106 files changed, 933 insertions, 623 deletions
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 2964f5f4a7ef..6b3e0c2f33e2 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -40,6 +40,7 @@ struct sh_cmt_priv {
        struct platform_device *pdev;
        unsigned long flags;
+        unsigned long flags_suspend;
        unsigned long match_value;
        unsigned long next_match_value;
        unsigned long max_match_value;
@@ -667,11 +668,38 @@ static int __devexit sh_cmt_remove(struct platform_device *pdev)
        return -EBUSY; /* cannot unregister clockevent and clocksource */
 }
+static int sh_cmt_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* save flag state and stop CMT channel */
+        p->flags_suspend = p->flags;
+        sh_cmt_stop(p, p->flags);
+        return 0;
+}
+static int sh_cmt_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* start CMT channel from saved state */
+        sh_cmt_start(p, p->flags_suspend);
+        return 0;
+}
+static struct dev_pm_ops sh_cmt_dev_pm_ops = {
+        .suspend = sh_cmt_suspend,
+        .resume = sh_cmt_resume,
+};
 static struct platform_driver sh_cmt_device_driver = {
        .probe          = sh_cmt_probe,
        .remove         = __devexit_p(sh_cmt_remove),
        .driver         = {
                .name   = "sh_cmt",
+                .pm     = &sh_cmt_dev_pm_ops,
        }
 };
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 0ca1ee768a1f..8ce74d95ae4d 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -108,7 +108,7 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
                                *(pkg->data_size) = 0;
                } else if (tfr->data_size > *(pkg->data_size)) {
                        DMERR("Insufficient space to receive package [%u] "
-                              "(%u vs %lu)", tfr->request_type,
+                              "(%u vs %zu)", tfr->request_type,
                              tfr->data_size, *(pkg->data_size));
                        *(pkg->data_size) = 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 103f2d33fa89..9dd872000cec 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4364,6 +4364,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                if (mode == 1)
                        set_disk_ro(disk, 1);
                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                err = 0;
        }
 out:
        mutex_unlock(&mddev->open_mutex);
diff --git a/drivers/media/common/tuners/qt1010.c b/drivers/media/common/tuners/qt1010.c
index 825aa1412e6f..9f5dba244cb8 100644
--- a/drivers/media/common/tuners/qt1010.c
+++ b/drivers/media/common/tuners/qt1010.c
@@ -64,24 +64,22 @@ static int qt1010_writereg(struct qt1010_priv *priv, u8 reg, u8 val)
 /* dump all registers */
 static void qt1010_dump_regs(struct qt1010_priv *priv)
 {
-        char buf[52], buf2[4];
        u8 reg, val;
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk("%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                if (qt1010_readreg(priv, reg, &val) == 0)
-                        sprintf(buf2, "%02x ", val);
+                        printk(KERN_CONT " %02x", val);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0x2f)
                        break;
        }
-        printk("%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static int qt1010_set_params(struct dvb_frontend *fe,
diff --git a/drivers/media/common/tuners/tuner-xc2028.c b/drivers/media/common/tuners/tuner-xc2028.c
index aa20ce8cc668..f270e605da83 100644
--- a/drivers/media/common/tuners/tuner-xc2028.c
+++ b/drivers/media/common/tuners/tuner-xc2028.c
@@ -1119,8 +1119,8 @@ static int xc2028_sleep(struct dvb_frontend *fe)
        struct xc2028_data *priv = fe->tuner_priv;
        int rc = 0;
-        /* Avoid firmware reload on slow devices */
+        /* Avoid firmware reload on slow devices or if PM disabled */
-        if (no_poweroff)
+        if (no_poweroff || priv->ctrl.disable_power_mgmt)
                return 0;
        tuner_dbg("Putting xc2028/3028 into poweroff mode.\n");
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 19de7928a74e..a90c35d50add 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -38,6 +38,7 @@ struct xc2028_ctrl {
        unsigned int            input1:1;
        unsigned int            vhfbw7:1;
        unsigned int            uhfbw8:1;
+        unsigned int            disable_power_mgmt:1;
        unsigned int            demod;
        enum firmware_type      type:2;
 };
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 4cb31e7c13c2..26690dfb3260 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -81,7 +81,6 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        switch (req->cmd) {
        case GET_CONFIG:
-        case BOOT:
        case READ_MEMORY:
        case RECONNECT_USB:
        case GET_IR_CODE:
@@ -100,6 +99,7 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        case WRITE_VIRTUAL_MEMORY:
        case COPY_FIRMWARE:
        case DOWNLOAD_FIRMWARE:
+        case BOOT:
                break;
        default:
                err("unknown command:%d", req->cmd);
diff --git a/drivers/media/dvb/frontends/cx22700.c b/drivers/media/dvb/frontends/cx22700.c
index ace5cb17165d..fbd838eca268 100644
--- a/drivers/media/dvb/frontends/cx22700.c
+++ b/drivers/media/dvb/frontends/cx22700.c
@@ -380,7 +380,7 @@ struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
        struct cx22700_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22700_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 5d1abe34bddb..00b5c7e91d5d 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -580,7 +580,7 @@ struct dvb_frontend *cx22702_attach(const struct cx22702_config *config,
        struct cx22702_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22702_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index 87ae29db024f..ffbcfabd83f0 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -598,7 +598,7 @@ struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
        int ret;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx24110_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/dvb_dummy_fe.c b/drivers/media/dvb/frontends/dvb_dummy_fe.c
index db8a937cc630..a7fc7e53a551 100644
--- a/drivers/media/dvb/frontends/dvb_dummy_fe.c
+++ b/drivers/media/dvb/frontends/dvb_dummy_fe.c
@@ -117,7 +117,7 @@ struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -137,7 +137,7 @@ struct dvb_frontend *dvb_dummy_fe_qpsk_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -157,7 +157,7 @@ struct dvb_frontend *dvb_dummy_fe_qam_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index e1e70e9e0cb9..3051b64aa17c 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -501,7 +501,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                           { .addr = config->demod_address, .flags = I2C_M_RD, .buf = b1, .len = 1 } };
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct l64781_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/lgs8gl5.c b/drivers/media/dvb/frontends/lgs8gl5.c
index 855852fddf22..bb37ed289a05 100644
--- a/drivers/media/dvb/frontends/lgs8gl5.c
+++ b/drivers/media/dvb/frontends/lgs8gl5.c
@@ -387,7 +387,7 @@ lgs8gl5_attach(const struct lgs8gl5_config *config, struct i2c_adapter *i2c)
        dprintk("%s\n", __func__);
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index a621f727935f..f69daaac78c9 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -782,7 +782,7 @@ struct dvb_frontend *mt312_attach(const struct mt312_config *config,
        struct mt312_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct mt312_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/nxt6000.c b/drivers/media/dvb/frontends/nxt6000.c
index 0eef22dbf8a0..a763ec756f7f 100644
--- a/drivers/media/dvb/frontends/nxt6000.c
+++ b/drivers/media/dvb/frontends/nxt6000.c
@@ -545,7 +545,7 @@ struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
        struct nxt6000_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index 8133ea3cddd7..38e67accb8c3 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -562,7 +562,7 @@ struct dvb_frontend* or51132_attach(const struct or51132_config* config,
        struct or51132_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51132_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51132_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 16cf2fdd5d7d..c709ce6771c8 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -527,7 +527,7 @@ struct dvb_frontend* or51211_attach(const struct or51211_config* config,
        struct or51211_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51211_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51211_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index 3e08d985d6e5..fb3011518427 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -796,7 +796,7 @@ struct dvb_frontend *s5h1409_attach(const struct s5h1409_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
index 66e2dd6d6fe4..d8adf1e32019 100644
--- a/drivers/media/dvb/frontends/s5h1411.c
+++ b/drivers/media/dvb/frontends/s5h1411.c
@@ -844,7 +844,7 @@ struct dvb_frontend *s5h1411_attach(const struct s5h1411_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/si21xx.c b/drivers/media/dvb/frontends/si21xx.c
index 0bd16af8a6cd..9552a22ccffb 100644
--- a/drivers/media/dvb/frontends/si21xx.c
+++ b/drivers/media/dvb/frontends/si21xx.c
@@ -928,7 +928,7 @@ struct dvb_frontend *si21xx_attach(const struct si21xx_config *config,
        dprintk("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct si21xx_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct si21xx_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 1c9a9b4051b9..b85eb60a893e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
        struct sp8870_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp8870_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index 559509ab4dab..4a7c3d842608 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
        struct sp887x_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp887x_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/stv0288.c b/drivers/media/dvb/frontends/stv0288.c
index ff1194de34c0..2930a5d6768a 100644
--- a/drivers/media/dvb/frontends/stv0288.c
+++ b/drivers/media/dvb/frontends/stv0288.c
@@ -570,7 +570,7 @@ struct dvb_frontend *stv0288_attach(const struct stv0288_config *config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0288_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0288_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 62caf802ed99..4fd7479bb62b 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -663,7 +663,7 @@ struct dvb_frontend *stv0297_attach(const struct stv0297_config *config,
        struct stv0297_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0297_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 6c1cb1973c6e..968874469726 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -667,7 +667,7 @@ struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0299_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index f648fdb64bb7..f5d7b3277a2f 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -413,7 +413,7 @@ struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
        u8 id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10021_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10048.c b/drivers/media/dvb/frontends/tda10048.c
index cc8862ce4aae..4e2a7c8b2f62 100644
--- a/drivers/media/dvb/frontends/tda10048.c
+++ b/drivers/media/dvb/frontends/tda10048.c
@@ -1095,7 +1095,7 @@ struct dvb_frontend *tda10048_attach(const struct tda10048_config *config,
        dprintk(1, "%s()\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10048_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10048_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 4981cef8b444..f2a8abe0a243 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -1269,7 +1269,7 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10045 state\n");
                return NULL;
@@ -1339,7 +1339,7 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10046 state\n");
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index a17ce3c4ad86..f2c8faac6f36 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -745,7 +745,7 @@ struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
        dprintk ("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10086_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10086_state), GFP_KERNEL);
        if (!state)
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda8083.c b/drivers/media/dvb/frontends/tda8083.c
index 5b843b2e67e8..9369f7442f27 100644
--- a/drivers/media/dvb/frontends/tda8083.c
+++ b/drivers/media/dvb/frontends/tda8083.c
@@ -417,7 +417,7 @@ struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
        struct tda8083_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda8083_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/ves1820.c b/drivers/media/dvb/frontends/ves1820.c
index a184597f1d9b..6e78e4865515 100644
--- a/drivers/media/dvb/frontends/ves1820.c
+++ b/drivers/media/dvb/frontends/ves1820.c
@@ -374,7 +374,7 @@ struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
        struct ves1820_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1820_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/ves1x93.c b/drivers/media/dvb/frontends/ves1x93.c
index bd558960bd87..8d7854c2fb0c 100644
--- a/drivers/media/dvb/frontends/ves1x93.c
+++ b/drivers/media/dvb/frontends/ves1x93.c
@@ -456,7 +456,7 @@ struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
        u8 identity;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/zl10353.c b/drivers/media/dvb/frontends/zl10353.c
index 148b6f7f6cb2..66f5c1fb3074 100644
--- a/drivers/media/dvb/frontends/zl10353.c
+++ b/drivers/media/dvb/frontends/zl10353.c
@@ -98,7 +98,6 @@ static int zl10353_read_register(struct zl10353_state *state, u8 reg)
 static void zl10353_dump_regs(struct dvb_frontend *fe)
 {
        struct zl10353_state *state = fe->demodulator_priv;
-        char buf[52], buf2[4];
        int ret;
        u8 reg;
@@ -106,19 +105,18 @@ static void zl10353_dump_regs(struct dvb_frontend *fe)
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk(KERN_DEBUG "%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                ret = zl10353_read_register(state, reg);
                if (ret >= 0)
-                        sprintf(buf2, "%02x ", (u8)ret);
+                        printk(KERN_CONT " %02x", (u8)ret);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0xff)
                        break;
        }
-        printk(KERN_DEBUG "%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index dd863f261672..88847d1dcbb5 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -4,7 +4,7 @@
 config DVB_SIANO_SMS1XXX
        tristate "Siano SMS1XXX USB dongle support"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && USB && INPUT
        ---help---
          Choose Y here if you have a USB dongle with a SMS1XXX chipset.
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index d8b15d583bde..0420e2885e75 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -116,99 +116,21 @@ static inline void sms_gpio_assign_11xx_default_led_config(
 int sms_board_event(struct smscore_device_t *coredev,
                enum SMS_BOARD_EVENTS gevent) {
-        int board_id = smscore_get_board_id(coredev);
-        struct sms_board *board = sms_get_board(board_id);
        struct smscore_gpio_config MyGpioConfig;
        sms_gpio_assign_11xx_default_led_config(&MyGpioConfig);
        switch (gevent) {
        case BOARD_EVENT_POWER_INIT: /* including hotplug */
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        /* set I/O and turn off all LEDs */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.leds_power,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.leds_power, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led0,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led0, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led1,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        /* set I/O and turn off LNA */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_POWER_SUSPEND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_SUSPEND */
        case BOARD_EVENT_POWER_RESUME:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_RESUME */
        case BOARD_EVENT_BIND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_SCAN_PROG:
@@ -218,20 +140,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_EMERGENCY_WARNING_SIGNAL:
                break; /* BOARD_EVENT_EMERGENCY_WARNING_SIGNAL */
        case BOARD_EVENT_FE_LOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                        board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_LOCK */
        case BOARD_EVENT_FE_UNLOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_UNLOCK */
        case BOARD_EVENT_DEMOD_LOCK:
                break; /* BOARD_EVENT_DEMOD_LOCK */
@@ -248,20 +158,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_RECEPTION_LOST_0:
                break; /* BOARD_EVENT_RECEPTION_LOST_0 */
        case BOARD_EVENT_MULTIPLEX_OK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_OK */
        case BOARD_EVENT_MULTIPLEX_ERRORS:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_ERRORS */
        default:
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index a246903c3341..bd9ab9d0d12a 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -816,7 +816,7 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
        sms_debug("set device mode to %d", mode);
        if (coredev->device_flags & SMS_DEVICE_FAMILY2) {
-                if (mode < DEVICE_MODE_DVBT || mode > DEVICE_MODE_RAW_TUNER) {
+                if (mode < DEVICE_MODE_DVBT || mode >= DEVICE_MODE_RAW_TUNER) {
                        sms_err("invalid mode specified %d", mode);
                        return -EINVAL;
                }
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 84b6fc15519d..dcf9fa9264bb 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -920,6 +920,8 @@ source "drivers/media/video/pwc/Kconfig"
 config USB_ZR364XX
        tristate "USB ZR364XX Camera support"
        depends on VIDEO_V4L2
+        select VIDEOBUF_GEN
+        select VIDEOBUF_VMALLOC
        ---help---
          Say Y here if you want to connect this type of camera to your
          computer's USB port.
diff --git a/drivers/media/video/bw-qcam.c b/drivers/media/video/bw-qcam.c
index 10dbd4a11b30..9e39bc5f7b00 100644
--- a/drivers/media/video/bw-qcam.c
+++ b/drivers/media/video/bw-qcam.c
@@ -992,7 +992,7 @@ static int accept_bwqcam(struct parport *port)
        if (parport[0] && strncmp(parport[0], "auto", 4) != 0) {
                /* user gave parport parameters */
-                for(n=0; parport[n] && n<MAX_CAMS; n++){
+                for (n = 0; n < MAX_CAMS && parport[n]; n++) {
                        char *ep;
                        unsigned long r;
                        r = simple_strtoul(parport[n], &ep, 0);
diff --git a/drivers/media/video/cx18/cx18-controls.c b/drivers/media/video/cx18/cx18-controls.c
index 5136df198338..93f0dae01350 100644
--- a/drivers/media/video/cx18/cx18-controls.c
+++ b/drivers/media/video/cx18/cx18-controls.c
@@ -20,6 +20,7 @@
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
 *  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "cx18-driver.h"
 #include "cx18-cards.h"
@@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index e0cf21e0b1bf..1a1048b18f70 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1715,6 +1715,8 @@ static struct video_device cx23885_mpeg_template = {
        .fops          = &mpeg_fops,
        .ioctl_ops     = &mpeg_ioctl_ops,
        .minor         = -1,
+        .tvnorms       = CX23885_NORMS,
+        .current_norm  = V4L2_STD_NTSC_M,
 };
 void cx23885_417_unregister(struct cx23885_dev *dev)
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index a5cc1c1fc2d6..39465301ec94 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -3003,6 +3003,14 @@ void cx88_setup_xc3028(struct cx88_core *core, struct xc2028_ctrl *ctl)
        case CX88_BOARD_DVICO_FUSIONHDTV_5_PCI_NANO:
                ctl->demod = XC3028_FE_OREN538;
                break;
+        case CX88_BOARD_GENIATECH_X8000_MT:
+                /* FIXME: For this board, the xc3028 never recovers after being
+                   powered down (the reset GPIO probably is not set properly).
+                   We don't have access to the hardware so we cannot determine
+                   which GPIO is used for xc3028, so just disable power xc3028
+                   power management for now */
+                ctl->disable_power_mgmt = 1;
+                break;
        case CX88_BOARD_WINFAST_TV2000_XP_GLOBAL:
        case CX88_BOARD_PROLINK_PV_GLOBAL_XTREME:
        case CX88_BOARD_PROLINK_PV_8000GT:
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index c44e87600219..e237b507659b 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -501,6 +501,7 @@ static struct zl10353_config cx88_pinnacle_hybrid_pctv = {
 static struct zl10353_config cx88_geniatech_x8000_mt = {
       .demod_address = (0x1e >> 1),
       .no_tuner = 1,
+       .disable_i2c_gate_ctrl = 1,
 };
 static struct s5h1411_config dvico_fusionhdtv7_config = {
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index da4e3912cd37..7172dcf2a4fa 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -116,6 +116,10 @@ static int cx8802_start_dma(struct cx8802_dev    *dev,
                        udelay(100);
                        break;
                case CX88_BOARD_HAUPPAUGE_HVR1300:
+                        /* Enable MPEG parallel IO and video signal pins */
+                        cx_write(MO_PINMUX_IO, 0x88);
+                        cx_write(TS_SOP_STAT, 0);
+                        cx_write(TS_VALERR_CNTRL, 0);
                        break;
                case CX88_BOARD_PINNACLE_PCTV_HD_800i:
                        /* Enable MPEG parallel IO and video signal pins */
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 320f1f60276e..ed281f565945 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -218,7 +218,7 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
 struct em28xx_board em28xx_boards[] = {
        [EM2750_BOARD_UNKNOWN] = {
                .name          = "EM2710/EM2750/EM2751 webcam grabber",
-                .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
+                .xclk          = EM28XX_XCLK_FREQUENCY_20MHZ,
                .tuner_type    = TUNER_ABSENT,
                .is_webcam     = 1,
                .input         = { {
@@ -622,22 +622,27 @@ struct em28xx_board em28xx_boards[] = {
        },
        [EM2861_BOARD_PLEXTOR_PX_TV100U] = {
                .name         = "Plextor ConvertX PX-TV100U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                .tuner_type   = TUNER_TNF_5335MF,
+                .xclk         = EM28XX_XCLK_I2S_MSB_TIMING |
+                                EM28XX_XCLK_FREQUENCY_12MHZ,
                .tda9887_conf = TDA9887_PRESENT,
                .decoder      = EM28XX_TVP5150,
+                .has_msp34xx  = 1,
                .input        = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                } },
        },
@@ -1544,6 +1549,8 @@ struct usb_device_id em28xx_id_table[] = {
                        .driver_info = EM2750_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2800),
                        .driver_info = EM2800_BOARD_UNKNOWN },
+        { USB_DEVICE(0xeb1a, 0x2710),
+                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2820),
                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2821),
@@ -1761,6 +1768,7 @@ static int em28xx_hint_sensor(struct em28xx *dev)
        __be16 version_be;
        u16 version;
+        /* Micron sensor detection */
        dev->i2c_client.addr = 0xba >> 1;
        cmd = 0;
        i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1769,15 +1777,27 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                return -EINVAL;
        version = be16_to_cpu(version_be);
        switch (version) {
-        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8232:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8243:            /* mt9v011 rev B 640x480 1.3 Mpix sensor */
                dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
+                em28xx_set_model(dev);
                sensor_name = "mt9v011";
                dev->em28xx_sensor = EM28XX_MT9V011;
                dev->sensor_xres = 640;
                dev->sensor_yres = 480;
-                dev->sensor_xtal = 6300000;
+                /*
+                 * FIXME: mt9v011 uses I2S speed as xtal clk - at least with
+                 * the Silvercrest cam I have here for testing - for higher
+                 * resolutions, a high clock cause horizontal artifacts, so we
+                 * need to use a lower xclk frequency.
+                 * Yet, it would be possible to adjust xclk depending on the
+                 * desired resolution, since this affects directly the
+                 * frame rate.
+                 */
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_4_3MHZ;
+                dev->sensor_xtal = 4300000;
                /* probably means GRGB 16 bit bayer */
                dev->vinmode = 0x0d;
@@ -1786,6 +1806,8 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                break;
        case 0x8431:
                dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
                sensor_name = "mt9m001";
                dev->em28xx_sensor = EM28XX_MT9M001;
                em28xx_initialize_mt9m001(dev);
@@ -1802,6 +1824,9 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                return -EINVAL;
        }
+        /* Setup webcam defaults */
+        em28xx_pre_card_setup(dev);
        em28xx_errdev("Sensor is %s, using model %s entry.\n",
                      sensor_name, em28xx_boards[dev->model].name);
@@ -1813,60 +1838,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
 */
 void em28xx_pre_card_setup(struct em28xx *dev)
 {
-        int rc;
-        em28xx_set_model(dev);
-        em28xx_info("Identified as %s (card=%d)\n",
-                    dev->board.name, dev->model);
-        /* Set the default GPO/GPIO for legacy devices */
-        dev->reg_gpo_num = EM2880_R04_GPO;
-        dev->reg_gpio_num = EM28XX_R08_GPIO;
-        dev->wait_after_write = 5;
-        /* Based on the Chip ID, set the device configuration */
-        rc = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
-        if (rc > 0) {
-                dev->chip_id = rc;
-                switch (dev->chip_id) {
-                case CHIP_ID_EM2750:
-                        em28xx_info("chip ID is em2750\n");
-                        break;
-                case CHIP_ID_EM2820:
-                        em28xx_info("chip ID is em2710 or em2820\n");
-                        break;
-                case CHIP_ID_EM2840:
-                        em28xx_info("chip ID is em2840\n");
-                        break;
-                case CHIP_ID_EM2860:
-                        em28xx_info("chip ID is em2860\n");
-                        break;
-                case CHIP_ID_EM2870:
-                        em28xx_info("chip ID is em2870\n");
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2874:
-                        em28xx_info("chip ID is em2874\n");
-                        dev->reg_gpio_num = EM2874_R80_GPIO;
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2883:
-                        em28xx_info("chip ID is em2882/em2883\n");
-                        dev->wait_after_write = 0;
-                        break;
-                default:
-                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
-                }
-        }
-        /* Prepopulate cached GPO register content */
-        rc = em28xx_read_reg(dev, dev->reg_gpo_num);
-        if (rc >= 0)
-                dev->reg_gpo = rc;
        /* Set the initial XCLK and I2C clock values based on the board
           definition */
        em28xx_write_reg(dev, EM28XX_R0F_XCLK, dev->board.xclk & 0x7f);
@@ -1876,9 +1847,8 @@ void em28xx_pre_card_setup(struct em28xx *dev)
        /* request some modules */
        switch (dev->model) {
        case EM2861_BOARD_PLEXTOR_PX_TV100U:
-                /* FIXME guess */
+                /* Sets the msp34xx I2S speed */
-                /* Turn on analog audio output */
+                dev->i2s_speed = 2048000;
-                em28xx_write_reg(dev, EM28XX_R08_GPIO, 0xfd);
                break;
        case EM2861_BOARD_KWORLD_PVRTV_300U:
        case EM2880_BOARD_KWORLD_DVB_305U:
@@ -2216,7 +2186,20 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 void em28xx_card_setup(struct em28xx *dev)
 {
-        em28xx_set_model(dev);
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam) {
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
+                else
+                        dev->progressive = 1;
+        } else
+                em28xx_set_model(dev);
+        em28xx_info("Identified as %s (card=%d)\n",
+                    dev->board.name, dev->model);
        dev->tuner_type = em28xx_boards[dev->model].tuner_type;
        if (em28xx_boards[dev->model].tuner_addr)
@@ -2290,10 +2273,6 @@ void em28xx_card_setup(struct em28xx *dev)
                em28xx_gpio_set(dev, dev->board.tuner_gpio);
                em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                break;
-        case EM2820_BOARD_SILVERCREST_WEBCAM:
-                /* FIXME: need to document the registers bellow */
-                em28xx_write_reg(dev, 0x0d, 0x42);
-                em28xx_write_reg(dev, 0x13, 0x08);
        }
        if (dev->board.has_snapshot_button)
@@ -2433,7 +2412,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                           int minor)
 {
        struct em28xx *dev = *devhandle;
-        int retval = -ENOMEM;
+        int retval;
        int errCode;
        dev->udev = udev;
@@ -2450,6 +2429,58 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->em28xx_read_reg_req = em28xx_read_reg_req;
        dev->board.is_em2800 = em28xx_boards[dev->model].is_em2800;
+        em28xx_set_model(dev);
+        /* Set the default GPO/GPIO for legacy devices */
+        dev->reg_gpo_num = EM2880_R04_GPO;
+        dev->reg_gpio_num = EM28XX_R08_GPIO;
+        dev->wait_after_write = 5;
+        /* Based on the Chip ID, set the device configuration */
+        retval = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
+        if (retval > 0) {
+                dev->chip_id = retval;
+                switch (dev->chip_id) {
+                case CHIP_ID_EM2710:
+                        em28xx_info("chip ID is em2710\n");
+                        break;
+                case CHIP_ID_EM2750:
+                        em28xx_info("chip ID is em2750\n");
+                        break;
+                case CHIP_ID_EM2820:
+                        em28xx_info("chip ID is em2820 (or em2710)\n");
+                        break;
+                case CHIP_ID_EM2840:
+                        em28xx_info("chip ID is em2840\n");
+                        break;
+                case CHIP_ID_EM2860:
+                        em28xx_info("chip ID is em2860\n");
+                        break;
+                case CHIP_ID_EM2870:
+                        em28xx_info("chip ID is em2870\n");
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2874:
+                        em28xx_info("chip ID is em2874\n");
+                        dev->reg_gpio_num = EM2874_R80_GPIO;
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2883:
+                        em28xx_info("chip ID is em2882/em2883\n");
+                        dev->wait_after_write = 0;
+                        break;
+                default:
+                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
+                }
+        }
+        /* Prepopulate cached GPO register content */
+        retval = em28xx_read_reg(dev, dev->reg_gpo_num);
+        if (retval >= 0)
+                dev->reg_gpo = retval;
        em28xx_pre_card_setup(dev);
        if (!dev->board.is_em2800) {
@@ -2484,14 +2515,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->vinmode = 0x10;
        dev->vinctl  = 0x11;
-        /*
-         * If the device can be a webcam, seek for a sensor.
-         * If sensor is not found, then it isn't a webcam.
-         */
-        if (dev->board.is_webcam)
-                if (em28xx_hint_sensor(dev) < 0)
-                        dev->board.is_webcam = 0;
        /* Do board specific init and eeprom reading */
        em28xx_card_setup(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5b78e199abd1..98e140b5d95e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -632,6 +632,9 @@ int em28xx_capture_start(struct em28xx *dev, int start)
                return rc;
        }
+        if (dev->board.is_webcam)
+                rc = em28xx_write_reg(dev, 0x13, 0x0c);
        /* enable video capture */
        rc = em28xx_write_reg(dev, 0x48, 0x00);
@@ -720,7 +723,10 @@ int em28xx_resolution_set(struct em28xx *dev)
 {
        int width, height;
        width = norm_maxw(dev);
-        height = norm_maxh(dev) >> 1;
+        height = norm_maxh(dev);
+        if (!dev->progressive)
+                height >>= norm_maxh(dev);
        em28xx_set_outfmt(dev);
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index cf0ac7f2a30d..d603575431b4 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -478,7 +478,6 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_KWORLD_DVB_310U:
-        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_with_xc3028,
                                           &dev->i2c_adap);
@@ -488,6 +487,7 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_xc3028_no_i2c_gate,
                                           &dev->i2c_adap);
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index a2676d63cfd0..6bf84bd787df 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -176,7 +176,8 @@
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
-        CHIP_ID_EM2820 = 18,    /* Also used by em2710 */
+        CHIP_ID_EM2710 = 17,
+        CHIP_ID_EM2820 = 18,    /* Also used by some em2710 */
        CHIP_ID_EM2840 = 20,
        CHIP_ID_EM2750 = 33,
        CHIP_ID_EM2860 = 34,
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ff37b4c15f44..ab079d9256c4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -194,15 +194,24 @@ static void em28xx_copy_video(struct em28xx *dev,
        startread = p;
        remain = len;
-        /* Interlaces frame */
+        if (dev->progressive)
-        if (buf->top_field)
                fieldstart = outp;
-        else
+        else {
-                fieldstart = outp + bytesperline;
+                /* Interlaces two half frames */
+                if (buf->top_field)
+                        fieldstart = outp;
+                else
+                        fieldstart = outp + bytesperline;
+        }
        linesdone = dma_q->pos / bytesperline;
        currlinedone = dma_q->pos % bytesperline;
-        offset = linesdone * bytesperline * 2 + currlinedone;
+        if (dev->progressive)
+                offset = linesdone * bytesperline + currlinedone;
+        else
+                offset = linesdone * bytesperline * 2 + currlinedone;
        startwrite = fieldstart + offset;
        lencopy = bytesperline - currlinedone;
        lencopy = lencopy > remain ? remain : lencopy;
@@ -376,7 +385,7 @@ static inline int em28xx_isoc_copy(struct em28xx *dev, struct urb *urb)
                        em28xx_isocdbg("Video frame %d, length=%i, %s\n", p[2],
                                       len, (p[2] & 1) ? "odd" : "even");
-                        if (!(p[2] & 1)) {
+                        if (dev->progressive || !(p[2] & 1)) {
                                if (buf != NULL)
                                        buffer_filled(dev, dma_q, buf);
                                get_next_buf(dma_q, &buf);
@@ -689,7 +698,10 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
        /* FIXME: TOP? NONE? BOTTOM? ALTENATE? */
-        f->fmt.pix.field = dev->interlaced ?
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        mutex_unlock(&dev->lock);
@@ -753,7 +765,11 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.bytesperline = (dev->width * fmt->depth + 7) >> 3;
        f->fmt.pix.sizeimage = f->fmt.pix.bytesperline * height;
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
+                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        return 0;
 }
@@ -846,6 +862,41 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm)
        return 0;
 }
+static int vidioc_g_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        int rc = 0;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (dev->board.is_webcam)
+                rc = v4l2_device_call_until_err(&dev->v4l2_dev, 0,
+                                                video, g_parm, p);
+        else
+                v4l2_video_std_frame_period(dev->norm,
+                                                 &p->parm.capture.timeperframe);
+        return rc;
+}
+static int vidioc_s_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        if (!dev->board.is_webcam)
+                return -EINVAL;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        return v4l2_device_call_until_err(&dev->v4l2_dev, 0, video, s_parm, p);
+}
 static const char *iname[] = {
        [EM28XX_VMUX_COMPOSITE1] = "Composite1",
        [EM28XX_VMUX_COMPOSITE2] = "Composite2",
@@ -1624,6 +1675,7 @@ static int em28xx_v4l2_open(struct file *filp)
        struct em28xx *dev;
        enum v4l2_buf_type fh_type;
        struct em28xx_fh *fh;
+        enum v4l2_field field;
        dev = em28xx_get_device(minor, &fh_type, &radio);
@@ -1665,8 +1717,13 @@ static int em28xx_v4l2_open(struct file *filp)
        dev->users++;
+        if (dev->progressive)
+                field = V4L2_FIELD_NONE;
+        else
+                field = V4L2_FIELD_INTERLACED;
        videobuf_queue_vmalloc_init(&fh->vb_vidq, &em28xx_video_qops,
-                        NULL, &dev->slock, fh->type, V4L2_FIELD_INTERLACED,
+                        NULL, &dev->slock, fh->type, field,
                        sizeof(struct em28xx_buffer), fh);
        mutex_unlock(&dev->lock);
@@ -1885,6 +1942,8 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
        .vidioc_qbuf                = vidioc_qbuf,
        .vidioc_dqbuf               = vidioc_dqbuf,
        .vidioc_s_std               = vidioc_s_std,
+        .vidioc_g_parm              = vidioc_g_parm,
+        .vidioc_s_parm              = vidioc_s_parm,
        .vidioc_enum_input          = vidioc_enum_input,
        .vidioc_g_input             = vidioc_g_input,
        .vidioc_s_input             = vidioc_s_input,
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 45bd513f62dc..8c2dc38bca9f 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -484,6 +484,9 @@ struct em28xx {
        int sensor_xres, sensor_yres;
        int sensor_xtal;
+        /* Allows progressive (e. g. non-interlaced) mode */
+        int progressive;
        /* Vinmode/Vinctl used at the driver */
        int vinmode, vinctl;
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index ccd47f57f42c..d678765cbba2 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -1220,6 +1220,8 @@ static const struct video_device hdpvr_video_template = {
                V4L2_STD_PAL_G | V4L2_STD_PAL_H | V4L2_STD_PAL_I |
                V4L2_STD_PAL_D | V4L2_STD_PAL_M | V4L2_STD_PAL_N |
                V4L2_STD_PAL_60,
+        .current_norm           = V4L2_STD_NTSC | V4L2_STD_PAL_M |
+                V4L2_STD_PAL_60,
 };
 int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
diff --git a/drivers/media/video/ivtv/ivtv-controls.c b/drivers/media/video/ivtv/ivtv-controls.c
index a3b77ed3f089..4a9c8ce0ecb3 100644
--- a/drivers/media/video/ivtv/ivtv-controls.c
+++ b/drivers/media/video/ivtv/ivtv-controls.c
@@ -17,6 +17,7 @@
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "ivtv-driver.h"
 #include "ivtv-cards.h"
@@ -281,7 +282,7 @@ int ivtv_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        ivtv_call_all(itv, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index b2260de645f0..cc85f77a5706 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -52,13 +52,34 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
                .step = 1,
                .default_value = 0,
                .flags = 0,
-        },
+        }, {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Mirror",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vflip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+        }
 };
 struct mt9v011 {
        struct v4l2_subdev sd;
        unsigned width, height;
        unsigned xtal;
+        unsigned hflip:1;
+        unsigned vflip:1;
        u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +152,6 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
                { R0A_MT9V011_CLK_SPEED, 0x0000 },
                { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
-                { R20_MT9V011_READ_MODE, 0x1000 },
                { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
@@ -156,7 +176,7 @@ static void set_balance(struct v4l2_subdev *sd)
        mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
-static void calc_fps(struct v4l2_subdev *sd)
+static void calc_fps(struct v4l2_subdev *sd, u32 *numerator, u32 *denominator)
 {
        struct mt9v011 *core = to_mt9v011(sd);
        unsigned height, width, hblank, vblank, speed;
@@ -179,6 +199,51 @@ static void calc_fps(struct v4l2_subdev *sd)
        v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
                tmp / 1000, tmp % 1000, t_time);
+        if (numerator && denominator) {
+                *numerator = 1000;
+                *denominator = (u32)frames_per_ms;
+        }
+}
+static u16 calc_speed(struct v4l2_subdev *sd, u32 numerator, u32 denominator)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank;
+        unsigned row_time, line_time;
+        u64 t_time, speed;
+        /* Avoid bogus calculus */
+        if (!numerator || !denominator)
+                return 0;
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+        row_time = width + 113 + hblank;
+        line_time = height + vblank + 1;
+        t_time = core->xtal * ((u64)numerator);
+        /* round to the closest value */
+        t_time += denominator / 2;
+        do_div(t_time, denominator);
+        speed = t_time;
+        do_div(speed, row_time * line_time);
+        /* Avoid having a negative value for speed */
+        if (speed < 2)
+                speed = 0;
+        else
+                speed -= 2;
+        /* Avoid speed overflow */
+        if (speed > 15)
+                return 15;
+        return (u16)speed;
 }
 static void set_res(struct v4l2_subdev *sd)
@@ -207,9 +272,23 @@ static void set_res(struct v4l2_subdev *sd)
        mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
        mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
-        calc_fps(sd);
+        calc_fps(sd, NULL, NULL);
 };
+static void set_read_mode(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned mode = 0x1000;
+        if (core->hflip)
+                mode |= 0x4000;
+        if (core->vflip)
+                mode |= 0x8000;
+        mt9v011_write(sd, R20_MT9V011_READ_MODE, mode);
+}
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
 {
        int i;
@@ -220,6 +299,7 @@ static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
        set_balance(sd);
        set_res(sd);
+        set_read_mode(sd);
        return 0;
 };
@@ -240,6 +320,12 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                ctrl->value = core->blue_bal;
                return 0;
+        case V4L2_CID_HFLIP:
+                ctrl->value = core->hflip ? 1 : 0;
+                return 0;
+        case V4L2_CID_VFLIP:
+                ctrl->value = core->vflip ? 1 : 0;
+                return 0;
        }
        return -EINVAL;
 }
@@ -288,6 +374,14 @@ static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                core->blue_bal = ctrl->value;
                break;
+        case V4L2_CID_HFLIP:
+                core->hflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
+        case V4L2_CID_VFLIP:
+                core->vflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
        default:
                return -EINVAL;
        }
@@ -322,6 +416,44 @@ static int mt9v011_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
        return 0;
 }
+static int mt9v011_g_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        memset(cp, 0, sizeof(struct v4l2_captureparm));
+        cp->capability = V4L2_CAP_TIMEPERFRAME;
+        calc_fps(sd,
+                 &cp->timeperframe.numerator,
+                 &cp->timeperframe.denominator);
+        return 0;
+}
+static int mt9v011_s_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        struct v4l2_fract *tpf = &cp->timeperframe;
+        u16 speed;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (cp->extendedmode != 0)
+                return -EINVAL;
+        speed = calc_speed(sd, tpf->numerator, tpf->denominator);
+        mt9v011_write(sd, R0A_MT9V011_CLK_SPEED, speed);
+        v4l2_dbg(1, debug, sd, "Setting speed to %d\n", speed);
+        /* Recalculate and update fps info */
+        calc_fps(sd, &tpf->numerator, &tpf->denominator);
+        return 0;
+}
 static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
 {
        struct v4l2_pix_format *pix = &fmt->fmt.pix;
@@ -393,10 +525,13 @@ static int mt9v011_s_register(struct v4l2_subdev *sd,
 static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
                                struct v4l2_dbg_chip_ident *chip)
 {
+        u16 version;
        struct i2c_client *client = v4l2_get_subdevdata(sd);
+        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
        return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_MT9V011,
-                                          MT9V011_VERSION);
+                                          version);
 }
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
@@ -416,6 +551,8 @@ static const struct v4l2_subdev_video_ops mt9v011_video_ops = {
        .enum_fmt = mt9v011_enum_fmt,
        .try_fmt = mt9v011_try_fmt,
        .s_fmt = mt9v011_s_fmt,
+        .g_parm = mt9v011_g_parm,
+        .s_parm = mt9v011_s_parm,
 };
 static const struct v4l2_subdev_ops mt9v011_ops = {
@@ -449,8 +586,9 @@ static int mt9v011_probe(struct i2c_client *c,
        /* Check if the sensor is really a MT9V011 */
        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
-        if (version != MT9V011_VERSION) {
+        if ((version != MT9V011_VERSION) &&
-                v4l2_info(sd, "*** unknown micron chip detected (0x%04x.\n",
+            (version != MT9V011_REV_B_VERSION)) {
+                v4l2_info(sd, "*** unknown micron chip detected (0x%04x).\n",
                          version);
                kfree(core);
                return -EINVAL;
@@ -461,8 +599,8 @@ static int mt9v011_probe(struct i2c_client *c,
        core->height = 480;
        core->xtal = 27000000;  /* Hz */
-        v4l_info(c, "chip found @ 0x%02x (%s)\n",
+        v4l_info(c, "chip found @ 0x%02x (%s - chip version 0x%04x)\n",
-                 c->addr << 1, c->adapter->name);
+                 c->addr << 1, c->adapter->name, version);
        return 0;
 }
diff --git a/drivers/media/video/mt9v011.h b/drivers/media/video/mt9v011.h
index 9e443ee30558..3350fd6083c3 100644
--- a/drivers/media/video/mt9v011.h
+++ b/drivers/media/video/mt9v011.h
@@ -30,6 +30,7 @@
 #define R35_MT9V011_GLOBAL_GAIN         0x35
 #define RF1_MT9V011_CHIP_ENABLE         0xf1
-#define MT9V011_VERSION                 0x8243
+#define MT9V011_VERSION                 0x8232
+#define MT9V011_REV_B_VERSION           0x8243
 #endif
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 2d075205bdfe..736c31d23194 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev)
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void mx1_videobuf_queue(struct videobuf_queue *vq,
                                                struct videobuf_buffer *vb)
 {
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct mx1_camera_dev *pcdev = ici->priv;
        struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                vb, vb->baddr, vb->bsize);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
                        __raw_writel(temp, pcdev->base + CSICR1);
                }
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void mx1_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index e605c076ed89..9770cb7932ca 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc)
        }
 }
-/* Called with .vb_lock held */
+/*
+ * Called with .vb_lock mutex held and
+ * under spinlock_irqsave(&mx3_cam->lock, ...)
+ */
 static void mx3_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        struct idmac_video_param *video = &ichan->params.video;
        const struct soc_camera_data_format *data_fmt = icd->current_fmt;
        dma_cookie_t cookie;
-        unsigned long flags;
+        BUG_ON(!irqs_disabled());
        /* This is the configuration of one sg-element */
        video->out_pixel_fmt    = fourcc_to_ipu_pix(data_fmt->fourcc);
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_add_tail(&vb->queue, &mx3_cam->capture);
        if (!mx3_cam->active) {
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
                vb->state = VIDEOBUF_QUEUED;
        }
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
        cookie = txd->tx_submit(txd);
        dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg));
+        spin_lock_irq(&mx3_cam->lock);
        if (cookie >= 0)
                return;
        /* Submit error */
        vb->state = VIDEOBUF_PREPARED;
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_del_init(&vb->queue);
        if (mx3_cam->active == buf)
                mx3_cam->active = NULL;
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
 }
 /* Called with .vb_lock held */
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 46e0d8ad880f..016bb45ba0c3 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev)
        dev_dbg(pcdev->soc_host.dev, "%s\n", __func__);
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void pxa_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct pxa_camera_dev *pcdev = ici->priv;
        struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__,
                vb, vb->baddr, vb->bsize, pcdev->active);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        if (!pcdev->active)
                pxa_camera_start_capture(pcdev);
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void pxa_videobuf_release(struct videobuf_queue *vq,
@@ -1579,6 +1575,7 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
                pcdev->mclk = 20000000;
        }
+        pcdev->soc_host.dev = &pdev->dev;
        pcdev->mclk_divisor = mclk_get_divisor(pcdev);
        INIT_LIST_HEAD(&pcdev->capture);
@@ -1644,7 +1641,6 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
        pcdev->soc_host.drv_name        = PXA_CAM_DRV_NAME;
        pcdev->soc_host.ops             = &pxa_soc_camera_host_ops;
        pcdev->soc_host.priv            = pcdev;
-        pcdev->soc_host.dev             = &pdev->dev;
        pcdev->soc_host.nr              = pdev->id;
        err = soc_camera_host_register(&pcdev->soc_host);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 06861b782b95..6eebe3ef97d3 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3331,8 +3331,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0200100,
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1150] = {
-                .name           = "Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid",
+                .name           = "Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -3363,8 +3363,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0800100, /* GPIO 23 HI for FM */
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1110R3] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
-                .name           = "Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid",
+                .name           = "Hauppauge WinTV-HVR1120 DVB-T/Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -5862,31 +5862,31 @@ struct pci_device_id saa7134_pci_tbl[] = {
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6706,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6707,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6708,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6709,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x670a,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -6363,8 +6363,8 @@ static int saa7134_tda8290_18271_callback(struct saa7134_dev *dev,
        switch (command) {
        case TDA18271_CALLBACK_CMD_AGC_ENABLE: /* 0 */
                switch (dev->board) {
+                case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-                case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                        ret = saa7134_tda18271_hvr11x0_toggle_agc(dev, arg);
                        break;
                default:
@@ -6384,8 +6384,8 @@ static int saa7134_tda8290_callback(struct saa7134_dev *dev,
        int ret;
        switch (dev->board) {
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* tda8290 + tda18271 */
                ret = saa7134_tda8290_18271_callback(dev, command, arg);
                break;
@@ -6427,7 +6427,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        switch (tv.model) {
        case 67019: /* WinTV-HVR1110 (Retail, IR Blaster, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67109: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
-        case 67201: /* WinTV-HVR1120 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
+        case 67201: /* WinTV-HVR1150 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67301: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
        case 67209: /* WinTV-HVR1110 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67559: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
@@ -6435,7 +6435,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        case 67579: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM) */
        case 67589: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
        case 67599: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
-        case 67651: /* WinTV-HVR1120 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
+        case 67651: /* WinTV-HVR1150 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
        case 67659: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
                break;
        default:
@@ -6625,8 +6625,8 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_writeb (SAA7134_PRODUCTION_TEST_MODE, 0x00);
                break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* GPIO 26 high for digital, low for analog */
                saa7134_set_gpio(dev, 26, 0);
                msleep(1);
@@ -6891,8 +6891,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                       dev->name, saa7134_boards[dev->board].name);
               }
               break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                hauppauge_eeprom(dev, dev->eedata+0x80);
                break;
        case SAA7134_BOARD_HAUPPAUGE_HVR1110:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 31930f26ffc7..98f3efd1e944 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1119,7 +1119,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_2) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
                fe0->dvb.frontend = dvb_attach(tda10048_attach,
                                               &hcw_tda10048_config,
                                               &dev->i2c_adap);
@@ -1147,7 +1147,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_1) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                fe0->dvb.frontend = dvb_attach(lgdt3305_attach,
                                               &hcw_lgdt3305_config,
                                               &dev->i2c_adap);
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 82268848f26a..fb564f14887c 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -278,8 +278,8 @@ struct saa7134_format {
 #define SAA7134_BOARD_ASUSTeK_TIGER         152
 #define SAA7134_BOARD_KWORLD_PLUS_TV_ANALOG 153
 #define SAA7134_BOARD_AVERMEDIA_GO_007_FM_PLUS 154
-#define SAA7134_BOARD_HAUPPAUGE_HVR1120     155
+#define SAA7134_BOARD_HAUPPAUGE_HVR1150     155
-#define SAA7134_BOARD_HAUPPAUGE_HVR1110R3   156
+#define SAA7134_BOARD_HAUPPAUGE_HVR1120   156
 #define SAA7134_BOARD_AVERMEDIA_STUDIO_507UA 157
 #define SAA7134_BOARD_AVERMEDIA_CARDBUS_501 158
 #define SAA7134_BOARD_BEHOLD_505RDS         159
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 0db88a53d92c..e86878deea71 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -282,27 +282,24 @@ out:
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,
                                         struct videobuf_buffer *vb)
 {
        struct soc_camera_device *icd = vq->priv_data;
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct sh_mobile_ceu_dev *pcdev = ici->priv;
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,
                vb, vb->baddr, vb->bsize);
        vb->state = VIDEOBUF_QUEUED;
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        if (!pcdev->active) {
                pcdev->active = vb;
                sh_mobile_ceu_capture(pcdev);
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 4d6785e63455..b154bd961e3b 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -1050,8 +1050,8 @@ static int stk_setup_format(struct stk_camera *dev)
                depth = 1;
        else
                depth = 2;
-        while (stk_sizes[i].m != dev->vsettings.mode
+        while (i < ARRAY_SIZE(stk_sizes) &&
-                        && i < ARRAY_SIZE(stk_sizes))
+                        stk_sizes[i].m != dev->vsettings.mode)
                i++;
        if (i == ARRAY_SIZE(stk_sizes)) {
                STK_ERROR("Something is broken in %s\n", __func__);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89927b7aec28..04b47832fa0a 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1845,11 +1845,29 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
-        /* ViMicro */
+        /* ViMicro Vega */
-        { .match_flags          = USB_DEVICE_ID_MATCH_VENDOR
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x332d,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x3410,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro Venus - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
          .idVendor             = 0x0ac8,
-          .idProduct            = 0x0000,
+          .idProduct            = 0x3420,
          .bInterfaceClass      = USB_CLASS_VIDEO,
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index f152a9903862..1ca6dff73612 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -145,8 +145,8 @@ static void uvc_status_complete(struct urb *urb)
                        break;
                default:
-                        uvc_printk(KERN_INFO, "unknown event type %u.\n",
+                        uvc_trace(UVC_TRACE_STATUS, "Unknown status event "
-                                dev->status[0]);
+                                "type %u.\n", dev->status[0]);
                        break;
                }
        }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index be64a502ea27..f2afc4e08379 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1081,8 +1081,10 @@ static long __video_do_ioctl(struct file *file,
                /* Calls the specific handler */
                if (ops->vidioc_g_std)
                        ret = ops->vidioc_g_std(file, fh, id);
-                else
+                else if (vfd->current_norm)
                        *id = vfd->current_norm;
+                else
+                        ret = -EINVAL;
                if (!ret)
                        dbgarg(cmd, "std=0x%08Lx\n", (long long unsigned)*id);
@@ -1553,12 +1555,19 @@ static long __video_do_ioctl(struct file *file,
                                break;
                        ret = ops->vidioc_g_parm(file, fh, p);
                } else {
+                        v4l2_std_id std = vfd->current_norm;
                        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                return -EINVAL;
-                        v4l2_video_std_frame_period(vfd->current_norm,
-                                                    &p->parm.capture.timeperframe);
                        ret = 0;
+                        if (ops->vidioc_g_std)
+                                ret = ops->vidioc_g_std(file, fh, &std);
+                        else if (std == 0)
+                                ret = -EINVAL;
+                        if (ret == 0)
+                                v4l2_video_std_frame_period(std,
+                                                    &p->parm.capture.timeperframe);
                }
                dbgarg(cmd, "type=%d\n", p->type);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c20416850948..45675889850b 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -235,6 +235,7 @@ enum vortex_chips {
        CH_3C900B_FL,
        CH_3C905_1,
        CH_3C905_2,
+        CH_3C905B_TX,
        CH_3C905B_1,
        CH_3C905B_2,
@@ -307,6 +308,8 @@ static struct vortex_chip_info {
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
        {"3c905 Boomerang 100baseT4",
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
+        {"3C905B-TX Fast Etherlink XL PCI",
+         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
        {"3c905B Cyclone 100baseTx",
         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
@@ -389,6 +392,7 @@ static struct pci_device_id vortex_pci_tbl[] = {
        { 0x10B7, 0x900A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C900B_FL },
        { 0x10B7, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_1 },
        { 0x10B7, 0x9051, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_2 },
+        { 0x10B7, 0x9054, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_TX },
        { 0x10B7, 0x9055, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_1 },
        { 0x10B7, 0x9058, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_2 },
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 50efde11ea6c..d0dbbf39349a 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -515,7 +515,7 @@ rx_status_loop:
                dma_addr_t mapping;
                struct sk_buff *skb, *new_skb;
                struct cp_desc *desc;
-                unsigned buflen;
+                const unsigned buflen = cp->rx_buf_sz;
                skb = cp->rx_skb[rx_tail];
                BUG_ON(!skb);
@@ -549,8 +549,7 @@ rx_status_loop:
                        pr_debug("%s: rx slot %d status 0x%x len %d\n",
                               dev->name, rx_tail, status, len);
-                buflen = cp->rx_buf_sz + NET_IP_ALIGN;
+                new_skb = netdev_alloc_skb(dev, buflen + NET_IP_ALIGN);
-                new_skb = netdev_alloc_skb(dev, buflen);
                if (!new_skb) {
                        dev->stats.rx_dropped++;
                        goto rx_next;
diff --git a/drivers/net/atl1c/atl1c_ethtool.c b/drivers/net/atl1c/atl1c_ethtool.c
index 607007d75b6f..00d11b480af3 100644
--- a/drivers/net/atl1c/atl1c_ethtool.c
+++ b/drivers/net/atl1c/atl1c_ethtool.c
@@ -232,11 +232,11 @@ static void atl1c_get_drvinfo(struct net_device *netdev,
 {
        struct atl1c_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, atl1c_driver_version,
+        strlcpy(drvinfo->version, atl1c_driver_version,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->n_stats = 0;
        drvinfo->testinfo_len = 0;
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 94d7325caf4f..8bca12f71390 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3378,11 +3378,11 @@ static void atl1_get_drvinfo(struct net_device *netdev,
 {
        struct atl1_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, ATLX_DRIVER_VERSION,
+        strlcpy(drvinfo->version, ATLX_DRIVER_VERSION,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->eedump_len = ATL1_EEDUMP_LEN;
 }
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 36d4d377ec2f..bafca672ea7d 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -952,9 +952,10 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int rc = NETDEV_TX_OK;
        dma_addr_t mapping;
        u32 len, entry, ctrl;
+        unsigned long flags;
        len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
        /* This is a hard error, log it. */
        if (unlikely(TX_BUFFS_AVAIL(bp) < 1)) {
@@ -1027,7 +1028,7 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
 out_unlock:
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
        return rc;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index b70cc99962fc..06b901152d44 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -399,9 +399,11 @@ static int bnx2_unregister_cnic(struct net_device *dev)
        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
        struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+        mutex_lock(&bp->cnic_lock);
        cp->drv_state = 0;
        bnapi->cnic_present = 0;
        rcu_assign_pointer(bp->cnic_ops, NULL);
+        mutex_unlock(&bp->cnic_lock);
        synchronize_rcu();
        return 0;
 }
@@ -429,13 +431,13 @@ bnx2_cnic_stop(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                info.cmd = CNIC_CTL_STOP_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 static void
@@ -444,8 +446,8 @@ bnx2_cnic_start(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
                        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
@@ -455,7 +457,7 @@ bnx2_cnic_start(struct bnx2 *bp)
                info.cmd = CNIC_CTL_START_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 #else
@@ -7663,6 +7665,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
        spin_lock_init(&bp->phy_lock);
        spin_lock_init(&bp->indirect_lock);
+#ifdef BCM_CNIC
+        mutex_init(&bp->cnic_lock);
+#endif
        INIT_WORK(&bp->reset_task, bnx2_reset_task);
        dev->base_addr = dev->mem_start = pci_resource_start(pdev, 0);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index f1edfaa9e56a..a4f12fd0ecd2 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6902,6 +6902,7 @@ struct bnx2 {
        u32                     idle_chk_status_idx;
 #ifdef BCM_CNIC
+        struct mutex            cnic_lock;
        struct cnic_eth_dev     cnic_eth_dev;
 #endif
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9e4283aff828..e1a4f8214239 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -611,11 +611,18 @@ nla_put_failure:
        return -EMSGSIZE;
 }
+static int can_newlink(struct net_device *dev,
+                       struct nlattr *tb[], struct nlattr *data[])
+{
+        return -EOPNOTSUPP;
+}
 static struct rtnl_link_ops can_link_ops __read_mostly = {
        .kind           = "can",
        .maxtype        = IFLA_CAN_MAX,
        .policy         = can_policy,
        .setup          = can_setup,
+        .newlink        = can_newlink,
        .changelink     = can_changelink,
        .fill_info      = can_fill_info,
        .fill_xstats    = can_fill_xstats,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4869d77cbe91..74c342959b7b 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -138,6 +138,16 @@ static struct cnic_dev *cnic_from_netdev(struct net_device *netdev)
        return NULL;
 }
+static inline void ulp_get(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_inc(&ulp_ops->ref_count);
+}
+static inline void ulp_put(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_dec(&ulp_ops->ref_count);
+}
 static void cnic_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off, u32 val)
 {
        struct cnic_local *cp = dev->cnic_priv;
@@ -358,6 +368,7 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
        }
        read_unlock(&cnic_dev_lock);
+        atomic_set(&ulp_ops->ref_count, 0);
        rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
        mutex_unlock(&cnic_lock);
@@ -379,6 +390,8 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 int cnic_unregister_driver(int ulp_type)
 {
        struct cnic_dev *dev;
+        struct cnic_ulp_ops *ulp_ops;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
@@ -386,7 +399,8 @@ int cnic_unregister_driver(int ulp_type)
                return -EINVAL;
        }
        mutex_lock(&cnic_lock);
-        if (!cnic_ulp_tbl[ulp_type]) {
+        ulp_ops = cnic_ulp_tbl[ulp_type];
+        if (!ulp_ops) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
                                    "been registered\n", ulp_type);
                goto out_unlock;
@@ -411,6 +425,14 @@ int cnic_unregister_driver(int ulp_type)
        mutex_unlock(&cnic_lock);
        synchronize_rcu();
+        while ((atomic_read(&ulp_ops->ref_count) != 0) && (i < 20)) {
+                msleep(100);
+                i++;
+        }
+        if (atomic_read(&ulp_ops->ref_count) != 0)
+                printk(KERN_WARNING PFX "%s: Failed waiting for ref count to go"
+                                        " to zero.\n", dev->netdev->name);
        return 0;
 out_unlock:
@@ -466,6 +488,7 @@ EXPORT_SYMBOL(cnic_register_driver);
 static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
 {
        struct cnic_local *cp = dev->cnic_priv;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
@@ -486,6 +509,15 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
        synchronize_rcu();
+        while (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]) &&
+               i < 20) {
+                msleep(100);
+                i++;
+        }
+        if (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]))
+                printk(KERN_WARNING PFX "%s: Failed waiting for ULP up call"
+                                        " to complete.\n", dev->netdev->name);
        return 0;
 }
 EXPORT_SYMBOL(cnic_unregister_driver);
@@ -1076,18 +1108,23 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
        if (cp->cnic_uinfo)
                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_start(struct cnic_dev *dev)
@@ -1095,18 +1132,23 @@ static void cnic_ulp_start(struct cnic_dev *dev)
        struct cnic_local *cp = dev->cnic_priv;
        int if_type;
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_start)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops || !ulp_ops->cnic_start) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_start(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static int cnic_ctl(void *data, struct cnic_ctl_info *info)
@@ -1116,22 +1158,18 @@ static int cnic_ctl(void *data, struct cnic_ctl_info *info)
        switch (info->cmd) {
        case CNIC_CTL_STOP_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                cnic_ulp_stop(dev);
                cnic_stop_hw(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        case CNIC_CTL_START_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                if (!cnic_start_hw(dev))
                        cnic_ulp_start(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        default:
@@ -1145,19 +1183,23 @@ static void cnic_ulp_init(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_init)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_init) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_init(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_exit(struct cnic_dev *dev)
@@ -1165,19 +1207,23 @@ static void cnic_ulp_exit(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_exit)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_exit) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_exit(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static int cnic_cm_offload_pg(struct cnic_sock *csk)
@@ -2393,21 +2439,45 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        return 0;
 }
-static int cnic_start_hw(struct cnic_dev *dev)
+static int cnic_register_netdev(struct cnic_dev *dev)
 {
        struct cnic_local *cp = dev->cnic_priv;
        struct cnic_eth_dev *ethdev = cp->ethdev;
        int err;
-        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+        if (!ethdev)
-                return -EALREADY;
+                return -ENODEV;
+        if (ethdev->drv_state & CNIC_DRV_STATE_REGD)
+                return 0;
        err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
-        if (err) {
+        if (err)
                printk(KERN_ERR PFX "%s: register_cnic failed\n",
                       dev->netdev->name);
-                goto err2;
-        }
+        return err;
+}
+static void cnic_unregister_netdev(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        if (!ethdev)
+                return;
+        ethdev->drv_unregister_cnic(dev->netdev);
+}
+static int cnic_start_hw(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        int err;
+        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+                return -EALREADY;
        dev->regview = ethdev->io_base;
        cp->chip_id = ethdev->chip_id;
@@ -2438,18 +2508,13 @@ static int cnic_start_hw(struct cnic_dev *dev)
        return 0;
 err1:
-        ethdev->drv_unregister_cnic(dev->netdev);
        cp->free_resc(dev);
        pci_dev_put(dev->pcidev);
-err2:
        return err;
 }
 static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        struct cnic_eth_dev *ethdev = cp->ethdev;
        cnic_disable_bnx2_int_sync(dev);
        cnic_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
@@ -2461,8 +2526,6 @@ static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
        cnic_setup_5709_context(dev, 0);
        cnic_free_irq(dev);
-        ethdev->drv_unregister_cnic(dev->netdev);
        cnic_free_resc(dev);
 }
@@ -2543,7 +2606,7 @@ static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
        probe = symbol_get(bnx2_cnic_probe);
        if (probe) {
                ethdev = (*probe)(dev);
-                symbol_put_addr(probe);
+                symbol_put(bnx2_cnic_probe);
        }
        if (!ethdev)
                return NULL;
@@ -2646,10 +2709,12 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                else if (event == NETDEV_UNREGISTER)
                        cnic_ulp_exit(dev);
                else if (event == NETDEV_UP) {
-                        mutex_lock(&cnic_lock);
+                        if (cnic_register_netdev(dev) != 0) {
+                                cnic_put(dev);
+                                goto done;
+                        }
                        if (!cnic_start_hw(dev))
                                cnic_ulp_start(dev);
-                        mutex_unlock(&cnic_lock);
                }
                rcu_read_lock();
@@ -2668,10 +2733,9 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                rcu_read_unlock();
                if (event == NETDEV_GOING_DOWN) {
-                        mutex_lock(&cnic_lock);
                        cnic_ulp_stop(dev);
                        cnic_stop_hw(dev);
-                        mutex_unlock(&cnic_lock);
+                        cnic_unregister_netdev(dev);
                } else if (event == NETDEV_UNREGISTER) {
                        write_lock(&cnic_dev_lock);
                        list_del_init(&dev->list);
@@ -2703,6 +2767,7 @@ static void cnic_release(void)
                }
                cnic_ulp_exit(dev);
+                cnic_unregister_netdev(dev);
                list_del_init(&dev->list);
                cnic_free_dev(dev);
        }
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
index 5192d4a9df5a..a94b302bb464 100644
--- a/drivers/net/cnic.h
+++ b/drivers/net/cnic.h
@@ -176,6 +176,7 @@ struct cnic_local {
        unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
 #define ULP_F_INIT      0
 #define ULP_F_START     1
+#define ULP_F_CALL_PENDING      2
        struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
        /* protected by ulp_lock */
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
index d1bce27ee99e..a49235739eef 100644
--- a/drivers/net/cnic_if.h
+++ b/drivers/net/cnic_if.h
@@ -290,6 +290,7 @@ struct cnic_ulp_ops {
        void (*iscsi_nl_send_msg)(struct cnic_dev *dev, u32 msg_type,
                                  char *data, u16 data_size);
        struct module *owner;
+        atomic_t ref_count;
 };
 extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index d56c7473144a..99df2abf82a9 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -338,10 +338,7 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg, sector_base_addr, sector_end_addr;
-        u32 gfpreg;
-        u32 sector_base_addr;
-        u32 sector_end_addr;
        u16 i;
        /* Can't read flash registers if the register set isn't mapped. */
@@ -375,20 +372,6 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
        /* Adjust to word count */
        nvm->flash_bank_size /= sizeof(u16);
-        /*
-         * Make sure the flash bank size does not overwrite the 4k
-         * sector ranges. We may have 64k allotted to us but we only care
-         * about the first 2 4k sectors. Therefore, if we have anything less
-         * than 64k set in the HSFSTS register, we will reduce the bank size
-         * down to 4k and let the rest remain unused. If berasesz == 3, then
-         * we are working in 64k mode. Otherwise we are not.
-         */
-        if (nvm->flash_bank_size > E1000_ICH8_SHADOW_RAM_WORDS) {
-                hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
-                if (hsfsts.hsf_status.berasesz != 3)
-                        nvm->flash_bank_size = E1000_ICH8_SHADOW_RAM_WORDS;
-        }
        nvm->word_size = E1000_ICH8_SHADOW_RAM_WORDS;
        /* Clear shadow ram */
@@ -594,8 +577,8 @@ static DEFINE_MUTEX(nvm_mutex);
 **/
 static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 {
-        u32 extcnf_ctrl;
+        u32 extcnf_ctrl, timeout = PHY_CFG_TIMEOUT;
-        u32 timeout = PHY_CFG_TIMEOUT;
+        s32 ret_val = 0;
        might_sleep();
@@ -603,28 +586,46 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        while (timeout) {
                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG))
+                        break;
-                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)) {
+                mdelay(1);
-                        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+                timeout--;
-                        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        }
+        if (!timeout) {
+                hw_dbg(hw, "SW/FW/HW has locked the resource for too long.\n");
+                ret_val = -E1000_ERR_CONFIG;
+                goto out;
+        }
+        timeout = PHY_CFG_TIMEOUT * 2;
+        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        while (timeout) {
+                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
+                        break;
-                        extcnf_ctrl = er32(EXTCNF_CTRL);
-                        if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
-                                break;
-                }
                mdelay(1);
                timeout--;
        }
        if (!timeout) {
-                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                hw_dbg(hw, "Failed to acquire the semaphore.\n");
                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
                ew32(EXTCNF_CTRL, extcnf_ctrl);
-                mutex_unlock(&nvm_mutex);
+                ret_val = -E1000_ERR_CONFIG;
-                return -E1000_ERR_CONFIG;
+                goto out;
        }
-        return 0;
+out:
+        if (ret_val)
+                mutex_unlock(&nvm_mutex);
+        return ret_val;
 }
 /**
@@ -1306,7 +1307,7 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
        u32 act_offset;
-        s32 ret_val;
+        s32 ret_val = 0;
        u32 bank = 0;
        u16 i, word;
@@ -1321,12 +1322,15 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                goto out;
        ret_val = e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
-        if (ret_val)
+        if (ret_val) {
-                goto release;
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
+                bank = 0;
+        }
        act_offset = (bank) ? nvm->flash_bank_size : 0;
        act_offset += offset;
+        ret_val = 0;
        for (i = 0; i < words; i++) {
                if ((dev_spec->shadow_ram) &&
                    (dev_spec->shadow_ram[offset+i].modified)) {
@@ -1341,7 +1345,6 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                }
        }
-release:
        e1000_release_swflag_ich8lan(hw);
 out:
@@ -1592,7 +1595,6 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        s32 ret_val;
        u16 i;
        if ((offset >= nvm->word_size) || (words > nvm->word_size - offset) ||
@@ -1601,17 +1603,11 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                return -E1000_ERR_NVM;
        }
-        ret_val = e1000_acquire_swflag_ich8lan(hw);
-        if (ret_val)
-                return ret_val;
        for (i = 0; i < words; i++) {
                dev_spec->shadow_ram[offset+i].modified = 1;
                dev_spec->shadow_ram[offset+i].value = data[i];
        }
-        e1000_release_swflag_ich8lan(hw);
        return 0;
 }
@@ -1652,8 +1648,8 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
         */
        ret_val =  e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
        if (ret_val) {
-                e1000_release_swflag_ich8lan(hw);
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
-                goto out;
+                bank = 0;
        }
        if (bank == 0) {
@@ -2039,12 +2035,8 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
                iteration = 1;
                break;
        case 2:
-                if (hw->mac.type == e1000_ich9lan) {
+                sector_size = ICH_FLASH_SEG_SIZE_8K;
-                        sector_size = ICH_FLASH_SEG_SIZE_8K;
+                iteration = 1;
-                        iteration = flash_bank_size / ICH_FLASH_SEG_SIZE_8K;
-                } else {
-                        return -E1000_ERR_NVM;
-                }
                break;
        case 3:
                sector_size = ICH_FLASH_SEG_SIZE_64K;
@@ -2056,7 +2048,7 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
        /* Start with the base address, then add the sector offset. */
        flash_linear_addr = hw->nvm.flash_base_addr;
-        flash_linear_addr += (bank) ? (sector_size * iteration) : 0;
+        flash_linear_addr += (bank) ? flash_bank_size : 0;
        for (j = 0; j < iteration ; j++) {
                do {
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 63415bb6f48f..fa92a683aefd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4538,8 +4538,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
                /* Allow time for pending master requests to run */
                e1000e_disable_pcie_master(&adapter->hw);
-                if ((adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) &&
+                if (adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) {
-                    !(hw->mac.ops.check_mng_mode(hw))) {
                        /* enable wakeup by the PHY */
                        retval = e1000_init_phy_wakeup(adapter, wufc);
                        if (retval)
@@ -4557,7 +4556,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
        *enable_wake = !!wufc;
        /* make sure adapter isn't asleep if manageability is enabled */
-        if (adapter->flags & FLAG_MNG_PT_ENABLED)
+        if ((adapter->flags & FLAG_MNG_PT_ENABLED) ||
+            (hw->mac.ops.check_mng_mode(hw)))
                *enable_wake = true;
        if (adapter->hw.phy.type == e1000_phy_igp_3)
@@ -4670,14 +4670,6 @@ static int e1000_resume(struct pci_dev *pdev)
                return err;
        }
-        /* AER (Advanced Error Reporting) hooks */
-        err = pci_enable_pcie_error_reporting(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
-                                    "0x%x\n", err);
-                /* non-fatal, continue */
-        }
        pci_set_master(pdev);
        pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -4990,6 +4982,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        if (err)
                goto err_pci_reg;
+        /* AER (Advanced Error Reporting) hooks */
+        err = pci_enable_pcie_error_reporting(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+                        "0x%x\n", err);
+                /* non-fatal, continue */
+        }
        pci_set_master(pdev);
        /* PCI config space info */
        err = pci_save_state(pdev);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index d4b98074b1b7..c9fd82d3a80d 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -285,6 +285,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct fec_enet_private *fep = netdev_priv(dev);
        struct bufdesc *bdp;
+        void *bufaddr;
        unsigned short  status;
        unsigned long flags;
@@ -312,7 +313,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        status &= ~BD_ENET_TX_STATS;
        /* Set buffer length and buffer pointer */
-        bdp->cbd_bufaddr = __pa(skb->data);
+        bufaddr = skb->data;
        bdp->cbd_datlen = skb->len;
        /*
@@ -320,11 +321,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         * 4-byte boundaries. Use bounce buffers to copy data
         * and get it aligned. Ugh.
         */
-        if (bdp->cbd_bufaddr & FEC_ALIGNMENT) {
+        if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
                unsigned int index;
                index = bdp - fep->tx_bd_base;
                memcpy(fep->tx_bounce[index], (void *)skb->data, skb->len);
-                bdp->cbd_bufaddr = __pa(fep->tx_bounce[index]);
+                bufaddr = fep->tx_bounce[index];
        }
        /* Save skb pointer */
@@ -336,7 +337,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Push the data cache so the CPM does not get stale memory
         * data.
         */
-        bdp->cbd_bufaddr = dma_map_single(&dev->dev, skb->data,
+        bdp->cbd_bufaddr = dma_map_single(&dev->dev, bufaddr,
                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f8ffcbf0bc39..e212f2c5448b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -936,6 +936,7 @@ int startup_gfar(struct net_device *dev)
        struct gfar __iomem *regs = priv->regs;
        int err = 0;
        u32 rctrl = 0;
+        u32 tctrl = 0;
        u32 attrs = 0;
        gfar_write(&regs->imask, IMASK_INIT_CLEAR);
@@ -1111,11 +1112,19 @@ int startup_gfar(struct net_device *dev)
                rctrl |= RCTRL_PADDING(priv->padding);
        }
+        /* keep vlan related bits if it's enabled */
+        if (priv->vlgrp) {
+                rctrl |= RCTRL_VLEX | RCTRL_PRSDEP_INIT;
+                tctrl |= TCTRL_VLINS;
+        }
        /* Init rctrl based on our settings */
        gfar_write(&priv->regs->rctrl, rctrl);
        if (dev->features & NETIF_F_IP_CSUM)
-                gfar_write(&priv->regs->tctrl, TCTRL_INIT_CSUM);
+                tctrl |= TCTRL_INIT_CSUM;
+        gfar_write(&priv->regs->tctrl, tctrl);
        /* Set the extraction length and index */
        attrs = ATTRELI_EL(priv->rx_stash_size) |
@@ -1450,7 +1459,6 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                /* Enable VLAN tag extraction */
                tempval = gfar_read(&priv->regs->rctrl);
-                tempval |= RCTRL_VLEX;
                tempval |= (RCTRL_VLEX | RCTRL_PRSDEP_INIT);
                gfar_write(&priv->regs->rctrl, tempval);
        } else {
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index d0883835b0c6..fe4f2b2bff96 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -115,7 +115,7 @@ static int __init w83977af_init(void)
        IRDA_DEBUG(0, "%s()\n", __func__ );
-        for (i=0; (io[i] < 2000) && (i < ARRAY_SIZE(dev_self)); i++) {
+        for (i=0; i < ARRAY_SIZE(dev_self) && io[i] < 2000; i++) {
                if (w83977af_open(i, io[i], irq[i], dma[i]) == 0)
                        return 0;
        }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index e11d83d5852b..2c4dc8221dcd 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -136,6 +136,8 @@ struct ixgbe_ring {
        u8 queue_index; /* needed for multiqueue queue management */
+#define IXGBE_RING_RX_PS_ENABLED                (u8)(1)
+        u8 flags;                       /* per ring feature flags */
        u16 head;
        u16 tail;
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 79144e950a34..dff8dfac7ed9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1948,6 +1948,7 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                              struct ethtool_coalesce *ec)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_q_vector *q_vector;
        int i;
        if (ec->tx_max_coalesced_frames_irq)
@@ -1982,14 +1983,24 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                adapter->itr_setting = 0;
        }
-        for (i = 0; i < adapter->num_msix_vectors - NON_Q_VECTORS; i++) {
+        /* MSI/MSIx Interrupt Mode */
-                struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+        if (adapter->flags &
-                if (q_vector->txr_count && !q_vector->rxr_count)
+            (IXGBE_FLAG_MSIX_ENABLED | IXGBE_FLAG_MSI_ENABLED)) {
-                        /* tx vector gets half the rate */
+                int num_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
-                        q_vector->eitr = (adapter->eitr_param >> 1);
+                for (i = 0; i < num_vectors; i++) {
-                else
+                        q_vector = adapter->q_vector[i];
-                        /* rx only or mixed */
+                        if (q_vector->txr_count && !q_vector->rxr_count)
-                        q_vector->eitr = adapter->eitr_param;
+                                /* tx vector gets half the rate */
+                                q_vector->eitr = (adapter->eitr_param >> 1);
+                        else
+                                /* rx only or mixed */
+                                q_vector->eitr = adapter->eitr_param;
+                        ixgbe_write_eitr(q_vector);
+                }
+        /* Legacy Interrupt Mode */
+        } else {
+                q_vector = adapter->q_vector[0];
+                q_vector->eitr = adapter->eitr_param;
                ixgbe_write_eitr(q_vector);
        }
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index fa9f24e23683..28cf104e36cc 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -336,7 +336,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
                /* return 0 to bypass going to ULD for DDPed data */
                if (fcstat == IXGBE_RXDADV_STAT_FCSTAT_DDP)
                        rc = 0;
-                else
+                else if (ddp->len)
                        rc = ddp->len;
        }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 110c65ab5cb5..77b0381a2b5c 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -492,12 +492,12 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
        skb_record_rx_queue(skb, ring->queue_index);
        if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
                else
                        napi_gro_receive(napi, skb);
        } else {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_hwaccel_rx(skb, adapter->vlgrp, tag);
                else
                        netif_rx(skb);
@@ -585,7 +585,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
                if (!bi->page_dma &&
-                    (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)) {
+                    (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
                        if (!bi->page) {
                                bi->page = alloc_page(GFP_ATOMIC);
                                if (!bi->page) {
@@ -629,7 +629,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                }
                /* Refresh the desc even if buffer_addrs didn't change because
                 * each write-back erases this info. */
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        rx_desc->read.pkt_addr = cpu_to_le64(bi->page_dma);
                        rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                } else {
@@ -726,7 +726,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        break;
                (*work_done)++;
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
@@ -798,7 +798,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        rx_ring->stats.packets++;
                        rx_ring->stats.bytes += skb->len;
                } else {
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                                rx_buffer_info->skb = next_buffer->skb;
                                rx_buffer_info->dma = next_buffer->dma;
                                next_buffer->skb = skb;
@@ -1898,46 +1898,19 @@ static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
 #define IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT 2
-static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
+static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *rx_ring)
 {
-        struct ixgbe_ring *rx_ring;
        u32 srrctl;
-        int queue0 = 0;
+        int index;
-        unsigned long mask;
        struct ixgbe_ring_feature *feature = adapter->ring_feature;
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        index = rx_ring->reg_idx;
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        int dcb_i = feature[RING_F_DCB].indices;
+                unsigned long mask;
-                        if (dcb_i == 8)
-                                queue0 = index >> 4;
-                        else if (dcb_i == 4)
-                                queue0 = index >> 5;
-                        else
-                                dev_err(&adapter->pdev->dev, "Invalid DCB "
-                                        "configuration\n");
-#ifdef IXGBE_FCOE
-                        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
-                                struct ixgbe_ring_feature *f;
-                                rx_ring = &adapter->rx_ring[queue0];
-                                f = &adapter->ring_feature[RING_F_FCOE];
-                                if ((queue0 == 0) && (index > rx_ring->reg_idx))
-                                        queue0 = f->mask + index -
-                                                 rx_ring->reg_idx - 1;
-                        }
-#endif /* IXGBE_FCOE */
-                } else {
-                        queue0 = index;
-                }
-        } else {
                mask = (unsigned long) feature[RING_F_RSS].mask;
-                queue0 = index & mask;
                index = index & mask;
        }
-        rx_ring = &adapter->rx_ring[queue0];
        srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(index));
        srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
@@ -1946,7 +1919,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
        srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                  IXGBE_SRRCTL_BSIZEHDR_MASK;
-        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (PAGE_SIZE / 2) > IXGBE_MAX_RXBUFFER
                srrctl |= IXGBE_MAX_RXBUFFER >> IXGBE_SRRCTL_BSIZEPKT_SHIFT;
 #else
@@ -2002,6 +1975,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
        u64 rdba;
        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring *rx_ring;
        struct net_device *netdev = adapter->netdev;
        int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
        int i, j;
@@ -2018,11 +1992,6 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        /* Decide whether to use packet split mode or not */
        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
-#ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
-                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
-#endif /* IXGBE_FCOE */
        /* Set the RX buffer length according to the mode */
        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                rx_buf_len = IXGBE_RX_HDR_SIZE;
@@ -2070,29 +2039,35 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         * the Base and Length of the Rx Descriptor Ring
         */
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                rdba = adapter->rx_ring[i].dma;
+                rx_ring = &adapter->rx_ring[i];
-                j = adapter->rx_ring[i].reg_idx;
+                rdba = rx_ring->dma;
+                j = rx_ring->reg_idx;
                IXGBE_WRITE_REG(hw, IXGBE_RDBAL(j), (rdba & DMA_BIT_MASK(32)));
                IXGBE_WRITE_REG(hw, IXGBE_RDBAH(j), (rdba >> 32));
                IXGBE_WRITE_REG(hw, IXGBE_RDLEN(j), rdlen);
                IXGBE_WRITE_REG(hw, IXGBE_RDH(j), 0);
                IXGBE_WRITE_REG(hw, IXGBE_RDT(j), 0);
-                adapter->rx_ring[i].head = IXGBE_RDH(j);
+                rx_ring->head = IXGBE_RDH(j);
-                adapter->rx_ring[i].tail = IXGBE_RDT(j);
+                rx_ring->tail = IXGBE_RDT(j);
-                adapter->rx_ring[i].rx_buf_len = rx_buf_len;
+                rx_ring->rx_buf_len = rx_buf_len;
+                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
+                        rx_ring->flags |= IXGBE_RING_RX_PS_ENABLED;
 #ifdef IXGBE_FCOE
                if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
                        struct ixgbe_ring_feature *f;
                        f = &adapter->ring_feature[RING_F_FCOE];
-                        if ((rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE) &&
+                        if ((i >= f->mask) && (i < f->mask + f->indices)) {
-                            (i >= f->mask) && (i < f->mask + f->indices))
+                                rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
-                                adapter->rx_ring[i].rx_buf_len =
+                                if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
-                                        IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                                        rx_ring->rx_buf_len =
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        }
                }
 #endif /* IXGBE_FCOE */
-                ixgbe_configure_srrctl(adapter, j);
+                ixgbe_configure_srrctl(adapter, rx_ring);
        }
        if (hw->mac.type == ixgbe_mac_82598EB) {
@@ -2168,7 +2143,8 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
-                        j = adapter->rx_ring[i].reg_idx;
+                        rx_ring = &adapter->rx_ring[i];
+                        j = rx_ring->reg_idx;
                        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(j));
                        rscctrl |= IXGBE_RSCCTL_RSCEN;
                        /*
@@ -2176,7 +2152,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                         * total size of max desc * buf_len is not greater
                         * than 65535
                         */
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (MAX_SKB_FRAGS > 16)
                                rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 91bdfdfd431f..3ac0404d0d11 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -506,8 +506,9 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                                 PCI_DMA_FROMDEVICE);
        }
        /* Adjust size of last fragment to match actual length */
-        skb_frags_rx[nr - 1].size = length -
+        if (nr > 0)
-                priv->frag_info[nr - 1].frag_prefix_size;
+                skb_frags_rx[nr - 1].size = length -
+                        priv->frag_info[nr - 1].frag_prefix_size;
        return nr;
 fail:
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index f86e05047d19..a9c1fcca5e75 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1254,7 +1254,7 @@ struct netxen_adapter {
        u8 mc_enabled;
        u8 max_mc_count;
        u8 rss_supported;
-        u8 resv2;
+        u8 link_changed;
        u32 resv3;
        u8 has_link_events;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 7acf204e38c9..5d3343ef3d86 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,13 +184,6 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
        kfree(recv_ctx->rds_rings);
 skip_rds:
-        if (recv_ctx->sds_rings == NULL)
-                goto skip_sds;
-        for(ring = 0; ring < adapter->max_sds_rings; ring++)
-                recv_ctx->sds_rings[ring].consumer = 0;
-skip_sds:
        if (adapter->tx_ring == NULL)
                return;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 3cd8cfcf627b..28f270f5ac78 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -94,10 +94,6 @@ static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
 MODULE_DEVICE_TABLE(pci, netxen_pci_tbl);
-static struct workqueue_struct *netxen_workq;
-#define SCHEDULE_WORK(tp)       queue_work(netxen_workq, tp)
-#define FLUSH_SCHEDULED_WORK()  flush_workqueue(netxen_workq)
 static void netxen_watchdog(unsigned long);
 static uint32_t crb_cmd_producer[4] = {
@@ -171,6 +167,8 @@ netxen_free_sds_rings(struct netxen_recv_context *recv_ctx)
 {
        if (recv_ctx->sds_rings != NULL)
                kfree(recv_ctx->sds_rings);
+        recv_ctx->sds_rings = NULL;
 }
 static int
@@ -193,6 +191,21 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
 }
 static void
+netxen_napi_del(struct netxen_adapter *adapter)
+{
+        int ring;
+        struct nx_host_sds_ring *sds_ring;
+        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+                sds_ring = &recv_ctx->sds_rings[ring];
+                netif_napi_del(&sds_ring->napi);
+        }
+        netxen_free_sds_rings(&adapter->recv_ctx);
+}
+static void
 netxen_napi_enable(struct netxen_adapter *adapter)
 {
        int ring;
@@ -260,7 +273,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        change = 0;
        shift = NXRD32(adapter, CRB_DMA_SHIFT);
-        if (shift >= 32)
+        if (shift > 32)
                return 0;
        if (NX_IS_REVISION_P3(adapter->ahw.revision_id) && (shift > 9))
@@ -272,7 +285,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
                old_mask = pdev->dma_mask;
                old_cmask = pdev->dev.coherent_dma_mask;
-                mask = (1ULL<<(32+shift)) - 1;
+                mask = DMA_BIT_MASK(32+shift);
                err = pci_set_dma_mask(pdev, mask);
                if (err)
@@ -880,7 +893,6 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
        spin_unlock(&adapter->tx_clean_lock);
        del_timer_sync(&adapter->watchdog_timer);
-        FLUSH_SCHEDULED_WORK();
 }
@@ -894,10 +906,12 @@ netxen_nic_attach(struct netxen_adapter *adapter)
        struct nx_host_tx_ring *tx_ring;
        err = netxen_init_firmware(adapter);
-        if (err != 0) {
+        if (err)
-                printk(KERN_ERR "Failed to init firmware\n");
+                return err;
-                return -EIO;
-        }
+        err = netxen_napi_add(adapter, netdev);
+        if (err)
+                return err;
        if (adapter->fw_major < 4)
                adapter->max_rds_rings = 3;
@@ -961,6 +975,7 @@ netxen_nic_detach(struct netxen_adapter *adapter)
        netxen_free_hw_resources(adapter);
        netxen_release_rx_buffers(adapter);
        netxen_nic_free_irq(adapter);
+        netxen_napi_del(adapter);
        netxen_free_sw_resources(adapter);
        adapter->is_up = 0;
@@ -1105,9 +1120,6 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        netdev->irq = adapter->msix_entries[0].vector;
-        if (netxen_napi_add(adapter, netdev))
-                goto err_out_disable_msi;
        init_timer(&adapter->watchdog_timer);
        adapter->watchdog_timer.function = &netxen_watchdog;
        adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -1177,6 +1189,9 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC) {
                netxen_nic_detach(adapter);
        }
@@ -1185,7 +1200,6 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
                netxen_free_adapter_offload(adapter);
        netxen_teardown_intr(adapter);
-        netxen_free_sds_rings(&adapter->recv_ctx);
        netxen_cleanup_pci_map(adapter);
@@ -1211,6 +1225,9 @@ netxen_nic_suspend(struct pci_dev *pdev, pm_message_t state)
        if (netif_running(netdev))
                netxen_nic_down(adapter, netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC)
                netxen_nic_detach(adapter);
@@ -1549,11 +1566,6 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                       "%s: Device temperature %d degrees C exceeds"
                       " maximum allowed. Hardware has been shut down.\n",
                       netdev->name, temp_val);
-                netif_device_detach(netdev);
-                netxen_nic_down(adapter, netdev);
-                netxen_nic_detach(adapter);
                rv = 1;
        } else if (temp_state == NX_TEMP_WARN) {
                if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1587,10 +1599,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_off(netdev);
                        netif_stop_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        } else if (!adapter->ahw.linkup && linkup) {
                printk(KERN_INFO "%s: %s NIC Link is up\n",
                       netxen_nic_driver_name, netdev->name);
@@ -1599,9 +1608,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_on(netdev);
                        netif_wake_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        }
 }
@@ -1628,11 +1635,36 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
        netxen_advert_link_change(adapter, linkup);
 }
+static void netxen_nic_thermal_shutdown(struct netxen_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        netif_device_detach(netdev);
+        netxen_nic_down(adapter, netdev);
+        netxen_nic_detach(adapter);
+}
 static void netxen_watchdog(unsigned long v)
 {
        struct netxen_adapter *adapter = (struct netxen_adapter *)v;
-        SCHEDULE_WORK(&adapter->watchdog_task);
+        if (netxen_nic_check_temp(adapter))
+                goto do_sched;
+        if (!adapter->has_link_events) {
+                netxen_nic_handle_phy_intr(adapter);
+                if (adapter->link_changed)
+                        goto do_sched;
+        }
+        if (netif_running(adapter->netdev))
+                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
+        return;
+do_sched:
+        schedule_work(&adapter->watchdog_task);
 }
 void netxen_watchdog_task(struct work_struct *work)
@@ -1640,11 +1672,13 @@ void netxen_watchdog_task(struct work_struct *work)
        struct netxen_adapter *adapter =
                container_of(work, struct netxen_adapter, watchdog_task);
-        if (netxen_nic_check_temp(adapter))
+        if (adapter->temp == NX_TEMP_PANIC) {
+                netxen_nic_thermal_shutdown(adapter);
                return;
+        }
-        if (!adapter->has_link_events)
+        if (adapter->link_changed)
-                netxen_nic_handle_phy_intr(adapter);
+                netxen_nic_set_link_parameters(adapter);
        if (netif_running(adapter->netdev))
                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
@@ -1652,9 +1686,8 @@ void netxen_watchdog_task(struct work_struct *work)
 static void netxen_tx_timeout(struct net_device *netdev)
 {
-        struct netxen_adapter *adapter = (struct netxen_adapter *)
+        struct netxen_adapter *adapter = netdev_priv(netdev);
-                                                netdev_priv(netdev);
+        schedule_work(&adapter->tx_timeout_task);
-        SCHEDULE_WORK(&adapter->tx_timeout_task);
 }
 static void netxen_tx_timeout_task(struct work_struct *work)
@@ -1811,9 +1844,6 @@ static int __init netxen_init_module(void)
 {
        printk(KERN_INFO "%s\n", netxen_nic_driver_string);
-        if ((netxen_workq = create_singlethread_workqueue("netxen")) == NULL)
-                return -ENOMEM;
        return pci_register_driver(&netxen_driver);
 }
@@ -1822,7 +1852,6 @@ module_init(netxen_init_module);
 static void __exit netxen_exit_module(void)
 {
        pci_unregister_driver(&netxen_driver);
-        destroy_workqueue(netxen_workq);
 }
 module_exit(netxen_exit_module);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index a646a445fda9..23e1a0750fe0 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1839,7 +1839,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        lp->chip_version = chip_version;
        lp->msg_enable = pcnet32_debug;
        if ((cards_found >= MAX_UNITS)
-            || (options[cards_found] > sizeof(options_mapping)))
+            || (options[cards_found] >= sizeof(options_mapping)))
                lp->options = PCNET32_PORT_ASEL;
        else
                lp->options = options_mapping[options[cards_found]];
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 99a63649f4fc..4cf9a6588751 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -652,8 +652,9 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int entry;
        u32 flag;
        dma_addr_t mapping;
+        unsigned long flags;
-        spin_lock_irq(&tp->lock);
+        spin_lock_irqsave(&tp->lock, flags);
        /* Calculate the next Tx descriptor entry. */
        entry = tp->cur_tx % TX_RING_SIZE;
@@ -688,7 +689,7 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Trigger an immediate transmit demand. */
        iowrite32(0, tp->base_addr + CSR1);
-        spin_unlock_irq(&tp->lock);
+        spin_unlock_irqrestore(&tp->lock, flags);
        dev->trans_start = jiffies;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 027f7aba26af..42b6c6319bc2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1048,20 +1048,15 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
        return err;
 }
-static int tun_get_iff(struct net *net, struct file *file, struct ifreq *ifr)
+static int tun_get_iff(struct net *net, struct tun_struct *tun,
+                       struct ifreq *ifr)
 {
-        struct tun_struct *tun = tun_get(file);
-        if (!tun)
-                return -EBADFD;
        DBG(KERN_INFO "%s: tun_get_iff\n", tun->dev->name);
        strcpy(ifr->ifr_name, tun->dev->name);
        ifr->ifr_flags = tun_flags(tun);
-        tun_put(tun);
        return 0;
 }
@@ -1105,8 +1100,8 @@ static int set_offload(struct net_device *dev, unsigned long arg)
        return 0;
 }
-static int tun_chr_ioctl(struct inode *inode, struct file *file,
+static long tun_chr_ioctl(struct file *file, unsigned int cmd,
-                         unsigned int cmd, unsigned long arg)
+                          unsigned long arg)
 {
        struct tun_file *tfile = file->private_data;
        struct tun_struct *tun;
@@ -1128,34 +1123,32 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                                (unsigned int __user*)argp);
        }
+        rtnl_lock();
        tun = __tun_get(tfile);
        if (cmd == TUNSETIFF && !tun) {
-                int err;
                ifr.ifr_name[IFNAMSIZ-1] = '\0';
-                rtnl_lock();
+                ret = tun_set_iff(tfile->net, file, &ifr);
-                err = tun_set_iff(tfile->net, file, &ifr);
-                rtnl_unlock();
-                if (err)
+                if (ret)
-                        return err;
+                        goto unlock;
                if (copy_to_user(argp, &ifr, sizeof(ifr)))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                goto unlock;
        }
+        ret = -EBADFD;
        if (!tun)
-                return -EBADFD;
+                goto unlock;
        DBG(KERN_INFO "%s: tun_chr_ioctl cmd %d\n", tun->dev->name, cmd);
        ret = 0;
        switch (cmd) {
        case TUNGETIFF:
-                ret = tun_get_iff(current->nsproxy->net_ns, file, &ifr);
+                ret = tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
                if (ret)
                        break;
@@ -1201,7 +1194,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case TUNSETLINK:
                /* Only allow setting the type when the interface is down */
-                rtnl_lock();
                if (tun->dev->flags & IFF_UP) {
                        DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",
                                tun->dev->name);
@@ -1211,7 +1203,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                        DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);
                        ret = 0;
                }
-                rtnl_unlock();
                break;
 #ifdef TUN_DEBUG
@@ -1220,9 +1211,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
 #endif
        case TUNSETOFFLOAD:
-                rtnl_lock();
                ret = set_offload(tun->dev, arg);
-                rtnl_unlock();
                break;
        case TUNSETTXFILTER:
@@ -1230,9 +1219,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                ret = -EINVAL;
                if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
                        break;
-                rtnl_lock();
                ret = update_filter(&tun->txflt, (void __user *)arg);
-                rtnl_unlock();
                break;
        case SIOCGIFHWADDR:
@@ -1248,9 +1235,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                DBG(KERN_DEBUG "%s: set hw address: %pM\n",
                        tun->dev->name, ifr.ifr_hwaddr.sa_data);
-                rtnl_lock();
                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
-                rtnl_unlock();
                break;
        case TUNGETSNDBUF:
@@ -1273,7 +1258,10 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
        };
-        tun_put(tun);
+unlock:
+        rtnl_unlock();
+        if (tun)
+                tun_put(tun);
        return ret;
 }
@@ -1361,7 +1349,7 @@ static const struct file_operations tun_fops = {
        .write = do_sync_write,
        .aio_write = tun_chr_aio_write,
        .poll   = tun_chr_poll,
-        .ioctl  = tun_chr_ioctl,
+        .unlocked_ioctl = tun_chr_ioctl,
        .open   = tun_chr_open,
        .release = tun_chr_close,
        .fasync = tun_chr_fasync
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 3b957e6412ee..8a7b8c7bd781 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3111,10 +3111,11 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        u8 __iomem *bd;                 /* BD pointer */
        u32 bd_status;
        u8 txQ = 0;
+        unsigned long flags;
        ugeth_vdbg("%s: IN", __func__);
-        spin_lock_irq(&ugeth->lock);
+        spin_lock_irqsave(&ugeth->lock, flags);
        dev->stats.tx_bytes += skb->len;
@@ -3171,7 +3172,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        uccf = ugeth->uccf;
        out_be16(uccf->p_utodr, UCC_FAST_TOD);
 #endif
-        spin_unlock_irq(&ugeth->lock);
+        spin_unlock_irqrestore(&ugeth->lock, flags);
        return 0;
 }
diff --git a/drivers/net/usb/pegasus.h b/drivers/net/usb/pegasus.h
index c7467823cd1c..f968c834ff63 100644
--- a/drivers/net/usb/pegasus.h
+++ b/drivers/net/usb/pegasus.h
@@ -250,6 +250,8 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR_IODATA, 0x0904,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
                DEFAULT_GPIO_RESET | PEGASUS_II )
+PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a,
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a,
                DEFAULT_GPIO_RESET)
 PEGASUS_DEV( "LANEED USB Ethernet LD-USB/TX", VENDOR_LANEED, 0x4002,
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 88c30a58b4bd..934f7671650a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1218,6 +1218,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        struct rhine_private *rp = netdev_priv(dev);
        void __iomem *ioaddr = rp->base;
        unsigned entry;
+        unsigned long flags;
        /* Caution: the write order is important here, set the field
           with the "ownership" bits last. */
@@ -1261,7 +1262,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
        /* lock eth irq */
-        spin_lock_irq(&rp->lock);
+        spin_lock_irqsave(&rp->lock, flags);
        wmb();
        rp->tx_ring[entry].tx_status = cpu_to_le32(DescOwn);
        wmb();
@@ -1280,7 +1281,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
-        spin_unlock_irq(&rp->lock);
+        spin_unlock_irqrestore(&rp->lock, flags);
        if (debug > 4) {
                printk(KERN_DEBUG "%s: Transmit frame #%d queued in slot %d.\n",
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3ba35956327a..cee08a1e497a 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1778,7 +1778,7 @@ static void velocity_error(struct velocity_info *vptr, int status)
                         *       mode
                         */
                        if (vptr->rev_id < REV_ID_VT3216_A0) {
-                                if (vptr->mii_status | VELOCITY_DUPLEX_FULL)
+                                if (vptr->mii_status & VELOCITY_DUPLEX_FULL)
                                        BYTE_REG_BITS_ON(TCR_TB2BDIS, &regs->TCR);
                                else
                                        BYTE_REG_BITS_OFF(TCR_TB2BDIS, &regs->TCR);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 9d38cf60a0db..88c3d8573869 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1967,13 +1967,14 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
        int ret;
        mutex_lock(&ar->mutex);
-        if ((param) && !(queue > __AR9170_NUM_TXQ)) {
+        if (queue < __AR9170_NUM_TXQ) {
                memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
                       param, sizeof(*param));
                ret = ar9170_set_qos(ar);
-        } else
+        } else {
                ret = -EINVAL;
+        }
        mutex_unlock(&ar->mutex);
        return ret;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 754b1f8d8da9..007eb85fc67e 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -598,11 +598,15 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
        err = request_firmware(&aru->init_values, "ar9170-1.fw",
                               &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
        if (err) {
                release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
                return err;
        }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f6728..6dcac73b4d29 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                        };
                        u8 channel;
-                        while (channel_index < IPW_SCAN_CHANNELS) {
+                        while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                channel =
                                    priv->speed_scan[priv->speed_scan_pos];
                                if (channel == 0) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index d6997371c27e..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,7 +1,6 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -44,21 +43,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
+        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
+        u8 tmp[30];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; j < *rates_size && rates[j]; j++) {
+                for (j = 0; rates[j] && (j < *rates_size); j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
-                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -70,7 +69,10 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
+                goto done;
        }
+        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +322,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
+        tmplen = MAX_RATES;
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -596,7 +598,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 0a2e29140add..c8a1998d4744 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -56,8 +56,8 @@ struct rxpd {
                        u8 bss_type;
                        /* BSS number */
                        u8 bss_num;
-                } bss;
+                } __attribute__ ((packed)) bss;
-        } u;
+        } __attribute__ ((packed)) u;
        /* SNR */
        u8 snr;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a263d5c84c08..83967afe0821 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -261,7 +261,7 @@ struct mwl8k_vif {
         */
 };
-#define MWL8K_VIF(_vif) (struct mwl8k_vif *)(&((_vif)->drv_priv))
+#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 static const struct ieee80211_channel mwl8k_channels[] = {
        { .center_freq = 2412, .hw_value = 1, },
@@ -1012,6 +1012,8 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                rmb();
                skb = rxq->rx_skb[rxq->rx_head];
+                if (skb == NULL)
+                        break;
                rxq->rx_skb[rxq->rx_head] = NULL;
                rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
@@ -1591,6 +1593,9 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
        timeout = wait_for_completion_timeout(&cmd_wait,
                                msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
+        pci_unmap_single(priv->pdev, dma_addr, dma_size,
+                                        PCI_DMA_BIDIRECTIONAL);
        result = &cmd->result;
        if (!timeout) {
                spin_lock_irq(&priv->fw_lock);
@@ -1610,8 +1615,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                               *result);
        }
-        pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                        PCI_DMA_BIDIRECTIONAL);
        return rc;
 }
@@ -1654,18 +1657,18 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
        memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
        cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
-        cmd->num_tx_queues = MWL8K_TX_QUEUES;
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
-        cmd->num_tx_desc_per_queue = MWL8K_TX_DESCS;
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
-        cmd->total_rx_desc = MWL8K_RX_DESCS;
+        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        if (!rc) {
                SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
-                priv->fw_rev = cmd->fw_rev;
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                priv->hw_rev = cmd->hw_rev;
                priv->region_code = le16_to_cpu(cmd->region_code);
        }
@@ -3216,15 +3219,19 @@ static int mwl8k_configure_filter_wt(struct work_struct *wt)
        struct dev_addr_list *mclist = worker->mclist;
        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mv_vif;
        int rc = 0;
        if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
                if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
                        rc = mwl8k_cmd_set_pre_scan(hw);
                else {
-                        mv_vif = MWL8K_VIF(priv->vif);
+                        u8 *bssid;
-                        rc = mwl8k_cmd_set_post_scan(hw, mv_vif->bssid);
+                        bssid = "\x00\x00\x00\x00\x00\x00";
+                        if (priv->vif != NULL)
+                                bssid = MWL8K_VIF(priv->vif)->bssid;
+                        rc = mwl8k_cmd_set_post_scan(hw, bssid);
                }
        }
@@ -3726,6 +3733,8 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
        /* Remove tx reclaim tasklet */
        tasklet_kill(&priv->tx_reclaim_task);
@@ -3739,8 +3748,6 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_reclaim(hw, i, 1);
-        ieee80211_unregister_hw(hw);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_deinit(hw, i);
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index a498dde024e1..49c9e2c1433d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -849,13 +849,15 @@ struct rt2x00_dev {
 static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev,
                                  const unsigned int word, u32 *data)
 {
-        *data = rt2x00dev->rf[word];
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        *data = rt2x00dev->rf[word - 1];
 }
 static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
                                   const unsigned int word, u32 data)
 {
-        rt2x00dev->rf[word] = data;
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        rt2x00dev->rf[word - 1] = data;
 }
 /*
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 37c84e3b8be0..81c753a617ab 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -120,6 +120,9 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
    for (i = ARRAY_SIZE(cards)-1; i >= 0; i--)
        if (z->id == cards[i].id)
            break;
+    if (i < 0)
+        return -ENODEV;
    board = z->resource.start;
    ioaddr = board+cards[i].offset;
    dev = alloc_ei_netdev();
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 037c1e0b7c4c..6553833c12db 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -527,7 +527,7 @@ config SERIAL_S3C24A0
 config SERIAL_S3C6400
        tristate "Samsung S3C6400/S3C6410 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C600 || CPU_S3C6410)
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410)
        default y
        help
          Serial port support for the Samsung S3C6400 and S3C6410
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index e0d44af4745a..3f3119d760db 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -111,29 +111,32 @@ static int s3c24xx_spi_setupxfer(struct spi_device *spi,
        unsigned int bpw;
        unsigned int hz;
        unsigned int div;
+        unsigned long clk;
        bpw = t ? t->bits_per_word : spi->bits_per_word;
        hz  = t ? t->speed_hz : spi->max_speed_hz;
+        if (!bpw)
+                bpw = 8;
+        if (!hz)
+                hz = spi->max_speed_hz;
        if (bpw != 8) {
                dev_err(&spi->dev, "invalid bits-per-word (%d)\n", bpw);
                return -EINVAL;
        }
-        div = clk_get_rate(hw->clk) / hz;
+        clk = clk_get_rate(hw->clk);
+        div = DIV_ROUND_UP(clk, hz * 2) - 1;
-        /* is clk = pclk / (2 * (pre+1)), or is it
-         *    clk = (pclk * 2) / ( pre + 1) */
-        div /= 2;
-        if (div > 0)
-                div -= 1;
        if (div > 255)
                div = 255;
-        dev_dbg(&spi->dev, "setting pre-scaler to %d (hz %d)\n", div, hz);
+        dev_dbg(&spi->dev, "setting pre-scaler to %d (wanted %d, got %ld)\n",
+                div, hz, clk / (2 * (div + 1)));
        writeb(div, hw->regs + S3C2410_SPPRE);
        spin_lock(&hw->bitbang.lock);
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 8f24564f77b0..07f22b625632 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -481,6 +481,9 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
        /* tell the board code to enable the panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                board_cfg = &ch->cfg.board_cfg;
                if (board_cfg->display_on)
                        board_cfg->display_on(board_cfg->board_data);
@@ -498,6 +501,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
        /* clean up deferred io and ask board code to disable panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                /* deferred io mode:
                 * flush frame, and wait for frame end interrupt