
@@ -1249,7 +1265,7 @@ struct usb_device_id em28xx_id_table [] = {
        { USB_DEVICE(0xeb1a, 0xe310),
                        .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD },
        { USB_DEVICE(0xeb1a, 0xa316),
-                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_A316 },
+                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_330U },
        { USB_DEVICE(0xeb1a, 0xe320),
                        .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD_II },
        { USB_DEVICE(0xeb1a, 0xe323),
@@ -1526,6 +1542,10 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                /* FIXME: Better to specify the needed IF */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                ctl->demod = XC3028_FE_CHINA;
+                ctl->fname = XC2028_DEFAULT_FIRMWARE;
+                break;
        default:
                ctl->demod = XC3028_FE_OREN538;
        }
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index eb5fb05fab22..94fb1b639a2e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -438,6 +438,10 @@ int em28xx_audio_analog_set(struct em28xx *dev)
        if (dev->audio_mode.ac97 != EM28XX_NO_AC97) {
                int vol;
+                em28xx_write_ac97(dev, AC97_POWER_DOWN_CTRL, 0x4200);
+                em28xx_write_ac97(dev, AC97_EXT_AUD_CTRL, 0x0031);
+                em28xx_write_ac97(dev, AC97_PCM_IN_SRATE, 0xbb80);
                /* LSB: left channel - both channels with the same level */
                vol = (0x1f - dev->volume) | ((0x1f - dev->volume) << 8);
@@ -454,6 +458,15 @@ int em28xx_audio_analog_set(struct em28xx *dev)
                                em28xx_warn("couldn't setup AC97 register %d\n",
                                     outputs[i].reg);
                }
+                if (dev->ctl_aoutput & EM28XX_AOUT_PCM_IN) {
+                        int sel = ac97_return_record_select(dev->ctl_aoutput);
+                        /* Use the same input for both left and right channels */
+                        sel |= (sel << 8);
+                        em28xx_write_ac97(dev, AC97_RECORD_SELECT, sel);
+                }
        }
        return ret;
@@ -847,8 +860,11 @@ void em28xx_uninit_isoc(struct em28xx *dev)
        for (i = 0; i < dev->isoc_ctl.num_bufs; i++) {
                urb = dev->isoc_ctl.urb[i];
                if (urb) {
-                        usb_kill_urb(urb);
+                        if (!irqs_disabled())
-                        usb_unlink_urb(urb);
+                                usb_kill_urb(urb);
+                        else
+                                usb_unlink_urb(urb);
                        if (dev->isoc_ctl.transfer_buffer[i]) {
                                usb_buffer_free(dev->udev,
                                        urb->transfer_buffer_length,
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index d38cb21834d9..9ad8527b3fda 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -28,6 +28,7 @@
 #include "lgdt330x.h"
 #include "zl10353.h"
+#include "s5h1409.h"
 #ifdef EM28XX_DRX397XD_SUPPORT
 #include "drx397xD.h"
 #endif
@@ -232,6 +233,15 @@ static struct zl10353_config em28xx_zl10353_with_xc3028 = {
        .if2 = 45600,
 };
+static struct s5h1409_config em28xx_s5h1409_with_xc3028 = {
+        .demod_address = 0x32 >> 1,
+        .output_mode   = S5H1409_PARALLEL_OUTPUT,
+        .gpio          = S5H1409_GPIO_OFF,
+        .inversion     = S5H1409_INVERSION_OFF,
+        .status_mode   = S5H1409_DEMODLOCKING,
+        .mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
+};
 #ifdef EM28XX_DRX397XD_SUPPORT
 /* [TODO] djh - not sure yet what the device config needs to contain */
 static struct drx397xD_config em28xx_drx397xD_with_xc3028 = {
@@ -412,7 +422,6 @@ static int dvb_init(struct em28xx *dev)
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850:
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
        case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2883_BOARD_KWORLD_HYBRID_A316:
        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                dvb->frontend = dvb_attach(lgdt330x_attach,
                                           &em2880_lgdt3303_dev,
@@ -433,6 +442,15 @@ static int dvb_init(struct em28xx *dev)
                        goto out_free;
                }
                break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                dvb->frontend = dvb_attach(s5h1409_attach,
+                                           &em28xx_s5h1409_with_xc3028,
+                                           &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900_R2:
 #ifdef EM28XX_DRX397XD_SUPPORT
                /* We don't have the config structure properly populated, so
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 416b691c33c1..8e61b2ca9167 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -886,10 +886,10 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
        if (0 == INPUT(i)->type)
                return -EINVAL;
-        mutex_lock(&dev->lock);
+        dev->ctl_input = i;
-        video_mux(dev, i);
+        mutex_lock(&dev->lock);
+        video_mux(dev, dev->ctl_input);
        mutex_unlock(&dev->lock);
        return 0;
 }
@@ -939,6 +939,12 @@ static int vidioc_s_audio(struct file *file, void *priv, struct v4l2_audio *a)
        struct em28xx_fh   *fh  = priv;
        struct em28xx      *dev = fh->dev;
+        if (a->index >= MAX_EM28XX_INPUT)
+                return -EINVAL;
+        if (0 == INPUT(a->index)->type)
+                return -EINVAL;
        mutex_lock(&dev->lock);
        dev->ctl_ainput = INPUT(a->index)->amux;
@@ -1950,6 +1956,7 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 int em28xx_register_analog_devices(struct em28xx *dev)
 {
+      u8 val;
        int ret;
        printk(KERN_INFO "%s: v4l2 driver version %d.%d.%d\n",
@@ -1957,34 +1964,34 @@ int em28xx_register_analog_devices(struct em28xx *dev)
                (EM28XX_VERSION_CODE >> 16) & 0xff,
                (EM28XX_VERSION_CODE >> 8) & 0xff, EM28XX_VERSION_CODE & 0xff);
+        /* set default norm */
+        dev->norm = em28xx_video_template.current_norm;
+        dev->width = norm_maxw(dev);
+        dev->height = norm_maxh(dev);
+        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
+        dev->hscale = 0;
+        dev->vscale = 0;
+        dev->ctl_input = 0;
        /* Analog specific initialization */
        dev->format = &format[0];
-        video_mux(dev, 0);
+        video_mux(dev, dev->ctl_input);
+        /* Audio defaults */
+        dev->mute = 1;
+        dev->volume = 0x1f;
        /* enable vbi capturing */
 /*      em28xx_write_reg(dev, EM28XX_R0E_AUDIOSRC, 0xc0); audio register */
-/*      em28xx_write_reg(dev, EM28XX_R0F_XCLK, 0x80); clk register */
+       val = (u8)em28xx_read_reg(dev, EM28XX_R0F_XCLK);
+       em28xx_write_reg(dev, EM28XX_R0F_XCLK, (EM28XX_XCLK_AUDIO_UNMUTE | val));
        em28xx_write_reg(dev, EM28XX_R11_VINCTRL, 0x51);
-        dev->mute = 1;          /* maybe not the right place... */
-        dev->volume = 0x1f;
        em28xx_set_outfmt(dev);
        em28xx_colorlevels_set_default(dev);
        em28xx_compression_disable(dev);
-        /* set default norm */
-        dev->norm = em28xx_video_template.current_norm;
-        dev->width = norm_maxw(dev);
-        dev->height = norm_maxh(dev);
-        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
-        dev->hscale = 0;
-        dev->vscale = 0;
-        /* FIXME: This is a very bad hack! Not all devices have TV on input 2 */
-        dev->ctl_input = 2;
        /* allocate and fill video video_device struct */
        dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
        if (!dev->vdev) {
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 6c6b94aa05b2..dd2cd36fb1bb 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -94,7 +94,7 @@
 #define EM2882_BOARD_KWORLD_VS_DVBT               54
 #define EM2882_BOARD_TERRATEC_HYBRID_XS           55
 #define EM2882_BOARD_PINNACLE_HYBRID_PRO          56
-#define EM2883_BOARD_KWORLD_HYBRID_A316           57
+#define EM2883_BOARD_KWORLD_HYBRID_330U                  57
 #define EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU      58
 #define EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850      60
 #define EM2820_BOARD_PROLINK_PLAYTV_BOX4_USB2     61
@@ -300,13 +300,32 @@ enum em28xx_amux {
 };
 enum em28xx_aout {
+        /* AC97 outputs */
        EM28XX_AOUT_MASTER = 1 << 0,
        EM28XX_AOUT_LINE   = 1 << 1,
        EM28XX_AOUT_MONO   = 1 << 2,
        EM28XX_AOUT_LFE    = 1 << 3,
        EM28XX_AOUT_SURR   = 1 << 4,
+        /* PCM IN Mixer - used by AC97_RECORD_SELECT register */
+        EM28XX_AOUT_PCM_IN = 1 << 7,
+        /* Bits 10-8 are used to indicate the PCM IN record select */
+        EM28XX_AOUT_PCM_MIC_PCM = 0 << 8,
+        EM28XX_AOUT_PCM_CD      = 1 << 8,
+        EM28XX_AOUT_PCM_VIDEO   = 2 << 8,
+        EM28XX_AOUT_PCM_AUX     = 3 << 8,
+        EM28XX_AOUT_PCM_LINE    = 4 << 8,
+        EM28XX_AOUT_PCM_STEREO  = 5 << 8,
+        EM28XX_AOUT_PCM_MONO    = 6 << 8,
+        EM28XX_AOUT_PCM_PHONE   = 7 << 8,
 };
+static inline int ac97_return_record_select(int a_out)
+{
+        return (a_out & 0x700) >> 8;
+}
 struct em28xx_reg_seq {
        int reg;
        unsigned char val, mask;
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 5e36b9a4ae3e..2ed24527ecd6 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -423,7 +423,8 @@ static void destroy_urbs(struct gspca_dev *gspca_dev)
                        break;
                gspca_dev->urb[i] = NULL;
-                usb_kill_urb(urb);
+                if (!gspca_dev->present)
+                        usb_kill_urb(urb);
                if (urb->transfer_buffer != NULL)
                        usb_buffer_free(gspca_dev->dev,
                                        urb->transfer_buffer_length,
@@ -1950,7 +1951,6 @@ void gspca_disconnect(struct usb_interface *intf)
        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
        gspca_dev->present = 0;
-        gspca_dev->streaming = 0;
        usb_set_intfdata(intf, NULL);
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index e8e5921cdc34..c46c990987f9 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -949,8 +949,10 @@ static int __devinit ivtv_probe(struct pci_dev *dev,
        itv->instance = atomic_inc_return(&ivtv_instance) - 1;
        retval = v4l2_device_register(&dev->dev, &itv->device);
-        if (retval)
+        if (retval) {
+                kfree(itv);
                return retval;
+        }
        /* "ivtv + PCI ID" is a bit of a mouthful, so use
           "ivtv + instance" instead. */
        snprintf(itv->device.name, sizeof(itv->device.name),
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 39fbc970f43d..0d810189dd87 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -62,7 +62,6 @@
 #include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
-#include <linux/version.h>
 #include <asm/io.h>
 #include "pwc.h"
diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
index d6848f7a503b..05221d47dd4c 100644
--- a/drivers/media/video/saa7127.c
+++ b/drivers/media/video/saa7127.c
@@ -149,7 +149,7 @@ static const struct i2c_reg_value saa7127_init_config_common[] = {
        { SAA7127_REG_COPYGEN_0,                        0x77 },
        { SAA7127_REG_COPYGEN_1,                        0x41 },
        { SAA7127_REG_COPYGEN_2,                        0x00 }, /* Macrovision enable/disable */
-        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0x9e },
+        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0xbf },
        { SAA7127_REG_GAIN_LUMINANCE_RGB,               0x00 },
        { SAA7127_REG_GAIN_COLORDIFF_RGB,               0x00 },
        { SAA7127_REG_INPUT_PORT_CONTROL_1,             0x80 }, /* for color bars */
@@ -488,12 +488,18 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                break;
        case SAA7127_OUTPUT_TYPE_COMPOSITE:
-                state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x20;   /* CVBS only */
+                else
+                        state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
        case SAA7127_OUTPUT_TYPE_SVIDEO:
-                state->reg_2d = 0xff;   /* 11111111  croma -> R, luma -> CVBS + G + B */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x18;   /* Y + C */
+                else
+                        state->reg_2d = 0xff;   /*11111111  croma -> R, luma -> CVBS + G + B */
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
@@ -508,7 +514,10 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                break;
        case SAA7127_OUTPUT_TYPE_BOTH:
-                state->reg_2d = 0xbf;
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x38;
+                else
+                        state->reg_2d = 0xbf;
                state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                break;
@@ -731,24 +740,6 @@ static int saa7127_probe(struct i2c_client *client,
                return -ENODEV;
        }
-        /* Configure Encoder */
-        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
-        saa7127_write_inittab(sd, saa7127_init_config_common);
-        saa7127_set_std(sd, V4L2_STD_NTSC);
-        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
-        saa7127_set_vps(sd, &vbi);
-        saa7127_set_wss(sd, &vbi);
-        saa7127_set_cc(sd, &vbi);
-        saa7127_set_xds(sd, &vbi);
-        if (test_image == 1)
-                /* The Encoder has an internal Colorbar generator */
-                /* This can be used for debugging */
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
-        else
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
-        saa7127_set_video_enable(sd, 1);
        if (id->driver_data) {  /* Chip type is already known */
                state->ident = id->driver_data;
        } else {                /* Needs detection */
@@ -770,6 +761,23 @@ static int saa7127_probe(struct i2c_client *client,
        v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
                        client->addr << 1, client->adapter->name);
+        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
+        saa7127_write_inittab(sd, saa7127_init_config_common);
+        saa7127_set_std(sd, V4L2_STD_NTSC);
+        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
+        saa7127_set_vps(sd, &vbi);
+        saa7127_set_wss(sd, &vbi);
+        saa7127_set_cc(sd, &vbi);
+        saa7127_set_xds(sd, &vbi);
+        if (test_image == 1)
+                /* The Encoder has an internal Colorbar generator */
+                /* This can be used for debugging */
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
+        else
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
+        saa7127_set_video_enable(sd, 1);
        if (state->ident == V4L2_IDENT_SAA7129)
                saa7127_write_inittab(sd, saa7129_init_config_extra);
        return 0;
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index 26194a0ce927..c750d3dd57d2 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -1089,7 +1089,11 @@ static int saa7134_alsa_init(void)
        list_for_each(list,&saa7134_devlist) {
                dev = list_entry(list, struct saa7134_dev, devlist);
-                alsa_device_init(dev);
+                if (dev->pci->device == PCI_DEVICE_ID_PHILIPS_SAA7130)
+                        printk(KERN_INFO "%s/alsa: %s doesn't support digital audio\n",
+                                dev->name, saa7134_boards[dev->board].name);
+                else
+                        alsa_device_init(dev);
        }
        if (dev == NULL)
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index dfbe08a9ad9b..99221d726edb 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -660,6 +660,10 @@ static int saa7134_hwinit1(struct saa7134_dev *dev)
        saa_writel(SAA7134_IRQ1, 0);
        saa_writel(SAA7134_IRQ2, 0);
+        /* Clear any stale IRQ reports */
+        saa_writel(SAA7134_IRQ_REPORT, saa_readl(SAA7134_IRQ_REPORT));
        mutex_init(&dev->lock);
        spin_lock_init(&dev->slock);
diff --git a/drivers/media/video/saa717x.c b/drivers/media/video/saa717x.c
index 454ad1dd7507..88c5e942f751 100644
--- a/drivers/media/video/saa717x.c
+++ b/drivers/media/video/saa717x.c
@@ -30,7 +30,6 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/drivers/media/video/tda9875.c b/drivers/media/video/tda9875.c
index 56f0c0eb500f..00c6cbe06ab0 100644
--- a/drivers/media/video/tda9875.c
+++ b/drivers/media/video/tda9875.c
@@ -242,7 +242,7 @@ static int tda9875_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 static int tda9875_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
        struct tda9875 *t = to_state(sd);
-        int chvol=0, volume, balance, left, right;
+        int chvol = 0, volume = 0, balance = 0, left, right;
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_VOLUME:
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index 3b0b84c2e451..78277abb733b 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -427,6 +427,9 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
        const char *t_fmt_name2[8] = { " none", "", "", "", "", "", "", "" };
        memset(tvee, 0, sizeof(*tvee));
+        tvee->tuner_type = TUNER_ABSENT;
+        tvee->tuner2_type = TUNER_ABSENT;
        done = len = beenhere = 0;
        /* Different eeprom start offsets for em28xx, cx2388x and cx23418 */
diff --git a/drivers/media/video/tvp514x.c b/drivers/media/video/tvp514x.c
index ac9aa40d09f6..8e23aa53c29a 100644
--- a/drivers/media/video/tvp514x.c
+++ b/drivers/media/video/tvp514x.c
@@ -1401,7 +1401,7 @@ tvp514x_probe(struct i2c_client *client, const struct i2c_device_id *id)
        decoder->pdata = client->dev.platform_data;
        if (!decoder->pdata) {
-                v4l_err(client, "No platform data\n!!");
+                v4l_err(client, "No platform data!!\n");
                return -ENODEV;
        }
        /*
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index 4f16effb530f..f4522bb08916 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -21,7 +21,6 @@
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 4b712f69d1b7..a5fb74bf2407 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -21,7 +21,6 @@
 * 02110-1301, USA.
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index 9907b9aff2b9..6b66ae4f430f 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -157,7 +157,7 @@ usbvision_i2c_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msgs[], int num)
        struct i2c_msg *pmsg;
        struct usb_usbvision *usbvision;
        int i, ret;
-        unsigned char addr;
+        unsigned char addr = 0;
        usbvision = (struct usb_usbvision *)i2c_get_adapdata(i2c_adap);
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 2208165aa6f0..d2576f6391c0 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_ctrl.c  --  USB Video Class driver - Controls
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
@@ -29,7 +28,7 @@
 #define UVC_CTRL_DATA_BACKUP    1
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Controls
 */
 static struct uvc_control_info uvc_ctrls[] = {
@@ -635,7 +634,7 @@ static __s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
                mask = (1 << bits) - 1;
        }
-        /* Sign-extend the value if needed */
+        /* Sign-extend the value if needed. */
        if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED)
                value |= -(value & (1 << (mapping->size - 1)));
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89d8bd10a852..b12873265cc5 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_driver.c  --  USB Video Class driver
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -24,7 +24,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -49,7 +48,7 @@ static unsigned int uvc_quirks_param;
 unsigned int uvc_trace_param;
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Video formats
 */
 static struct uvc_format_desc uvc_fmts[] = {
@@ -474,7 +473,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                /* Several UVC chipsets screw up dwMaxVideoFrameBufferSize
                 * completely. Observed behaviours range from setting the
-                 * value to 1.1x the actual frame size of hardwiring the
+                 * value to 1.1x the actual frame size to hardwiring the
                 * 16 low bits to 0. This results in a higher than necessary
                 * memory usage as well as a wrong image size information. For
                 * uncompressed formats this can be fixed by computing the
@@ -487,7 +486,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                /* Some bogus devices report dwMinFrameInterval equal to
                 * dwMaxFrameInterval and have dwFrameIntervalStep set to
                 * zero. Setting all null intervals to 1 fixes the problem and
-                 * some other divisions by zero which could happen.
+                 * some other divisions by zero that could happen.
                 */
                for (i = 0; i < n; ++i) {
                        interval = get_unaligned_le32(&buffer[26+4*i]);
@@ -1200,13 +1199,13 @@ static void uvc_unregister_video(struct uvc_device *dev)
 * Scan the UVC descriptors to locate a chain starting at an Output Terminal
 * and containing the following units:
 *
- * - a USB Streaming Output Terminal
+ * - one Output Terminal (USB Streaming or Display)
 * - zero or one Processing Unit
 * - zero, one or mode single-input Selector Units
 * - zero or one multiple-input Selector Units, provided all inputs are
 *   connected to input terminals
 * - zero, one or mode single-input Extension Units
- * - one Camera Input Terminal, or one or more External terminals.
+ * - one or more Input Terminals (Camera, External or USB Streaming)
 *
 * A side forward scan is made on each detected entity to check for additional
 * extension units.
@@ -1531,10 +1530,6 @@ static int uvc_register_video(struct uvc_device *dev)
        /* Set the driver data before calling video_register_device, otherwise
         * uvc_v4l2_open might race us.
-         *
-         * FIXME: usb_set_intfdata hasn't been called so far. Is that a
-         *        problem ? Does any function which could be called here get
-         *        a pointer to the usb_interface ?
         */
        dev->video.vdev = vdev;
        video_set_drvdata(vdev, &dev->video);
@@ -1569,7 +1564,7 @@ void uvc_delete(struct kref *kref)
        struct uvc_device *dev = container_of(kref, struct uvc_device, kref);
        struct list_head *p, *n;
-        /* Unregister the video device */
+        /* Unregister the video device. */
        uvc_unregister_video(dev);
        usb_put_intf(dev->intf);
        usb_put_dev(dev->udev);
@@ -1612,7 +1607,7 @@ static int uvc_probe(struct usb_interface *intf,
                uvc_trace(UVC_TRACE_PROBE, "Probing generic UVC device %s\n",
                                udev->devpath);
-        /* Allocate memory for the device and initialize it */
+        /* Allocate memory for the device and initialize it. */
        if ((dev = kzalloc(sizeof *dev, GFP_KERNEL)) == NULL)
                return -ENOMEM;
@@ -1633,14 +1628,14 @@ static int uvc_probe(struct usb_interface *intf,
                        le16_to_cpu(udev->descriptor.idVendor),
                        le16_to_cpu(udev->descriptor.idProduct));
-        /* Parse the Video Class control descriptor */
+        /* Parse the Video Class control descriptor. */
        if (uvc_parse_control(dev) < 0) {
                uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC "
                        "descriptors.\n");
                goto error;
        }
-        uvc_printk(KERN_INFO, "Found UVC %u.%02u device %s (%04x:%04x)\n",
+        uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
                dev->uvc_version >> 8, dev->uvc_version & 0xff,
                udev->product ? udev->product : "<unnamed>",
                le16_to_cpu(udev->descriptor.idVendor),
@@ -1653,18 +1648,18 @@ static int uvc_probe(struct usb_interface *intf,
                        "linux-uvc-devel mailing list.\n");
        }
-        /* Initialize controls */
+        /* Initialize controls. */
        if (uvc_ctrl_init_device(dev) < 0)
                goto error;
-        /* Register the video devices */
+        /* Register the video devices. */
        if (uvc_register_video(dev) < 0)
                goto error;
-        /* Save our data pointer in the interface data */
+        /* Save our data pointer in the interface data. */
        usb_set_intfdata(intf, dev);
-        /* Initialize the interrupt URB */
+        /* Initialize the interrupt URB. */
        if ((ret = uvc_status_init(dev)) < 0) {
                uvc_printk(KERN_INFO, "Unable to initialize the status "
                        "endpoint (%d), status interrupt will not be "
@@ -1839,24 +1834,24 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0 },
        /* Apple Built-In iSight */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
          .idVendor             = 0x05ac,
          .idProduct            = 0x8501,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
+          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
+          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                | UVC_QUIRK_BUILTIN_ISIGHT },
        /* Genesys Logic USB 2.0 PC Camera */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
-          .idVendor             = 0x05e3,
+          .idVendor             = 0x05e3,
-          .idProduct            = 0x0505,
+          .idProduct            = 0x0505,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
+          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
+          .bInterfaceProtocol   = 0,
-          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
        /* MT6227 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvc_isight.c b/drivers/media/video/uvc/uvc_isight.c
index 37bdefdbead5..436f462685a0 100644
--- a/drivers/media/video/uvc/uvc_isight.c
+++ b/drivers/media/video/uvc/uvc_isight.c
@@ -3,6 +3,8 @@
 *
 *      Copyright (C) 2006-2007
 *              Ivan N. Zlatev <contact@i-nz.net>
+ *      Copyright (C) 2008-2009
+ *              Laurent Pinchart <laurent.pinchart@skynet.be>
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 42546342e97d..0155752e4a5a 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_queue.c  --  USB Video Class driver - Buffers management
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/mm.h>
 #include <linux/list.h>
 #include <linux/module.h>
@@ -37,22 +36,22 @@
 * to user space will return -EBUSY.
 *
 * Video buffers are managed using two queues. However, unlike most USB video
- * drivers which use an in queue and an out queue, we use a main queue which
+ * drivers that use an in queue and an out queue, we use a main queue to hold
- * holds all queued buffers (both 'empty' and 'done' buffers), and an irq
+ * all queued buffers (both 'empty' and 'done' buffers), and an irq queue to
- * queue which holds empty buffers. This design (copied from video-buf)
+ * hold empty buffers. This design (copied from video-buf) minimizes locking
- * minimizes locking in interrupt, as only one queue is shared between
+ * in interrupt, as only one queue is shared between interrupt and user
- * interrupt and user contexts.
+ * contexts.
 *
 * Use cases
 * ---------
 *
- * Unless stated otherwise, all operations which modify the irq buffers queue
+ * Unless stated otherwise, all operations that modify the irq buffers queue
 * are protected by the irq spinlock.
 *
 * 1. The user queues the buffers, starts streaming and dequeues a buffer.
 *
 *    The buffers are added to the main and irq queues. Both operations are
- *    protected by the queue lock, and the latert is protected by the irq
+ *    protected by the queue lock, and the later is protected by the irq
 *    spinlock as well.
 *
 *    The completion handler fetches a buffer from the irq queue and fills it
@@ -60,7 +59,7 @@
 *    returns immediately.
 *
 *    When the buffer is full, the completion handler removes it from the irq
- *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wake its wait queue.
+ *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wakes its wait queue.
 *    At that point, any process waiting on the buffer will be woken up. If a
 *    process tries to dequeue a buffer after it has been marked ready, the
 *    dequeing will succeed immediately.
@@ -91,8 +90,8 @@ void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
 /*
 * Allocate the video buffers.
 *
- * Pages are reserved to make sure they will not be swaped, as they will be
+ * Pages are reserved to make sure they will not be swapped, as they will be
- * filled in URB completion handler.
+ * filled in the URB completion handler.
 *
 * Buffers will be individually mapped, so they must all be page aligned.
 */
@@ -210,8 +209,8 @@ int uvc_query_buffer(struct uvc_video_queue *queue,
        __uvc_query_buffer(&queue->buffer[v4l2_buf->index], v4l2_buf);
 done:
-       mutex_unlock(&queue->mutex);
+        mutex_unlock(&queue->mutex);
-       return ret;
+        return ret;
 }
 /*
@@ -236,7 +235,7 @@ int uvc_queue_buffer(struct uvc_video_queue *queue,
        }
        mutex_lock(&queue->mutex);
-        if (v4l2_buf->index >= queue->count)  {
+        if (v4l2_buf->index >= queue->count) {
                uvc_trace(UVC_TRACE_CAPTURE, "[E] Out of range index.\n");
                ret = -EINVAL;
                goto done;
@@ -429,7 +428,7 @@ done:
 * Cancel the video buffers queue.
 *
 * Cancelling the queue marks all buffers on the irq queue as erroneous,
- * wakes them up and remove them from the queue.
+ * wakes them up and removes them from the queue.
 *
 * If the disconnect parameter is set, further calls to uvc_queue_buffer will
 * fail with -ENODEV.
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index 5d60b264d59a..c1e4ae27c613 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_status.c  --  USB Video Class driver - Status endpoint
 *
- *      Copyright (C) 2007-2008
+ *      Copyright (C) 2007-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/usb/input.h>
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index fa150fff2c10..d681519d0c8a 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_v4l2.c  --  USB Video Class driver - V4L2 API
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -37,7 +37,7 @@
 * must be grouped (for instance the Red Balance, Blue Balance and Do White
 * Balance V4L2 controls use the White Balance Component UVC control) or
 * otherwise translated. The approach we take here is to use a translation
- * table for the controls which can be mapped directly, and handle the others
+ * table for the controls that can be mapped directly, and handle the others
 * manually.
 */
 static int uvc_v4l2_query_menu(struct uvc_video_device *video,
@@ -189,7 +189,7 @@ static int uvc_v4l2_try_format(struct uvc_video_device *video,
                probe->dwMaxVideoFrameSize =
                        video->streaming->ctrl.dwMaxVideoFrameSize;
-        /* Probe the device */
+        /* Probe the device. */
        if ((ret = uvc_probe_video(video, probe)) < 0)
                goto done;
@@ -354,11 +354,11 @@ static int uvc_v4l2_set_streamparm(struct uvc_video_device *video,
 *
 * Each open instance of a UVC device can either be in a privileged or
 * unprivileged state. Only a single instance can be in a privileged state at
- * a given time. Trying to perform an operation which requires privileges will
+ * a given time. Trying to perform an operation that requires privileges will
 * automatically acquire the required privileges if possible, or return -EBUSY
 * otherwise. Privileges are dismissed when closing the instance.
 *
- * Operations which require privileges are:
+ * Operations that require privileges are:
 *
 * - VIDIOC_S_INPUT
 * - VIDIOC_S_PARM
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index e7c31995527f..9bc4705be78d 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1,7 +1,7 @@
 /*
 *      uvc_video.c  --  USB Video Class driver - Video handling
 *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
 *          Laurent Pinchart (laurent.pinchart@skynet.be)
 *
 *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -115,7 +114,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
                ctrl->wCompQuality = le16_to_cpup((__le16 *)data);
                ret = 0;
                goto out;
-        } else if (query == GET_DEF && probe == 1) {
+        } else if (query == GET_DEF && probe == 1 && ret != size) {
                /* Many cameras don't support the GET_DEF request on their
                 * video probe control. Warn once and return, the caller will
                 * fall back to GET_CUR.
@@ -160,7 +159,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
        }
        /* Some broken devices return a null or wrong dwMaxVideoFrameSize.
-         * Try to get the value from the format and frame descriptor.
+         * Try to get the value from the format and frame descriptors.
         */
        uvc_fixup_buffer_size(video, ctrl);
        ret = 0;
@@ -191,9 +190,6 @@ static int uvc_set_video_ctrl(struct uvc_video_device *video,
        *(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
        *(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
        *(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
-        /* Note: Some of the fields below are not required for IN devices (see
-         * UVC spec, 4.3.1.1), but we still copy them in case support for OUT
-         * devices is added in the future. */
        put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
        put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
@@ -400,7 +396,7 @@ static int uvc_video_decode_start(struct uvc_video_device *video,
         *
         * Empty buffers (bytesused == 0) don't trigger end of frame detection
         * as it doesn't make sense to return an empty buffer. This also
-         * avoids detecting and of frame conditions at FID toggling if the
+         * avoids detecting end of frame conditions at FID toggling if the
         * previous payload had the EOF bit set.
         */
        if (fid != video->last_fid && buf->buf.bytesused != 0) {
@@ -453,6 +449,17 @@ static void uvc_video_decode_end(struct uvc_video_device *video,
        }
 }
+/* Video payload encoding is handled by uvc_video_encode_header() and
+ * uvc_video_encode_data(). Only bulk transfers are currently supported.
+ *
+ * uvc_video_encode_header is called at the start of a payload. It adds header
+ * data to the transfer buffer and returns the header size. As the only known
+ * UVC output device transfers a whole frame in a single payload, the EOF bit
+ * is always set in the header.
+ *
+ * uvc_video_encode_data is called for every URB and copies the data from the
+ * video buffer to the transfer buffer.
+ */
 static int uvc_video_encode_header(struct uvc_video_device *video,
                struct uvc_buffer *buf, __u8 *data, int len)
 {
@@ -953,7 +960,7 @@ int uvc_video_suspend(struct uvc_video_device *video)
 }
 /*
- * Reconfigure the video interface and restart streaming if it was enable
+ * Reconfigure the video interface and restart streaming if it was enabled
 * before suspend.
 *
 * If an error occurs, disable the video queue. This will wake all pending
@@ -985,8 +992,8 @@ int uvc_video_resume(struct uvc_video_device *video)
 */
 /*
- * Initialize the UVC video device by retrieving the default format and
+ * Initialize the UVC video device by switching to alternate setting 0 and
- * committing it.
+ * retrieve the default format.
 *
 * Some cameras (namely the Fuji Finepix) set the format and frame
 * indexes to zero. The UVC standard doesn't clearly make this a spec
@@ -1014,7 +1021,7 @@ int uvc_video_init(struct uvc_video_device *video)
         */
        usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
-        /* Some webcams don't suport GET_DEF request on the probe control. We
+        /* Some webcams don't suport GET_DEF requests on the probe control. We
         * fall back to GET_CUR if GET_DEF fails.
         */
        if ((ret = uvc_get_video_ctrl(video, probe, 1, GET_DEF)) < 0 &&
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bcf4361dc1bc..027947ea9b6e 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -72,149 +72,149 @@ struct uvc_xu_control {
 * UVC constants
 */
-#define SC_UNDEFINED                    0x00
+#define SC_UNDEFINED                    0x00
-#define SC_VIDEOCONTROL                 0x01
+#define SC_VIDEOCONTROL                 0x01
-#define SC_VIDEOSTREAMING               0x02
+#define SC_VIDEOSTREAMING               0x02
-#define SC_VIDEO_INTERFACE_COLLECTION   0x03
+#define SC_VIDEO_INTERFACE_COLLECTION   0x03
-#define PC_PROTOCOL_UNDEFINED           0x00
+#define PC_PROTOCOL_UNDEFINED           0x00
-#define CS_UNDEFINED                    0x20
+#define CS_UNDEFINED                    0x20
-#define CS_DEVICE                       0x21
+#define CS_DEVICE                       0x21
-#define CS_CONFIGURATION                0x22
+#define CS_CONFIGURATION                0x22
-#define CS_STRING                       0x23
+#define CS_STRING                       0x23
-#define CS_INTERFACE                    0x24
+#define CS_INTERFACE                    0x24
-#define CS_ENDPOINT                     0x25
+#define CS_ENDPOINT                     0x25
 /* VideoControl class specific interface descriptor */
-#define VC_DESCRIPTOR_UNDEFINED         0x00
+#define VC_DESCRIPTOR_UNDEFINED         0x00
-#define VC_HEADER                       0x01
+#define VC_HEADER                       0x01
-#define VC_INPUT_TERMINAL               0x02
+#define VC_INPUT_TERMINAL               0x02
-#define VC_OUTPUT_TERMINAL              0x03
+#define VC_OUTPUT_TERMINAL              0x03
-#define VC_SELECTOR_UNIT                0x04
+#define VC_SELECTOR_UNIT                0x04
-#define VC_PROCESSING_UNIT              0x05
+#define VC_PROCESSING_UNIT              0x05
-#define VC_EXTENSION_UNIT               0x06
+#define VC_EXTENSION_UNIT               0x06
 /* VideoStreaming class specific interface descriptor */
-#define VS_UNDEFINED                    0x00
+#define VS_UNDEFINED                    0x00
-#define VS_INPUT_HEADER                 0x01
+#define VS_INPUT_HEADER                 0x01
-#define VS_OUTPUT_HEADER                0x02
+#define VS_OUTPUT_HEADER                0x02
-#define VS_STILL_IMAGE_FRAME            0x03
+#define VS_STILL_IMAGE_FRAME            0x03
-#define VS_FORMAT_UNCOMPRESSED          0x04
+#define VS_FORMAT_UNCOMPRESSED          0x04
-#define VS_FRAME_UNCOMPRESSED           0x05
+#define VS_FRAME_UNCOMPRESSED           0x05
-#define VS_FORMAT_MJPEG                 0x06
+#define VS_FORMAT_MJPEG                 0x06
-#define VS_FRAME_MJPEG                  0x07
+#define VS_FRAME_MJPEG                  0x07
-#define VS_FORMAT_MPEG2TS               0x0a
+#define VS_FORMAT_MPEG2TS               0x0a
-#define VS_FORMAT_DV                    0x0c
+#define VS_FORMAT_DV                    0x0c
-#define VS_COLORFORMAT                  0x0d
+#define VS_COLORFORMAT                  0x0d
-#define VS_FORMAT_FRAME_BASED           0x10
+#define VS_FORMAT_FRAME_BASED           0x10
-#define VS_FRAME_FRAME_BASED            0x11
+#define VS_FRAME_FRAME_BASED            0x11
-#define VS_FORMAT_STREAM_BASED          0x12
+#define VS_FORMAT_STREAM_BASED          0x12
 /* Endpoint type */
-#define EP_UNDEFINED                    0x00
+#define EP_UNDEFINED                    0x00
-#define EP_GENERAL                      0x01
+#define EP_GENERAL                      0x01
-#define EP_ENDPOINT                     0x02
+#define EP_ENDPOINT                     0x02
-#define EP_INTERRUPT                    0x03
+#define EP_INTERRUPT                    0x03
 /* Request codes */
-#define RC_UNDEFINED                    0x00
+#define RC_UNDEFINED                    0x00
-#define SET_CUR                         0x01
+#define SET_CUR                         0x01
-#define GET_CUR                         0x81
+#define GET_CUR                         0x81
-#define GET_MIN                         0x82
+#define GET_MIN                         0x82
-#define GET_MAX                         0x83
+#define GET_MAX                         0x83
-#define GET_RES                         0x84
+#define GET_RES                         0x84
-#define GET_LEN                         0x85
+#define GET_LEN                         0x85
-#define GET_INFO                        0x86
+#define GET_INFO                        0x86
-#define GET_DEF                         0x87
+#define GET_DEF                         0x87
 /* VideoControl interface controls */
-#define VC_CONTROL_UNDEFINED            0x00
+#define VC_CONTROL_UNDEFINED            0x00
-#define VC_VIDEO_POWER_MODE_CONTROL     0x01
+#define VC_VIDEO_POWER_MODE_CONTROL     0x01
-#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
+#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
 /* Terminal controls */
-#define TE_CONTROL_UNDEFINED            0x00
+#define TE_CONTROL_UNDEFINED            0x00
 /* Selector Unit controls */
-#define SU_CONTROL_UNDEFINED            0x00
+#define SU_CONTROL_UNDEFINED            0x00
-#define SU_INPUT_SELECT_CONTROL         0x01
+#define SU_INPUT_SELECT_CONTROL         0x01
 /* Camera Terminal controls */
-#define CT_CONTROL_UNDEFINED                            0x00
+#define CT_CONTROL_UNDEFINED                            0x00
-#define CT_SCANNING_MODE_CONTROL                        0x01
+#define CT_SCANNING_MODE_CONTROL                        0x01
-#define CT_AE_MODE_CONTROL                              0x02
+#define CT_AE_MODE_CONTROL                              0x02
-#define CT_AE_PRIORITY_CONTROL                          0x03
+#define CT_AE_PRIORITY_CONTROL                          0x03
-#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
+#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
-#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
+#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
-#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
+#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
-#define CT_FOCUS_RELATIVE_CONTROL                       0x07
+#define CT_FOCUS_RELATIVE_CONTROL                       0x07
-#define CT_FOCUS_AUTO_CONTROL                           0x08
+#define CT_FOCUS_AUTO_CONTROL                           0x08
-#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
+#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
-#define CT_IRIS_RELATIVE_CONTROL                        0x0a
+#define CT_IRIS_RELATIVE_CONTROL                        0x0a
-#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
+#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
-#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
+#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
-#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
+#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
-#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
+#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
-#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
+#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
-#define CT_ROLL_RELATIVE_CONTROL                        0x10
+#define CT_ROLL_RELATIVE_CONTROL                        0x10
-#define CT_PRIVACY_CONTROL                              0x11
+#define CT_PRIVACY_CONTROL                              0x11
 /* Processing Unit controls */
-#define PU_CONTROL_UNDEFINED                            0x00
+#define PU_CONTROL_UNDEFINED                            0x00
-#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
+#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
-#define PU_BRIGHTNESS_CONTROL                           0x02
+#define PU_BRIGHTNESS_CONTROL                           0x02
-#define PU_CONTRAST_CONTROL                             0x03
+#define PU_CONTRAST_CONTROL                             0x03
-#define PU_GAIN_CONTROL                                 0x04
+#define PU_GAIN_CONTROL                                 0x04
-#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
+#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
-#define PU_HUE_CONTROL                                  0x06
+#define PU_HUE_CONTROL                                  0x06
-#define PU_SATURATION_CONTROL                           0x07
+#define PU_SATURATION_CONTROL                           0x07
-#define PU_SHARPNESS_CONTROL                            0x08
+#define PU_SHARPNESS_CONTROL                            0x08
-#define PU_GAMMA_CONTROL                                0x09
+#define PU_GAMMA_CONTROL                                0x09
-#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
+#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
-#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
+#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
-#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
+#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
-#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
+#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
-#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
+#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
-#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
+#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
-#define PU_HUE_AUTO_CONTROL                             0x10
+#define PU_HUE_AUTO_CONTROL                             0x10
-#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
+#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
-#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
+#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
 #define LXU_MOTOR_PANTILT_RELATIVE_CONTROL              0x01
 #define LXU_MOTOR_PANTILT_RESET_CONTROL                 0x02
 #define LXU_MOTOR_FOCUS_MOTOR_CONTROL                   0x03
 /* VideoStreaming interface controls */
-#define VS_CONTROL_UNDEFINED            0x00
+#define VS_CONTROL_UNDEFINED            0x00
-#define VS_PROBE_CONTROL                0x01
+#define VS_PROBE_CONTROL                0x01
-#define VS_COMMIT_CONTROL               0x02
+#define VS_COMMIT_CONTROL               0x02
-#define VS_STILL_PROBE_CONTROL          0x03
+#define VS_STILL_PROBE_CONTROL          0x03
-#define VS_STILL_COMMIT_CONTROL         0x04
+#define VS_STILL_COMMIT_CONTROL         0x04
-#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
+#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
-#define VS_STREAM_ERROR_CODE_CONTROL    0x06
+#define VS_STREAM_ERROR_CODE_CONTROL    0x06
-#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
+#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
-#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
+#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
-#define VS_SYNC_DELAY_CONTROL           0x09
+#define VS_SYNC_DELAY_CONTROL           0x09
-#define TT_VENDOR_SPECIFIC              0x0100
+#define TT_VENDOR_SPECIFIC              0x0100
-#define TT_STREAMING                    0x0101
+#define TT_STREAMING                    0x0101
 /* Input Terminal types */
-#define ITT_VENDOR_SPECIFIC             0x0200
+#define ITT_VENDOR_SPECIFIC             0x0200
-#define ITT_CAMERA                      0x0201
+#define ITT_CAMERA                      0x0201
-#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
+#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
 /* Output Terminal types */
-#define OTT_VENDOR_SPECIFIC             0x0300
+#define OTT_VENDOR_SPECIFIC             0x0300
-#define OTT_DISPLAY                     0x0301
+#define OTT_DISPLAY                     0x0301
-#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
+#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
 /* External Terminal types */
-#define EXTERNAL_VENDOR_SPECIFIC        0x0400
+#define EXTERNAL_VENDOR_SPECIFIC        0x0400
-#define COMPOSITE_CONNECTOR             0x0401
+#define COMPOSITE_CONNECTOR             0x0401
-#define SVIDEO_CONNECTOR                0x0402
+#define SVIDEO_CONNECTOR                0x0402
-#define COMPONENT_CONNECTOR             0x0403
+#define COMPONENT_CONNECTOR             0x0403
 #define UVC_TERM_INPUT                  0x0000
 #define UVC_TERM_OUTPUT                 0x8000
@@ -541,11 +541,11 @@ struct uvc_streaming {
 };
 enum uvc_buffer_state {
-        UVC_BUF_STATE_IDLE       = 0,
+        UVC_BUF_STATE_IDLE      = 0,
-        UVC_BUF_STATE_QUEUED     = 1,
+        UVC_BUF_STATE_QUEUED    = 1,
-        UVC_BUF_STATE_ACTIVE     = 2,
+        UVC_BUF_STATE_ACTIVE    = 2,
-        UVC_BUF_STATE_DONE       = 3,
+        UVC_BUF_STATE_DONE      = 3,
-        UVC_BUF_STATE_ERROR      = 4,
+        UVC_BUF_STATE_ERROR     = 4,
 };
 struct uvc_buffer {
diff --git a/drivers/media/video/v4l2-subdev.c b/drivers/media/video/v4l2-subdev.c
index fbe9cc0d433a..21208805ea9b 100644
--- a/drivers/media/video/v4l2-subdev.c
+++ b/drivers/media/video/v4l2-subdev.c
@@ -28,13 +28,13 @@ int v4l2_subdev_command(struct v4l2_subdev *sd, unsigned cmd, void *arg)
 {
        switch (cmd) {
        case VIDIOC_QUERYCTRL:
-                return v4l2_subdev_call(sd, core, querymenu, arg);
+                return v4l2_subdev_call(sd, core, queryctrl, arg);
        case VIDIOC_G_CTRL:
                return v4l2_subdev_call(sd, core, g_ctrl, arg);
        case VIDIOC_S_CTRL:
                return v4l2_subdev_call(sd, core, s_ctrl, arg);
        case VIDIOC_QUERYMENU:
-                return v4l2_subdev_call(sd, core, queryctrl, arg);
+                return v4l2_subdev_call(sd, core, querymenu, arg);
        case VIDIOC_LOG_STATUS:
                return v4l2_subdev_call(sd, core, log_status);
        case VIDIOC_DBG_G_CHIP_IDENT:
diff --git a/drivers/media/video/zoran/zoran.h b/drivers/media/video/zoran/zoran.h
index 46b7ad477ceb..e873a916250f 100644
--- a/drivers/media/video/zoran/zoran.h
+++ b/drivers/media/video/zoran/zoran.h
@@ -349,7 +349,6 @@ struct card_info {
        u16 i2c_decoder, i2c_encoder;                   /* I2C types */
        u16 video_vfe, video_codec;                     /* videocodec types */
        u16 audio_chip;                                 /* audio type */
-        u16 vendor_id, device_id;       /* subsystem vendor/device ID */
        int inputs;             /* number of video inputs */
        struct input {
@@ -401,7 +400,6 @@ struct zoran {
        char name[32];          /* name of this device */
        struct pci_dev *pci_dev;        /* PCI device */
        unsigned char revision; /* revision of zr36057 */
-        unsigned int zr36057_adr;       /* bus address of IO mem returned by PCI BIOS */
        unsigned char __iomem *zr36057_mem;/* pointer to mapped IO memory */
        spinlock_t spinlock;    /* Spinlock */
@@ -490,16 +488,10 @@ struct zoran {
        wait_queue_head_t test_q;
 };
-/*The following should be done in more portable way. It depends on define
+/* There was something called _ALPHA_BUZ that used the PCI address instead of
-  of _ALPHA_BUZ in the Makefile.*/
+ * the kernel iomapped address for btread/btwrite.  */
-#ifdef _ALPHA_BUZ
-#define btwrite(dat,adr)    writel((dat), zr->zr36057_adr+(adr))
-#define btread(adr)         readl(zr->zr36057_adr+(adr))
-#else
 #define btwrite(dat,adr)    writel((dat), zr->zr36057_mem+(adr))
 #define btread(adr)         readl(zr->zr36057_mem+(adr))
-#endif
 #define btand(dat,adr)      btwrite((dat) & btread(adr), adr)
 #define btor(dat,adr)       btwrite((dat) | btread(adr), adr)
diff --git a/drivers/media/video/zoran/zoran_card.c b/drivers/media/video/zoran/zoran_card.c
index 05f39195372e..5d2f090aa0f8 100644
--- a/drivers/media/video/zoran/zoran_card.c
+++ b/drivers/media/video/zoran/zoran_card.c
@@ -61,17 +61,17 @@
 extern const struct zoran_format zoran_formats[];
-static int card[BUZ_MAX] = { -1, -1, -1, -1 };
+static int card[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(card, int, NULL, 0444);
-MODULE_PARM_DESC(card, "The type of card");
+MODULE_PARM_DESC(card, "Card type");
-static int encoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int encoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(encoder, int, NULL, 0444);
-MODULE_PARM_DESC(encoder, "i2c TV encoder");
+MODULE_PARM_DESC(encoder, "Video encoder chip");
-static int decoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int decoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(decoder, int, NULL, 0444);
-MODULE_PARM_DESC(decoder, "i2c TV decoder");
+MODULE_PARM_DESC(decoder, "Video decoder chip");
 /*
   The video mem address of the video card.
@@ -104,9 +104,9 @@ module_param(default_norm, int, 0444);
 MODULE_PARM_DESC(default_norm, "Default norm (0=PAL, 1=NTSC, 2=SECAM)");
 /* /dev/videoN, -1 for autodetect */
-static int video_nr[BUZ_MAX] = {-1, -1, -1, -1};
+static int video_nr[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(video_nr, int, NULL, 0444);
-MODULE_PARM_DESC(video_nr, "video device number (-1=Auto)");
+MODULE_PARM_DESC(video_nr, "Video device number (-1=Auto)");
 /*
   Number and size of grab buffers for Video 4 Linux
@@ -153,9 +153,21 @@ MODULE_DESCRIPTION("Zoran-36057/36067 JPEG codec driver");
 MODULE_AUTHOR("Serguei Miridonov");
 MODULE_LICENSE("GPL");
+#define ZR_DEVICE(subven, subdev, data) { \
+        .vendor = PCI_VENDOR_ID_ZORAN, .device = PCI_DEVICE_ID_ZORAN_36057, \
+        .subvendor = (subven), .subdevice = (subdev), .driver_data = (data) }
+static struct pci_device_id zr36067_pci_tbl[] = {
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC10PLUS, DC10plus),
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC30PLUS, DC30plus),
+        ZR_DEVICE(PCI_VENDOR_ID_ELECTRONICDESIGNGMBH, PCI_DEVICE_ID_LML_33R10, LML33R10),
+        ZR_DEVICE(PCI_VENDOR_ID_IOMEGA, PCI_DEVICE_ID_IOMEGA_BUZ, BUZ),
+        ZR_DEVICE(PCI_ANY_ID, PCI_ANY_ID, NUM_CARDS),
+        {0}
+};
+MODULE_DEVICE_TABLE(pci, zr36067_pci_tbl);
-int zoran_num;                  /* number of Buzs in use */
+static unsigned int zoran_num;          /* number of cards found */
-struct zoran *zoran[BUZ_MAX];
 /* videocodec bus functions ZR36060 */
 static u32
@@ -472,8 +484,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = DC10plus,
                .name = "DC10plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC10PLUS,
                .i2c_decoder = I2C_DRIVERID_SAA7110,
                .i2c_encoder = I2C_DRIVERID_ADV7175,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -531,8 +541,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = DC30plus,
                .name = "DC30plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC30PLUS,
                .i2c_decoder = I2C_DRIVERID_VPX3220,
                .i2c_encoder = I2C_DRIVERID_ADV7175,
                .video_codec = CODEC_TYPE_ZR36050,
@@ -589,8 +597,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = LML33R10,
                .name = "LML33R10",
-                .vendor_id = PCI_VENDOR_ID_ELECTRONICDESIGNGMBH,
-                .device_id = PCI_DEVICE_ID_LML_33R10,
                .i2c_decoder = I2C_DRIVERID_SAA7114,
                .i2c_encoder = I2C_DRIVERID_ADV7170,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -618,8 +624,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
        }, {
                .type = BUZ,
                .name = "Buz",
-                .vendor_id = PCI_VENDOR_ID_IOMEGA,
-                .device_id = PCI_DEVICE_ID_IOMEGA_BUZ,
                .i2c_decoder = I2C_DRIVERID_SAA7111A,
                .i2c_encoder = I2C_DRIVERID_SAA7185B,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -649,8 +653,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
                .name = "6-Eyes",
                /* AverMedia chose not to brand the 6-Eyes. Thus it
                   can't be autodetected, and requires card=x. */
-                .vendor_id = -1,
-                .device_id = -1,
                .i2c_decoder = I2C_DRIVERID_KS0127,
                .i2c_encoder = I2C_DRIVERID_BT866,
                .video_codec = CODEC_TYPE_ZR36060,
@@ -1138,7 +1140,8 @@ zr36057_init (struct zoran *zr)
        strcpy(zr->video_dev->name, ZR_DEVNAME(zr));
        err = video_register_device(zr->video_dev, VFL_TYPE_GRABBER, video_nr[zr->id]);
        if (err < 0)
-                goto exit_unregister;
+                goto exit_free;
+        video_set_drvdata(zr->video_dev, zr);
        zoran_init_hardware(zr);
        if (zr36067_debug > 2)
@@ -1153,19 +1156,19 @@ zr36057_init (struct zoran *zr)
        zr->initialized = 1;
        return 0;
-exit_unregister:
-        zoran_unregister_i2c(zr);
 exit_free:
        kfree(zr->stat_com);
        kfree(zr->video_dev);
        return err;
 }
-static void
+static void __devexit zoran_remove(struct pci_dev *pdev)
-zoran_release (struct zoran *zr)
 {
+        struct zoran *zr = pci_get_drvdata(pdev);
        if (!zr->initialized)
                goto exit_free;
        /* unregister videocodec bus */
        if (zr->codec) {
                struct videocodec_master *master = zr->codec->master_data;
@@ -1194,6 +1197,7 @@ zoran_release (struct zoran *zr)
        pci_disable_device(zr->pci_dev);
        video_unregister_device(zr->video_dev);
 exit_free:
+        pci_set_drvdata(pdev, NULL);
        kfree(zr);
 }
@@ -1256,338 +1260,329 @@ zoran_setup_videocodec (struct zoran *zr,
 *   Scan for a Buz card (actually for the PCI controller ZR36057),
 *   request the irq and map the io memory
 */
-static int __devinit
+static int __devinit zoran_probe(struct pci_dev *pdev,
-find_zr36057 (void)
+                                 const struct pci_device_id *ent)
 {
        unsigned char latency, need_latency;
        struct zoran *zr;
-        struct pci_dev *dev = NULL;
        int result;
        struct videocodec_master *master_vfe = NULL;
        struct videocodec_master *master_codec = NULL;
        int card_num;
        char *i2c_enc_name, *i2c_dec_name, *codec_name, *vfe_name;
+        unsigned int nr;
-        zoran_num = 0;
-        while (zoran_num < BUZ_MAX &&
-               (dev = pci_get_device(PCI_VENDOR_ID_ZORAN, PCI_DEVICE_ID_ZORAN_36057, dev)) != NULL) {
-                card_num = card[zoran_num];
-                zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
-                if (!zr) {
-                        dprintk(1,
-                                KERN_ERR
-                                "%s: find_zr36057() - kzalloc failed\n",
-                                ZORAN_NAME);
-                        continue;
-                }
-                zr->pci_dev = dev;
-                //zr->zr36057_mem = NULL;
-                zr->id = zoran_num;
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
-                spin_lock_init(&zr->spinlock);
-                mutex_init(&zr->resource_lock);
-                if (pci_enable_device(dev))
-                        goto zr_free_mem;
-                zr->zr36057_adr = pci_resource_start(zr->pci_dev, 0);
-                pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION,
-                                     &zr->revision);
-                if (zr->revision < 2) {
-                        dprintk(1,
-                                KERN_INFO
-                                "%s: Zoran ZR36057 (rev %d) irq: %d, memory: 0x%08x.\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
-                                zr->zr36057_adr);
-                        if (card_num == -1) {
+        nr = zoran_num++;
-                                dprintk(1,
+        if (nr >= BUZ_MAX) {
-                                        KERN_ERR
+                dprintk(1,
-                                        "%s: find_zr36057() - no card specified, please use the card=X insmod option\n",
+                        KERN_ERR
-                                        ZR_DEVNAME(zr));
+                        "%s: driver limited to %d card(s) maximum\n",
-                                goto zr_free_mem;
+                        ZORAN_NAME, BUZ_MAX);
-                        }
+                return -ENOENT;
-                } else {
+        }
-                        int i;
-                        unsigned short ss_vendor, ss_device;
-                        ss_vendor = zr->pci_dev->subsystem_vendor;
+        zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
-                        ss_device = zr->pci_dev->subsystem_device;
+        if (!zr) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - kzalloc failed\n",
+                        ZORAN_NAME);
+                return -ENOMEM;
+        }
+        zr->pci_dev = pdev;
+        zr->id = nr;
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
+        spin_lock_init(&zr->spinlock);
+        mutex_init(&zr->resource_lock);
+        if (pci_enable_device(pdev))
+                goto zr_free_mem;
+        pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION, &zr->revision);
+        dprintk(1,
+                KERN_INFO
+                "%s: Zoran ZR360%c7 (rev %d), irq: %d, memory: 0x%08llx\n",
+                ZR_DEVNAME(zr), zr->revision < 2 ? '5' : '6', zr->revision,
+                zr->pci_dev->irq, (uint64_t)pci_resource_start(zr->pci_dev, 0));
+        if (zr->revision >= 2) {
+                dprintk(1,
+                        KERN_INFO
+                        "%s: Subsystem vendor=0x%04x id=0x%04x\n",
+                        ZR_DEVNAME(zr), zr->pci_dev->subsystem_vendor,
+                        zr->pci_dev->subsystem_device);
+        }
+        /* Use auto-detected card type? */
+        if (card[nr] == -1) {
+                if (zr->revision < 2) {
                        dprintk(1,
-                                KERN_INFO
+                                KERN_ERR
-                                "%s: Zoran ZR36067 (rev %d) irq: %d, memory: 0x%08x\n",
+                                "%s: No card type specified, please use the card=X module parameter\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
+                                ZR_DEVNAME(zr));
-                                zr->zr36057_adr);
                        dprintk(1,
-                                KERN_INFO
-                                "%s: subsystem vendor=0x%04x id=0x%04x\n",
-                                ZR_DEVNAME(zr), ss_vendor, ss_device);
-                        if (card_num == -1) {
-                                dprintk(3,
-                                        KERN_DEBUG
-                                        "%s: find_zr36057() - trying to autodetect card type\n",
-                                        ZR_DEVNAME(zr));
-                                for (i=0;i<NUM_CARDS;i++) {
-                                        if (ss_vendor == zoran_cards[i].vendor_id &&
-                                            ss_device == zoran_cards[i].device_id) {
-                                                dprintk(3,
-                                                        KERN_DEBUG
-                                                        "%s: find_zr36057() - card %s detected\n",
-                                                        ZR_DEVNAME(zr),
-                                                        zoran_cards[i].name);
-                                                card_num = i;
-                                                break;
-                                        }
-                                }
-                                if (i == NUM_CARDS) {
-                                        dprintk(1,
-                                                KERN_ERR
-                                                "%s: find_zr36057() - unknown card\n",
-                                                ZR_DEVNAME(zr));
-                                        goto zr_free_mem;
-                                }
-                        }
-                }
-                if (card_num < 0 || card_num >= NUM_CARDS) {
-                        dprintk(2,
                                KERN_ERR
-                                "%s: find_zr36057() - invalid cardnum %d\n",
+                                "%s: It is not possible to auto-detect ZR36057 based cards\n",
-                                ZR_DEVNAME(zr), card_num);
+                                ZR_DEVNAME(zr));
                        goto zr_free_mem;
                }
-                /* even though we make this a non pointer and thus
+                card_num = ent->driver_data;
-                 * theoretically allow for making changes to this struct
+                if (card_num >= NUM_CARDS) {
-                 * on a per-individual card basis at runtime, this is
-                 * strongly discouraged. This structure is intended to
-                 * keep general card information, no settings or anything */
-                zr->card = zoran_cards[card_num];
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
-                         "%s[%u]", zr->card.name, zr->id);
-                zr->zr36057_mem = ioremap_nocache(zr->zr36057_adr, 0x1000);
-                if (!zr->zr36057_mem) {
                        dprintk(1,
                                KERN_ERR
-                                "%s: find_zr36057() - ioremap failed\n",
+                                "%s: Unknown card, try specifying card=X module parameter\n",
                                ZR_DEVNAME(zr));
                        goto zr_free_mem;
                }
+                dprintk(3,
-                result = request_irq(zr->pci_dev->irq,
+                        KERN_DEBUG
-                                     zoran_irq,
+                        "%s: %s() - card %s detected\n",
-                                     IRQF_SHARED | IRQF_DISABLED,
+                        ZR_DEVNAME(zr), __func__, zoran_cards[card_num].name);
-                                     ZR_DEVNAME(zr),
+        } else {
-                                     (void *) zr);
+                card_num = card[nr];
-                if (result < 0) {
+                if (card_num >= NUM_CARDS || card_num < 0) {
-                        if (result == -EINVAL) {
+                        dprintk(1,
-                                dprintk(1,
+                                KERN_ERR
-                                        KERN_ERR
+                                "%s: User specified card type %d out of range (0 .. %d)\n",
-                                        "%s: find_zr36057() - bad irq number or handler\n",
+                                ZR_DEVNAME(zr), card_num, NUM_CARDS - 1);
-                                        ZR_DEVNAME(zr));
+                        goto zr_free_mem;
-                        } else if (result == -EBUSY) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
-                                        ZR_DEVNAME(zr), zr->pci_dev->irq);
-                        } else {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - can't assign irq, error code %d\n",
-                                        ZR_DEVNAME(zr), result);
-                        }
-                        goto zr_unmap;
-                }
-                /* set PCI latency timer */
-                pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
-                                     &latency);
-                need_latency = zr->revision > 1 ? 32 : 48;
-                if (latency != need_latency) {
-                        dprintk(2,
-                                KERN_INFO
-                                "%s: Changing PCI latency from %d to %d.\n",
-                                ZR_DEVNAME(zr), latency, need_latency);
-                        pci_write_config_byte(zr->pci_dev,
-                                              PCI_LATENCY_TIMER,
-                                              need_latency);
                }
+        }
-                zr36057_restart(zr);
+        /* even though we make this a non pointer and thus
-                /* i2c */
+         * theoretically allow for making changes to this struct
-                dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
+         * on a per-individual card basis at runtime, this is
-                        ZR_DEVNAME(zr));
+         * strongly discouraged. This structure is intended to
+         * keep general card information, no settings or anything */
+        zr->card = zoran_cards[card_num];
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
+                 "%s[%u]", zr->card.name, zr->id);
+        zr->zr36057_mem = pci_ioremap_bar(zr->pci_dev, 0);
+        if (!zr->zr36057_mem) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: %s() - ioremap failed\n",
+                        ZR_DEVNAME(zr), __func__);
+                goto zr_free_mem;
+        }
-                /* i2c decoder */
+        result = request_irq(zr->pci_dev->irq, zoran_irq,
-                if (decoder[zr->id] != -1) {
+                             IRQF_SHARED | IRQF_DISABLED, ZR_DEVNAME(zr), zr);
-                        i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
+        if (result < 0) {
-                        zr->card.i2c_decoder = decoder[zr->id];
+                if (result == -EINVAL) {
-                } else if (zr->card.i2c_decoder != 0) {
+                        dprintk(1,
-                        i2c_dec_name =
+                                KERN_ERR
-                                i2cid_to_modulename(zr->card.i2c_decoder);
+                                "%s: find_zr36057() - bad irq number or handler\n",
+                                ZR_DEVNAME(zr));
+                } else if (result == -EBUSY) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
+                                ZR_DEVNAME(zr), zr->pci_dev->irq);
                } else {
-                        i2c_dec_name = NULL;
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - can't assign irq, error code %d\n",
+                                ZR_DEVNAME(zr), result);
                }
+                goto zr_unmap;
+        }
-                if (i2c_dec_name) {
+        /* set PCI latency timer */
-                        if ((result = request_module(i2c_dec_name)) < 0) {
+        pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
-                                dprintk(1,
+                             &latency);
-                                        KERN_ERR
+        need_latency = zr->revision > 1 ? 32 : 48;
-                                        "%s: failed to load module %s: %d\n",
+        if (latency != need_latency) {
-                                        ZR_DEVNAME(zr), i2c_dec_name, result);
+                dprintk(2,
-                        }
+                        KERN_INFO
-                }
+                        "%s: Changing PCI latency from %d to %d\n",
+                        ZR_DEVNAME(zr), latency, need_latency);
+                pci_write_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
+                                      need_latency);
+        }
-                /* i2c encoder */
+        zr36057_restart(zr);
-                if (encoder[zr->id] != -1) {
+        /* i2c */
-                        i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
+        dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
-                        zr->card.i2c_encoder = encoder[zr->id];
+                ZR_DEVNAME(zr));
-                } else if (zr->card.i2c_encoder != 0) {
-                        i2c_enc_name =
+        /* i2c decoder */
-                                i2cid_to_modulename(zr->card.i2c_encoder);
+        if (decoder[zr->id] != -1) {
-                } else {
+                i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
-                        i2c_enc_name = NULL;
+                zr->card.i2c_decoder = decoder[zr->id];
-                }
+        } else if (zr->card.i2c_decoder != 0) {
+                i2c_dec_name = i2cid_to_modulename(zr->card.i2c_decoder);
+        } else {
+                i2c_dec_name = NULL;
+        }
-                if (i2c_enc_name) {
+        if (i2c_dec_name) {
-                        if ((result = request_module(i2c_enc_name)) < 0) {
+                result = request_module(i2c_dec_name);
-                                dprintk(1,
+                if (result < 0) {
-                                        KERN_ERR
+                        dprintk(1,
-                                        "%s: failed to load module %s: %d\n",
+                                KERN_ERR
-                                        ZR_DEVNAME(zr), i2c_enc_name, result);
+                                "%s: failed to load module %s: %d\n",
-                        }
+                                ZR_DEVNAME(zr), i2c_dec_name, result);
                }
+        }
+        /* i2c encoder */
+        if (encoder[zr->id] != -1) {
+                i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
+                zr->card.i2c_encoder = encoder[zr->id];
+        } else if (zr->card.i2c_encoder != 0) {
+                i2c_enc_name = i2cid_to_modulename(zr->card.i2c_encoder);
+        } else {
+                i2c_enc_name = NULL;
+        }
-                if (zoran_register_i2c(zr) < 0) {
+        if (i2c_enc_name) {
+                result = request_module(i2c_enc_name);
+                if (result < 0) {
                        dprintk(1,
                                KERN_ERR
-                                "%s: find_zr36057() - can't initialize i2c bus\n",
+                                "%s: failed to load module %s: %d\n",
-                                ZR_DEVNAME(zr));
+                                ZR_DEVNAME(zr), i2c_enc_name, result);
-                        goto zr_free_irq;
                }
+        }
-                dprintk(2,
+        if (zoran_register_i2c(zr) < 0) {
-                        KERN_INFO "%s: Initializing videocodec bus...\n",
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - can't initialize i2c bus\n",
                        ZR_DEVNAME(zr));
+                goto zr_free_irq;
+        }
-                if (zr->card.video_codec != 0 &&
+        dprintk(2,
-                    (codec_name =
+                KERN_INFO "%s: Initializing videocodec bus...\n",
-                     codecid_to_modulename(zr->card.video_codec)) != NULL) {
+                ZR_DEVNAME(zr));
-                        if ((result = request_module(codec_name)) < 0) {
+        if (zr->card.video_codec) {
+                codec_name = codecid_to_modulename(zr->card.video_codec);
+                if (codec_name) {
+                        result = request_module(codec_name);
+                        if (result) {
                                dprintk(1,
                                        KERN_ERR
                                        "%s: failed to load modules %s: %d\n",
                                        ZR_DEVNAME(zr), codec_name, result);
                        }
                }
-                if (zr->card.video_vfe != 0 &&
+        }
-                    (vfe_name =
+        if (zr->card.video_vfe) {
-                     codecid_to_modulename(zr->card.video_vfe)) != NULL) {
+                vfe_name = codecid_to_modulename(zr->card.video_vfe);
-                        if ((result = request_module(vfe_name)) < 0) {
+                if (vfe_name) {
+                        result = request_module(vfe_name);
+                        if (result < 0) {
                                dprintk(1,
                                        KERN_ERR
                                        "%s: failed to load modules %s: %d\n",
                                        ZR_DEVNAME(zr), vfe_name, result);
                        }
                }
+        }
-                /* reset JPEG codec */
+        /* reset JPEG codec */
-                jpeg_codec_sleep(zr, 1);
+        jpeg_codec_sleep(zr, 1);
-                jpeg_codec_reset(zr);
+        jpeg_codec_reset(zr);
-                /* video bus enabled */
+        /* video bus enabled */
-                /* display codec revision */
+        /* display codec revision */
-                if (zr->card.video_codec != 0) {
+        if (zr->card.video_codec != 0) {
-                        master_codec = zoran_setup_videocodec(zr,
+                master_codec = zoran_setup_videocodec(zr, zr->card.video_codec);
-                                                              zr->card.video_codec);
+                if (!master_codec)
-                        if (!master_codec)
+                        goto zr_unreg_i2c;
-                                goto zr_unreg_i2c;
+                zr->codec = videocodec_attach(master_codec);
-                        zr->codec = videocodec_attach(master_codec);
+                if (!zr->codec) {
-                        if (!zr->codec) {
+                        dprintk(1,
-                                dprintk(1,
+                                KERN_ERR
-                                        KERN_ERR
+                                "%s: find_zr36057() - no codec found\n",
-                                        "%s: find_zr36057() - no codec found\n",
+                                ZR_DEVNAME(zr));
-                                        ZR_DEVNAME(zr));
+                        goto zr_free_codec;
-                                goto zr_free_codec;
-                        }
-                        if (zr->codec->type != zr->card.video_codec) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - wrong codec\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_detach_codec;
-                        }
                }
-                if (zr->card.video_vfe != 0) {
+                if (zr->codec->type != zr->card.video_codec) {
-                        master_vfe = zoran_setup_videocodec(zr,
+                        dprintk(1,
-                                                            zr->card.video_vfe);
+                                KERN_ERR
-                        if (!master_vfe)
+                                "%s: find_zr36057() - wrong codec\n",
-                                goto zr_detach_codec;
+                                ZR_DEVNAME(zr));
-                        zr->vfe = videocodec_attach(master_vfe);
+                        goto zr_detach_codec;
-                        if (!zr->vfe) {
+                }
-                                dprintk(1,
+        }
-                                        KERN_ERR
+        if (zr->card.video_vfe != 0) {
-                                        "%s: find_zr36057() - no VFE found\n",
+                master_vfe = zoran_setup_videocodec(zr, zr->card.video_vfe);
-                                        ZR_DEVNAME(zr));
+                if (!master_vfe)
-                                goto zr_free_vfe;
+                        goto zr_detach_codec;
-                        }
+                zr->vfe = videocodec_attach(master_vfe);
-                        if (zr->vfe->type != zr->card.video_vfe) {
+                if (!zr->vfe) {
-                                dprintk(1,
+                        dprintk(1,
-                                        KERN_ERR
+                                KERN_ERR
-                                        "%s: find_zr36057() = wrong VFE\n",
+                                "%s: find_zr36057() - no VFE found\n",
-                                        ZR_DEVNAME(zr));
+                                ZR_DEVNAME(zr));
-                                goto zr_detach_vfe;
+                        goto zr_free_vfe;
-                        }
+                }
+                if (zr->vfe->type != zr->card.video_vfe) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() = wrong VFE\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_detach_vfe;
                }
-                /* Success so keep the pci_dev referenced */
-                pci_dev_get(zr->pci_dev);
-                zoran[zoran_num++] = zr;
-                continue;
-                // Init errors
-              zr_detach_vfe:
-                videocodec_detach(zr->vfe);
-              zr_free_vfe:
-                kfree(master_vfe);
-              zr_detach_codec:
-                videocodec_detach(zr->codec);
-              zr_free_codec:
-                kfree(master_codec);
-              zr_unreg_i2c:
-                zoran_unregister_i2c(zr);
-              zr_free_irq:
-                btwrite(0, ZR36057_SPGPPCR);
-                free_irq(zr->pci_dev->irq, zr);
-              zr_unmap:
-                iounmap(zr->zr36057_mem);
-              zr_free_mem:
-                kfree(zr);
-                continue;
        }
-        if (dev)        /* Clean up ref count on early exit */
-                pci_dev_put(dev);
-        if (zoran_num == 0) {
+        /* take care of Natoma chipset and a revision 1 zr36057 */
-                dprintk(1, KERN_INFO "No known MJPEG cards found.\n");
+        if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
+                zr->jpg_buffers.need_contiguous = 1;
+                dprintk(1,
+                        KERN_INFO
+                        "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
+                        ZR_DEVNAME(zr));
        }
-        return zoran_num;
+        if (zr36057_init(zr) < 0)
+                goto zr_detach_vfe;
+        zoran_proc_init(zr);
+        pci_set_drvdata(pdev, zr);
+        return 0;
+zr_detach_vfe:
+        videocodec_detach(zr->vfe);
+zr_free_vfe:
+        kfree(master_vfe);
+zr_detach_codec:
+        videocodec_detach(zr->codec);
+zr_free_codec:
+        kfree(master_codec);
+zr_unreg_i2c:
+        zoran_unregister_i2c(zr);
+zr_free_irq:
+        btwrite(0, ZR36057_SPGPPCR);
+        free_irq(zr->pci_dev->irq, zr);
+zr_unmap:
+        iounmap(zr->zr36057_mem);
+zr_free_mem:
+        kfree(zr);
+        return -ENODEV;
 }
-static int __init
+static struct pci_driver zoran_driver = {
-init_dc10_cards (void)
+        .name = "zr36067",
+        .id_table = zr36067_pci_tbl,
+        .probe = zoran_probe,
+        .remove = zoran_remove,
+};
+static int __init zoran_init(void)
 {
-        int i;
+        int res;
-        memset(zoran, 0, sizeof(zoran));
        printk(KERN_INFO "Zoran MJPEG board driver version %d.%d.%d\n",
               MAJOR_VERSION, MINOR_VERSION, RELEASE_VERSION);
-        /* Look for cards */
-        if (find_zr36057() < 0) {
-                return -EIO;
-        }
-        if (zoran_num == 0)
-                return -ENODEV;
-        dprintk(1, KERN_INFO "%s: %d card(s) found\n", ZORAN_NAME,
-                zoran_num);
        /* check the parameters we have been given, adjust if necessary */
        if (v4l_nbufs < 2)
                v4l_nbufs = 2;
@@ -1629,37 +1624,22 @@ init_dc10_cards (void)
                        ZORAN_NAME);
        }
-        /* take care of Natoma chipset and a revision 1 zr36057 */
+        res = pci_register_driver(&zoran_driver);
-        for (i = 0; i < zoran_num; i++) {
+        if (res) {
-                struct zoran *zr = zoran[i];
+                dprintk(1,
+                        KERN_ERR
-                if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
+                        "%s: Unable to register ZR36057 driver\n",
-                        zr->jpg_buffers.need_contiguous = 1;
+                        ZORAN_NAME);
-                        dprintk(1,
+                return res;
-                                KERN_INFO
-                                "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
-                                ZR_DEVNAME(zr));
-                }
-                if (zr36057_init(zr) < 0) {
-                        for (i = 0; i < zoran_num; i++)
-                                zoran_release(zoran[i]);
-                        return -EIO;
-                }
-                zoran_proc_init(zr);
        }
        return 0;
 }
-static void __exit
+static void __exit zoran_exit(void)
-unload_dc10_cards (void)
 {
-        int i;
+        pci_unregister_driver(&zoran_driver);
-        for (i = 0; i < zoran_num; i++)
-                zoran_release(zoran[i]);
 }
-module_init(init_dc10_cards);
+module_init(zoran_init);
-module_exit(unload_dc10_cards);
+module_exit(zoran_exit);
diff --git a/drivers/media/video/zoran/zoran_card.h b/drivers/media/video/zoran/zoran_card.h
index e4dc9d29b404..4507bdc5e338 100644
--- a/drivers/media/video/zoran/zoran_card.h
+++ b/drivers/media/video/zoran/zoran_card.h
@@ -40,8 +40,6 @@ extern int zr36067_debug;
 /* Anybody who uses more than four? */
 #define BUZ_MAX 4
-extern int zoran_num;
-extern struct zoran *zoran[BUZ_MAX];
 extern struct video_device zoran_template;
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index b58b9dda715c..120ef235e63d 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1196,83 +1196,54 @@ zoran_close_end_session (struct file *file)
 *   Open a zoran card. Right now the flags stuff is just playing
 */
-static int
+static int zoran_open(struct file *file)
-zoran_open(struct file  *file)
 {
-        unsigned int minor = video_devdata(file)->minor;
+        struct zoran *zr = video_drvdata(file);
-        struct zoran *zr = NULL;
        struct zoran_fh *fh;
-        int i, res, first_open = 0, have_module_locks = 0;
+        int res, first_open = 0;
-        lock_kernel();
+        dprintk(2, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
-        /* find the device */
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user + 1);
-        for (i = 0; i < zoran_num; i++) {
-                if (zoran[i]->video_dev->minor == minor) {
-                        zr = zoran[i];
-                        break;
-                }
-        }
-        if (!zr) {
+        lock_kernel();
-                dprintk(1, KERN_ERR "%s: device not found!\n", ZORAN_NAME);
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
        /* see fs/device.c - the kernel already locks during open(),
         * so locking ourselves only causes deadlocks */
        /*mutex_lock(&zr->resource_lock);*/
+        if (zr->user >= 2048) {
+                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
+                        ZR_DEVNAME(zr), zr->user);
+                res = -EBUSY;
+                goto fail_unlock;
+        }
        if (!zr->decoder) {
                dprintk(1,
                        KERN_ERR "%s: no TV decoder loaded for device!\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                goto open_unlock_and_return;
+                goto fail_unlock;
        }
-        /* try to grab a module lock */
-        if (!try_module_get(THIS_MODULE)) {
-                dprintk(1,
-                        KERN_ERR
-                        "%s: failed to acquire my own lock! PANIC!\n",
-                        ZR_DEVNAME(zr));
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
        if (!try_module_get(zr->decoder->driver->driver.owner)) {
                dprintk(1,
                        KERN_ERR
-                        "%s: failed to grab ownership of i2c decoder\n",
+                        "%s: failed to grab ownership of video decoder\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                module_put(THIS_MODULE);
+                goto fail_unlock;
-                goto open_unlock_and_return;
        }
        if (zr->encoder &&
            !try_module_get(zr->encoder->driver->driver.owner)) {
                dprintk(1,
                        KERN_ERR
-                        "%s: failed to grab ownership of i2c encoder\n",
+                        "%s: failed to grab ownership of video encoder\n",
                        ZR_DEVNAME(zr));
                res = -EIO;
-                module_put(zr->decoder->driver->driver.owner);
+                goto fail_decoder;
-                module_put(THIS_MODULE);
-                goto open_unlock_and_return;
        }
-        have_module_locks = 1;
-        if (zr->user >= 2048) {
-                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
-                        ZR_DEVNAME(zr), zr->user);
-                res = -EBUSY;
-                goto open_unlock_and_return;
-        }
-        dprintk(1, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
        /* now, create the open()-specific file_ops struct */
        fh = kzalloc(sizeof(struct zoran_fh), GFP_KERNEL);
        if (!fh) {
@@ -1281,7 +1252,7 @@ zoran_open(struct file  *file)
                        "%s: zoran_open() - allocation of zoran_fh failed\n",
                        ZR_DEVNAME(zr));
                res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_encoder;
        }
        /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
         * on norm-change! */
@@ -1292,9 +1263,8 @@ zoran_open(struct file  *file)
                        KERN_ERR
                        "%s: zoran_open() - allocation of overlay_mask failed\n",
                        ZR_DEVNAME(zr));
-                kfree(fh);
                res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_fh;
        }
        if (zr->user++ == 0)
@@ -1319,22 +1289,19 @@ zoran_open(struct file  *file)
        return 0;
-open_unlock_and_return:
+fail_fh:
-        /* if we grabbed locks, release them accordingly */
+        kfree(fh);
-        if (have_module_locks) {
+fail_encoder:
-                module_put(zr->decoder->driver->driver.owner);
+        if (zr->encoder)
-                if (zr->encoder) {
+                module_put(zr->encoder->driver->driver.owner);
-                        module_put(zr->encoder->driver->driver.owner);
+fail_decoder:
-                }
+        module_put(zr->decoder->driver->driver.owner);
-                module_put(THIS_MODULE);
+fail_unlock:
-        }
-        /* if there's no device found, we didn't obtain the lock either */
-        if (zr) {
-                /*mutex_unlock(&zr->resource_lock);*/
-        }
        unlock_kernel();
+        dprintk(2, KERN_INFO "%s: open failed (%d), users(-)=%d\n",
+                ZR_DEVNAME(zr), res, zr->user);
        return res;
 }
@@ -1344,8 +1311,8 @@ zoran_close(struct file  *file)
        struct zoran_fh *fh = file->private_data;
        struct zoran *zr = fh->zr;
-        dprintk(1, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
+        dprintk(2, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user - 1);
        /* kernel locks (fs/device.c), so don't do that ourselves
         * (prevents deadlocks) */
@@ -1391,10 +1358,8 @@ zoran_close(struct file  *file)
        /* release locks on the i2c modules */
        module_put(zr->decoder->driver->driver.owner);
-        if (zr->encoder) {
+        if (zr->encoder)
-                 module_put(zr->encoder->driver->driver.owner);
+                module_put(zr->encoder->driver->driver.owner);
-        }
-        module_put(THIS_MODULE);
        /*mutex_unlock(&zr->resource_lock);*/
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 05e298289238..10c421b73eaf 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -758,7 +758,7 @@ static void __exit ilo_exit(void)
        class_destroy(ilo_class);
 }
-MODULE_VERSION("0.05");
+MODULE_VERSION("0.06");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/misc/sgi-xp/xpc_channel.c b/drivers/misc/sgi-xp/xpc_channel.c
index 9cd2ebe2a3b6..45fd653dbe31 100644
--- a/drivers/misc/sgi-xp/xpc_channel.c
+++ b/drivers/misc/sgi-xp/xpc_channel.c
@@ -49,9 +49,6 @@ xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
                if (ch->flags & (XPC_C_CONNECTED | XPC_C_DISCONNECTING))
                        return;
-                DBUG_ON(ch->local_msgqueue == NULL);
-                DBUG_ON(ch->remote_msgqueue == NULL);
        }
        if (!(ch->flags & XPC_C_OPENREPLY)) {
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 82fb9958f22f..2e975762c32b 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -1106,8 +1106,6 @@ xpc_process_activate_IRQ_rcvd_sn2(void)
        int n_IRQs_expected;
        int n_IRQs_detected;
-        DBUG_ON(xpc_activate_IRQ_rcvd == 0);
        spin_lock_irqsave(&xpc_activate_IRQ_rcvd_lock, irq_flags);
        n_IRQs_expected = xpc_activate_IRQ_rcvd;
        xpc_activate_IRQ_rcvd = 0;
@@ -1726,6 +1724,7 @@ xpc_clear_local_msgqueue_flags_sn2(struct xpc_channel *ch)
                msg = (struct xpc_msg_sn2 *)((u64)ch_sn2->local_msgqueue +
                                             (get % ch->local_nentries) *
                                             ch->entry_size);
+                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
                msg->flags = 0;
        } while (++get < ch_sn2->remote_GP.get);
 }
@@ -1740,11 +1739,18 @@ xpc_clear_remote_msgqueue_flags_sn2(struct xpc_channel *ch)
        struct xpc_msg_sn2 *msg;
        s64 put;
-        put = ch_sn2->w_remote_GP.put;
+        /* flags are zeroed when the buffer is allocated */
+        if (ch_sn2->remote_GP.put < ch->remote_nentries)
+                return;
+        put = max(ch_sn2->w_remote_GP.put, ch->remote_nentries);
        do {
                msg = (struct xpc_msg_sn2 *)((u64)ch_sn2->remote_msgqueue +
                                             (put % ch->remote_nentries) *
                                             ch->entry_size);
+                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
+                DBUG_ON(!(msg->flags & XPC_M_SN2_DONE));
+                DBUG_ON(msg->number != put - ch->remote_nentries);
                msg->flags = 0;
        } while (++put < ch_sn2->remote_GP.put);
 }
@@ -1836,6 +1842,7 @@ xpc_process_msg_chctl_flags_sn2(struct xpc_partition *part, int ch_number)
                 */
                xpc_clear_remote_msgqueue_flags_sn2(ch);
+                smp_wmb(); /* ensure flags have been cleared before bte_copy */
                ch_sn2->w_remote_GP.put = ch_sn2->remote_GP.put;
                dev_dbg(xpc_chan, "w_remote_GP.put changed to %ld, partid=%d, "
@@ -1934,7 +1941,7 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
                        break;
                get = ch_sn2->w_local_GP.get;
-                rmb();  /* guarantee that .get loads before .put */
+                smp_rmb();      /* guarantee that .get loads before .put */
                if (get == ch_sn2->w_remote_GP.put)
                        break;
@@ -1956,11 +1963,13 @@ xpc_get_deliverable_payload_sn2(struct xpc_channel *ch)
                        msg = xpc_pull_remote_msg_sn2(ch, get);
-                        DBUG_ON(msg != NULL && msg->number != get);
+                        if (msg != NULL) {
-                        DBUG_ON(msg != NULL && (msg->flags & XPC_M_SN2_DONE));
+                                DBUG_ON(msg->number != get);
-                        DBUG_ON(msg != NULL && !(msg->flags & XPC_M_SN2_READY));
+                                DBUG_ON(msg->flags & XPC_M_SN2_DONE);
+                                DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
-                        payload = &msg->payload;
+                                payload = &msg->payload;
+                        }
                        break;
                }
@@ -2053,7 +2062,7 @@ xpc_allocate_msg_sn2(struct xpc_channel *ch, u32 flags,
        while (1) {
                put = ch_sn2->w_local_GP.put;
-                rmb();  /* guarantee that .put loads before .get */
+                smp_rmb();      /* guarantee that .put loads before .get */
                if (put - ch_sn2->w_remote_GP.get < ch->local_nentries) {
                        /* There are available message entries. We need to try
@@ -2186,7 +2195,7 @@ xpc_send_payload_sn2(struct xpc_channel *ch, u32 flags, void *payload,
         * The preceding store of msg->flags must occur before the following
         * load of local_GP->put.
         */
-        mb();
+        smp_mb();
        /* see if the message is next in line to be sent, if so send it */
@@ -2277,8 +2286,9 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
        dev_dbg(xpc_chan, "msg=0x%p, msg_number=%ld, partid=%d, channel=%d\n",
                (void *)msg, msg_number, ch->partid, ch->number);
-        DBUG_ON((((u64)msg - (u64)ch->remote_msgqueue) / ch->entry_size) !=
+        DBUG_ON((((u64)msg - (u64)ch->sn.sn2.remote_msgqueue) / ch->entry_size) !=
                msg_number % ch->remote_nentries);
+        DBUG_ON(!(msg->flags & XPC_M_SN2_READY));
        DBUG_ON(msg->flags & XPC_M_SN2_DONE);
        msg->flags |= XPC_M_SN2_DONE;
@@ -2287,7 +2297,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
         * The preceding store of msg->flags must occur before the following
         * load of local_GP->get.
         */
-        mb();
+        smp_mb();
        /*
         * See if this message is next in line to be acknowledged as having
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 91a55b1b1037..f17f7d40ea2c 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -1423,7 +1423,7 @@ xpc_send_payload_uv(struct xpc_channel *ch, u32 flags, void *payload,
                atomic_inc(&ch->n_to_notify);
                msg_slot->key = key;
-                wmb(); /* a non-NULL func must hit memory after the key */
+                smp_wmb(); /* a non-NULL func must hit memory after the key */
                msg_slot->func = func;
                if (ch->flags & XPC_C_DISCONNECTING) {
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 0efa390978bd..99d4b28d52ed 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -145,6 +145,16 @@ config MMC_IMX
          If unsure, say N.
+config MMC_MXC
+        tristate "Freescale i.MX2/3 Multimedia Card Interface support"
+        depends on ARCH_MXC
+        help
+          This selects the Freescale i.MX2/3 Multimedia card Interface.
+          If you have a i.MX platform with a Multimedia Card slot,
+          say Y or M here.
+          If unsure, say N.
 config MMC_TIFM_SD
        tristate "TI Flash Media MMC/SD Interface support  (EXPERIMENTAL)"
        depends on EXPERIMENTAL && PCI
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index 98cab84829b8..dedec55861d9 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -9,6 +9,7 @@ endif
 obj-$(CONFIG_MMC_ARMMMCI)       += mmci.o
 obj-$(CONFIG_MMC_PXA)           += pxamci.o
 obj-$(CONFIG_MMC_IMX)           += imxmmc.o
+obj-$(CONFIG_MMC_MXC)           += mxcmmc.o
 obj-$(CONFIG_MMC_SDHCI)         += sdhci.o
 obj-$(CONFIG_MMC_SDHCI_PCI)     += sdhci-pci.o
 obj-$(CONFIG_MMC_RICOH_MMC)     += ricoh_mmc.o
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 1bcbdd6763ac..2909bbc8ad00 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -430,6 +430,8 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                clk = 255;
                        host->cclk = host->mclk / (2 * (clk + 1));
                }
+                if (host->hw_designer == 0x80)
+                        clk |= MCI_FCEN; /* Bug fix in ST IP block */
                clk |= MCI_CLK_ENABLE;
        }
@@ -440,15 +442,27 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        case MMC_POWER_OFF:
                break;
        case MMC_POWER_UP:
-                pwr |= MCI_PWR_UP;
+                /* The ST version does not have this, fall through to POWER_ON */
-                break;
+                if (host->hw_designer != 0x80) {
+                        pwr |= MCI_PWR_UP;
+                        break;
+                }
        case MMC_POWER_ON:
                pwr |= MCI_PWR_ON;
                break;
        }
-        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
+        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN) {
-                pwr |= MCI_ROD;
+                if (host->hw_designer != 0x80)
+                        pwr |= MCI_ROD;
+                else {
+                        /*
+                         * The ST Micro variant use the ROD bit for something
+                         * else and only has OD (Open Drain).
+                         */
+                        pwr |= MCI_OD;
+                }
+        }
        writel(clk, host->base + MMCICLOCK);
@@ -500,6 +514,12 @@ static int mmci_probe(struct amba_device *dev, void *id)
        }
        host = mmc_priv(mmc);
+        /* Bits 12 thru 19 is the designer */
+        host->hw_designer = (dev->periphid >> 12) & 0xff;
+        /* Bits 20 thru 23 is the revison */
+        host->hw_revision = (dev->periphid >> 20) & 0xf;
+        DBG(host, "designer ID = 0x%02x\n", host->hw_designer);
+        DBG(host, "revision = 0x%01x\n", host->hw_revision);
        host->clk = clk_get(&dev->dev, NULL);
        if (IS_ERR(host->clk)) {
                ret = PTR_ERR(host->clk);
@@ -693,6 +713,15 @@ static struct amba_id mmci_ids[] = {
                .id     = 0x00041181,
                .mask   = 0x000fffff,
        },
+        /* ST Micro variants */
+        {
+                .id     = 0x00180180,
+                .mask   = 0x00ffffff,
+        },
+        {
+                .id     = 0x00280180,
+                .mask   = 0x00ffffff,
+        },
        { 0, 0 },
 };
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index 0f39c490f022..0441bac1c0ec 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -11,13 +11,23 @@
 #define MCI_PWR_OFF             0x00
 #define MCI_PWR_UP              0x02
 #define MCI_PWR_ON              0x03
+#define MCI_DATA2DIREN          (1 << 2)
+#define MCI_CMDDIREN            (1 << 3)
+#define MCI_DATA0DIREN          (1 << 4)
+#define MCI_DATA31DIREN         (1 << 5)
 #define MCI_OD                  (1 << 6)
 #define MCI_ROD                 (1 << 7)
+/* The ST Micro version does not have ROD */
+#define MCI_FBCLKEN             (1 << 7)
+#define MCI_DATA74DIREN         (1 << 8)
 #define MMCICLOCK               0x004
 #define MCI_CLK_ENABLE          (1 << 8)
 #define MCI_CLK_PWRSAVE         (1 << 9)
 #define MCI_CLK_BYPASS          (1 << 10)
+#define MCI_WIDE_BUS            (1 << 11)
+/* HW flow control on the ST Micro version */
+#define MCI_FCEN                (1 << 13)
 #define MMCIARGUMENT            0x008
 #define MMCICOMMAND             0x00c
@@ -26,6 +36,10 @@
 #define MCI_CPSM_INTERRUPT      (1 << 8)
 #define MCI_CPSM_PENDING        (1 << 9)
 #define MCI_CPSM_ENABLE         (1 << 10)
+#define MCI_SDIO_SUSP           (1 << 11)
+#define MCI_ENCMD_COMPL         (1 << 12)
+#define MCI_NIEN                (1 << 13)
+#define MCI_CE_ATACMD           (1 << 14)
 #define MMCIRESPCMD             0x010
 #define MMCIRESPONSE0           0x014
@@ -39,6 +53,11 @@
 #define MCI_DPSM_DIRECTION      (1 << 1)
 #define MCI_DPSM_MODE           (1 << 2)
 #define MCI_DPSM_DMAENABLE      (1 << 3)
+#define MCI_DPSM_BLOCKSIZE      (1 << 4)
+#define MCI_DPSM_RWSTART        (1 << 8)
+#define MCI_DPSM_RWSTOP         (1 << 9)
+#define MCI_DPSM_RWMOD          (1 << 10)
+#define MCI_DPSM_SDIOEN         (1 << 11)
 #define MMCIDATACNT             0x030
 #define MMCISTATUS              0x034
@@ -63,6 +82,8 @@
 #define MCI_RXFIFOEMPTY         (1 << 19)
 #define MCI_TXDATAAVLBL         (1 << 20)
 #define MCI_RXDATAAVLBL         (1 << 21)
+#define MCI_SDIOIT              (1 << 22)
+#define MCI_CEATAEND            (1 << 23)
 #define MMCICLEAR               0x038
 #define MCI_CMDCRCFAILCLR       (1 << 0)
@@ -75,6 +96,8 @@
 #define MCI_CMDSENTCLR          (1 << 7)
 #define MCI_DATAENDCLR          (1 << 8)
 #define MCI_DATABLOCKENDCLR     (1 << 10)
+#define MCI_SDIOITC             (1 << 22)
+#define MCI_CEATAENDC           (1 << 23)
 #define MMCIMASK0               0x03c
 #define MCI_CMDCRCFAILMASK      (1 << 0)
@@ -98,6 +121,8 @@
 #define MCI_RXFIFOEMPTYMASK     (1 << 19)
 #define MCI_TXDATAAVLBLMASK     (1 << 20)
 #define MCI_RXDATAAVLBLMASK     (1 << 21)
+#define MCI_SDIOITMASK          (1 << 22)
+#define MCI_CEATAENDMASK        (1 << 23)
 #define MMCIMASK1               0x040
 #define MMCIFIFOCNT             0x048
@@ -136,6 +161,9 @@ struct mmci_host {
        u32                     pwr;
        struct mmc_platform_data *plat;
+        u8                      hw_designer;
+        u8                      hw_revision:4;
        struct timer_list       timer;
        unsigned int            oldstat;
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
new file mode 100644
index 000000000000..dda0be4e25dc
--- /dev/null
+++ b/drivers/mmc/host/mxcmmc.c
@@ -0,0 +1,880 @@
+/*
+ *  linux/drivers/mmc/host/mxcmmc.c - Freescale i.MX MMCI driver
+ *
+ *  This is a driver for the SDHC controller found in Freescale MX2/MX3
+ *  SoCs. It is basically the same hardware as found on MX1 (imxmmc.c).
+ *  Unlike the hardware found on MX1, this hardware just works and does
+ *  not need all the quirks found in imxmmc.c, hence the seperate driver.
+ *
+ *  Copyright (C) 2008 Sascha Hauer, Pengutronix <s.hauer@pengutronix.de>
+ *  Copyright (C) 2006 Pavel Pisa, PiKRON <ppisa@pikron.com>
+ *
+ *  derived from pxamci.c by Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/blkdev.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+#include <asm/dma.h>
+#include <asm/irq.h>
+#include <asm/sizes.h>
+#include <mach/mmc.h>
+#ifdef CONFIG_ARCH_MX2
+#include <mach/dma-mx1-mx2.h>
+#define HAS_DMA
+#endif
+#define DRIVER_NAME "imx-mmc"
+#define MMC_REG_STR_STP_CLK             0x00
+#define MMC_REG_STATUS                  0x04
+#define MMC_REG_CLK_RATE                0x08
+#define MMC_REG_CMD_DAT_CONT            0x0C
+#define MMC_REG_RES_TO                  0x10
+#define MMC_REG_READ_TO                 0x14
+#define MMC_REG_BLK_LEN                 0x18
+#define MMC_REG_NOB                     0x1C
+#define MMC_REG_REV_NO                  0x20
+#define MMC_REG_INT_CNTR                0x24
+#define MMC_REG_CMD                     0x28
+#define MMC_REG_ARG                     0x2C
+#define MMC_REG_RES_FIFO                0x34
+#define MMC_REG_BUFFER_ACCESS           0x38
+#define STR_STP_CLK_RESET               (1 << 3)
+#define STR_STP_CLK_START_CLK           (1 << 1)
+#define STR_STP_CLK_STOP_CLK            (1 << 0)
+#define STATUS_CARD_INSERTION           (1 << 31)
+#define STATUS_CARD_REMOVAL             (1 << 30)
+#define STATUS_YBUF_EMPTY               (1 << 29)
+#define STATUS_XBUF_EMPTY               (1 << 28)
+#define STATUS_YBUF_FULL                (1 << 27)
+#define STATUS_XBUF_FULL                (1 << 26)
+#define STATUS_BUF_UND_RUN              (1 << 25)
+#define STATUS_BUF_OVFL                 (1 << 24)
+#define STATUS_SDIO_INT_ACTIVE          (1 << 14)
+#define STATUS_END_CMD_RESP             (1 << 13)
+#define STATUS_WRITE_OP_DONE            (1 << 12)
+#define STATUS_DATA_TRANS_DONE          (1 << 11)
+#define STATUS_READ_OP_DONE             (1 << 11)
+#define STATUS_WR_CRC_ERROR_CODE_MASK   (3 << 10)
+#define STATUS_CARD_BUS_CLK_RUN         (1 << 8)
+#define STATUS_BUF_READ_RDY             (1 << 7)
+#define STATUS_BUF_WRITE_RDY            (1 << 6)
+#define STATUS_RESP_CRC_ERR             (1 << 5)
+#define STATUS_CRC_READ_ERR             (1 << 3)
+#define STATUS_CRC_WRITE_ERR            (1 << 2)
+#define STATUS_TIME_OUT_RESP            (1 << 1)
+#define STATUS_TIME_OUT_READ            (1 << 0)
+#define STATUS_ERR_MASK                 0x2f
+#define CMD_DAT_CONT_CMD_RESP_LONG_OFF  (1 << 12)
+#define CMD_DAT_CONT_STOP_READWAIT      (1 << 11)
+#define CMD_DAT_CONT_START_READWAIT     (1 << 10)
+#define CMD_DAT_CONT_BUS_WIDTH_4        (2 << 8)
+#define CMD_DAT_CONT_INIT               (1 << 7)
+#define CMD_DAT_CONT_WRITE              (1 << 4)
+#define CMD_DAT_CONT_DATA_ENABLE        (1 << 3)
+#define CMD_DAT_CONT_RESPONSE_48BIT_CRC (1 << 0)
+#define CMD_DAT_CONT_RESPONSE_136BIT    (2 << 0)
+#define CMD_DAT_CONT_RESPONSE_48BIT     (3 << 0)
+#define INT_SDIO_INT_WKP_EN             (1 << 18)
+#define INT_CARD_INSERTION_WKP_EN       (1 << 17)
+#define INT_CARD_REMOVAL_WKP_EN         (1 << 16)
+#define INT_CARD_INSERTION_EN           (1 << 15)
+#define INT_CARD_REMOVAL_EN             (1 << 14)
+#define INT_SDIO_IRQ_EN                 (1 << 13)
+#define INT_DAT0_EN                     (1 << 12)
+#define INT_BUF_READ_EN                 (1 << 4)
+#define INT_BUF_WRITE_EN                (1 << 3)
+#define INT_END_CMD_RES_EN              (1 << 2)
+#define INT_WRITE_OP_DONE_EN            (1 << 1)
+#define INT_READ_OP_EN                  (1 << 0)
+struct mxcmci_host {
+        struct mmc_host         *mmc;
+        struct resource         *res;
+        void __iomem            *base;
+        int                     irq;
+        int                     detect_irq;
+        int                     dma;
+        int                     do_dma;
+        unsigned int            power_mode;
+        struct imxmmc_platform_data *pdata;
+        struct mmc_request      *req;
+        struct mmc_command      *cmd;
+        struct mmc_data         *data;
+        unsigned int            dma_nents;
+        unsigned int            datasize;
+        unsigned int            dma_dir;
+        u16                     rev_no;
+        unsigned int            cmdat;
+        struct clk              *clk;
+        int                     clock;
+        struct work_struct      datawork;
+};
+static inline int mxcmci_use_dma(struct mxcmci_host *host)
+{
+        return host->do_dma;
+}
+static void mxcmci_softreset(struct mxcmci_host *host)
+{
+        int i;
+        /* reset sequence */
+        writew(STR_STP_CLK_RESET, host->base + MMC_REG_STR_STP_CLK);
+        writew(STR_STP_CLK_RESET | STR_STP_CLK_START_CLK,
+                        host->base + MMC_REG_STR_STP_CLK);
+        for (i = 0; i < 8; i++)
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+        writew(0xff, host->base + MMC_REG_RES_TO);
+}
+static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
+{
+        unsigned int nob = data->blocks;
+        unsigned int blksz = data->blksz;
+        unsigned int datasize = nob * blksz;
+#ifdef HAS_DMA
+        struct scatterlist *sg;
+        int i;
+#endif
+        if (data->flags & MMC_DATA_STREAM)
+                nob = 0xffff;
+        host->data = data;
+        data->bytes_xfered = 0;
+        writew(nob, host->base + MMC_REG_NOB);
+        writew(blksz, host->base + MMC_REG_BLK_LEN);
+        host->datasize = datasize;
+#ifdef HAS_DMA
+        for_each_sg(data->sg, sg, data->sg_len, i) {
+                if (sg->offset & 3 || sg->length & 3) {
+                        host->do_dma = 0;
+                        return;
+                }
+        }
+        if (data->flags & MMC_DATA_READ) {
+                host->dma_dir = DMA_FROM_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_READ);
+        } else {
+                host->dma_dir = DMA_TO_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_WRITE);
+        }
+        wmb();
+        imx_dma_enable(host->dma);
+#endif /* HAS_DMA */
+}
+static int mxcmci_start_cmd(struct mxcmci_host *host, struct mmc_command *cmd,
+                unsigned int cmdat)
+{
+        WARN_ON(host->cmd != NULL);
+        host->cmd = cmd;
+        switch (mmc_resp_type(cmd)) {
+        case MMC_RSP_R1: /* short CRC, OPCODE */
+        case MMC_RSP_R1B:/* short CRC, OPCODE, BUSY */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT_CRC;
+                break;
+        case MMC_RSP_R2: /* long 136 bit + CRC */
+                cmdat |= CMD_DAT_CONT_RESPONSE_136BIT;
+                break;
+        case MMC_RSP_R3: /* short */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT;
+                break;
+        case MMC_RSP_NONE:
+                break;
+        default:
+                dev_err(mmc_dev(host->mmc), "unhandled response type 0x%x\n",
+                                mmc_resp_type(cmd));
+                cmd->error = -EINVAL;
+                return -EINVAL;
+        }
+        if (mxcmci_use_dma(host))
+                writel(INT_READ_OP_EN | INT_WRITE_OP_DONE_EN |
+                                INT_END_CMD_RES_EN,
+                                host->base + MMC_REG_INT_CNTR);
+        else
+                writel(INT_END_CMD_RES_EN, host->base + MMC_REG_INT_CNTR);
+        writew(cmd->opcode, host->base + MMC_REG_CMD);
+        writel(cmd->arg, host->base + MMC_REG_ARG);
+        writew(cmdat, host->base + MMC_REG_CMD_DAT_CONT);
+        return 0;
+}
+static void mxcmci_finish_request(struct mxcmci_host *host,
+                struct mmc_request *req)
+{
+        writel(0, host->base + MMC_REG_INT_CNTR);
+        host->req = NULL;
+        host->cmd = NULL;
+        host->data = NULL;
+        mmc_request_done(host->mmc, req);
+}
+static int mxcmci_finish_data(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host)) {
+                imx_dma_disable(host->dma);
+                dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->dma_nents,
+                                host->dma_dir);
+        }
+#endif
+        if (stat & STATUS_ERR_MASK) {
+                dev_dbg(mmc_dev(host->mmc), "request failed. status: 0x%08x\n",
+                                stat);
+                if (stat & STATUS_CRC_READ_ERR) {
+                        data->error = -EILSEQ;
+                } else if (stat & STATUS_CRC_WRITE_ERR) {
+                        u32 err_code = (stat >> 9) & 0x3;
+                        if (err_code == 2) /* No CRC response */
+                                data->error = -ETIMEDOUT;
+                        else
+                                data->error = -EILSEQ;
+                } else if (stat & STATUS_TIME_OUT_READ) {
+                        data->error = -ETIMEDOUT;
+                } else {
+                        data->error = -EIO;
+                }
+        } else {
+                data->bytes_xfered = host->datasize;
+        }
+        data_error = data->error;
+        host->data = NULL;
+        return data_error;
+}
+static void mxcmci_read_response(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_command *cmd = host->cmd;
+        int i;
+        u32 a, b, c;
+        if (!cmd)
+                return;
+        if (stat & STATUS_TIME_OUT_RESP) {
+                dev_dbg(mmc_dev(host->mmc), "CMD TIMEOUT\n");
+                cmd->error = -ETIMEDOUT;
+        } else if (stat & STATUS_RESP_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
+                dev_dbg(mmc_dev(host->mmc), "cmd crc error\n");
+                cmd->error = -EILSEQ;
+        }
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136) {
+                        for (i = 0; i < 4; i++) {
+                                a = readw(host->base + MMC_REG_RES_FIFO);
+                                b = readw(host->base + MMC_REG_RES_FIFO);
+                                cmd->resp[i] = a << 16 | b;
+                        }
+                } else {
+                        a = readw(host->base + MMC_REG_RES_FIFO);
+                        b = readw(host->base + MMC_REG_RES_FIFO);
+                        c = readw(host->base + MMC_REG_RES_FIFO);
+                        cmd->resp[0] = a << 24 | b << 8 | c >> 8;
+                }
+        }
+}
+static int mxcmci_poll_status(struct mxcmci_host *host, u32 mask)
+{
+        u32 stat;
+        unsigned long timeout = jiffies + HZ;
+        do {
+                stat = readl(host->base + MMC_REG_STATUS);
+                if (stat & STATUS_ERR_MASK)
+                        return stat;
+                if (time_after(jiffies, timeout))
+                        return STATUS_TIME_OUT_READ;
+                if (stat & mask)
+                        return 0;
+                cpu_relax();
+        } while (1);
+}
+static int mxcmci_pull(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                *buf++ = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                tmp = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                memcpy(b, &tmp, bytes);
+        }
+        return 0;
+}
+static int mxcmci_push(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+                writel(*buf++, host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+                memcpy(&tmp, b, bytes);
+                writel(tmp, host->base + MMC_REG_BUFFER_ACCESS);
+        }
+        stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+        if (stat)
+                return stat;
+        return 0;
+}
+static int mxcmci_transfer_data(struct mxcmci_host *host)
+{
+        struct mmc_data *data = host->req->data;
+        struct scatterlist *sg;
+        int stat, i;
+        host->datasize = 0;
+        host->data = data;
+        host->datasize = 0;
+        if (data->flags & MMC_DATA_READ) {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_pull(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+        } else {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_push(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+                stat = mxcmci_poll_status(host, STATUS_WRITE_OP_DONE);
+                if (stat)
+                        return stat;
+        }
+        return 0;
+}
+static void mxcmci_datawork(struct work_struct *work)
+{
+        struct mxcmci_host *host = container_of(work, struct mxcmci_host,
+                                                  datawork);
+        int datastat = mxcmci_transfer_data(host);
+        mxcmci_finish_data(host, datastat);
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+#ifdef HAS_DMA
+static void mxcmci_data_done(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+        if (!data)
+                return;
+        data_error = mxcmci_finish_data(host, stat);
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+#endif /* HAS_DMA */
+static void mxcmci_cmd_done(struct mxcmci_host *host, unsigned int stat)
+{
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+        if (!host->data && host->req) {
+                mxcmci_finish_request(host, host->req);
+                return;
+        }
+        /* For the DMA case the DMA engine handles the data transfer
+         * automatically. For non DMA we have to to it ourselves.
+         * Don't do it in interrupt context though.
+         */
+        if (!mxcmci_use_dma(host) && host->data)
+                schedule_work(&host->datawork);
+}
+static irqreturn_t mxcmci_irq(int irq, void *devid)
+{
+        struct mxcmci_host *host = devid;
+        u32 stat;
+        stat = readl(host->base + MMC_REG_STATUS);
+        writel(stat, host->base + MMC_REG_STATUS);
+        dev_dbg(mmc_dev(host->mmc), "%s: 0x%08x\n", __func__, stat);
+        if (stat & STATUS_END_CMD_RESP)
+                mxcmci_cmd_done(host, stat);
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host) &&
+                  (stat & (STATUS_DATA_TRANS_DONE | STATUS_WRITE_OP_DONE)))
+                mxcmci_data_done(host, stat);
+#endif
+        return IRQ_HANDLED;
+}
+static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+        unsigned int cmdat = host->cmdat;
+        WARN_ON(host->req != NULL);
+        host->req = req;
+        host->cmdat &= ~CMD_DAT_CONT_INIT;
+#ifdef HAS_DMA
+        host->do_dma = 1;
+#endif
+        if (req->data) {
+                mxcmci_setup_data(host, req->data);
+                cmdat |= CMD_DAT_CONT_DATA_ENABLE;
+                if (req->data->flags & MMC_DATA_WRITE)
+                        cmdat |= CMD_DAT_CONT_WRITE;
+        }
+        if (mxcmci_start_cmd(host, req->cmd, cmdat))
+                mxcmci_finish_request(host, req);
+}
+static void mxcmci_set_clk_rate(struct mxcmci_host *host, unsigned int clk_ios)
+{
+        unsigned int divider;
+        int prescaler = 0;
+        unsigned int clk_in = clk_get_rate(host->clk);
+        while (prescaler <= 0x800) {
+                for (divider = 1; divider <= 0xF; divider++) {
+                        int x;
+                        x = (clk_in / (divider + 1));
+                        if (prescaler)
+                                x /= (prescaler * 2);
+                        if (x <= clk_ios)
+                                break;
+                }
+                if (divider < 0x10)
+                        break;
+                if (prescaler == 0)
+                        prescaler = 1;
+                else
+                        prescaler <<= 1;
+        }
+        writew((prescaler << 4) | divider, host->base + MMC_REG_CLK_RATE);
+        dev_dbg(mmc_dev(host->mmc), "scaler: %d divider: %d in: %d out: %d\n",
+                        prescaler, divider, clk_in, clk_ios);
+}
+static void mxcmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+#ifdef HAS_DMA
+        unsigned int blen;
+        /*
+         * use burstlen of 64 in 4 bit mode (--> reg value  0)
+         * use burstlen of 16 in 1 bit mode (--> reg value 16)
+         */
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                blen = 0;
+        else
+                blen = 16;
+        imx_dma_config_burstlen(host->dma, blen);
+#endif
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                host->cmdat |= CMD_DAT_CONT_BUS_WIDTH_4;
+        else
+                host->cmdat &= ~CMD_DAT_CONT_BUS_WIDTH_4;
+        if (host->power_mode != ios->power_mode) {
+                if (host->pdata && host->pdata->setpower)
+                        host->pdata->setpower(mmc_dev(mmc), ios->vdd);
+                host->power_mode = ios->power_mode;
+                if (ios->power_mode == MMC_POWER_ON)
+                        host->cmdat |= CMD_DAT_CONT_INIT;
+        }
+        if (ios->clock) {
+                mxcmci_set_clk_rate(host, ios->clock);
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+        } else {
+                writew(STR_STP_CLK_STOP_CLK, host->base + MMC_REG_STR_STP_CLK);
+        }
+        host->clock = ios->clock;
+}
+static irqreturn_t mxcmci_detect_irq(int irq, void *data)
+{
+        struct mmc_host *mmc = data;
+        dev_dbg(mmc_dev(mmc), "%s\n", __func__);
+        mmc_detect_change(mmc, msecs_to_jiffies(250));
+        return IRQ_HANDLED;
+}
+static int mxcmci_get_ro(struct mmc_host *mmc)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+        if (host->pdata && host->pdata->get_ro)
+                return !!host->pdata->get_ro(mmc_dev(mmc));
+        /*
+         * Board doesn't support read only detection; let the mmc core
+         * decide what to do.
+         */
+        return -ENOSYS;
+}
+static const struct mmc_host_ops mxcmci_ops = {
+        .request        = mxcmci_request,
+        .set_ios        = mxcmci_set_ios,
+        .get_ro         = mxcmci_get_ro,
+};
+static int mxcmci_probe(struct platform_device *pdev)
+{
+        struct mmc_host *mmc;
+        struct mxcmci_host *host = NULL;
+        struct resource *r;
+        int ret = 0, irq;
+        printk(KERN_INFO "i.MX SDHC driver\n");
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(pdev, 0);
+        if (!r || irq < 0)
+                return -EINVAL;
+        r = request_mem_region(r->start, resource_size(r), pdev->name);
+        if (!r)
+                return -EBUSY;
+        mmc = mmc_alloc_host(sizeof(struct mxcmci_host), &pdev->dev);
+        if (!mmc) {
+                ret = -ENOMEM;
+                goto out_release_mem;
+        }
+        mmc->ops = &mxcmci_ops;
+        mmc->caps = MMC_CAP_4_BIT_DATA;
+        /* MMC core transfer sizes tunable parameters */
+        mmc->max_hw_segs = 64;
+        mmc->max_phys_segs = 64;
+        mmc->max_blk_size = 2048;
+        mmc->max_blk_count = 65535;
+        mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+        mmc->max_seg_size = mmc->max_seg_size;
+        host = mmc_priv(mmc);
+        host->base = ioremap(r->start, resource_size(r));
+        if (!host->base) {
+                ret = -ENOMEM;
+                goto out_free;
+        }
+        host->mmc = mmc;
+        host->pdata = pdev->dev.platform_data;
+        if (host->pdata && host->pdata->ocr_avail)
+                mmc->ocr_avail = host->pdata->ocr_avail;
+        else
+                mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+        host->res = r;
+        host->irq = irq;
+        host->clk = clk_get(&pdev->dev, "sdhc_clk");
+        if (IS_ERR(host->clk)) {
+                ret = PTR_ERR(host->clk);
+                goto out_iounmap;
+        }
+        clk_enable(host->clk);
+        mxcmci_softreset(host);
+        host->rev_no = readw(host->base + MMC_REG_REV_NO);
+        if (host->rev_no != 0x400) {
+                ret = -ENODEV;
+                dev_err(mmc_dev(host->mmc), "wrong rev.no. 0x%08x. aborting.\n",
+                        host->rev_no);
+                goto out_clk_put;
+        }
+        mmc->f_min = clk_get_rate(host->clk) >> 7;
+        mmc->f_max = clk_get_rate(host->clk) >> 1;
+        /* recommended in data sheet */
+        writew(0x2db4, host->base + MMC_REG_READ_TO);
+        writel(0, host->base + MMC_REG_INT_CNTR);
+#ifdef HAS_DMA
+        host->dma = imx_dma_request_by_prio(DRIVER_NAME, DMA_PRIO_LOW);
+        if (host->dma < 0) {
+                dev_err(mmc_dev(host->mmc), "imx_dma_request_by_prio failed\n");
+                ret = -EBUSY;
+                goto out_clk_put;
+        }
+        r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+        if (!r) {
+                ret = -EINVAL;
+                goto out_free_dma;
+        }
+        ret = imx_dma_config_channel(host->dma,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_FIFO,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_LINEAR,
+                                     r->start, 0);
+        if (ret) {
+                dev_err(mmc_dev(host->mmc), "failed to config DMA channel\n");
+                goto out_free_dma;
+        }
+#endif
+        INIT_WORK(&host->datawork, mxcmci_datawork);
+        ret = request_irq(host->irq, mxcmci_irq, 0, DRIVER_NAME, host);
+        if (ret)
+                goto out_free_dma;
+        platform_set_drvdata(pdev, mmc);
+        if (host->pdata && host->pdata->init) {
+                ret = host->pdata->init(&pdev->dev, mxcmci_detect_irq,
+                                host->mmc);
+                if (ret)
+                        goto out_free_irq;
+        }
+        mmc_add_host(mmc);
+        return 0;
+out_free_irq:
+        free_irq(host->irq, host);
+out_free_dma:
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+out_clk_put:
+        clk_disable(host->clk);
+        clk_put(host->clk);
+out_iounmap:
+        iounmap(host->base);
+out_free:
+        mmc_free_host(mmc);
+out_release_mem:
+        release_mem_region(host->res->start, resource_size(host->res));
+        return ret;
+}
+static int mxcmci_remove(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        struct mxcmci_host *host = mmc_priv(mmc);
+        platform_set_drvdata(pdev, NULL);
+        mmc_remove_host(mmc);
+        if (host->pdata && host->pdata->exit)
+                host->pdata->exit(&pdev->dev, mmc);
+        free_irq(host->irq, host);
+        iounmap(host->base);
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+        clk_disable(host->clk);
+        clk_put(host->clk);
+        release_mem_region(host->res->start, resource_size(host->res));
+        release_resource(host->res);
+        mmc_free_host(mmc);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int mxcmci_suspend(struct platform_device *dev, pm_message_t state)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        int ret = 0;
+        if (mmc)
+                ret = mmc_suspend_host(mmc, state);
+        return ret;
+}
+static int mxcmci_resume(struct platform_device *dev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        struct mxcmci_host *host;
+        int ret = 0;
+        if (mmc) {
+                host = mmc_priv(mmc);
+                ret = mmc_resume_host(mmc);
+        }
+        return ret;
+}
+#else
+#define mxcmci_suspend  NULL
+#define mxcmci_resume   NULL
+#endif /* CONFIG_PM */
+static struct platform_driver mxcmci_driver = {
+        .probe          = mxcmci_probe,
+        .remove         = mxcmci_remove,
+        .suspend        = mxcmci_suspend,
+        .resume         = mxcmci_resume,
+        .driver         = {
+                .name           = DRIVER_NAME,
+                .owner          = THIS_MODULE,
+        }
+};
+static int __init mxcmci_init(void)
+{
+        return platform_driver_register(&mxcmci_driver);
+}
+static void __exit mxcmci_exit(void)
+{
+        platform_driver_unregister(&mxcmci_driver);
+}
+module_init(mxcmci_init);
+module_exit(mxcmci_exit);
+MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
+MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:imx-mmc");
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 3c5483b75da4..9702ad3774cf 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -180,7 +180,15 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
        else
                DALGN &= ~(1 << host->dma);
        DDADR(host->dma) = host->sg_dma;
-        DCSR(host->dma) = DCSR_RUN;
+        /*
+         * workaround for erratum #91:
+         * only start DMA now if we are doing a read,
+         * otherwise we wait until CMD/RESP has finished
+         * before starting DMA.
+         */
+        if (!cpu_is_pxa27x() || data->flags & MMC_DATA_READ)
+                DCSR(host->dma) = DCSR_RUN;
 }
 static void pxamci_start_cmd(struct pxamci_host *host, struct mmc_command *cmd, unsigned int cmdat)
@@ -251,23 +259,28 @@ static int pxamci_cmd_done(struct pxamci_host *host, unsigned int stat)
        if (stat & STAT_TIME_OUT_RESPONSE) {
                cmd->error = -ETIMEDOUT;
        } else if (stat & STAT_RES_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
-#ifdef CONFIG_PXA27x
                /*
                 * workaround for erratum #42:
                 * Intel PXA27x Family Processor Specification Update Rev 001
                 * A bogus CRC error can appear if the msb of a 136 bit
                 * response is a one.
                 */
-                if (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000) {
+                if (cpu_is_pxa27x() &&
+                    (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000))
                        pr_debug("ignoring CRC from command %d - *risky*\n", cmd->opcode);
-                } else
+                else
-#endif
+                        cmd->error = -EILSEQ;
-                cmd->error = -EILSEQ;
        }
        pxamci_disable_irq(host, END_CMD_RES);
        if (host->data && !cmd->error) {
                pxamci_enable_irq(host, DATA_TRAN_DONE);
+                /*
+                 * workaround for erratum #91, if doing write
+                 * enable DMA late
+                 */
+                if (cpu_is_pxa27x() && host->data->flags & MMC_DATA_WRITE)
+                        DCSR(host->dma) = DCSR_RUN;
        } else {
                pxamci_finish_request(host, host->mrq);
        }
diff --git a/drivers/mmc/host/ricoh_mmc.c b/drivers/mmc/host/ricoh_mmc.c
index be9e7b32b34e..f62790513322 100644
--- a/drivers/mmc/host/ricoh_mmc.c
+++ b/drivers/mmc/host/ricoh_mmc.c
@@ -196,7 +196,7 @@ static void __devexit ricoh_mmc_remove(struct pci_dev *pdev)
        pci_set_drvdata(pdev, NULL);
 }
-static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
+static int ricoh_mmc_suspend_late(struct pci_dev *pdev, pm_message_t state)
 {
        struct pci_dev *fw_dev = NULL;
@@ -210,7 +210,7 @@ static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
        return 0;
 }
-static int ricoh_mmc_resume(struct pci_dev *pdev)
+static int ricoh_mmc_resume_early(struct pci_dev *pdev)
 {
        struct pci_dev *fw_dev = NULL;
@@ -229,8 +229,8 @@ static struct pci_driver ricoh_mmc_driver = {
        .id_table =     pci_ids,
        .probe =        ricoh_mmc_probe,
        .remove =       __devexit_p(ricoh_mmc_remove),
-        .suspend =      ricoh_mmc_suspend,
+        .suspend_late = ricoh_mmc_suspend_late,
-        .resume =       ricoh_mmc_resume,
+        .resume_early = ricoh_mmc_resume_early,
 };
 /*****************************************************************************\
diff --git a/drivers/mtd/ubi/Kconfig.debug b/drivers/mtd/ubi/Kconfig.debug
index 1e2ee22edeff..2246f154e2f7 100644
--- a/drivers/mtd/ubi/Kconfig.debug
+++ b/drivers/mtd/ubi/Kconfig.debug
@@ -33,16 +33,6 @@ config MTD_UBI_DEBUG_DISABLE_BGT
          This option switches the background thread off by default. The thread
          may be also be enabled/disabled via UBI sysfs.
-config MTD_UBI_DEBUG_USERSPACE_IO
-        bool "Direct user-space write/erase support"
-        default n
-        depends on MTD_UBI_DEBUG
-        help
-          By default, users cannot directly write and erase individual
-          eraseblocks of dynamic volumes, and have to use update operation
-          instead. This option enables this capability - it is very useful for
-          debugging and testing.
 config MTD_UBI_DEBUG_EMULATE_BITFLIPS
        bool "Emulate flash bit-flips"
        depends on MTD_UBI_DEBUG
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 9082768cc6c3..4048db83aef6 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -263,8 +263,12 @@ static ssize_t dev_attribute_show(struct device *dev,
        return ret;
 }
-/* Fake "release" method for UBI devices */
+static void dev_release(struct device *dev)
-static void dev_release(struct device *dev) { }
+{
+        struct ubi_device *ubi = container_of(dev, struct ubi_device, dev);
+        kfree(ubi);
+}
 /**
 * ubi_sysfs_init - initialize sysfs for an UBI device.
@@ -380,7 +384,7 @@ static void free_user_volumes(struct ubi_device *ubi)
 */
 static int uif_init(struct ubi_device *ubi)
 {
-        int i, err, do_free = 0;
+        int i, err;
        dev_t dev;
        sprintf(ubi->ubi_name, UBI_NAME_STR "%d", ubi->ubi_num);
@@ -427,13 +431,10 @@ static int uif_init(struct ubi_device *ubi)
 out_volumes:
        kill_volumes(ubi);
-        do_free = 0;
 out_sysfs:
        ubi_sysfs_close(ubi);
        cdev_del(&ubi->cdev);
 out_unreg:
-        if (do_free)
-                free_user_volumes(ubi);
        unregister_chrdev_region(ubi->cdev.dev, ubi->vtbl_slots + 1);
        ubi_err("cannot initialize UBI %s, error %d", ubi->ubi_name, err);
        return err;
@@ -947,6 +948,12 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        if (ubi->bgt_thread)
                kthread_stop(ubi->bgt_thread);
+        /*
+         * Get a reference to the device in order to prevent 'dev_release()'
+         * from freeing @ubi object.
+         */
+        get_device(&ubi->dev);
        uif_close(ubi);
        ubi_wl_close(ubi);
        free_internal_volumes(ubi);
@@ -958,7 +965,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        vfree(ubi->dbg_peb_buf);
 #endif
        ubi_msg("mtd%d is detached from ubi%d", ubi->mtd->index, ubi->ubi_num);
-        kfree(ubi);
+        put_device(&ubi->dev);
        return 0;
 }
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index 98cf31ed0814..e63c8fc3df3a 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -40,9 +40,9 @@
 #include <linux/ioctl.h>
 #include <linux/capability.h>
 #include <linux/uaccess.h>
-#include <linux/smp_lock.h>
+#include <linux/compat.h>
+#include <linux/math64.h>
 #include <mtd/ubi-user.h>
-#include <asm/div64.h>
 #include "ubi.h"
 /**
@@ -195,7 +195,6 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
        int err, lnum, off, len,  tbuf_size;
        size_t count_save = count;
        void *tbuf;
-        uint64_t tmp;
        dbg_gen("read %zd bytes from offset %lld of volume %d",
                count, *offp, vol->vol_id);
@@ -225,10 +224,7 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
                return -ENOMEM;
        len = count > tbuf_size ? tbuf_size : count;
+        lnum = div_u64_rem(*offp, vol->usable_leb_size, &off);
-        tmp = *offp;
-        off = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        do {
                cond_resched();
@@ -263,12 +259,9 @@ static ssize_t vol_cdev_read(struct file *file, __user char *buf, size_t count,
        return err ? err : count_save - count;
 }
-#ifdef CONFIG_MTD_UBI_DEBUG_USERSPACE_IO
 /*
 * This function allows to directly write to dynamic UBI volumes, without
- * issuing the volume update operation. Available only as a debugging feature.
+ * issuing the volume update operation.
- * Very useful for testing UBI.
 */
 static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
                                     size_t count, loff_t *offp)
@@ -279,7 +272,9 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        int lnum, off, len, tbuf_size, err = 0;
        size_t count_save = count;
        char *tbuf;
-        uint64_t tmp;
+        if (!vol->direct_writes)
+                return -EPERM;
        dbg_gen("requested: write %zd bytes to offset %lld of volume %u",
                count, *offp, vol->vol_id);
@@ -287,10 +282,7 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        if (vol->vol_type == UBI_STATIC_VOLUME)
                return -EROFS;
-        tmp = *offp;
+        lnum = div_u64_rem(*offp, vol->usable_leb_size, &off);
-        off = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        if (off & (ubi->min_io_size - 1)) {
                dbg_err("unaligned position");
                return -EINVAL;
@@ -347,10 +339,6 @@ static ssize_t vol_cdev_direct_write(struct file *file, const char __user *buf,
        return err ? err : count_save - count;
 }
-#else
-#define vol_cdev_direct_write(file, buf, count, offp) (-EPERM)
-#endif /* CONFIG_MTD_UBI_DEBUG_USERSPACE_IO */
 static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
                              size_t count, loff_t *offp)
 {
@@ -402,8 +390,8 @@ static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
        return count;
 }
-static int vol_cdev_ioctl(struct inode *inode, struct file *file,
+static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
-                          unsigned int cmd, unsigned long arg)
+                           unsigned long arg)
 {
        int err = 0;
        struct ubi_volume_desc *desc = file->private_data;
@@ -487,7 +475,6 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file,
                break;
        }
-#ifdef CONFIG_MTD_UBI_DEBUG_USERSPACE_IO
        /* Logical eraseblock erasure command */
        case UBI_IOCEBER:
        {
@@ -518,13 +505,77 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file,
                err = ubi_wl_flush(ubi);
                break;
        }
-#endif
+        /* Logical eraseblock map command */
+        case UBI_IOCEBMAP:
+        {
+                struct ubi_map_req req;
+                err = copy_from_user(&req, argp, sizeof(struct ubi_map_req));
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_leb_map(desc, req.lnum, req.dtype);
+                break;
+        }
+        /* Logical eraseblock un-map command */
+        case UBI_IOCEBUNMAP:
+        {
+                int32_t lnum;
+                err = get_user(lnum, (__user int32_t *)argp);
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_leb_unmap(desc, lnum);
+                break;
+        }
+        /* Check if logical eraseblock is mapped command */
+        case UBI_IOCEBISMAP:
+        {
+                int32_t lnum;
+                err = get_user(lnum, (__user int32_t *)argp);
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                err = ubi_is_mapped(desc, lnum);
+                break;
+        }
+        /* Set volume property command*/
+        case UBI_IOCSETPROP:
+        {
+                struct ubi_set_prop_req req;
+                err = copy_from_user(&req, argp,
+                                sizeof(struct ubi_set_prop_req));
+                if (err) {
+                        err = -EFAULT;
+                        break;
+                }
+                switch (req.property) {
+                case UBI_PROP_DIRECT_WRITE:
+                        mutex_lock(&ubi->volumes_mutex);
+                        desc->vol->direct_writes = !!req.value;
+                        mutex_unlock(&ubi->volumes_mutex);
+                        break;
+                default:
+                        err = -EINVAL;
+                        break;
+                }
+                break;
+        }
        default:
                err = -ENOTTY;
                break;
        }
        return err;
 }
@@ -762,8 +813,8 @@ out_free:
        return err;
 }
-static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
+static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
-                          unsigned int cmd, unsigned long arg)
+                           unsigned long arg)
 {
        int err = 0;
        struct ubi_device *ubi;
@@ -773,7 +824,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        if (!capable(CAP_SYS_RESOURCE))
                return -EPERM;
-        ubi = ubi_get_by_major(imajor(inode));
+        ubi = ubi_get_by_major(imajor(file->f_mapping->host));
        if (!ubi)
                return -ENODEV;
@@ -843,7 +894,6 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        case UBI_IOCRSVOL:
        {
                int pebs;
-                uint64_t tmp;
                struct ubi_rsvol_req req;
                dbg_gen("re-size volume");
@@ -863,9 +913,8 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
                        break;
                }
-                tmp = req.bytes;
+                pebs = div_u64(req.bytes + desc->vol->usable_leb_size - 1,
-                pebs = !!do_div(tmp, desc->vol->usable_leb_size);
+                               desc->vol->usable_leb_size);
-                pebs += tmp;
                mutex_lock(&ubi->volumes_mutex);
                err = ubi_resize_volume(desc, pebs);
@@ -909,8 +958,8 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
        return err;
 }
-static int ctrl_cdev_ioctl(struct inode *inode, struct file *file,
+static long ctrl_cdev_ioctl(struct file *file, unsigned int cmd,
-                           unsigned int cmd, unsigned long arg)
+                            unsigned long arg)
 {
        int err = 0;
        void __user *argp = (void __user *)arg;
@@ -986,26 +1035,59 @@ static int ctrl_cdev_ioctl(struct inode *inode, struct file *file,
        return err;
 }
-/* UBI control character device operations */
+#ifdef CONFIG_COMPAT
-struct file_operations ubi_ctrl_cdev_operations = {
+static long vol_cdev_compat_ioctl(struct file *file, unsigned int cmd,
-        .ioctl = ctrl_cdev_ioctl,
+                                  unsigned long arg)
-        .owner = THIS_MODULE,
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return vol_cdev_ioctl(file, cmd, translated_arg);
+}
+static long ubi_cdev_compat_ioctl(struct file *file, unsigned int cmd,
+                                  unsigned long arg)
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return ubi_cdev_ioctl(file, cmd, translated_arg);
+}
+static long ctrl_cdev_compat_ioctl(struct file *file, unsigned int cmd,
+                                   unsigned long arg)
+{
+        unsigned long translated_arg = (unsigned long)compat_ptr(arg);
+        return ctrl_cdev_ioctl(file, cmd, translated_arg);
+}
+#else
+#define vol_cdev_compat_ioctl  NULL
+#define ubi_cdev_compat_ioctl  NULL
+#define ctrl_cdev_compat_ioctl NULL
+#endif
+/* UBI volume character device operations */
+const struct file_operations ubi_vol_cdev_operations = {
+        .owner          = THIS_MODULE,
+        .open           = vol_cdev_open,
+        .release        = vol_cdev_release,
+        .llseek         = vol_cdev_llseek,
+        .read           = vol_cdev_read,
+        .write          = vol_cdev_write,
+        .unlocked_ioctl = vol_cdev_ioctl,
+        .compat_ioctl   = vol_cdev_compat_ioctl,
 };
 /* UBI character device operations */
-struct file_operations ubi_cdev_operations = {
+const struct file_operations ubi_cdev_operations = {
-        .owner = THIS_MODULE,
+        .owner          = THIS_MODULE,
-        .ioctl = ubi_cdev_ioctl,
+        .llseek         = no_llseek,
-        .llseek = no_llseek,
+        .unlocked_ioctl = ubi_cdev_ioctl,
+        .compat_ioctl   = ubi_cdev_compat_ioctl,
 };
-/* UBI volume character device operations */
+/* UBI control character device operations */
-struct file_operations ubi_vol_cdev_operations = {
+const struct file_operations ubi_ctrl_cdev_operations = {
-        .owner   = THIS_MODULE,
+        .owner          = THIS_MODULE,
-        .open    = vol_cdev_open,
+        .unlocked_ioctl = ctrl_cdev_ioctl,
-        .release = vol_cdev_release,
+        .compat_ioctl   = ctrl_cdev_compat_ioctl,
-        .llseek  = vol_cdev_llseek,
-        .read    = vol_cdev_read,
-        .write   = vol_cdev_write,
-        .ioctl   = vol_cdev_ioctl,
 };
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 6dd4f5e77f82..49cd55ade9c8 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -28,7 +28,7 @@
 * eraseblock size is equivalent to the logical eraseblock size of the volume.
 */
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 /**
@@ -109,7 +109,6 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
        int err = 0, lnum, offs, total_read;
        struct ubi_volume *vol;
        struct ubi_device *ubi;
-        uint64_t tmp = from;
        dbg_gen("read %zd bytes from offset %lld", len, from);
@@ -119,9 +118,7 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
        ubi = vol->ubi;
-        offs = do_div(tmp, mtd->erasesize);
+        lnum = div_u64_rem(from, mtd->erasesize, &offs);
-        lnum = tmp;
        total_read = len;
        while (total_read) {
                size_t to_read = mtd->erasesize - offs;
@@ -160,7 +157,6 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
        int err = 0, lnum, offs, total_written;
        struct ubi_volume *vol;
        struct ubi_device *ubi;
-        uint64_t tmp = to;
        dbg_gen("write %zd bytes to offset %lld", len, to);
@@ -173,8 +169,7 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
        if (ubi->ro_mode)
                return -EROFS;
-        offs = do_div(tmp, mtd->erasesize);
+        lnum = div_u64_rem(to, mtd->erasesize, &offs);
-        lnum = tmp;
        if (len % mtd->writesize || offs % mtd->writesize)
                return -EINVAL;
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index ecde202a5a12..c3d653ba5ca0 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -42,7 +42,7 @@
 #include <linux/err.h>
 #include <linux/crc32.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -904,10 +904,8 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
        dbg_msg("scanning is finished");
        /* Calculate mean erase counter */
-        if (si->ec_count) {
+        if (si->ec_count)
-                do_div(si->ec_sum, si->ec_count);
+                si->mean_ec = div_u64(si->ec_sum, si->ec_count);
-                si->mean_ec = si->ec_sum;
-        }
        if (si->is_empty)
                ubi_msg("empty MTD device detected");
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 4a8ec485c91d..c055511bb1b2 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -206,6 +206,7 @@ struct ubi_volume_desc;
 * @upd_marker: %1 if the update marker is set for this volume
 * @updating: %1 if the volume is being updated
 * @changing_leb: %1 if the atomic LEB change ioctl command is in progress
+ * @direct_writes: %1 if direct writes are enabled for this volume
 *
 * @gluebi_desc: gluebi UBI volume descriptor
 * @gluebi_refcount: reference count of the gluebi MTD device
@@ -253,6 +254,7 @@ struct ubi_volume {
        unsigned int upd_marker:1;
        unsigned int updating:1;
        unsigned int changing_leb:1;
+        unsigned int direct_writes:1;
 #ifdef CONFIG_MTD_UBI_GLUEBI
        /*
@@ -304,7 +306,8 @@ struct ubi_wl_entry;
 * @vtbl_size: size of the volume table in bytes
 * @vtbl: in-RAM volume table copy
 * @volumes_mutex: protects on-flash volume table and serializes volume
- *                 changes, like creation, deletion, update, re-size and re-name
+ *                 changes, like creation, deletion, update, re-size,
+ *                 re-name and set property
 *
 * @max_ec: current highest erase counter value
 * @mean_ec: current mean erase counter value
@@ -449,9 +452,9 @@ struct ubi_device {
 };
 extern struct kmem_cache *ubi_wl_entry_slab;
-extern struct file_operations ubi_ctrl_cdev_operations;
+extern const struct file_operations ubi_ctrl_cdev_operations;
-extern struct file_operations ubi_cdev_operations;
+extern const struct file_operations ubi_cdev_operations;
-extern struct file_operations ubi_vol_cdev_operations;
+extern const struct file_operations ubi_vol_cdev_operations;
 extern struct class *ubi_class;
 extern struct mutex ubi_devices_mutex;
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 8b89cc18ff0b..6b4d1ae891ae 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -40,7 +40,7 @@
 #include <linux/err.h>
 #include <linux/uaccess.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 /**
@@ -89,7 +89,6 @@ static int clear_update_marker(struct ubi_device *ubi, struct ubi_volume *vol,
                               long long bytes)
 {
        int err;
-        uint64_t tmp;
        struct ubi_vtbl_record vtbl_rec;
        dbg_gen("clear update marker for volume %d", vol->vol_id);
@@ -101,9 +100,9 @@ static int clear_update_marker(struct ubi_device *ubi, struct ubi_volume *vol,
        if (vol->vol_type == UBI_STATIC_VOLUME) {
                vol->corrupted = 0;
-                vol->used_bytes = tmp = bytes;
+                vol->used_bytes = bytes;
-                vol->last_eb_bytes = do_div(tmp, vol->usable_leb_size);
+                vol->used_ebs = div_u64_rem(bytes, vol->usable_leb_size,
-                vol->used_ebs = tmp;
+                                            &vol->last_eb_bytes);
                if (vol->last_eb_bytes)
                        vol->used_ebs += 1;
                else
@@ -131,7 +130,6 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                     long long bytes)
 {
        int i, err;
-        uint64_t tmp;
        dbg_gen("start update of volume %d, %llu bytes", vol->vol_id, bytes);
        ubi_assert(!vol->updating && !vol->changing_leb);
@@ -161,9 +159,8 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
        if (!vol->upd_buf)
                return -ENOMEM;
-        tmp = bytes;
+        vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
-        vol->upd_ebs = !!do_div(tmp, vol->usable_leb_size);
+                               vol->usable_leb_size);
-        vol->upd_ebs += tmp;
        vol->upd_bytes = bytes;
        vol->upd_received = 0;
        return 0;
@@ -282,7 +279,6 @@ static int write_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
 int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
                         const void __user *buf, int count)
 {
-        uint64_t tmp;
        int lnum, offs, err = 0, len, to_write = count;
        dbg_gen("write %d of %lld bytes, %lld already passed",
@@ -291,10 +287,7 @@ int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
        if (ubi->ro_mode)
                return -EROFS;
-        tmp = vol->upd_received;
+        lnum = div_u64_rem(vol->upd_received,  vol->usable_leb_size, &offs);
-        offs = do_div(tmp, vol->usable_leb_size);
-        lnum = tmp;
        if (vol->upd_received + count > vol->upd_bytes)
                to_write = count = vol->upd_bytes - vol->upd_received;
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index 22e1d7398fce..df5483562b7a 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -24,7 +24,7 @@
 */
 #include <linux/err.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -205,7 +205,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        int i, err, vol_id = req->vol_id, do_free = 1;
        struct ubi_volume *vol;
        struct ubi_vtbl_record vtbl_rec;
-        uint64_t bytes;
        dev_t dev;
        if (ubi->ro_mode)
@@ -255,10 +254,8 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        /* Calculate how many eraseblocks are requested */
        vol->usable_leb_size = ubi->leb_size - ubi->leb_size % req->alignment;
-        bytes = req->bytes;
+        vol->reserved_pebs += div_u64(req->bytes + vol->usable_leb_size - 1,
-        if (do_div(bytes, vol->usable_leb_size))
+                                      vol->usable_leb_size);
-                vol->reserved_pebs = 1;
-        vol->reserved_pebs += bytes;
        /* Reserve physical eraseblocks */
        if (vol->reserved_pebs > ubi->avail_pebs) {
@@ -301,10 +298,10 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                vol->used_bytes =
                        (long long)vol->used_ebs * vol->usable_leb_size;
        } else {
-                bytes = vol->used_bytes;
+                vol->used_ebs = div_u64_rem(vol->used_bytes,
-                vol->last_eb_bytes = do_div(bytes, vol->usable_leb_size);
+                                            vol->usable_leb_size,
-                vol->used_ebs = bytes;
+                                            &vol->last_eb_bytes);
-                if (vol->last_eb_bytes)
+                if (vol->last_eb_bytes != 0)
                        vol->used_ebs += 1;
                else
                        vol->last_eb_bytes = vol->usable_leb_size;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 26474c92193f..c986978ce761 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.20-k3-NAPI"
+#define DRV_VERSION "7.3.21-k3-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -3712,7 +3712,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
        struct e1000_hw *hw = &adapter->hw;
        u32 rctl, icr = er32(ICR);
-        if (unlikely(!icr))
+        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
                return IRQ_NONE;  /* Not our interrupt */
        /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index f3706e415b45..f49a426ad681 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -234,6 +234,8 @@ static int gfar_mdio_probe(struct of_device *ofdev,
        if (NULL == new_bus)
                return -ENOMEM;
+        device_init_wakeup(&ofdev->dev, 1);
        new_bus->name = "Gianfar MII Bus",
        new_bus->read = &gfar_mdio_read,
        new_bus->write = &gfar_mdio_write,
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index f5e2e7235fcb..13ca73f96ec6 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -699,11 +699,18 @@ static s32 igb_check_for_link_82575(struct e1000_hw *hw)
        /* SGMII link check is done through the PCS register. */
        if ((hw->phy.media_type != e1000_media_type_copper) ||
-            (igb_sgmii_active_82575(hw)))
+            (igb_sgmii_active_82575(hw))) {
                ret_val = igb_get_pcs_speed_and_duplex_82575(hw, &speed,
                                                             &duplex);
-        else
+                /*
+                 * Use this flag to determine if link needs to be checked or
+                 * not.  If  we have link clear the flag so that we do not
+                 * continue to check for link.
+                 */
+                hw->mac.get_link_status = !hw->mac.serdes_has_link;
+        } else {
                ret_val = igb_check_for_copper_link(hw);
+        }
        return ret_val;
 }
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 5a27825cc48a..aebef8e48e76 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -300,11 +300,10 @@ struct igb_adapter {
 #define IGB_FLAG_HAS_MSI           (1 << 0)
 #define IGB_FLAG_MSI_ENABLE        (1 << 1)
-#define IGB_FLAG_HAS_DCA           (1 << 2)
+#define IGB_FLAG_DCA_ENABLED       (1 << 2)
-#define IGB_FLAG_DCA_ENABLED       (1 << 3)
+#define IGB_FLAG_IN_NETPOLL        (1 << 3)
-#define IGB_FLAG_IN_NETPOLL        (1 << 5)
+#define IGB_FLAG_QUAD_PORT_A       (1 << 4)
-#define IGB_FLAG_QUAD_PORT_A       (1 << 6)
+#define IGB_FLAG_NEED_CTX_IDX      (1 << 5)
-#define IGB_FLAG_NEED_CTX_IDX      (1 << 7)
 enum e1000_state_t {
        __IGB_TESTING,
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index b82b0fb2056c..a50db5398fa5 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -206,10 +206,11 @@ static int __init igb_init_module(void)
        global_quad_port_a = 0;
-        ret = pci_register_driver(&igb_driver);
 #ifdef CONFIG_IGB_DCA
        dca_register_notify(&dca_notifier);
 #endif
+        ret = pci_register_driver(&igb_driver);
        return ret;
 }
@@ -1156,11 +1157,10 @@ static int __devinit igb_probe(struct pci_dev *pdev,
        /* set flags */
        switch (hw->mac.type) {
-        case e1000_82576:
        case e1000_82575:
-                adapter->flags |= IGB_FLAG_HAS_DCA;
                adapter->flags |= IGB_FLAG_NEED_CTX_IDX;
                break;
+        case e1000_82576:
        default:
                break;
        }
@@ -1310,8 +1310,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                goto err_register;
 #ifdef CONFIG_IGB_DCA
-        if ((adapter->flags & IGB_FLAG_HAS_DCA) &&
+        if (dca_add_requester(&pdev->dev) == 0) {
-            (dca_add_requester(&pdev->dev) == 0)) {
                adapter->flags |= IGB_FLAG_DCA_ENABLED;
                dev_info(&pdev->dev, "DCA enabled\n");
                /* Always use CB2 mode, difference is masked
@@ -1835,11 +1834,11 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
        rctl |= E1000_RCTL_SECRC;
        /*
-         * disable store bad packets, long packet enable, and clear size bits.
+         * disable store bad packets and clear size bits.
         */
-        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_LPE | E1000_RCTL_SZ_256);
+        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_SZ_256);
-        if (adapter->netdev->mtu > ETH_DATA_LEN)
+        /* enable LPE when to prevent packets larger than max_frame_size */
                rctl |= E1000_RCTL_LPE;
        /* Setup buffer sizes */
@@ -1865,7 +1864,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         */
        /* allocations using alloc_page take too long for regular MTU
         * so only enable packet split for jumbo frames */
-        if (rctl & E1000_RCTL_LPE) {
+        if (adapter->netdev->mtu > ETH_DATA_LEN) {
                adapter->rx_ps_hdr_size = IGB_RXBUFFER_128;
                srrctl |= adapter->rx_ps_hdr_size <<
                         E1000_SRRCTL_BSIZEHDRSIZE_SHIFT;
@@ -3473,19 +3472,16 @@ static int __igb_notify_dca(struct device *dev, void *data)
        struct e1000_hw *hw = &adapter->hw;
        unsigned long event = *(unsigned long *)data;
-        if (!(adapter->flags & IGB_FLAG_HAS_DCA))
-                goto out;
        switch (event) {
        case DCA_PROVIDER_ADD:
                /* if already enabled, don't do it again */
                if (adapter->flags & IGB_FLAG_DCA_ENABLED)
                        break;
-                adapter->flags |= IGB_FLAG_DCA_ENABLED;
                /* Always use CB2 mode, difference is masked
                 * in the CB driver. */
                wr32(E1000_DCA_CTRL, 2);
                if (dca_add_requester(dev) == 0) {
+                        adapter->flags |= IGB_FLAG_DCA_ENABLED;
                        dev_info(&adapter->pdev->dev, "DCA enabled\n");
                        igb_setup_dca(adapter);
                        break;
@@ -3502,7 +3498,7 @@ static int __igb_notify_dca(struct device *dev, void *data)
                }
                break;
        }
-out:
        return 0;
 }
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index a75a31005fd3..9c78c963b721 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -210,7 +210,7 @@
 #define MAX_CMD_DESCRIPTORS_HOST        1024
 #define MAX_RCV_DESCRIPTORS_1G          2048
 #define MAX_RCV_DESCRIPTORS_10G         4096
-#define MAX_JUMBO_RCV_DESCRIPTORS       512
+#define MAX_JUMBO_RCV_DESCRIPTORS       1024
 #define MAX_LRO_RCV_DESCRIPTORS         8
 #define MAX_RCVSTATUS_DESCRIPTORS       MAX_RCV_DESCRIPTORS
 #define MAX_JUMBO_RCV_DESC      MAX_JUMBO_RCV_DESCRIPTORS
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index ca7c8d8050c9..ffd37bea1628 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -947,8 +947,10 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
        }
        for (i = 0; i < n; i++) {
                if (netxen_rom_fast_read(adapter, 8*i + 4*offset, &val) != 0 ||
-                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0)
+                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0) {
+                        kfree(buf);
                        return -EIO;
+                }
                buf[i].addr = addr;
                buf[i].data = val;
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index ec2314246682..335da4831ab3 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2168,7 +2168,7 @@ static void gelic_wl_connected_event(struct gelic_wl_info *wl,
                complete(&wl->assoc_done);
                netif_carrier_on(port_to_netdev(wl_port(wl)));
        } else
-                pr_debug("%s: event %#lx under wpa\n",
+                pr_debug("%s: event %#llx under wpa\n",
                                 __func__, event);
 }
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 72fd9e97c190..b2dcdb5ed8bd 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -438,7 +438,6 @@ static void r6040_down(struct net_device *dev)
 {
        struct r6040_private *lp = netdev_priv(dev);
        void __iomem *ioaddr = lp->base;
-        struct pci_dev *pdev = lp->pdev;
        int limit = 2048;
        u16 *adrp;
        u16 cmd;
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 101c00a7bb73..847e9bb0098f 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -676,9 +676,8 @@ static int efx_init_port(struct efx_nic *efx)
        rc = efx->phy_op->init(efx);
        if (rc)
                return rc;
-        efx->phy_op->reconfigure(efx);
        mutex_lock(&efx->mac_lock);
+        efx->phy_op->reconfigure(efx);
        rc = falcon_switch_mac(efx);
        mutex_unlock(&efx->mac_lock);
        if (rc)
@@ -686,7 +685,7 @@ static int efx_init_port(struct efx_nic *efx)
        efx->mac_op->reconfigure(efx);
        efx->port_initialized = true;
-        efx->stats_enabled = true;
+        efx_stats_enable(efx);
        return 0;
 fail:
@@ -735,6 +734,7 @@ static void efx_fini_port(struct efx_nic *efx)
        if (!efx->port_initialized)
                return;
+        efx_stats_disable(efx);
        efx->phy_op->fini(efx);
        efx->port_initialized = false;
@@ -1368,6 +1368,20 @@ static int efx_net_stop(struct net_device *net_dev)
        return 0;
 }
+void efx_stats_disable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        ++efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
+void efx_stats_enable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        --efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
 /* Context: process, dev_base_lock or RTNL held, non-blocking. */
 static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
 {
@@ -1376,12 +1390,12 @@ static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
        struct net_device_stats *stats = &net_dev->stats;
        /* Update stats if possible, but do not wait if another thread
-         * is updating them (or resetting the NIC); slightly stale
+         * is updating them or if MAC stats fetches are temporarily
-         * stats are acceptable.
+         * disabled; slightly stale stats are acceptable.
         */
        if (!spin_trylock(&efx->stats_lock))
                return stats;
-        if (efx->stats_enabled) {
+        if (!efx->stats_disable_count) {
                efx->mac_op->update_stats(efx);
                falcon_update_nic_stats(efx);
        }
@@ -1629,16 +1643,12 @@ static void efx_unregister_netdev(struct efx_nic *efx)
 /* Tears down the entire software state and most of the hardware state
 * before reset.  */
-void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+void efx_reset_down(struct efx_nic *efx, enum reset_type method,
+                    struct ethtool_cmd *ecmd)
 {
        EFX_ASSERT_RESET_SERIALISED(efx);
-        /* The net_dev->get_stats handler is quite slow, and will fail
+        efx_stats_disable(efx);
-         * if a fetch is pending over reset. Serialise against it. */
-        spin_lock(&efx->stats_lock);
-        efx->stats_enabled = false;
-        spin_unlock(&efx->stats_lock);
        efx_stop_all(efx);
        mutex_lock(&efx->mac_lock);
        mutex_lock(&efx->spi_lock);
@@ -1646,6 +1656,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
        efx->phy_op->get_settings(efx, ecmd);
        efx_fini_channels(efx);
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE)
+                efx->phy_op->fini(efx);
 }
 /* This function will always ensure that the locks acquired in
@@ -1653,7 +1665,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 * that we were unable to reinitialise the hardware, and the
 * driver should be disabled. If ok is false, then the rx and tx
 * engines are not restarted, pending a RESET_DISABLE. */
-int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
+int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                 struct ethtool_cmd *ecmd, bool ok)
 {
        int rc;
@@ -1665,6 +1678,15 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
                ok = false;
        }
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE) {
+                if (ok) {
+                        rc = efx->phy_op->init(efx);
+                        if (rc)
+                                ok = false;
+                } else
+                        efx->port_initialized = false;
+        }
        if (ok) {
                efx_init_channels(efx);
@@ -1677,7 +1699,7 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
        if (ok) {
                efx_start_all(efx);
-                efx->stats_enabled = true;
+                efx_stats_enable(efx);
        }
        return rc;
 }
@@ -1709,7 +1731,7 @@ static int efx_reset(struct efx_nic *efx)
        EFX_INFO(efx, "resetting (%d)\n", method);
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, method, &ecmd);
        rc = falcon_reset_hw(efx, method);
        if (rc) {
@@ -1728,10 +1750,10 @@ static int efx_reset(struct efx_nic *efx)
        /* Leave device stopped if necessary */
        if (method == RESET_TYPE_DISABLE) {
-                efx_reset_up(efx, &ecmd, false);
+                efx_reset_up(efx, method, &ecmd, false);
                rc = -EIO;
        } else {
-                rc = efx_reset_up(efx, &ecmd, true);
+                rc = efx_reset_up(efx, method, &ecmd, true);
        }
 out_disable:
@@ -1883,6 +1905,7 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
        efx->rx_checksum_enabled = true;
        spin_lock_init(&efx->netif_stop_lock);
        spin_lock_init(&efx->stats_lock);
+        efx->stats_disable_count = 1;
        mutex_init(&efx->mac_lock);
        efx->mac_op = &efx_dummy_mac_operations;
        efx->phy_op = &efx_dummy_phy_operations;
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index 0dd7a532c78a..55d0f131b0e9 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -36,13 +36,16 @@ extern void efx_process_channel_now(struct efx_channel *channel);
 extern void efx_flush_queues(struct efx_nic *efx);
 /* Ports */
+extern void efx_stats_disable(struct efx_nic *efx);
+extern void efx_stats_enable(struct efx_nic *efx);
 extern void efx_reconfigure_port(struct efx_nic *efx);
 extern void __efx_reconfigure_port(struct efx_nic *efx);
 /* Reset handling */
-extern void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd);
+extern void efx_reset_down(struct efx_nic *efx, enum reset_type method,
-extern int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd,
+                           struct ethtool_cmd *ecmd);
-                        bool ok);
+extern int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                        struct ethtool_cmd *ecmd, bool ok);
 /* Global */
 extern void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index 53d259e90187..7b5924c039b3 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -219,9 +219,6 @@ int efx_ethtool_set_settings(struct net_device *net_dev,
        struct efx_nic *efx = netdev_priv(net_dev);
        int rc;
-        if (EFX_WORKAROUND_13963(efx) && !ecmd->autoneg)
-                return -EINVAL;
        /* Falcon GMAC does not support 1000Mbps HD */
        if (ecmd->speed == SPEED_1000 && ecmd->duplex != DUPLEX_FULL) {
                EFX_LOG(efx, "rejecting unsupported 1000Mbps HD"
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 5b9f2d9cc4ed..d5378e60fcdd 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -824,10 +824,6 @@ static void falcon_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                            rx_ev_pause_frm ? " [PAUSE]" : "");
        }
 #endif
-        if (unlikely(rx_ev_eth_crc_err && EFX_WORKAROUND_10750(efx) &&
-                     efx->phy_type == PHY_TYPE_SFX7101))
-                tenxpress_crc_err(efx);
 }
 /* Handle receive events that are not in-order. */
@@ -1887,7 +1883,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
        /* MAC stats will fail whilst the TX fifo is draining. Serialise
         * the drain sequence with the statistics fetch */
-        spin_lock(&efx->stats_lock);
+        efx_stats_disable(efx);
        falcon_read(efx, &reg, MAC0_CTRL_REG_KER);
        EFX_SET_OWORD_FIELD(reg, TXFIFO_DRAIN_EN_B0, 1);
@@ -1917,7 +1913,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
                udelay(10);
        }
-        spin_unlock(&efx->stats_lock);
+        efx_stats_enable(efx);
        /* If we've reset the EM block and the link is up, then
         * we'll have to kick the XAUI link so the PHY can recover */
@@ -2277,6 +2273,10 @@ int falcon_switch_mac(struct efx_nic *efx)
        struct efx_mac_operations *old_mac_op = efx->mac_op;
        efx_oword_t nic_stat;
        unsigned strap_val;
+        int rc = 0;
+        /* Don't try to fetch MAC stats while we're switching MACs */
+        efx_stats_disable(efx);
        /* Internal loopbacks override the phy speed setting */
        if (efx->loopback_mode == LOOPBACK_GMAC) {
@@ -2287,16 +2287,12 @@ int falcon_switch_mac(struct efx_nic *efx)
                efx->link_fd = true;
        }
+        WARN_ON(!mutex_is_locked(&efx->mac_lock));
        efx->mac_op = (EFX_IS10G(efx) ?
                       &falcon_xmac_operations : &falcon_gmac_operations);
-        if (old_mac_op == efx->mac_op)
-                return 0;
-        WARN_ON(!mutex_is_locked(&efx->mac_lock));
-        /* Not all macs support a mac-level link state */
-        efx->mac_up = true;
+        /* Always push the NIC_STAT_REG setting even if the mac hasn't
+         * changed, because this function is run post online reset */
        falcon_read(efx, &nic_stat, NIC_STAT_REG);
        strap_val = EFX_IS10G(efx) ? 5 : 3;
        if (falcon_rev(efx) >= FALCON_REV_B0) {
@@ -2309,9 +2305,17 @@ int falcon_switch_mac(struct efx_nic *efx)
                BUG_ON(EFX_OWORD_FIELD(nic_stat, STRAP_PINS) != strap_val);
        }
+        if (old_mac_op == efx->mac_op)
+                goto out;
        EFX_LOG(efx, "selected %cMAC\n", EFX_IS10G(efx) ? 'X' : 'G');
-        return falcon_reset_macs(efx);
+        /* Not all macs support a mac-level link state */
+        efx->mac_up = true;
+        rc = falcon_reset_macs(efx);
+out:
+        efx_stats_enable(efx);
+        return rc;
 }
 /* This call is responsible for hooking in the MAC and PHY operations */
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index f6a16428113d..f9e2f95c3b48 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -15,6 +15,7 @@
 #include "net_driver.h"
 #include "mdio_10g.h"
 #include "boards.h"
+#include "workarounds.h"
 int mdio_clause45_reset_mmd(struct efx_nic *port, int mmd,
                            int spins, int spintime)
@@ -179,17 +180,12 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                return false;
        else if (efx_phy_mode_disabled(efx->phy_mode))
                return false;
-        else if (efx->loopback_mode == LOOPBACK_PHYXS) {
+        else if (efx->loopback_mode == LOOPBACK_PHYXS)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PHYXS |
                              MDIO_MMDREG_DEVS_PCS |
                              MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
-                if (!mmd_mask) {
+        else if (efx->loopback_mode == LOOPBACK_PCS)
-                        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
-                                                 MDIO_PHYXS_STATUS2);
-                        return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
-                }
-        } else if (efx->loopback_mode == LOOPBACK_PCS)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PCS |
                              MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
@@ -197,6 +193,13 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                mmd_mask &= ~(MDIO_MMDREG_DEVS_PMAPMD |
                              MDIO_MMDREG_DEVS_AN);
+        if (!mmd_mask) {
+                /* Use presence of XGMII faults in leui of link state */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
+                                         MDIO_PHYXS_STATUS2);
+                return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
+        }
        while (mmd_mask) {
                if (mmd_mask & 1) {
                        /* Double reads because link state is latched, and a
@@ -263,7 +266,7 @@ void mdio_clause45_set_mmds_lpower(struct efx_nic *efx,
        }
 }
-static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
+static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr)
 {
        int phy_id = efx->mii.phy_id;
        u32 result = 0;
@@ -278,9 +281,6 @@ static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
                result |= ADVERTISED_100baseT_Half;
        if (reg & ADVERTISE_100FULL)
                result |= ADVERTISED_100baseT_Full;
-        if (reg & LPA_RESV)
-                result |= xnp;
        return result;
 }
@@ -310,7 +310,7 @@ void mdio_clause45_get_settings(struct efx_nic *efx,
 */
 void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                                    struct ethtool_cmd *ecmd,
-                                    u32 xnp, u32 xnp_lpa)
+                                    u32 npage_adv, u32 npage_lpa)
 {
        int phy_id = efx->mii.phy_id;
        int reg;
@@ -361,8 +361,8 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                        ecmd->autoneg = AUTONEG_ENABLE;
                        ecmd->advertising |=
                                ADVERTISED_Autoneg |
-                                mdio_clause45_get_an(efx,
+                                mdio_clause45_get_an(efx, MDIO_AN_ADVERTISE) |
-                                                     MDIO_AN_ADVERTISE, xnp);
+                                npage_adv;
                } else
                        ecmd->autoneg = AUTONEG_DISABLE;
        } else
@@ -371,27 +371,30 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
        if (ecmd->autoneg) {
                /* If AN is complete, report best common mode,
                 * otherwise report best advertised mode. */
-                u32 common = ecmd->advertising;
+                u32 modes = 0;
                if (mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                       MDIO_MMDREG_STAT1) &
-                    (1 << MDIO_AN_STATUS_AN_DONE_LBN)) {
+                    (1 << MDIO_AN_STATUS_AN_DONE_LBN))
-                        common &= mdio_clause45_get_an(efx, MDIO_AN_LPA,
+                        modes = (ecmd->advertising &
-                                                       xnp_lpa);
+                                 (mdio_clause45_get_an(efx, MDIO_AN_LPA) |
-                }
+                                  npage_lpa));
-                if (common & ADVERTISED_10000baseT_Full) {
+                if (modes == 0)
+                        modes = ecmd->advertising;
+                if (modes & ADVERTISED_10000baseT_Full) {
                        ecmd->speed = SPEED_10000;
                        ecmd->duplex = DUPLEX_FULL;
-                } else if (common & (ADVERTISED_1000baseT_Full |
+                } else if (modes & (ADVERTISED_1000baseT_Full |
-                                     ADVERTISED_1000baseT_Half)) {
+                                    ADVERTISED_1000baseT_Half)) {
                        ecmd->speed = SPEED_1000;
-                        ecmd->duplex = !!(common & ADVERTISED_1000baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_1000baseT_Full);
-                } else if (common & (ADVERTISED_100baseT_Full |
+                } else if (modes & (ADVERTISED_100baseT_Full |
-                                     ADVERTISED_100baseT_Half)) {
+                                    ADVERTISED_100baseT_Half)) {
                        ecmd->speed = SPEED_100;
-                        ecmd->duplex = !!(common & ADVERTISED_100baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_100baseT_Full);
                } else {
                        ecmd->speed = SPEED_10;
-                        ecmd->duplex = !!(common & ADVERTISED_10baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_10baseT_Full);
                }
        } else {
                /* Report forced settings */
@@ -415,7 +418,7 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
        int phy_id = efx->mii.phy_id;
        struct ethtool_cmd prev;
        u32 required;
-        int ctrl1_bits, reg;
+        int reg;
        efx->phy_op->get_settings(efx, &prev);
@@ -430,99 +433,83 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
        if (prev.port != PORT_TP || ecmd->port != PORT_TP)
                return -EINVAL;
-        /* Check that PHY supports these settings and work out the
+        /* Check that PHY supports these settings */
-         * basic control bits */
+        if (ecmd->autoneg) {
-        if (ecmd->duplex) {
+                required = SUPPORTED_Autoneg;
+        } else if (ecmd->duplex) {
                switch (ecmd->speed) {
-                case SPEED_10:
+                case SPEED_10:  required = SUPPORTED_10baseT_Full;  break;
-                        ctrl1_bits = BMCR_FULLDPLX;
+                case SPEED_100: required = SUPPORTED_100baseT_Full; break;
-                        required = SUPPORTED_10baseT_Full;
+                default:        return -EINVAL;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100 | BMCR_FULLDPLX;
-                        required = SUPPORTED_100baseT_Full;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000 | BMCR_FULLDPLX;
-                        required = SUPPORTED_1000baseT_Full;
-                        break;
-                case SPEED_10000:
-                        ctrl1_bits = (BMCR_SPEED1000 | BMCR_SPEED100 |
-                                      BMCR_FULLDPLX);
-                        required = SUPPORTED_10000baseT_Full;
-                        break;
-                default:
-                        return -EINVAL;
                }
        } else {
                switch (ecmd->speed) {
-                case SPEED_10:
+                case SPEED_10:  required = SUPPORTED_10baseT_Half;  break;
-                        ctrl1_bits = 0;
+                case SPEED_100: required = SUPPORTED_100baseT_Half; break;
-                        required = SUPPORTED_10baseT_Half;
+                default:        return -EINVAL;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100;
-                        required = SUPPORTED_100baseT_Half;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000;
-                        required = SUPPORTED_1000baseT_Half;
-                        break;
-                default:
-                        return -EINVAL;
                }
        }
-        if (ecmd->autoneg)
-                required |= SUPPORTED_Autoneg;
        required |= ecmd->advertising;
        if (required & ~prev.supported)
                return -EINVAL;
-        /* Set the basic control bits */
+        if (ecmd->autoneg) {
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
+                bool xnp = (ecmd->advertising & ADVERTISED_10000baseT_Full
-                                 MDIO_MMDREG_CTRL1);
+                            || EFX_WORKAROUND_13204(efx));
-        reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX | 0x003c);
-        reg |= ctrl1_bits;
+                /* Set up the base page */
-        mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD, MDIO_MMDREG_CTRL1,
+                reg = ADVERTISE_CSMA;
-                            reg);
+                if (ecmd->advertising & ADVERTISED_10baseT_Half)
+                        reg |= ADVERTISE_10HALF;
-        /* Set the AN registers */
+                if (ecmd->advertising & ADVERTISED_10baseT_Full)
-        if (ecmd->autoneg != prev.autoneg ||
+                        reg |= ADVERTISE_10FULL;
-            ecmd->advertising != prev.advertising) {
+                if (ecmd->advertising & ADVERTISED_100baseT_Half)
-                bool xnp = false;
+                        reg |= ADVERTISE_100HALF;
+                if (ecmd->advertising & ADVERTISED_100baseT_Full)
-                if (efx->phy_op->set_xnp_advertise)
+                        reg |= ADVERTISE_100FULL;
-                        xnp = efx->phy_op->set_xnp_advertise(efx,
+                if (xnp)
-                                                             ecmd->advertising);
+                        reg |= ADVERTISE_RESV;
+                else if (ecmd->advertising & (ADVERTISED_1000baseT_Half |
-                if (ecmd->autoneg) {
+                                              ADVERTISED_1000baseT_Full))
-                        reg = 0;
+                        reg |= ADVERTISE_NPAGE;
-                        if (ecmd->advertising & ADVERTISED_10baseT_Half)
+                reg |= efx_fc_advertise(efx->wanted_fc);
-                                reg |= ADVERTISE_10HALF;
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
-                        if (ecmd->advertising & ADVERTISED_10baseT_Full)
+                                    MDIO_AN_ADVERTISE, reg);
-                                reg |= ADVERTISE_10FULL;
-                        if (ecmd->advertising & ADVERTISED_100baseT_Half)
+                /* Set up the (extended) next page if necessary */
-                                reg |= ADVERTISE_100HALF;
+                if (efx->phy_op->set_npage_adv)
-                        if (ecmd->advertising & ADVERTISED_100baseT_Full)
+                        efx->phy_op->set_npage_adv(efx, ecmd->advertising);
-                                reg |= ADVERTISE_100FULL;
-                        if (xnp)
-                                reg |= ADVERTISE_RESV;
-                        mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
-                                            MDIO_AN_ADVERTISE, reg);
-                }
+                /* Enable and restart AN */
                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                         MDIO_MMDREG_CTRL1);
-                if (ecmd->autoneg)
+                reg |= BMCR_ANENABLE;
-                        reg |= BMCR_ANENABLE | BMCR_ANRESTART;
+                if (!(EFX_WORKAROUND_15195(efx) &&
-                else
+                      LOOPBACK_MASK(efx) & efx->phy_op->loopbacks))
-                        reg &= ~BMCR_ANENABLE;
+                        reg |= BMCR_ANRESTART;
                if (xnp)
                        reg |= 1 << MDIO_AN_CTRL_XNP_LBN;
                else
                        reg &= ~(1 << MDIO_AN_CTRL_XNP_LBN);
                mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
                                    MDIO_MMDREG_CTRL1, reg);
+        } else {
+                /* Disable AN */
+                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
+                                       MDIO_MMDREG_CTRL1,
+                                       __ffs(BMCR_ANENABLE), false);
+                /* Set the basic control bits */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
+                                         MDIO_MMDREG_CTRL1);
+                reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX |
+                         0x003c);
+                if (ecmd->speed == SPEED_100)
+                        reg |= BMCR_SPEED100;
+                if (ecmd->duplex)
+                        reg |= BMCR_FULLDPLX;
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
+                                    MDIO_MMDREG_CTRL1, reg);
        }
        return 0;
diff --git a/drivers/net/sfc/mdio_10g.h b/drivers/net/sfc/mdio_10g.h
index 09bf801d0569..8ba49773ce7e 100644
--- a/drivers/net/sfc/mdio_10g.h
+++ b/drivers/net/sfc/mdio_10g.h
@@ -155,7 +155,8 @@
 #define MDIO_AN_XNP                     22
 #define MDIO_AN_LPA_XNP                 25
-#define MDIO_AN_10GBT_ADVERTISE         32
+#define MDIO_AN_10GBT_CTRL              32
+#define MDIO_AN_10GBT_CTRL_ADV_10G_LBN  12
 #define MDIO_AN_10GBT_STATUS            (33)
 #define MDIO_AN_10GBT_STATUS_MS_FLT_LBN (15) /* MASTER/SLAVE config fault */
 #define MDIO_AN_10GBT_STATUS_MS_LBN     (14) /* MASTER/SLAVE config */
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 5f255f75754e..e019ad1fb9a0 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -566,7 +566,7 @@ struct efx_mac_operations {
 * @poll: Poll for hardware state. Serialised by the mac_lock.
 * @get_settings: Get ethtool settings. Serialised by the mac_lock.
 * @set_settings: Set ethtool settings. Serialised by the mac_lock.
- * @set_xnp_advertise: Set abilities advertised in Extended Next Page
+ * @set_npage_adv: Set abilities advertised in (Extended) Next Page
 *      (only needed where AN bit is set in mmds)
 * @num_tests: Number of PHY-specific tests/results
 * @test_names: Names of the tests/results
@@ -586,7 +586,7 @@ struct efx_phy_operations {
                              struct ethtool_cmd *ecmd);
        int (*set_settings) (struct efx_nic *efx,
                             struct ethtool_cmd *ecmd);
-        bool (*set_xnp_advertise) (struct efx_nic *efx, u32);
+        void (*set_npage_adv) (struct efx_nic *efx, u32);
        u32 num_tests;
        const char *const *test_names;
        int (*run_tests) (struct efx_nic *efx, int *results, unsigned flags);
@@ -754,8 +754,7 @@ union efx_multicast_hash {
 *      &struct net_device_stats.
 * @stats_buffer: DMA buffer for statistics
 * @stats_lock: Statistics update lock. Serialises statistics fetches
- * @stats_enabled: Temporarily disable statistics fetches.
+ * @stats_disable_count: Nest count for disabling statistics fetches
- *      Serialised by @stats_lock
 * @mac_op: MAC interface
 * @mac_address: Permanent MAC address
 * @phy_type: PHY type
@@ -837,7 +836,7 @@ struct efx_nic {
        struct efx_mac_stats mac_stats;
        struct efx_buffer stats_buffer;
        spinlock_t stats_lock;
-        bool stats_enabled;
+        unsigned int stats_disable_count;
        struct efx_mac_operations *mac_op;
        unsigned char mac_address[ETH_ALEN];
diff --git a/drivers/net/sfc/phy.h b/drivers/net/sfc/phy.h
index 58c493ef81bb..07e855c148bc 100644
--- a/drivers/net/sfc/phy.h
+++ b/drivers/net/sfc/phy.h
@@ -17,7 +17,6 @@ extern struct efx_phy_operations falcon_sfx7101_phy_ops;
 extern struct efx_phy_operations falcon_sft9001_phy_ops;
 extern void tenxpress_phy_blink(struct efx_nic *efx, bool blink);
-extern void tenxpress_crc_err(struct efx_nic *efx);
 /****************************************************************************
 * Exported functions from the driver for XFP optical PHYs
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index dba0d64d50cd..0a598084c513 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -665,6 +665,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
 {
        enum efx_loopback_mode loopback_mode = efx->loopback_mode;
        int phy_mode = efx->phy_mode;
+        enum reset_type reset_method = RESET_TYPE_INVISIBLE;
        struct ethtool_cmd ecmd;
        struct efx_channel *channel;
        int rc_test = 0, rc_reset = 0, rc;
@@ -718,21 +719,21 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
        mutex_unlock(&efx->mac_lock);
        /* free up all consumers of SRAM (including all the queues) */
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, reset_method, &ecmd);
        rc = efx_test_chip(efx, tests);
        if (rc && !rc_test)
                rc_test = rc;
        /* reset the chip to recover from the register test */
-        rc_reset = falcon_reset_hw(efx, RESET_TYPE_ALL);
+        rc_reset = falcon_reset_hw(efx, reset_method);
        /* Ensure that the phy is powered and out of loopback
         * for the bist and loopback tests */
        efx->phy_mode &= ~PHY_MODE_LOW_POWER;
        efx->loopback_mode = LOOPBACK_NONE;
-        rc = efx_reset_up(efx, &ecmd, rc_reset == 0);
+        rc = efx_reset_up(efx, reset_method, &ecmd, rc_reset == 0);
        if (rc && !rc_reset)
                rc_reset = rc;
diff --git a/drivers/net/sfc/sfe4001.c b/drivers/net/sfc/sfe4001.c
index 16b80acb9992..cb25ae5b257a 100644
--- a/drivers/net/sfc/sfe4001.c
+++ b/drivers/net/sfc/sfe4001.c
@@ -186,19 +186,22 @@ static int sfn4111t_reset(struct efx_nic *efx)
 {
        efx_oword_t reg;
-        /* GPIO pins are also used for I2C, so block that temporarily */
+        /* GPIO 3 and the GPIO register are shared with I2C, so block that */
        mutex_lock(&efx->i2c_adap.bus_lock);
+        /* Pull RST_N (GPIO 2) low then let it up again, setting the
+         * FLASH_CFG_1 strap (GPIO 3) appropriately.  Only change the
+         * output enables; the output levels should always be 0 (low)
+         * and we rely on external pull-ups. */
        falcon_read(efx, &reg, GPIO_CTL_REG_KER);
        EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, true);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, false);
        falcon_write(efx, &reg, GPIO_CTL_REG_KER);
        msleep(1000);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, true);
+        EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, false);
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN, true);
+        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN,
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OUT,
+                            !!(efx->phy_mode & PHY_MODE_SPECIAL));
-                            !(efx->phy_mode & PHY_MODE_SPECIAL));
        falcon_write(efx, &reg, GPIO_CTL_REG_KER);
+        msleep(1);
        mutex_unlock(&efx->i2c_adap.bus_lock);
@@ -232,12 +235,18 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
        } else if (efx->state != STATE_RUNNING || netif_running(efx->net_dev)) {
                err = -EBUSY;
        } else {
+                /* Reset the PHY, reconfigure the MAC and enable/disable
+                 * MAC stats accordingly. */
                efx->phy_mode = new_mode;
+                if (new_mode & PHY_MODE_SPECIAL)
+                        efx_stats_disable(efx);
                if (efx->board_info.type == EFX_BOARD_SFE4001)
                        err = sfe4001_poweron(efx);
                else
                        err = sfn4111t_reset(efx);
                efx_reconfigure_port(efx);
+                if (!(new_mode & PHY_MODE_SPECIAL))
+                        efx_stats_enable(efx);
        }
        rtnl_unlock();
@@ -326,6 +335,11 @@ int sfe4001_init(struct efx_nic *efx)
        efx->board_info.monitor = sfe4001_check_hw;
        efx->board_info.fini = sfe4001_fini;
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                /* PHY won't generate a 156.25 MHz clock and MAC stats fetch
+                 * will fail. */
+                efx_stats_disable(efx);
+        }
        rc = sfe4001_poweron(efx);
        if (rc)
                goto fail_ioexp;
@@ -372,17 +386,25 @@ static void sfn4111t_fini(struct efx_nic *efx)
        i2c_unregister_device(efx->board_info.hwmon_client);
 }
-static struct i2c_board_info sfn4111t_hwmon_info = {
+static struct i2c_board_info sfn4111t_a0_hwmon_info = {
        I2C_BOARD_INFO("max6647", 0x4e),
        .irq            = -1,
 };
+static struct i2c_board_info sfn4111t_r5_hwmon_info = {
+        I2C_BOARD_INFO("max6646", 0x4d),
+        .irq            = -1,
+};
 int sfn4111t_init(struct efx_nic *efx)
 {
        int rc;
        efx->board_info.hwmon_client =
-                i2c_new_device(&efx->i2c_adap, &sfn4111t_hwmon_info);
+                i2c_new_device(&efx->i2c_adap,
+                               (efx->board_info.minor < 5) ?
+                               &sfn4111t_a0_hwmon_info :
+                               &sfn4111t_r5_hwmon_info);
        if (!efx->board_info.hwmon_client)
                return -EIO;
@@ -394,8 +416,10 @@ int sfn4111t_init(struct efx_nic *efx)
        if (rc)
                goto fail_hwmon;
-        if (efx->phy_mode & PHY_MODE_SPECIAL)
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                efx_stats_disable(efx);
                sfn4111t_reset(efx);
+        }
        return 0;
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 9ecb77da9545..f0efd246962c 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -67,6 +67,8 @@
 #define PMA_PMD_EXT_CLK312_WIDTH 1
 #define PMA_PMD_EXT_LPOWER_LBN  12
 #define PMA_PMD_EXT_LPOWER_WIDTH 1
+#define PMA_PMD_EXT_ROBUST_LBN  14
+#define PMA_PMD_EXT_ROBUST_WIDTH 1
 #define PMA_PMD_EXT_SSR_LBN     15
 #define PMA_PMD_EXT_SSR_WIDTH   1
@@ -177,35 +179,24 @@
 #define C22EXT_STATUS_LINK_LBN  2
 #define C22EXT_STATUS_LINK_WIDTH 1
-#define C22EXT_MSTSLV_REG       49162
+#define C22EXT_MSTSLV_CTRL                      49161
-#define C22EXT_MSTSLV_1000_HD_LBN 10
+#define C22EXT_MSTSLV_CTRL_ADV_1000_HD_LBN      8
-#define C22EXT_MSTSLV_1000_HD_WIDTH 1
+#define C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN      9
-#define C22EXT_MSTSLV_1000_FD_LBN 11
-#define C22EXT_MSTSLV_1000_FD_WIDTH 1
+#define C22EXT_MSTSLV_STATUS                    49162
+#define C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN     10
+#define C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN     11
 /* Time to wait between powering down the LNPGA and turning off the power
 * rails */
 #define LNPGA_PDOWN_WAIT        (HZ / 5)
-static int crc_error_reset_threshold = 100;
-module_param(crc_error_reset_threshold, int, 0644);
-MODULE_PARM_DESC(crc_error_reset_threshold,
-                 "Max number of CRC errors before XAUI reset");
 struct tenxpress_phy_data {
        enum efx_loopback_mode loopback_mode;
-        atomic_t bad_crc_count;
        enum efx_phy_mode phy_mode;
        int bad_lp_tries;
 };
-void tenxpress_crc_err(struct efx_nic *efx)
-{
-        struct tenxpress_phy_data *phy_data = efx->phy_data;
-        if (phy_data != NULL)
-                atomic_inc(&phy_data->bad_crc_count);
-}
 static ssize_t show_phy_short_reach(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
@@ -284,7 +275,9 @@ static int tenxpress_init(struct efx_nic *efx)
                                         PMA_PMD_XCONTROL_REG);
                reg |= ((1 << PMA_PMD_EXT_GMII_EN_LBN) |
                        (1 << PMA_PMD_EXT_CLK_OUT_LBN) |
-                        (1 << PMA_PMD_EXT_CLK312_LBN));
+                        (1 << PMA_PMD_EXT_CLK312_LBN) |
+                        (1 << PMA_PMD_EXT_ROBUST_LBN));
                mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
                                    PMA_PMD_XCONTROL_REG, reg);
                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
@@ -346,6 +339,7 @@ static int tenxpress_phy_init(struct efx_nic *efx)
        rc = tenxpress_init(efx);
        if (rc < 0)
                goto fail;
+        mdio_clause45_set_pause(efx);
        if (efx->phy_type == PHY_TYPE_SFT9001B) {
                rc = device_create_file(&efx->pci_dev->dev,
@@ -376,8 +370,8 @@ static int tenxpress_special_reset(struct efx_nic *efx)
        /* The XGMAC clock is driven from the SFC7101/SFT9001 312MHz clock, so
         * a special software reset can glitch the XGMAC sufficiently for stats
-         * requests to fail. Since we don't often special_reset, just lock. */
+         * requests to fail. */
-        spin_lock(&efx->stats_lock);
+        efx_stats_disable(efx);
        /* Initiate reset */
        reg = mdio_clause45_read(efx, efx->mii.phy_id,
@@ -392,17 +386,17 @@ static int tenxpress_special_reset(struct efx_nic *efx)
        rc = mdio_clause45_wait_reset_mmds(efx,
                                           TENXPRESS_REQUIRED_DEVS);
        if (rc < 0)
-                goto unlock;
+                goto out;
        /* Try and reconfigure the device */
        rc = tenxpress_init(efx);
        if (rc < 0)
-                goto unlock;
+                goto out;
        /* Wait for the XGXS state machine to churn */
        mdelay(10);
-unlock:
+out:
-        spin_unlock(&efx->stats_lock);
+        efx_stats_enable(efx);
        return rc;
 }
@@ -520,7 +514,7 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
 {
        struct tenxpress_phy_data *phy_data = efx->phy_data;
        struct ethtool_cmd ecmd;
-        bool phy_mode_change, loop_reset, loop_toggle, loopback;
+        bool phy_mode_change, loop_reset;
        if (efx->phy_mode & (PHY_MODE_OFF | PHY_MODE_SPECIAL)) {
                phy_data->phy_mode = efx->phy_mode;
@@ -531,12 +525,10 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
        phy_mode_change = (efx->phy_mode == PHY_MODE_NORMAL &&
                           phy_data->phy_mode != PHY_MODE_NORMAL);
-        loopback = LOOPBACK_MASK(efx) & efx->phy_op->loopbacks;
-        loop_toggle = LOOPBACK_CHANGED(phy_data, efx, efx->phy_op->loopbacks);
        loop_reset = (LOOPBACK_OUT_OF(phy_data, efx, efx->phy_op->loopbacks) ||
                      LOOPBACK_CHANGED(phy_data, efx, 1 << LOOPBACK_GPHY));
-        if (loop_reset || loop_toggle || loopback || phy_mode_change) {
+        if (loop_reset || phy_mode_change) {
                int rc;
                efx->phy_op->get_settings(efx, &ecmd);
@@ -551,20 +543,6 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
                                falcon_reset_xaui(efx);
                }
-                if (efx->phy_type != PHY_TYPE_SFX7101) {
-                        /* Only change autoneg once, on coming out or
-                         * going into loopback */
-                        if (loop_toggle)
-                                ecmd.autoneg = !loopback;
-                        if (loopback) {
-                                ecmd.duplex = DUPLEX_FULL;
-                                if (efx->loopback_mode == LOOPBACK_GPHY)
-                                        ecmd.speed = SPEED_1000;
-                                else
-                                        ecmd.speed = SPEED_10000;
-                        }
-                }
                rc = efx->phy_op->set_settings(efx, &ecmd);
                WARN_ON(rc);
        }
@@ -623,13 +601,6 @@ static void tenxpress_phy_poll(struct efx_nic *efx)
        if (phy_data->phy_mode != PHY_MODE_NORMAL)
                return;
-        if (EFX_WORKAROUND_10750(efx) &&
-            atomic_read(&phy_data->bad_crc_count) > crc_error_reset_threshold) {
-                EFX_ERR(efx, "Resetting XAUI due to too many CRC errors\n");
-                falcon_reset_xaui(efx);
-                atomic_set(&phy_data->bad_crc_count, 0);
-        }
 }
 static void tenxpress_phy_fini(struct efx_nic *efx)
@@ -772,107 +743,76 @@ reset:
        return rc;
 }
-static u32 tenxpress_get_xnp_lpa(struct efx_nic *efx)
+static void
+tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy = efx->mii.phy_id;
+        int phy_id = efx->mii.phy_id;
-        u32 lpa = 0;
+        u32 adv = 0, lpa = 0;
        int reg;
        if (efx->phy_type != PHY_TYPE_SFX7101) {
-                reg = mdio_clause45_read(efx, phy, MDIO_MMD_C22EXT,
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
-                                         C22EXT_MSTSLV_REG);
+                                         C22EXT_MSTSLV_CTRL);
-                if (reg & (1 << C22EXT_MSTSLV_1000_HD_LBN))
+                if (reg & (1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN))
+                        adv |= ADVERTISED_1000baseT_Full;
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
+                                         C22EXT_MSTSLV_STATUS);
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN))
                        lpa |= ADVERTISED_1000baseT_Half;
-                if (reg & (1 << C22EXT_MSTSLV_1000_FD_LBN))
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN))
                        lpa |= ADVERTISED_1000baseT_Full;
        }
-        reg = mdio_clause45_read(efx, phy, MDIO_MMD_AN, MDIO_AN_10GBT_STATUS);
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_CTRL);
+        if (reg & (1 << MDIO_AN_10GBT_CTRL_ADV_10G_LBN))
+                adv |= ADVERTISED_10000baseT_Full;
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_STATUS);
        if (reg & (1 << MDIO_AN_10GBT_STATUS_LP_10G_LBN))
                lpa |= ADVERTISED_10000baseT_Full;
-        return lpa;
-}
-static void sfx7101_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+        mdio_clause45_get_settings_ext(efx, ecmd, adv, lpa);
-{
-        mdio_clause45_get_settings_ext(efx, ecmd, ADVERTISED_10000baseT_Full,
+        if (efx->phy_type != PHY_TYPE_SFX7101)
-                                       tenxpress_get_xnp_lpa(efx));
+                ecmd->supported |= (SUPPORTED_100baseT_Full |
-        ecmd->supported |= SUPPORTED_10000baseT_Full;
+                                    SUPPORTED_1000baseT_Full);
-        ecmd->advertising |= ADVERTISED_10000baseT_Full;
+        /* In loopback, the PHY automatically brings up the correct interface,
+         * but doesn't advertise the correct speed. So override it */
+        if (efx->loopback_mode == LOOPBACK_GPHY)
+                ecmd->speed = SPEED_1000;
+        else if (LOOPBACK_MASK(efx) & efx->phy_op->loopbacks)
+                ecmd->speed = SPEED_10000;
 }
-static void sft9001_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static int tenxpress_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy_id = efx->mii.phy_id;
+        if (!ecmd->autoneg)
-        u32 xnp_adv = 0;
+                return -EINVAL;
-        int reg;
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
-                                 PMA_PMD_SPEED_ENABLE_REG);
-        if (EFX_WORKAROUND_13204(efx) && (reg & (1 << PMA_PMD_100TX_ADV_LBN)))
-                xnp_adv |= ADVERTISED_100baseT_Full;
-        if (reg & (1 << PMA_PMD_1000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_1000baseT_Full;
-        if (reg & (1 << PMA_PMD_10000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_10000baseT_Full;
-        mdio_clause45_get_settings_ext(efx, ecmd, xnp_adv,
-                                       tenxpress_get_xnp_lpa(efx));
-        ecmd->supported |= (SUPPORTED_100baseT_Half |
-                            SUPPORTED_100baseT_Full |
-                            SUPPORTED_1000baseT_Full);
-        /* Use the vendor defined C22ext register for duplex settings */
+        return mdio_clause45_set_settings(efx, ecmd);
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg) {
-                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
-                                         GPHY_XCONTROL_REG);
-                ecmd->duplex = (reg & (1 << GPHY_DUPLEX_LBN) ?
-                                DUPLEX_FULL : DUPLEX_HALF);
-        }
 }
-static int sft9001_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static void sfx7101_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy_id = efx->mii.phy_id;
+        mdio_clause45_set_flag(efx, efx->mii.phy_id, MDIO_MMD_AN,
-        int rc;
+                               MDIO_AN_10GBT_CTRL,
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
-        rc = mdio_clause45_set_settings(efx, ecmd);
+                               advertising & ADVERTISED_10000baseT_Full);
-        if (rc)
-                return rc;
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg)
-                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
-                                       GPHY_XCONTROL_REG, GPHY_DUPLEX_LBN,
-                                       ecmd->duplex == DUPLEX_FULL);
-        return rc;
 }
-static bool sft9001_set_xnp_advertise(struct efx_nic *efx, u32 advertising)
+static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy = efx->mii.phy_id;
+        int phy_id = efx->mii.phy_id;
-        int reg = mdio_clause45_read(efx, phy, MDIO_MMD_PMAPMD,
-                                     PMA_PMD_SPEED_ENABLE_REG);
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
-        bool enabled;
+                               C22EXT_MSTSLV_CTRL,
+                               C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN,
-        reg &= ~((1 << 2) | (1 << 3));
+                               advertising & ADVERTISED_1000baseT_Full);
-        if (EFX_WORKAROUND_13204(efx) &&
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
-            (advertising & ADVERTISED_100baseT_Full))
+                               MDIO_AN_10GBT_CTRL,
-                reg |= 1 << PMA_PMD_100TX_ADV_LBN;
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
-        if (advertising & ADVERTISED_1000baseT_Full)
+                               advertising & ADVERTISED_10000baseT_Full);
-                reg |= 1 << PMA_PMD_1000T_ADV_LBN;
-        if (advertising & ADVERTISED_10000baseT_Full)
-                reg |= 1 << PMA_PMD_10000T_ADV_LBN;
-        mdio_clause45_write(efx, phy, MDIO_MMD_PMAPMD,
-                            PMA_PMD_SPEED_ENABLE_REG, reg);
-        enabled = (advertising &
-                   (ADVERTISED_1000baseT_Half |
-                    ADVERTISED_1000baseT_Full |
-                    ADVERTISED_10000baseT_Full));
-        if (EFX_WORKAROUND_13204(efx))
-                enabled |= (advertising & ADVERTISED_100baseT_Full);
-        return enabled;
 }
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
@@ -882,8 +822,9 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
        .poll             = tenxpress_phy_poll,
        .fini             = tenxpress_phy_fini,
        .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sfx7101_get_settings,
+        .get_settings     = tenxpress_get_settings,
-        .set_settings     = mdio_clause45_set_settings,
+        .set_settings     = tenxpress_set_settings,
+        .set_npage_adv    = sfx7101_set_npage_adv,
        .num_tests        = ARRAY_SIZE(sfx7101_test_names),
        .test_names       = sfx7101_test_names,
        .run_tests        = sfx7101_run_tests,
@@ -898,9 +839,9 @@ struct efx_phy_operations falcon_sft9001_phy_ops = {
        .poll             = tenxpress_phy_poll,
        .fini             = tenxpress_phy_fini,
        .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sft9001_get_settings,
+        .get_settings     = tenxpress_get_settings,
-        .set_settings     = sft9001_set_settings,
+        .set_settings     = tenxpress_set_settings,
-        .set_xnp_advertise = sft9001_set_xnp_advertise,
+        .set_npage_adv    = sft9001_set_npage_adv,
        .num_tests        = ARRAY_SIZE(sft9001_test_names),
        .test_names       = sft9001_test_names,
        .run_tests        = sft9001_run_tests,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 82e03e1d7371..78de68f4a95b 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -18,8 +18,8 @@
 #define EFX_WORKAROUND_ALWAYS(efx) 1
 #define EFX_WORKAROUND_FALCON_A(efx) (falcon_rev(efx) <= FALCON_REV_A1)
 #define EFX_WORKAROUND_10G(efx) EFX_IS10G(efx)
-#define EFX_WORKAROUND_SFX7101(efx) ((efx)->phy_type == PHY_TYPE_SFX7101)
+#define EFX_WORKAROUND_SFT9001(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A || \
-#define EFX_WORKAROUND_SFT9001A(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A)
+                                     (efx)->phy_type == PHY_TYPE_SFT9001B)
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
@@ -29,8 +29,6 @@
 #define EFX_WORKAROUND_7884 EFX_WORKAROUND_10G
 /* TX pkt parser problem with <= 16 byte TXes */
 #define EFX_WORKAROUND_9141 EFX_WORKAROUND_ALWAYS
-/* Low rate CRC errors require XAUI reset */
-#define EFX_WORKAROUND_10750 EFX_WORKAROUND_SFX7101
 /* TX_EV_PKT_ERR can be caused by a dangling TX descriptor
 * or a PCIe error (bug 11028) */
 #define EFX_WORKAROUND_10727 EFX_WORKAROUND_ALWAYS
@@ -55,8 +53,8 @@
 #define EFX_WORKAROUND_8071 EFX_WORKAROUND_FALCON_A
 /* Need to send XNP pages for 100BaseT */
-#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001A
+#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001
-/* Need to keep AN enabled */
+/* Don't restart AN in near-side loopback */
-#define EFX_WORKAROUND_13963 EFX_WORKAROUND_SFT9001A
+#define EFX_WORKAROUND_15195 EFX_WORKAROUND_SFT9001
 #endif /* EFX_WORKAROUNDS_H */
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 607efeaf0bc5..9a00e5566af7 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -1003,9 +1003,9 @@ static int skfp_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                break;
        case SKFP_CLR_STATS:    /* Zero out the driver statistics */
                if (!capable(CAP_NET_ADMIN)) {
-                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
-                } else {
                        status = -EPERM;
+                } else {
+                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
                }
                break;
        default:
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3668e81e474d..994703cc0db3 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1403,9 +1403,6 @@ static int sky2_up(struct net_device *dev)
        }
-        if (netif_msg_ifup(sky2))
-                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        netif_carrier_off(dev);
        /* must be power of 2 */
@@ -1484,6 +1481,9 @@ static int sky2_up(struct net_device *dev)
        sky2_write32(hw, B0_IMSK, imask);
        sky2_set_multicast(dev);
+        if (netif_msg_ifup(sky2))
+                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
        return 0;
 err_out:
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index f513bdf1c887..783c1a7b869e 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -953,7 +953,7 @@ smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
                do {
                        udelay(1);
                        val = smsc911x_reg_read(pdata, RX_DP_CTRL);
-                } while (timeout-- && (val & RX_DP_CTRL_RX_FFWD_));
+                } while (--timeout && (val & RX_DP_CTRL_RX_FFWD_));
                if (unlikely(timeout == 0))
                        SMSC_WARNING(HW, "Timed out waiting for "
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index c14a4c6452c7..d801900a5036 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -1378,6 +1378,7 @@ static int smsc9420_open(struct net_device *dev)
        /* test the IRQ connection to the ISR */
        smsc_dbg(IFUP, "Testing ISR using IRQ %d", dev->irq);
+        pd->software_irq_signal = false;
        spin_lock_irqsave(&pd->int_lock, flags);
        /* configure interrupt deassertion timer and enable interrupts */
@@ -1393,8 +1394,6 @@ static int smsc9420_open(struct net_device *dev)
        smsc9420_pci_flush_write(pd);
        timeout = 1000;
-        pd->software_irq_signal = false;
-        smp_wmb();
        while (timeout--) {
                if (pd->software_irq_signal)
                        break;
diff --git a/drivers/net/tulip/21142.c b/drivers/net/tulip/21142.c
index 1210fb3748a7..db7d5e11855d 100644
--- a/drivers/net/tulip/21142.c
+++ b/drivers/net/tulip/21142.c
@@ -9,6 +9,11 @@
        Please refer to Documentation/DocBook/tulip-user.{pdf,ps,html}
        for more information on this driver.
+        DC21143 manual "21143 PCI/CardBus 10/100Mb/s Ethernet LAN Controller
+        Hardware Reference Manual" is currently available at :
+        http://developer.intel.com/design/network/manuals/278074.htm
        Please submit bugs to http://bugzilla.kernel.org/ .
 */
@@ -32,7 +37,11 @@ void t21142_media_task(struct work_struct *work)
        int csr12 = ioread32(ioaddr + CSR12);
        int next_tick = 60*HZ;
        int new_csr6 = 0;
+        int csr14 = ioread32(ioaddr + CSR14);
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
        if (tulip_debug > 2)
                printk(KERN_INFO"%s: 21143 negotiation status %8.8x, %s.\n",
                           dev->name, csr12, medianame[dev->if_port]);
@@ -76,7 +85,7 @@ void t21142_media_task(struct work_struct *work)
                        new_csr6 = 0x83860000;
                        dev->if_port = 3;
                        iowrite32(0, ioaddr + CSR13);
-                        iowrite32(0x0003FF7F, ioaddr + CSR14);
+                        iowrite32(0x0003FFFF, ioaddr + CSR14);
                        iowrite16(8, ioaddr + CSR15);
                        iowrite32(1, ioaddr + CSR13);
                }
@@ -132,10 +141,14 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
        struct tulip_private *tp = netdev_priv(dev);
        void __iomem *ioaddr = tp->base_addr;
        int csr12 = ioread32(ioaddr + CSR12);
+        int csr14 = ioread32(ioaddr + CSR14);
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
        if (tulip_debug > 1)
                printk(KERN_INFO"%s: 21143 link status interrupt %8.8x, CSR5 %x, "
-                           "%8.8x.\n", dev->name, csr12, csr5, ioread32(ioaddr + CSR14));
+                           "%8.8x.\n", dev->name, csr12, csr5, csr14);
        /* If NWay finished and we have a negotiated partner capability. */
        if (tp->nway  &&  !tp->nwayset  &&  (csr12 & 0x7000) == 0x5000) {
@@ -143,7 +156,9 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                int negotiated = tp->sym_advertise & (csr12 >> 16);
                tp->lpar = csr12 >> 16;
                tp->nwayset = 1;
-                if (negotiated & 0x0100)                dev->if_port = 5;
+                /* If partner cannot negotiate, it is 10Mbps Half Duplex */
+                if (!(csr12 & 0x8000))          dev->if_port = 0;
+                else if (negotiated & 0x0100)   dev->if_port = 5;
                else if (negotiated & 0x0080)   dev->if_port = 3;
                else if (negotiated & 0x0040)   dev->if_port = 4;
                else if (negotiated & 0x0020)   dev->if_port = 0;
@@ -214,7 +229,7 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                        tp->timer.expires = RUN_AT(3*HZ);
                        add_timer(&tp->timer);
                } else if (dev->if_port == 5)
-                        iowrite32(ioread32(ioaddr + CSR14) & ~0x080, ioaddr + CSR14);
+                        iowrite32(csr14 & ~0x080, ioaddr + CSR14);
        } else if (dev->if_port == 0  ||  dev->if_port == 4) {
                if ((csr12 & 4) == 0)
                        printk(KERN_INFO"%s: 21143 10baseT link beat good.\n",
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 11441225bf41..e87986867ba5 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1536,6 +1536,11 @@ static void adjust_link(struct net_device *dev)
 static int init_phy(struct net_device *dev)
 {
        struct ucc_geth_private *priv = netdev_priv(dev);
+        struct device_node *np = priv->node;
+        struct device_node *phy, *mdio;
+        const phandle *ph;
+        char bus_name[MII_BUS_ID_SIZE];
+        const unsigned int *id;
        struct phy_device *phydev;
        char phy_id[BUS_ID_SIZE];
@@ -1543,8 +1548,18 @@ static int init_phy(struct net_device *dev)
        priv->oldspeed = 0;
        priv->oldduplex = -1;
-        snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, priv->ug_info->mdio_bus,
+        ph = of_get_property(np, "phy-handle", NULL);
-                 priv->ug_info->phy_address);
+        phy = of_find_node_by_phandle(*ph);
+        mdio = of_get_parent(phy);
+        id = of_get_property(phy, "reg", NULL);
+        of_node_put(phy);
+        of_node_put(mdio);
+        uec_mdio_bus_name(bus_name, mdio);
+        snprintf(phy_id, sizeof(phy_id), "%s:%02x",
+                                bus_name, *id);
        phydev = phy_connect(dev, phy_id, &adjust_link, 0, priv->phy_interface);
@@ -3748,6 +3763,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
        ugeth->ug_info = ug_info;
        ugeth->dev = dev;
+        ugeth->node = np;
        return 0;
 }
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 8f699cb773ee..16cbe42ba43c 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -1186,6 +1186,8 @@ struct ucc_geth_private {
        int oldspeed;
        int oldduplex;
        int oldlink;
+        struct device_node *node;
 };
 void uec_set_ethtool_ops(struct net_device *netdev);
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index c001d261366b..54635911305c 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -156,7 +156,7 @@ static int uec_mdio_probe(struct of_device *ofdev, const struct of_device_id *ma
        if (err)
                goto reg_map_fail;
-        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+        uec_mdio_bus_name(new_bus->id, np);
        new_bus->irq = kmalloc(32 * sizeof(int), GFP_KERNEL);
@@ -283,3 +283,13 @@ void uec_mdio_exit(void)
 {
        of_unregister_platform_driver(&uec_mdio_driver);
 }
+void uec_mdio_bus_name(char *name, struct device_node *np)
+{
+        const u32 *reg;
+        reg = of_get_property(np, "reg", NULL);
+        snprintf(name, MII_BUS_ID_SIZE, "%s@%x", np->name, reg ? *reg : 0);
+}
diff --git a/drivers/net/ucc_geth_mii.h b/drivers/net/ucc_geth_mii.h
index 1e45b2028a50..840cf80235b7 100644
--- a/drivers/net/ucc_geth_mii.h
+++ b/drivers/net/ucc_geth_mii.h
@@ -97,4 +97,5 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum);
 int uec_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value);
 int __init uec_mdio_init(void);
 void uec_mdio_exit(void);
+void uec_mdio_bus_name(char *name, struct device_node *np);
 #endif                          /* __UEC_MII_H */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 63ef2a8905fb..c68808336c8c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -287,7 +287,7 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
                skb_put(skb, MAX_PACKET_LEN);
                hdr = skb_vnet_hdr(skb);
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
                if (vi->big_packets) {
                        for (i = 0; i < MAX_SKB_FRAGS; i++) {
@@ -488,9 +488,9 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
        /* Encode metadata header at front. */
        if (vi->mergeable_rx_bufs)
-                sg_init_one(sg, mhdr, sizeof(*mhdr));
+                sg_set_buf(sg, mhdr, sizeof(*mhdr));
        else
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
        num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
diff --git a/drivers/net/wimax/i2400m/debugfs.c b/drivers/net/wimax/i2400m/debugfs.c
index 626632985977..9b81af3f80a9 100644
--- a/drivers/net/wimax/i2400m/debugfs.c
+++ b/drivers/net/wimax/i2400m/debugfs.c
@@ -234,20 +234,6 @@ struct dentry *debugfs_create_i2400m_reset(
                                   &fops_i2400m_reset);
 }
-/*
- * Debug levels control; see debug.h
- */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(control),
-        D_SUBMODULE_DEFINE(driver),
-        D_SUBMODULE_DEFINE(debugfs),
-        D_SUBMODULE_DEFINE(fw),
-        D_SUBMODULE_DEFINE(netdev),
-        D_SUBMODULE_DEFINE(rfkill),
-        D_SUBMODULE_DEFINE(rx),
-        D_SUBMODULE_DEFINE(tx),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 #define __debugfs_register(prefix, name, parent)                        \
 do {                                                                    \
diff --git a/drivers/net/wimax/i2400m/driver.c b/drivers/net/wimax/i2400m/driver.c
index 5f98047e18cf..e80a0b65a754 100644
--- a/drivers/net/wimax/i2400m/driver.c
+++ b/drivers/net/wimax/i2400m/driver.c
@@ -707,6 +707,22 @@ void i2400m_release(struct i2400m *i2400m)
 EXPORT_SYMBOL_GPL(i2400m_release);
+/*
+ * Debug levels control; see debug.h
+ */
+struct d_level D_LEVEL[] = {
+        D_SUBMODULE_DEFINE(control),
+        D_SUBMODULE_DEFINE(driver),
+        D_SUBMODULE_DEFINE(debugfs),
+        D_SUBMODULE_DEFINE(fw),
+        D_SUBMODULE_DEFINE(netdev),
+        D_SUBMODULE_DEFINE(rfkill),
+        D_SUBMODULE_DEFINE(rx),
+        D_SUBMODULE_DEFINE(tx),
+};
+size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 static
 int __init i2400m_driver_init(void)
 {
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 8ef87356e083..a533ed60bb4d 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -1028,6 +1028,8 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
 * it's done by reseting the chip.  To accomplish this we must
 * first cleanup any pending DMA, then restart stuff after a la
 * ath5k_init.
+ *
+ * Called with sc->lock.
 */
 static int
 ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
@@ -2814,11 +2816,17 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 {
        struct ath5k_softc *sc = hw->priv;
        struct ieee80211_conf *conf = &hw->conf;
+        int ret;
+        mutex_lock(&sc->lock);
        sc->bintval = conf->beacon_int;
        sc->power_level = conf->power_level;
-        return ath5k_chan_set(sc, conf->channel);
+        ret = ath5k_chan_set(sc, conf->channel);
+        mutex_unlock(&sc->lock);
+        return ret;
 }
 static int
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0dc8eed16404..b35c8813bef4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1719,6 +1719,10 @@ static int iwl_read_ucode(struct iwl_priv *priv)
        priv->ucode_data_backup.len = data_size;
        iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
+        if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
+            !priv->ucode_data_backup.v_addr)
+                goto err_pci_alloc;
        /* Initialization instructions and data */
        if (init_size && init_data_size) {
                priv->ucode_init.len = init_size;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 4e75e8e7fa90..78df281b297a 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -285,7 +285,10 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
        ofdm_power = priv->channels[channel - 1].hw_value >> 4;
        cck_power = min(cck_power, (u8)11);
-        ofdm_power = min(ofdm_power, (u8)35);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
        rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
                         rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
@@ -536,7 +539,10 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
        cck_power += priv->txpwr_base & 0xF;
        cck_power = min(cck_power, (u8)35);
-        ofdm_power = min(ofdm_power, (u8)15);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
        ofdm_power += priv->txpwr_base >> 4;
        ofdm_power = min(ofdm_power, (u8)35);
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 3fac8f81d59d..a70cf16ee1ad 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -668,7 +668,7 @@ sba_mark_invalid(struct ioc *ioc, dma_addr_t iova, size_t byte_cnt)
 * @dev: instance of PCI owned by the driver that's asking
 * @mask:  number of address bits this PCI device can handle
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static int sba_dma_supported( struct device *dev, u64 mask)
 {
@@ -680,8 +680,8 @@ static int sba_dma_supported( struct device *dev, u64 mask)
                return(0);
        }
-        /* Documentation/DMA-mapping.txt tells drivers to try 64-bit first,
+        /* Documentation/PCI/PCI-DMA-mapping.txt tells drivers to try 64-bit
-         * then fall back to 32-bit if that fails.
+         * first, then fall back to 32-bit if that fails.
         * We are just "encouraging" 32-bit DMA masks here since we can
         * never allow IOMMU bypass unless we add special support for ZX1.
         */
@@ -706,7 +706,7 @@ static int sba_dma_supported( struct device *dev, u64 mask)
 * @size:  number of bytes to map in driver buffer.
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static dma_addr_t
 sba_map_single(struct device *dev, void *addr, size_t size,
@@ -785,7 +785,7 @@ sba_map_single(struct device *dev, void *addr, size_t size,
 * @size:  number of bytes mapped in driver buffer.
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void
 sba_unmap_single(struct device *dev, dma_addr_t iova, size_t size,
@@ -861,7 +861,7 @@ sba_unmap_single(struct device *dev, dma_addr_t iova, size_t size,
 * @size:  number of bytes mapped in driver buffer.
 * @dma_handle:  IOVA of new buffer.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void *sba_alloc_consistent(struct device *hwdev, size_t size,
                                        dma_addr_t *dma_handle, gfp_t gfp)
@@ -892,7 +892,7 @@ static void *sba_alloc_consistent(struct device *hwdev, size_t size,
 * @vaddr:  virtual address IOVA of "consistent" buffer.
 * @dma_handler:  IO virtual address of "consistent" buffer.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void
 sba_free_consistent(struct device *hwdev, size_t size, void *vaddr,
@@ -927,7 +927,7 @@ int dump_run_sg = 0;
 * @nents:  number of entries in list
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static int
 sba_map_sg(struct device *dev, struct scatterlist *sglist, int nents,
@@ -1011,7 +1011,7 @@ sba_map_sg(struct device *dev, struct scatterlist *sglist, int nents,
 * @nents:  number of entries in list
 * @direction:  R/W or both.
 *
- * See Documentation/DMA-mapping.txt
+ * See Documentation/PCI/PCI-DMA-mapping.txt
 */
 static void 
 sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
diff --git a/drivers/pci/hotplug/Makefile b/drivers/pci/hotplug/Makefile
index e31fb91652ce..2aa117c8cd87 100644
--- a/drivers/pci/hotplug/Makefile
+++ b/drivers/pci/hotplug/Makefile
@@ -5,11 +5,15 @@
 obj-$(CONFIG_HOTPLUG_PCI)               += pci_hotplug.o
 obj-$(CONFIG_HOTPLUG_PCI_COMPAQ)        += cpqphp.o
 obj-$(CONFIG_HOTPLUG_PCI_IBM)           += ibmphp.o
+# pciehp should be linked before acpiphp in order to allow the native driver
+# to attempt to bind first. We can then fall back to generic support.
+obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI)          += acpiphp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI_IBM)      += acpiphp_ibm.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_ZT5550)   += cpcihp_zt5550.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_GENERIC)  += cpcihp_generic.o
-obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_SHPC)          += shpchp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA)           += rpaphp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA_DLPAR)     += rpadlpar_io.o
diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
index b0e7de9e536d..d8649e127298 100644
--- a/drivers/pci/hotplug/fakephp.c
+++ b/drivers/pci/hotplug/fakephp.c
@@ -195,13 +195,13 @@ static void remove_slot_worker(struct work_struct *work)
 * Tries hard not to re-enable already existing devices;
 * also handles scanning of subfunctions.
 */
-static void pci_rescan_slot(struct pci_dev *temp)
+static int pci_rescan_slot(struct pci_dev *temp)
 {
        struct pci_bus *bus = temp->bus;
        struct pci_dev *dev;
        int func;
-        int retval;
        u8 hdr_type;
+        int count = 0;
        if (!pci_read_config_byte(temp, PCI_HEADER_TYPE, &hdr_type)) {
                temp->hdr_type = hdr_type & 0x7f;
@@ -213,17 +213,12 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                dbg("New device on %s function %x:%x\n",
                                        bus->name, temp->devfn >> 3,
                                        temp->devfn & 7);
-                                retval = pci_bus_add_device(dev);
+                                count++;
-                                if (retval)
-                                        dev_err(&dev->dev, "error adding "
-                                                "device, continuing.\n");
-                                else
-                                        add_slot(dev);
                        }
                }
                /* multifunction device? */
                if (!(hdr_type & 0x80))
-                        return;
+                        return count;
                /* continue scanning for other functions */
                for (func = 1, temp->devfn++; func < 8; func++, temp->devfn++) {
@@ -239,16 +234,13 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                        dbg("New device on %s function %x:%x\n",
                                                bus->name, temp->devfn >> 3,
                                                temp->devfn & 7);
-                                        retval = pci_bus_add_device(dev);
+                                        count++;
-                                        if (retval)
-                                                dev_err(&dev->dev, "error adding "
-                                                        "device, continuing.\n");
-                                        else
-                                                add_slot(dev);
                                }
                        }
                }
        }
+        return count;
 }
@@ -262,6 +254,8 @@ static void pci_rescan_bus(const struct pci_bus *bus)
 {
        unsigned int devfn;
        struct pci_dev *dev;
+        int retval;
+        int found = 0;
        dev = alloc_pci_dev();
        if (!dev)
                return;
@@ -270,7 +264,23 @@ static void pci_rescan_bus(const struct pci_bus *bus)
        dev->sysdata = bus->sysdata;
        for (devfn = 0; devfn < 0x100; devfn += 8) {
                dev->devfn = devfn;
-                pci_rescan_slot(dev);
+                found += pci_rescan_slot(dev);
+        }
+        if (found) {
+                pci_bus_assign_resources(bus);
+                list_for_each_entry(dev, &bus->devices, bus_list) {
+                        /* Skip already-added devices */
+                        if (dev->is_added)
+                                        continue;
+                        retval = pci_bus_add_device(dev);
+                        if (retval)
+                                dev_err(&dev->dev,
+                                        "Error adding device, continuing\n");
+                        else
+                                add_slot(dev);
+                }
+                pci_bus_add_devices(bus);
        }
        kfree(dev);
 }
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 3dfecb20d5e7..f4b7c79023ff 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -268,7 +268,12 @@ static long list_size;
 static void domain_remove_dev_info(struct dmar_domain *domain);
-int dmar_disabled;
+#ifdef CONFIG_DMAR_DEFAULT_ON
+int dmar_disabled = 0;
+#else
+int dmar_disabled = 1;
+#endif /*CONFIG_DMAR_DEFAULT_ON*/
 static int __initdata dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
@@ -284,9 +289,12 @@ static int __init intel_iommu_setup(char *str)
        if (!str)
                return -EINVAL;
        while (*str) {
-                if (!strncmp(str, "off", 3)) {
+                if (!strncmp(str, "on", 2)) {
+                        dmar_disabled = 0;
+                        printk(KERN_INFO "Intel-IOMMU: enabled\n");
+                } else if (!strncmp(str, "off", 3)) {
                        dmar_disabled = 1;
-                        printk(KERN_INFO"Intel-IOMMU: disabled\n");
+                        printk(KERN_INFO "Intel-IOMMU: disabled\n");
                } else if (!strncmp(str, "igfx_off", 8)) {
                        dmar_map_gfx = 0;
                        printk(KERN_INFO
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 896a15d70f5b..44f15ff70c1d 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -103,6 +103,16 @@ static void msix_set_enable(struct pci_dev *dev, int enable)
        }
 }
+/*
+ * Essentially, this is ((1 << (1 << x)) - 1), but without the
+ * undefinedness of a << 32.
+ */
+static inline __attribute_const__ u32 msi_mask(unsigned x)
+{
+        static const u32 mask[] = { 1, 2, 4, 0xf, 0xff, 0xffff, 0xffffffff };
+        return mask[x];
+}
 static void msix_flush_writes(struct irq_desc *desc)
 {
        struct msi_desc *entry;
@@ -407,8 +417,7 @@ static int msi_capability_init(struct pci_dev *dev)
                /* All MSIs are unmasked by default, Mask them all */
                pci_read_config_dword(dev, base, &maskbits);
-                temp = (1 << multi_msi_capable(control));
+                temp = msi_mask((control & PCI_MSI_FLAGS_QMASK) >> 1);
-                temp = ((temp - 1) & ~temp);
                maskbits |= temp;
                pci_write_config_dword(dev, base, maskbits);
                entry->msi_attrib.maskbits_mask = temp;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 9de07b75b993..ab1d615425a8 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -370,6 +370,7 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
        }
        pci_save_state(pci_dev);
+        pci_dev->state_saved = true;
        /*
         * This is for compatibility with existing code with legacy PM support.
         */
@@ -419,6 +420,7 @@ static int pci_legacy_resume(struct device *dev)
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
 {
        pci_restore_standard_config(pci_dev);
+        pci_dev->state_saved = false;
        pci_fixup_device(pci_fixup_resume_early, pci_dev);
 }
@@ -555,6 +557,13 @@ static int pci_pm_resume(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        /*
+         * This is necessary for the suspend error path in which resume is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume(dev);
@@ -660,7 +669,10 @@ static int pci_pm_poweroff(struct device *dev)
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_suspend(dev, PMSG_HIBERNATE);
-        if (drv && drv->pm && drv->pm->poweroff) {
+        if (!drv || !drv->pm)
+                return 0;
+        if (drv->pm->poweroff) {
                error = drv->pm->poweroff(dev);
                suspend_report_result(drv->pm->poweroff, error);
        }
@@ -710,6 +722,13 @@ static int pci_pm_restore(struct device *dev)
        struct device_driver *drv = dev->driver;
        int error = 0;
+        /*
+         * This is necessary for the hibernation error path in which restore is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
        if (pci_has_legacy_pm_support(pci_dev))
                return pci_legacy_resume(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 17bd9325a245..48807556b47a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1393,35 +1393,35 @@ int pci_restore_standard_config(struct pci_dev *dev)
        pci_power_t prev_state;
        int error;
-        pci_restore_state(dev);
        pci_update_current_state(dev, PCI_D0);
        prev_state = dev->current_state;
        if (prev_state == PCI_D0)
-                return 0;
+                goto Restore;
        error = pci_raw_set_power_state(dev, PCI_D0, false);
        if (error)
                return error;
-        if (pci_is_bridge(dev)) {
+        /*
-                if (prev_state > PCI_D1)
+         * This assumes that we won't get a bus in B2 or B3 from the BIOS, but
-                        mdelay(PCI_PM_BUS_WAIT);
+         * we've made this assumption forever and it appears to be universally
-        } else {
+         * satisfied.
-                switch(prev_state) {
+         */
-                case PCI_D3cold:
+        switch(prev_state) {
-                case PCI_D3hot:
+        case PCI_D3cold:
-                        mdelay(pci_pm_d3_delay);
+        case PCI_D3hot:
-                        break;
+                mdelay(pci_pm_d3_delay);
-                case PCI_D2:
+                break;
-                        udelay(PCI_PM_D2_DELAY);
+        case PCI_D2:
-                        break;
+                udelay(PCI_PM_D2_DELAY);
-                }
+                break;
        }
        dev->current_state = PCI_D0;
-        return 0;
+ Restore:
+        return pci_restore_state(dev);
 }
 /**
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 7c789f0a94d7..de91ddab0a86 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -382,6 +382,11 @@ static int __init hp_wmi_input_setup(void)
                case KE_SW:
                        set_bit(EV_SW, hp_wmi_input_dev->evbit);
                        set_bit(key->keycode, hp_wmi_input_dev->swbit);
+                        /* Set initial dock state */
+                        input_report_switch(hp_wmi_input_dev, key->keycode,
+                                            hp_wmi_dock_state());
+                        input_sync(hp_wmi_input_dev);
                        break;
                }
        }
@@ -441,6 +446,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
                bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
                bluetooth_rfkill->user_claim_unsupported = 1;
                err = rfkill_register(bluetooth_rfkill);
+                if (err)
                        goto register_bluetooth_error;
        }
diff --git a/drivers/regulator/bq24022.c b/drivers/regulator/bq24022.c
index 366565aba865..c175e38a4cd5 100644
--- a/drivers/regulator/bq24022.c
+++ b/drivers/regulator/bq24022.c
@@ -152,11 +152,7 @@ static void __exit bq24022_exit(void)
        platform_driver_unregister(&bq24022_driver);
 }
-/*
+module_init(bq24022_init);
- * make sure this is probed before gpio_vbus and pda_power,
- * but after asic3 or other GPIO expander drivers.
- */
-subsys_initcall(bq24022_init);
 module_exit(bq24022_exit);
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 7aa35248181b..5056e23e4414 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1435,7 +1435,7 @@ int wm8350_register_led(struct wm8350 *wm8350, int lednum, int dcdc, int isink,
        struct platform_device *pdev;
        int ret;
-        if (lednum > ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
+        if (lednum >= ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
                dev_err(wm8350->dev, "Invalid LED index %d\n", lednum);
                return -ENODEV;
        }
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 3547558d2caf..324c74d2f666 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_port *port)
        channel->ch_bd->bd_ops->disable_receiver(channel);
 }
+static void jsm_tty_enable_ms(struct uart_port *port)
+{
+        /* Nothing needed */
+}
 static void jsm_tty_break(struct uart_port *port, int break_state)
 {
        unsigned long lock_flags;
@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
        .start_tx       = jsm_tty_start_tx,
        .send_xchar     = jsm_tty_send_xchar,
        .stop_rx        = jsm_tty_stop_rx,
+        .enable_ms      = jsm_tty_enable_ms,
        .break_ctl      = jsm_tty_break,
        .startup        = jsm_tty_open,
        .shutdown       = jsm_tty_close,
diff --git a/drivers/staging/agnx/agnx.h b/drivers/staging/agnx/agnx.h
index a75b0db3726c..20f36da62475 100644
--- a/drivers/staging/agnx/agnx.h
+++ b/drivers/staging/agnx/agnx.h
@@ -1,6 +1,8 @@
 #ifndef AGNX_H_
 #define AGNX_H_
+#include <linux/io.h>
 #include "xmit.h"
 #define PFX                             KBUILD_MODNAME ": "
diff --git a/drivers/staging/altpciechdma/altpciechdma.c b/drivers/staging/altpciechdma/altpciechdma.c
index 8e2b4ca0651d..f516140ca976 100644
--- a/drivers/staging/altpciechdma/altpciechdma.c
+++ b/drivers/staging/altpciechdma/altpciechdma.c
@@ -531,7 +531,7 @@ static int __devinit dma_test(struct ape_dev *ape, struct pci_dev *dev)
        goto fail;
        /* allocate and map coherently-cached memory for a DMA-able buffer */
-        /* @see 2.6.26.2/Documentation/DMA-mapping.txt line 318 */
+        /* @see Documentation/PCI/PCI-DMA-mapping.txt, near line 318 */
        buffer_virt = (u8 *)pci_alloc_consistent(dev, PAGE_SIZE * 4, &buffer_bus);
        if (!buffer_virt) {
                printk(KERN_DEBUG "Could not allocate coherent DMA buffer.\n");
@@ -846,7 +846,7 @@ static int __devinit probe(struct pci_dev *dev, const struct pci_device_id *id)
 #if 1 // @todo For now, disable 64-bit, because I do not understand the implications (DAC!)
        /* query for DMA transfer */
-        /* @see Documentation/DMA-mapping.txt */
+        /* @see Documentation/PCI/PCI-DMA-mapping.txt */
        if (!pci_set_dma_mask(dev, DMA_64BIT_MASK)) {
                pci_set_consistent_dma_mask(dev, DMA_64BIT_MASK);
                /* use 64-bit DMA */
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 6a4ceacb33f5..758131cad08a 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -319,6 +319,7 @@ int task_get_unused_fd_flags(struct task_struct *tsk, int flags)
        int fd, error;
        struct fdtable *fdt;
        unsigned long rlim_cur;
+        unsigned long irqs;
        if (files == NULL)
                return -ESRCH;
@@ -335,12 +336,11 @@ repeat:
         * N.B. For clone tasks sharing a files structure, this test
         * will limit the total number of files that can be opened.
         */
-        rcu_read_lock();
+        rlim_cur = 0;
-        if (tsk->signal)
+        if (lock_task_sighand(tsk, &irqs)) {
                rlim_cur = tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur;
-        else
+                unlock_task_sighand(tsk, &irqs);
-                rlim_cur = 0;
+        }
-        rcu_read_unlock();
        if (fd >= rlim_cur)
                goto out;
@@ -2649,14 +2649,14 @@ static void binder_vma_open(struct vm_area_struct *vma)
 {
        struct binder_proc *proc = vma->vm_private_data;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        dump_stack();
 }
 static void binder_vma_close(struct vm_area_struct *vma)
 {
        struct binder_proc *proc = vma->vm_private_data;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        proc->vma = NULL;
 }
@@ -2677,7 +2677,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
                vma->vm_end = vma->vm_start + SZ_4M;
        if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
-                printk(KERN_INFO "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, vma->vm_page_prot.pgprot);
+                printk(KERN_INFO "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, pgprot_val(vma->vm_page_prot));
        if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
                ret = -EPERM;
diff --git a/drivers/staging/android/lowmemorykiller.txt b/drivers/staging/android/lowmemorykiller.txt
new file mode 100644
index 000000000000..bd5c0c028968
--- /dev/null
+++ b/drivers/staging/android/lowmemorykiller.txt
@@ -0,0 +1,16 @@
+The lowmemorykiller driver lets user-space specify a set of memory thresholds
+where processes with a range of oom_adj values will get killed. Specify the
+minimum oom_adj values in /sys/module/lowmemorykiller/parameters/adj and the
+number of free pages in /sys/module/lowmemorykiller/parameters/minfree. Both
+files take a comma separated list of numbers in ascending order.
+For example, write "0,8" to /sys/module/lowmemorykiller/parameters/adj and
+"1024,4096" to /sys/module/lowmemorykiller/parameters/minfree to kill processes
+with a oom_adj value of 8 or higher when the free memory drops below 4096 pages
+and kill processes with a oom_adj value of 0 or higher when the free memory
+drops below 1024 pages.
+The driver considers memory used for caches to be free, but if a large
+percentage of the cached memory is locked this can be very inaccurate
+and processes may not get killed until the normal oom killer is triggered.
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
index bea68c9fc942..903270cbbe02 100644
--- a/drivers/staging/android/timed_gpio.c
+++ b/drivers/staging/android/timed_gpio.c
@@ -18,7 +18,7 @@
 #include <linux/platform_device.h>
 #include <linux/hrtimer.h>
 #include <linux/err.h>
-#include <asm/arch/gpio.h>
+#include <linux/gpio.h>
 #include "timed_gpio.h"
@@ -49,7 +49,8 @@ static ssize_t gpio_enable_show(struct device *dev, struct device_attribute *att
        if (hrtimer_active(&gpio_data->timer)) {
                ktime_t r = hrtimer_get_remaining(&gpio_data->timer);
-                remaining = r.tv.sec * 1000 + r.tv.nsec / 1000000;
+                struct timeval t = ktime_to_timeval(r);
+                remaining = t.tv_sec * 1000 + t.tv_usec;
        } else
                remaining = 0;
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index b501bfb9c754..b47ca1e7e383 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -1,6 +1,7 @@
 config COMEDI
        tristate "Data Acquision support (comedi)"
        default N
+        depends on m
        ---help---
          Enable support a wide range of data acquision devices
          for Linux.
diff --git a/drivers/staging/meilhaus/Kconfig b/drivers/staging/meilhaus/Kconfig
index 6def83fa2c96..923af22a4686 100644
--- a/drivers/staging/meilhaus/Kconfig
+++ b/drivers/staging/meilhaus/Kconfig
@@ -4,6 +4,7 @@
 menuconfig MEILHAUS
        tristate "Meilhaus support"
+        depends on m
        ---help---
          If you have a Meilhaus card, say Y (or M) here.
@@ -18,7 +19,7 @@ if MEILHAUS
 config ME0600
        tristate "Meilhaus ME-600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-600 family of boards
          that do data collection and multipurpose I/O.
@@ -29,7 +30,7 @@ config ME0600
 config ME0900
        tristate "Meilhaus ME-900 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-900 family of boards
          that do data collection and multipurpose I/O.
@@ -40,7 +41,7 @@ config ME0900
 config ME1000
        tristate "Meilhaus ME-1000 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1000 family of boards
          that do data collection and multipurpose I/O.
@@ -51,7 +52,7 @@ config ME1000
 config ME1400
        tristate "Meilhaus ME-1400 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1400 family of boards
          that do data collection and multipurpose I/O.
@@ -62,7 +63,7 @@ config ME1400
 config ME1600
        tristate "Meilhaus ME-1600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-1600 family of boards
          that do data collection and multipurpose I/O.
@@ -73,7 +74,7 @@ config ME1600
 config ME4600
        tristate "Meilhaus ME-4600 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-4600 family of boards
          that do data collection and multipurpose I/O.
@@ -84,7 +85,7 @@ config ME4600
 config ME6000
        tristate "Meilhaus ME-6000 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-6000 family of boards
          that do data collection and multipurpose I/O.
@@ -95,7 +96,7 @@ config ME6000
 config ME8100
        tristate "Meilhaus ME-8100 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-8100 family of boards
          that do data collection and multipurpose I/O.
@@ -106,7 +107,7 @@ config ME8100
 config ME8200
        tristate "Meilhaus ME-8200 support"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This driver supports the Meilhaus ME-8200 family of boards
          that do data collection and multipurpose I/O.
@@ -117,7 +118,7 @@ config ME8200
 config MEDUMMY
        tristate "Meilhaus dummy driver"
        default n
-        depends on PCI
+        depends on PCI && m
        help
          This provides a dummy driver for the Meilhaus driver package
diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
index ec343ef53a85..0d111ddfabb2 100644
--- a/drivers/staging/poch/poch.c
+++ b/drivers/staging/poch/poch.c
@@ -1026,7 +1026,7 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
                }
                break;
        case POCH_IOC_GET_COUNTERS:
-                if (access_ok(VERIFY_WRITE, argp, sizeof(struct poch_counters)))
+                if (!access_ok(VERIFY_WRITE, argp, sizeof(struct poch_counters)))
                        return -EFAULT;
                spin_lock_irq(&channel->counters_lock);
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 72e209276ea7..22f93dd0ba03 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -406,8 +406,20 @@ void usbip_start_threads(struct usbip_device *ud)
        /*
         * threads are invoked per one device (per one connection).
         */
-        kernel_thread(usbip_thread, (void *)&ud->tcp_rx, 0);
+        int retval;
-        kernel_thread(usbip_thread, (void *)&ud->tcp_tx, 0);
+        retval = kernel_thread(usbip_thread, (void *)&ud->tcp_rx, 0);
+        if (retval < 0) {
+                printk(KERN_ERR "Creating tcp_rx thread for ud %p failed.\n",
+                                ud);
+                return;
+        }
+        retval = kernel_thread(usbip_thread, (void *)&ud->tcp_tx, 0);
+        if (retval < 0) {
+                printk(KERN_ERR "Creating tcp_tx thread for ud %p failed.\n",
+                                ud);
+                return;
+        }
        /* confirm threads are starting */
        wait_for_completion(&ud->tcp_rx.thread_done);
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index 577c0d29849d..2291c5f5af51 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -170,12 +170,17 @@ void asl_stop(struct whc *whc)
 void asl_update(struct whc *whc, uint32_t wusbcmd)
 {
        struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
        mutex_lock(&wusbhc->mutex);
        if (wusbhc->active) {
                whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->async_list_wq,
+                t = wait_event_timeout(
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0);
+                        whc->async_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "ASL update timeout");
        }
        mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/hw.c b/drivers/usb/host/whci/hw.c
index d498e7203217..6afa2e379160 100644
--- a/drivers/usb/host/whci/hw.c
+++ b/drivers/usb/host/whci/hw.c
@@ -87,3 +87,18 @@ out:
        return ret;
 }
+/**
+ * whc_hw_error - recover from a hardware error
+ * @whc:    the WHCI HC that broke.
+ * @reason: a description of the failure.
+ *
+ * Recover from broken hardware with a full reset.
+ */
+void whc_hw_error(struct whc *whc, const char *reason)
+{
+        struct wusbhc *wusbhc = &whc->wusbhc;
+        dev_err(&whc->umc->dev, "hardware error: %s\n", reason);
+        wusbhc_reset_all(wusbhc);
+}
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index 2ae5abf69a6a..7dc85a0bee7c 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -183,12 +183,17 @@ void pzl_stop(struct whc *whc)
 void pzl_update(struct whc *whc, uint32_t wusbcmd)
 {
        struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
        mutex_lock(&wusbhc->mutex);
        if (wusbhc->active) {
                whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->periodic_list_wq,
+                t = wait_event_timeout(
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0);
+                        whc->periodic_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "PZL update timeout");
        }
        mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/whcd.h b/drivers/usb/host/whci/whcd.h
index 0f3540f04f53..d3543a181dc9 100644
--- a/drivers/usb/host/whci/whcd.h
+++ b/drivers/usb/host/whci/whcd.h
@@ -137,6 +137,7 @@ void whc_clean_up(struct whc *whc);
 /* hw.c */
 void whc_write_wusbcmd(struct whc *whc, u32 mask, u32 val);
 int whc_do_gencmd(struct whc *whc, u32 cmd, u32 params, void *addr, size_t len);
+void whc_hw_error(struct whc *whc, const char *reason);
 /* wusb.c */
 int whc_wusbhc_start(struct wusbhc *wusbhc);
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e2e7e4bc8463..8e18141bb2e0 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -386,6 +386,7 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
                          | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
        port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
        if (wusb_dev) {
+                dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
                if (!list_empty(&wusb_dev->cack_node))
                        list_del_init(&wusb_dev->cack_node);
                /* For the one in cack_add() */
diff --git a/drivers/usb/wusbcore/rh.c b/drivers/usb/wusbcore/rh.c
index 3937bf6f8cef..9fe4246cecb9 100644
--- a/drivers/usb/wusbcore/rh.c
+++ b/drivers/usb/wusbcore/rh.c
@@ -100,6 +100,9 @@ static int wusbhc_rh_port_reset(struct wusbhc *wusbhc, u8 port_idx)
        struct wusb_port *port = wusb_port_by_idx(wusbhc, port_idx);
        struct wusb_dev *wusb_dev = port->wusb_dev;
+        if (wusb_dev == NULL)
+                return -ENOTCONN;
        port->status |= USB_PORT_STAT_RESET;
        port->change |= USB_PORT_STAT_C_RESET;
diff --git a/drivers/uwb/allocator.c b/drivers/uwb/allocator.c
index c8185e6b0cd5..c13cec7dcbc5 100644
--- a/drivers/uwb/allocator.c
+++ b/drivers/uwb/allocator.c
@@ -15,7 +15,6 @@
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/uwb.h>
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index 2b4f9406789d..4f5ca99a04b9 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -66,14 +66,14 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
        } else
                dev_err(&rc->uwb_dev.dev, "SET-DRP-IE: timeout\n");
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
        if (rc->set_drp_ie_pending > 1) {
                rc->set_drp_ie_pending = 0;
                uwb_rsv_queue_update(rc);       
        } else {
                rc->set_drp_ie_pending = 0;     
        }
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 /**
diff --git a/drivers/uwb/rsv.c b/drivers/uwb/rsv.c
index ec6eecb32f30..6b76f4bb4cc7 100644
--- a/drivers/uwb/rsv.c
+++ b/drivers/uwb/rsv.c
@@ -114,7 +114,8 @@ void uwb_rsv_dump(char *text, struct uwb_rsv *rsv)
                devaddr = rsv->target.devaddr;
        uwb_dev_addr_print(target, sizeof(target), &devaddr);
-        dev_dbg(dev, "rsv %s -> %s: %s\n", owner, target, uwb_rsv_state_str(rsv->state));
+        dev_dbg(dev, "rsv %s %s -> %s: %s\n",
+                text, owner, target, uwb_rsv_state_str(rsv->state));
 }
 static void uwb_rsv_release(struct kref *kref)
@@ -511,8 +512,7 @@ void uwb_rsv_remove(struct uwb_rsv *rsv)
        if (uwb_rsv_is_owner(rsv))
                uwb_rsv_put_stream(rsv);
-        
-        del_timer_sync(&rsv->timer);
        uwb_dev_put(rsv->owner);
        if (rsv->target.type == UWB_RSV_TARGET_DEV)
                uwb_dev_put(rsv->target.dev);
@@ -870,7 +870,7 @@ void uwb_rsv_queue_update(struct uwb_rc *rc)
 */
 void uwb_rsv_sched_update(struct uwb_rc *rc)
 {
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
        if (!delayed_work_pending(&rc->rsv_update_work)) {
                if (rc->set_drp_ie_pending > 0) {
                        rc->set_drp_ie_pending++;
@@ -879,7 +879,7 @@ void uwb_rsv_sched_update(struct uwb_rc *rc)
                uwb_rsv_queue_update(rc);
        }
 unlock:
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 /*
@@ -943,13 +943,22 @@ void uwb_rsv_remove_all(struct uwb_rc *rc)
        mutex_lock(&rc->rsvs_mutex);
        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
-                uwb_rsv_remove(rsv);
+                if (rsv->state != UWB_RSV_STATE_NONE)
+                        uwb_rsv_set_state(rsv, UWB_RSV_STATE_NONE);
+                del_timer_sync(&rsv->timer);
        }
        /* Cancel any postponed update. */
        rc->set_drp_ie_pending = 0;
        mutex_unlock(&rc->rsvs_mutex);
        cancel_delayed_work_sync(&rc->rsv_update_work);
+        flush_workqueue(rc->rsv_workq);
+        mutex_lock(&rc->rsvs_mutex);
+        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
+                uwb_rsv_remove(rsv);
+        }
+        mutex_unlock(&rc->rsvs_mutex);
 }
 void uwb_rsv_init(struct uwb_rc *rc)
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index c94f71980c1b..f0267706cb45 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -41,7 +41,7 @@ menuconfig FB
          You need an utility program called fbset to make full use of frame
          buffer devices. Please read <file:Documentation/fb/framebuffer.txt>
          and the Framebuffer-HOWTO at
-          <http://www.tahallah.demon.co.uk/programming/prog.html> for more
+          <http://www.munted.org.uk/programming/Framebuffer-HOWTO-1.2.html> for more
          information.
          Say Y here and to the driver for your graphics board below if you
diff --git a/drivers/video/aty/mach64_ct.c b/drivers/video/aty/mach64_ct.c
index c50c7cf26fe9..2745b8539485 100644
--- a/drivers/video/aty/mach64_ct.c
+++ b/drivers/video/aty/mach64_ct.c
@@ -8,6 +8,9 @@
 #include <asm/io.h>
 #include <video/mach64.h>
 #include "atyfb.h"
+#ifdef CONFIG_PPC
+#include <asm/machdep.h>
+#endif
 #undef DEBUG
@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(const struct fb_info *info,
        pll->ct.xclk_post_div_real = postdividers[xpost_div];
        pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
+#ifdef CONFIG_PPC
+        if (machine_is(powermac)) {
+                /* Override PLL_EXT_CNTL & 0x07. */
+                pll->ct.xclk_post_div = xpost_div;
+                pll->ct.xclk_ref_div = 1;
+        }
+#endif
 #ifdef DEBUG
        pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
                        (par->ref_clk_per * pll->ct.pll_ref_div);
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index bef6b45e8a5c..330aacbdec1f 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -192,7 +192,7 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
                drv = container_of(vp_dev->vdev.dev.driver,
                                   struct virtio_driver, driver);
-                if (drv->config_changed)
+                if (drv && drv->config_changed)
                        drv->config_changed(&vp_dev->vdev);
        }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 2ba8f95516a0..efa4b363ce72 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -498,7 +498,7 @@ static ssize_t store_target_kb(struct sys_device *dev,
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
-        target_bytes = memparse(buf, &endchar);
+        target_bytes = simple_strtoull(buf, &endchar, 0) * 1024;
        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
@@ -508,8 +508,39 @@ static ssize_t store_target_kb(struct sys_device *dev,
 static SYSDEV_ATTR(target_kb, S_IRUGO | S_IWUSR,
                   show_target_kb, store_target_kb);
+static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr,
+                              char *buf)
+{
+        return sprintf(buf, "%llu\n",
+                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+}
+static ssize_t store_target(struct sys_device *dev,
+                            struct sysdev_attribute *attr,
+                            const char *buf,
+                            size_t count)
+{
+        char *endchar;
+        unsigned long long target_bytes;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+        target_bytes = memparse(buf, &endchar);
+        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
+        return count;
+}
+static SYSDEV_ATTR(target, S_IRUGO | S_IWUSR,
+                   show_target, store_target);
 static struct sysdev_attribute *balloon_attrs[] = {
        &attr_target_kb,
+        &attr_target,
 };
 static struct attribute *balloon_info_attrs[] = {