66 files changed, 474 insertions, 779 deletions

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0cd3ad497136..4214bfb13bbd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -612,7 +612,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev)
                 if (tf->flags & ATA_TFLAG_LBA48) {
                         block |= (u64)tf->hob_lbah << 40;
                         block |= (u64)tf->hob_lbam << 32;
-                        block |= tf->hob_lbal << 24;
+                        block |= (u64)tf->hob_lbal << 24;
                 } else
                         block |= (tf->device & 0xf) << 24;
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 8077bdf5d30d..32da9a93ce44 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -610,9 +610,6 @@ void ata_scsi_error(struct Scsi_Host *host)
                                 if (ata_ncq_enabled(dev))
                                         ehc->saved_ncq_enabled |= 1 << devno;
                         }
-
-                        /* set last reset timestamp to some time in the past */
-                        ehc->last_reset = jiffies - 60 * HZ;
                 }
 
                 ap->pflags |= ATA_PFLAG_EH_IN_PROGRESS;
@@ -2281,17 +2278,21 @@ int ata_eh_reset(struct ata_link *link, int classify,
         if (link->flags & ATA_LFLAG_NO_SRST)
                 softreset = NULL;
 
-        now = jiffies;
-        deadline = ata_deadline(ehc->last_reset, ATA_EH_RESET_COOL_DOWN);
-        if (time_before(now, deadline))
-                schedule_timeout_uninterruptible(deadline - now);
+        /* make sure each reset attemp is at least COOL_DOWN apart */
+        if (ehc->i.flags & ATA_EHI_DID_RESET) {
+                now = jiffies;
+                WARN_ON(time_after(ehc->last_reset, now));
+                deadline = ata_deadline(ehc->last_reset,
+                                        ATA_EH_RESET_COOL_DOWN);
+                if (time_before(now, deadline))
+                        schedule_timeout_uninterruptible(deadline - now);
+        }
 
         spin_lock_irqsave(ap->lock, flags);
         ap->pflags |= ATA_PFLAG_RESETTING;
         spin_unlock_irqrestore(ap->lock, flags);
 
         ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
-        ehc->last_reset = jiffies;
 
         ata_link_for_each_dev(dev, link) {
                 /* If we issue an SRST then an ATA drive (not ATAPI)
@@ -2379,7 +2380,6 @@ int ata_eh_reset(struct ata_link *link, int classify,
         /*
          * Perform reset
          */
-        ehc->last_reset = jiffies;
         if (ata_is_host_link(link))
                 ata_eh_freeze_port(ap);
 
@@ -2391,6 +2391,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
                                         reset == softreset ? "soft" : "hard");
 
                 /* mark that this EH session started with reset */
+                ehc->last_reset = jiffies;
                 if (reset == hardreset)
                         ehc->i.flags |= ATA_EHI_DID_HARDRESET;
                 else
@@ -2535,7 +2536,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
         ata_eh_done(link, NULL, ATA_EH_RESET);
         if (slave)
                 ata_eh_done(slave, NULL, ATA_EH_RESET);
-        ehc->last_reset = jiffies;
+        ehc->last_reset = jiffies;      /* update to completion time */
         ehc->i.action |= ATA_EH_REVALIDATE;
 
         rc = 0;
diff --git a/drivers/ata/pata_cs5535.c b/drivers/ata/pata_cs5535.c
index 1b2d4a0f5f74..8b236af84c2e 100644
--- a/drivers/ata/pata_cs5535.c
+++ b/drivers/ata/pata_cs5535.c
@@ -72,7 +72,6 @@
 /**
  *      cs5535_cable_detect     -       detect cable type
  *      @ap: Port to detect on
- *      @deadline: deadline jiffies for the operation
  *
  *      Perform cable detection for ATA66 capable cable. Return a libata
  *      cable type.
diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
index 73f8332cb679..afed92976198 100644
--- a/drivers/ata/pata_cs5536.c
+++ b/drivers/ata/pata_cs5536.c
@@ -110,7 +110,6 @@ static inline int cs5536_write(struct pci_dev *pdev, int reg, int val)
 /**
  *      cs5536_cable_detect     -       detect cable type
  *      @ap: Port to detect on
- *      @deadline: deadline jiffies for the operation
  *
  *      Perform cable detection for ATA66 capable cable. Return a libata
  *      cable type.
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index 271cb64d429e..64b2e2281ee7 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -416,6 +416,7 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
         PCMCIA_DEVICE_PROD_ID12("STI", "Flash 5.0", 0xbf2df18d, 0x8cb57a0e),
         PCMCIA_MFC_DEVICE_PROD_ID12(1, "SanDisk", "ConnectPlus", 0x7a954bd9, 0x74be00c6),
+        PCMCIA_DEVICE_PROD_ID2("Flash Card", 0x5a362506),
         PCMCIA_DEVICE_NULL,
 };
 
diff --git a/drivers/ata/pata_sch.c b/drivers/ata/pata_sch.c
index c8cc027789fe..6aeeeeb34124 100644
--- a/drivers/ata/pata_sch.c
+++ b/drivers/ata/pata_sch.c
@@ -83,7 +83,7 @@ static struct ata_port_operations sch_pata_ops = {
 };
 
 static struct ata_port_info sch_port_info = {
-        .flags          = 0,
+        .flags          = ATA_FLAG_SLAVE_POSS,
         .pio_mask       = ATA_PIO4,   /* pio0-4 */
         .mwdma_mask     = ATA_MWDMA2, /* mwdma0-2 */
         .udma_mask      = ATA_UDMA5,  /* udma0-5 */
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 7d30ee1d3fca..04e4549299ba 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -7,12 +7,14 @@
  *      Original driver code supplied by Multi-Tech
  *
  *      Changes
- *      1/9/98  alan@redhat.com         Merge to 2.0.x kernel tree
+ *      1/9/98  alan@lxorguk.ukuu.org.uk
+ *                                      Merge to 2.0.x kernel tree
  *                                      Obtain and use official major/minors
  *                                      Loader switched to a misc device
  *                                      (fixed range check bug as a side effect)
  *                                      Printk clean up
- *      9/12/98 alan@redhat.com         Rough port to 2.1.x
+ *      9/12/98 alan@lxorguk.ukuu.org.uk
+ *                                      Rough port to 2.1.x
  *
  *      10/6/99 sameer                  Merged the ISA and PCI drivers to
  *                                      a new unified driver.
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 8beef50f95a0..047766915411 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -14,7 +14,8 @@
  *      (at your option) any later version.
  *
  *      Fed through a cleanup, indent and remove of non 2.6 code by Alan Cox
- *      <alan@redhat.com>. The original 1.8 code is available on www.moxa.com.
+ *      <alan@lxorguk.ukuu.org.uk>. The original 1.8 code is available on
+ *      www.moxa.com.
  *      - Fixed x86_64 cleanness
  */
 
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index ec249d2db633..d883e1b8bb8c 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -270,6 +270,6 @@ static void __exit dca_exit(void)
         dca_sysfs_exit();
 }
 
-module_init(dca_init);
+subsys_initcall(dca_init);
 module_exit(dca_exit);
 
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index b0438c4f0c30..ecd743f7cc61 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -525,7 +525,7 @@ static dma_cookie_t ioat1_tx_submit(struct dma_async_tx_descriptor *tx)
         }
 
         hw->ctl = IOAT_DMA_DESCRIPTOR_CTL_CP_STS;
-        if (new->async_tx.callback) {
+        if (first->async_tx.callback) {
                 hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN;
                 if (first != new) {
                         /* move callback into to last desc */
@@ -617,7 +617,7 @@ static dma_cookie_t ioat2_tx_submit(struct dma_async_tx_descriptor *tx)
         }
 
         hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_CP_STS;
-        if (new->async_tx.callback) {
+        if (first->async_tx.callback) {
                 hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN;
                 if (first != new) {
                         /* move callback into to last desc */
@@ -807,6 +807,12 @@ static void ioat_dma_free_chan_resources(struct dma_chan *chan)
         struct ioat_desc_sw *desc, *_desc;
         int in_use_descs = 0;
 
+        /* Before freeing channel resources first check
+         * if they have been previously allocated for this channel.
+         */
+        if (ioat_chan->desccount == 0)
+                return;
+
         tasklet_disable(&ioat_chan->cleanup_task);
         ioat_dma_memcpy_cleanup(ioat_chan);
 
@@ -869,6 +875,7 @@ static void ioat_dma_free_chan_resources(struct dma_chan *chan)
         ioat_chan->last_completion = ioat_chan->completion_addr = 0;
         ioat_chan->pending = 0;
         ioat_chan->dmacount = 0;
+        ioat_chan->desccount = 0;
         ioat_chan->watchdog_completion = 0;
         ioat_chan->last_compl_desc_addr_hw = 0;
         ioat_chan->watchdog_tcp_cookie =
diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c
index e763d723e4cf..9f6fe46a9b87 100644
--- a/drivers/dma/iovlock.c
+++ b/drivers/dma/iovlock.c
@@ -55,7 +55,6 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
         int nr_iovecs = 0;
         int iovec_len_used = 0;
         int iovec_pages_used = 0;
-        long err;
 
         /* don't pin down non-user-based iovecs */
         if (segment_eq(get_fs(), KERNEL_DS))
@@ -72,23 +71,21 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
         local_list = kmalloc(sizeof(*local_list)
                 + (nr_iovecs * sizeof (struct dma_page_list))
                 + (iovec_pages_used * sizeof (struct page*)), GFP_KERNEL);
-        if (!local_list) {
-                err = -ENOMEM;
+        if (!local_list)
                 goto out;
-        }
 
         /* list of pages starts right after the page list array */
         pages = (struct page **) &local_list->page_list[nr_iovecs];
 
+        local_list->nr_iovecs = 0;
+
         for (i = 0; i < nr_iovecs; i++) {
                 struct dma_page_list *page_list = &local_list->page_list[i];
 
                 len -= iov[i].iov_len;
 
-                if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) {
-                        err = -EFAULT;
+                if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len))
                         goto unpin;
-                }
 
                 page_list->nr_pages = num_pages_spanned(&iov[i]);
                 page_list->base_address = iov[i].iov_base;
@@ -109,10 +106,8 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
                         NULL);
                 up_read(&current->mm->mmap_sem);
 
-                if (ret != page_list->nr_pages) {
-                        err = -ENOMEM;
+                if (ret != page_list->nr_pages)
                         goto unpin;
-                }
 
                 local_list->nr_iovecs = i + 1;
         }
@@ -122,7 +117,7 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
 unpin:
         dma_unpin_iovec_pages(local_list);
 out:
-        return ERR_PTR(err);
+        return NULL;
 }
 
 void dma_unpin_iovec_pages(struct dma_pinned_list *pinned_list)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 96f416afc3f6..3ab1e9cc4692 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -266,11 +266,19 @@ int drm_init(struct drm_driver *driver)
         for (i = 0; driver->pci_driver.id_table[i].vendor != 0; i++) {
                 pid = (struct pci_device_id *)&driver->pci_driver.id_table[i];
 
+                /* Loop around setting up a DRM device for each PCI device
+                 * matching our ID and device class.  If we had the internal
+                 * function that pci_get_subsys and pci_get_class used, we'd
+                 * be able to just pass pid in instead of doing a two-stage
+                 * thing.
+                 */
                 pdev = NULL;
-                /* pass back in pdev to account for multiple identical cards */
                 while ((pdev =
                         pci_get_subsys(pid->vendor, pid->device, pid->subvendor,
                                        pid->subdevice, pdev)) != NULL) {
+                        if ((pdev->class & pid->class_mask) != pid->class)
+                                continue;
+
                         /* stealth mode requires a manual probe */
                         pci_dev_get(pdev);
                         drm_get_dev(pdev, pid, driver);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 212a94f715b2..15c8dabc3e97 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -280,8 +280,6 @@ int drm_irq_uninstall(struct drm_device * dev)
 
         drm_vblank_cleanup(dev);
 
-        dev->locked_tasklet_func = NULL;
-
         return 0;
 }
 EXPORT_SYMBOL(drm_irq_uninstall);
@@ -699,81 +697,3 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         drm_vbl_send_signals(dev, crtc);
 }
 EXPORT_SYMBOL(drm_handle_vblank);
-
-/**
- * Tasklet wrapper function.
- *
- * \param data DRM device in disguise.
- *
- * Attempts to grab the HW lock and calls the driver callback on success. On
- * failure, leave the lock marked as contended so the callback can be called
- * from drm_unlock().
- */
-static void drm_locked_tasklet_func(unsigned long data)
-{
-        struct drm_device *dev = (struct drm_device *)data;
-        unsigned long irqflags;
-        void (*tasklet_func)(struct drm_device *);
-        
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-        tasklet_func = dev->locked_tasklet_func;
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-
-        if (!tasklet_func ||
-            !drm_lock_take(&dev->lock,
-                           DRM_KERNEL_CONTEXT)) {
-                return;
-        }
-
-        dev->lock.lock_time = jiffies;
-        atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-        tasklet_func = dev->locked_tasklet_func;
-        dev->locked_tasklet_func = NULL;
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-        
-        if (tasklet_func != NULL)
-                tasklet_func(dev);
-
-        drm_lock_free(&dev->lock,
-                      DRM_KERNEL_CONTEXT);
-}
-
-/**
- * Schedule a tasklet to call back a driver hook with the HW lock held.
- *
- * \param dev DRM device.
- * \param func Driver callback.
- *
- * This is intended for triggering actions that require the HW lock from an
- * interrupt handler. The lock will be grabbed ASAP after the interrupt handler
- * completes. Note that the callback may be called from interrupt or process
- * context, it must not make any assumptions about this. Also, the HW lock will
- * be held with the kernel context or any client context.
- */
-void drm_locked_tasklet(struct drm_device *dev, void (*func)(struct drm_device *))
-{
-        unsigned long irqflags;
-        static DECLARE_TASKLET(drm_tasklet, drm_locked_tasklet_func, 0);
-
-        if (!drm_core_check_feature(dev, DRIVER_HAVE_IRQ) ||
-            test_bit(TASKLET_STATE_SCHED, &drm_tasklet.state))
-                return;
-
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-
-        if (dev->locked_tasklet_func) {
-                spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-                return;
-        }
-
-        dev->locked_tasklet_func = func;
-
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-
-        drm_tasklet.data = (unsigned long)dev;
-
-        tasklet_hi_schedule(&drm_tasklet);
-}
-EXPORT_SYMBOL(drm_locked_tasklet);
diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
index 888159e03d26..1cfa72031f8f 100644
--- a/drivers/gpu/drm/drm_lock.c
+++ b/drivers/gpu/drm/drm_lock.c
@@ -154,8 +154,6 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
 int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
         struct drm_lock *lock = data;
-        unsigned long irqflags;
-        void (*tasklet_func)(struct drm_device *);
 
         if (lock->context == DRM_KERNEL_CONTEXT) {
                 DRM_ERROR("Process %d using kernel context %d\n",
@@ -163,13 +161,6 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                 return -EINVAL;
         }
 
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-        tasklet_func = dev->locked_tasklet_func;
-        dev->locked_tasklet_func = NULL;
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-        if (tasklet_func != NULL)
-                tasklet_func(dev);
-
         atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
 
         /* kernel_context_switch isn't used by any of the x86 drm
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 141e33004a76..66c96ec66672 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -92,7 +92,6 @@ static int drm_fill_in_dev(struct drm_device * dev, struct pci_dev *pdev,
 
         spin_lock_init(&dev->count_lock);
         spin_lock_init(&dev->drw_lock);
-        spin_lock_init(&dev->tasklet_lock);
         spin_lock_init(&dev->lock.spinlock);
         init_timer(&dev->timer);
         mutex_init(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 256e22963ae4..0d215e38606a 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -154,6 +154,9 @@ static int i915_dma_cleanup(struct drm_device * dev)
         if (I915_NEED_GFX_HWS(dev))
                 i915_free_hws(dev);
 
+        dev_priv->sarea = NULL;
+        dev_priv->sarea_priv = NULL;
+
         return 0;
 }
 
@@ -442,7 +445,7 @@ static void i915_emit_breadcrumb(struct drm_device *dev)
 
         BEGIN_LP_RING(4);
         OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(5 << MI_STORE_DWORD_INDEX_SHIFT);
+        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
         OUT_RING(dev_priv->counter);
         OUT_RING(0);
         ADVANCE_LP_RING();
@@ -573,7 +576,7 @@ static int i915_dispatch_flip(struct drm_device * dev)
 
         BEGIN_LP_RING(4);
         OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(5 << MI_STORE_DWORD_INDEX_SHIFT);
+        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
         OUT_RING(dev_priv->counter);
         OUT_RING(0);
         ADVANCE_LP_RING();
@@ -608,7 +611,6 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
                             struct drm_file *file_priv)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        u32 *hw_status = dev_priv->hw_status_page;
         drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
             dev_priv->sarea_priv;
         drm_i915_batchbuffer_t *batch = data;
@@ -634,7 +636,7 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
         mutex_unlock(&dev->struct_mutex);
 
         if (sarea_priv)
-                sarea_priv->last_dispatch = (int)hw_status[5];
+                sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
         return ret;
 }
 
@@ -642,7 +644,6 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
                           struct drm_file *file_priv)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        u32 *hw_status = dev_priv->hw_status_page;
         drm_i915_sarea_t *sarea_priv = (drm_i915_sarea_t *)
             dev_priv->sarea_priv;
         drm_i915_cmdbuffer_t *cmdbuf = data;
@@ -670,7 +671,7 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
         }
 
         if (sarea_priv)
-                sarea_priv->last_dispatch = (int)hw_status[5];
+                sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
         return 0;
 }
 
@@ -849,8 +850,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
          * be lost or delayed
          */
         if (!IS_I945G(dev) && !IS_I945GM(dev) && !IS_I965GM(dev))
-                if (pci_enable_msi(dev->pdev))
-                        DRM_ERROR("failed to enable MSI\n");
+                pci_enable_msi(dev->pdev);
 
         intel_opregion_init(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 572dcd0e3e0d..ef1c0b8f8d07 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -88,13 +88,6 @@ struct mem_block {
         struct drm_file *file_priv; /* NULL: free, -1: heap, other: real files */
 };
 
-typedef struct _drm_i915_vbl_swap {
-        struct list_head head;
-        drm_drawable_t drw_id;
-        unsigned int pipe;
-        unsigned int sequence;
-} drm_i915_vbl_swap_t;
-
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -146,10 +139,6 @@ typedef struct drm_i915_private {
         unsigned int sr01, adpa, ppcr, dvob, dvoc, lvds;
         int vblank_pipe;
 
-        spinlock_t swaps_lock;
-        drm_i915_vbl_swap_t vbl_swaps;
-        unsigned int swaps_pending;
-
         struct intel_opregion opregion;
 
         /* Register state */
@@ -157,6 +146,7 @@ typedef struct drm_i915_private {
         u32 saveDSPACNTR;
         u32 saveDSPBCNTR;
         u32 saveDSPARB;
+        u32 saveRENDERSTANDBY;
         u32 savePIPEACONF;
         u32 savePIPEBCONF;
         u32 savePIPEASRC;
@@ -241,9 +231,6 @@ typedef struct drm_i915_private {
         u8 saveDACDATA[256*3]; /* 256 3-byte colors */
         u8 saveCR[37];
 
-        /** Work task for vblank-related ring access */
-        struct work_struct vblank_work;
-
         struct {
                 struct drm_mm gtt_space;
 
@@ -444,7 +431,6 @@ extern int i915_irq_wait(struct drm_device *dev, void *data,
 void i915_user_irq_get(struct drm_device *dev);
 void i915_user_irq_put(struct drm_device *dev);
 
-extern void i915_vblank_work_handler(struct work_struct *work);
 extern irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS);
 extern void i915_driver_irq_preinstall(struct drm_device * dev);
 extern int i915_driver_irq_postinstall(struct drm_device *dev);
@@ -622,8 +608,9 @@ static inline void opregion_enable_asle(struct drm_device *dev) { return; }
  * The area from dword 0x20 to 0x3ff is available for driver usage.
  */
 #define READ_HWSP(dev_priv, reg)  (((volatile u32*)(dev_priv->hw_status_page))[reg])
-#define READ_BREADCRUMB(dev_priv) READ_HWSP(dev_priv, 5)
+#define READ_BREADCRUMB(dev_priv) READ_HWSP(dev_priv, I915_BREADCRUMB_INDEX)
 #define I915_GEM_HWS_INDEX              0x20
+#define I915_BREADCRUMB_INDEX           0x21
 
 extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b0ec73fa6a93..6b4a2bd20640 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1455,11 +1455,9 @@ i915_gem_object_set_domain_range(struct drm_gem_object *obj,
                                                   read_domains, write_domain);
 
         /* Wait on any GPU rendering to the object to be flushed. */
-        if (obj->write_domain & ~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT)) {
-                ret = i915_gem_object_wait_rendering(obj);
-                if (ret)
-                        return ret;
-        }
+        ret = i915_gem_object_wait_rendering(obj);
+        if (ret)
+                return ret;
 
         if (obj_priv->page_cpu_valid == NULL) {
                 obj_priv->page_cpu_valid = drm_calloc(1, obj->size / PAGE_SIZE,
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 26f48932a51e..82752d6177a4 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -80,211 +80,6 @@ i915_pipe_enabled(struct drm_device *dev, int pipe)
         return 0;
 }
 
-/**
- * Emit blits for scheduled buffer swaps.
- *
- * This function will be called with the HW lock held.
- * Because this function must grab the ring mutex (dev->struct_mutex),
- * it can no longer run at soft irq time. We'll fix this when we do
- * the DRI2 swap buffer work.
- */
-static void i915_vblank_tasklet(struct drm_device *dev)
-{
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        unsigned long irqflags;
-        struct list_head *list, *tmp, hits, *hit;
-        int nhits, nrects, slice[2], upper[2], lower[2], i;
-        unsigned counter[2];
-        struct drm_drawable_info *drw;
-        drm_i915_sarea_t *sarea_priv = dev_priv->sarea_priv;
-        u32 cpp = dev_priv->cpp;
-        u32 cmd = (cpp == 4) ? (XY_SRC_COPY_BLT_CMD |
-                                XY_SRC_COPY_BLT_WRITE_ALPHA |
-                                XY_SRC_COPY_BLT_WRITE_RGB)
-                             : XY_SRC_COPY_BLT_CMD;
-        u32 src_pitch = sarea_priv->pitch * cpp;
-        u32 dst_pitch = sarea_priv->pitch * cpp;
-        u32 ropcpp = (0xcc << 16) | ((cpp - 1) << 24);
-        RING_LOCALS;
-
-        mutex_lock(&dev->struct_mutex);
-
-        if (IS_I965G(dev) && sarea_priv->front_tiled) {
-                cmd |= XY_SRC_COPY_BLT_DST_TILED;
-                dst_pitch >>= 2;
-        }
-        if (IS_I965G(dev) && sarea_priv->back_tiled) {
-                cmd |= XY_SRC_COPY_BLT_SRC_TILED;
-                src_pitch >>= 2;
-        }
-
-        counter[0] = drm_vblank_count(dev, 0);
-        counter[1] = drm_vblank_count(dev, 1);
-
-        DRM_DEBUG("\n");
-
-        INIT_LIST_HEAD(&hits);
-
-        nhits = nrects = 0;
-
-        spin_lock_irqsave(&dev_priv->swaps_lock, irqflags);
-
-        /* Find buffer swaps scheduled for this vertical blank */
-        list_for_each_safe(list, tmp, &dev_priv->vbl_swaps.head) {
-                drm_i915_vbl_swap_t *vbl_swap =
-                        list_entry(list, drm_i915_vbl_swap_t, head);
-                int pipe = vbl_swap->pipe;
-
-                if ((counter[pipe] - vbl_swap->sequence) > (1<<23))
-                        continue;
-
-                list_del(list);
-                dev_priv->swaps_pending--;
-                drm_vblank_put(dev, pipe);
-
-                spin_unlock(&dev_priv->swaps_lock);
-                spin_lock(&dev->drw_lock);
-
-                drw = drm_get_drawable_info(dev, vbl_swap->drw_id);
-
-                list_for_each(hit, &hits) {
-                        drm_i915_vbl_swap_t *swap_cmp =
-                                list_entry(hit, drm_i915_vbl_swap_t, head);
-                        struct drm_drawable_info *drw_cmp =
-                                drm_get_drawable_info(dev, swap_cmp->drw_id);
-
-                        /* Make sure both drawables are still
-                         * around and have some rectangles before
-                         * we look inside to order them for the
-                         * blts below.
-                         */
-                        if (drw_cmp && drw_cmp->num_rects > 0 &&
-                            drw && drw->num_rects > 0 &&
-                            drw_cmp->rects[0].y1 > drw->rects[0].y1) {
-                                list_add_tail(list, hit);
-                                break;
-                        }
-                }
-
-                spin_unlock(&dev->drw_lock);
-
-                /* List of hits was empty, or we reached the end of it */
-                if (hit == &hits)
-                        list_add_tail(list, hits.prev);
-
-                nhits++;
-
-                spin_lock(&dev_priv->swaps_lock);
-        }
-
-        if (nhits == 0) {
-                spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
-                mutex_unlock(&dev->struct_mutex);
-                return;
-        }
-
-        spin_unlock(&dev_priv->swaps_lock);
-
-        i915_kernel_lost_context(dev);
-
-        if (IS_I965G(dev)) {
-                BEGIN_LP_RING(4);
-
-                OUT_RING(GFX_OP_DRAWRECT_INFO_I965);
-                OUT_RING(0);
-                OUT_RING(((sarea_priv->width - 1) & 0xffff) | ((sarea_priv->height - 1) << 16));
-                OUT_RING(0);
-                ADVANCE_LP_RING();
-        } else {
-                BEGIN_LP_RING(6);
-
-                OUT_RING(GFX_OP_DRAWRECT_INFO);
-                OUT_RING(0);
-                OUT_RING(0);
-                OUT_RING(sarea_priv->width | sarea_priv->height << 16);
-                OUT_RING(sarea_priv->width | sarea_priv->height << 16);
-                OUT_RING(0);
-
-                ADVANCE_LP_RING();
-        }
-
-        sarea_priv->ctxOwner = DRM_KERNEL_CONTEXT;
-
-        upper[0] = upper[1] = 0;
-        slice[0] = max(sarea_priv->pipeA_h / nhits, 1);
-        slice[1] = max(sarea_priv->pipeB_h / nhits, 1);
-        lower[0] = sarea_priv->pipeA_y + slice[0];
-        lower[1] = sarea_priv->pipeB_y + slice[0];
-
-        spin_lock(&dev->drw_lock);
-
-        /* Emit blits for buffer swaps, partitioning both outputs into as many
-         * slices as there are buffer swaps scheduled in order to avoid tearing
-         * (based on the assumption that a single buffer swap would always
-         * complete before scanout starts).
-         */
-        for (i = 0; i++ < nhits;
-             upper[0] = lower[0], lower[0] += slice[0],
-             upper[1] = lower[1], lower[1] += slice[1]) {
-                if (i == nhits)
-                        lower[0] = lower[1] = sarea_priv->height;
-
-                list_for_each(hit, &hits) {
-                        drm_i915_vbl_swap_t *swap_hit =
-                                list_entry(hit, drm_i915_vbl_swap_t, head);
-                        struct drm_clip_rect *rect;
-                        int num_rects, pipe;
-                        unsigned short top, bottom;
-
-                        drw = drm_get_drawable_info(dev, swap_hit->drw_id);
-
-                        /* The drawable may have been destroyed since
-                         * the vblank swap was queued
-                         */
-                        if (!drw)
-                                continue;
-
-                        rect = drw->rects;
-                        pipe = swap_hit->pipe;
-                        top = upper[pipe];
-                        bottom = lower[pipe];
-
-                        for (num_rects = drw->num_rects; num_rects--; rect++) {
-                                int y1 = max(rect->y1, top);
-                                int y2 = min(rect->y2, bottom);
-
-                                if (y1 >= y2)
-                                        continue;
-
-                                BEGIN_LP_RING(8);
-
-                                OUT_RING(cmd);
-                                OUT_RING(ropcpp | dst_pitch);
-                                OUT_RING((y1 << 16) | rect->x1);
-                                OUT_RING((y2 << 16) | rect->x2);
-                                OUT_RING(sarea_priv->front_offset);
-                                OUT_RING((y1 << 16) | rect->x1);
-                                OUT_RING(src_pitch);
-                                OUT_RING(sarea_priv->back_offset);
-
-                                ADVANCE_LP_RING();
-                        }
-                }
-        }
-
-        spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-        mutex_unlock(&dev->struct_mutex);
-
-        list_for_each_safe(hit, tmp, &hits) {
-                drm_i915_vbl_swap_t *swap_hit =
-                        list_entry(hit, drm_i915_vbl_swap_t, head);
-
-                list_del(hit);
-
-                drm_free(swap_hit, sizeof(*swap_hit), DRM_MEM_DRIVER);
-        }
-}
-
 /* Called from drm generic code, passed a 'crtc', which
  * we use as a pipe index
  */
@@ -322,40 +117,6 @@ u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
         return count;
 }
 
-void
-i915_vblank_work_handler(struct work_struct *work)
-{
-        drm_i915_private_t *dev_priv = container_of(work, drm_i915_private_t,
-                                                    vblank_work);
-        struct drm_device *dev = dev_priv->dev;
-        unsigned long irqflags;
-
-        if (dev->lock.hw_lock == NULL) {
-                i915_vblank_tasklet(dev);
-                return;
-        }
-
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-        dev->locked_tasklet_func = i915_vblank_tasklet;
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-
-        /* Try to get the lock now, if this fails, the lock
-         * holder will execute the tasklet during unlock
-         */
-        if (!drm_lock_take(&dev->lock, DRM_KERNEL_CONTEXT))
-                return;
-
-        dev->lock.lock_time = jiffies;
-        atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-
-        spin_lock_irqsave(&dev->tasklet_lock, irqflags);
-        dev->locked_tasklet_func = NULL;
-        spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
-
-        i915_vblank_tasklet(dev);
-        drm_lock_free(&dev->lock, DRM_KERNEL_CONTEXT);
-}
-
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
@@ -433,9 +194,6 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
         if (iir & I915_ASLE_INTERRUPT)
                 opregion_asle_intr(dev);
 
-        if (vblank && dev_priv->swaps_pending > 0)
-                schedule_work(&dev_priv->vblank_work);
-
         return IRQ_HANDLED;
 }
 
@@ -454,12 +212,10 @@ static int i915_emit_irq(struct drm_device * dev)
         if (dev_priv->sarea_priv)
                 dev_priv->sarea_priv->last_enqueue = dev_priv->counter;
 
-        BEGIN_LP_RING(6);
+        BEGIN_LP_RING(4);
         OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(5 << MI_STORE_DWORD_INDEX_SHIFT);
+        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
         OUT_RING(dev_priv->counter);
-        OUT_RING(0);
-        OUT_RING(0);
         OUT_RING(MI_USER_INTERRUPT);
         ADVANCE_LP_RING();
 
@@ -696,123 +452,21 @@ int i915_vblank_pipe_get(struct drm_device *dev, void *data,
 int i915_vblank_swap(struct drm_device *dev, void *data,
                      struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        drm_i915_vblank_swap_t *swap = data;
-        drm_i915_vbl_swap_t *vbl_swap, *vbl_old;
-        unsigned int pipe, seqtype, curseq;
-        unsigned long irqflags;
-        struct list_head *list;
-        int ret;
-
-        if (!dev_priv || !dev_priv->sarea_priv) {
-                DRM_ERROR("%s called with no initialization\n", __func__);
-                return -EINVAL;
-        }
-
-        if (dev_priv->sarea_priv->rotation) {
-                DRM_DEBUG("Rotation not supported\n");
-                return -EINVAL;
-        }
-
-        if (swap->seqtype & ~(_DRM_VBLANK_RELATIVE | _DRM_VBLANK_ABSOLUTE |
-                             _DRM_VBLANK_SECONDARY | _DRM_VBLANK_NEXTONMISS)) {
-                DRM_ERROR("Invalid sequence type 0x%x\n", swap->seqtype);
-                return -EINVAL;
-        }
-
-        pipe = (swap->seqtype & _DRM_VBLANK_SECONDARY) ? 1 : 0;
-
-        seqtype = swap->seqtype & (_DRM_VBLANK_RELATIVE | _DRM_VBLANK_ABSOLUTE);
-
-        if (!(dev_priv->vblank_pipe & (1 << pipe))) {
-                DRM_ERROR("Invalid pipe %d\n", pipe);
-                return -EINVAL;
-        }
-
-        spin_lock_irqsave(&dev->drw_lock, irqflags);
-
-        if (!drm_get_drawable_info(dev, swap->drawable)) {
-                spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-                DRM_DEBUG("Invalid drawable ID %d\n", swap->drawable);
-                return -EINVAL;
-        }
-
-        spin_unlock_irqrestore(&dev->drw_lock, irqflags);
-
-        /*
-         * We take the ref here and put it when the swap actually completes
-         * in the tasklet.
+        /* The delayed swap mechanism was fundamentally racy, and has been
+         * removed.  The model was that the client requested a delayed flip/swap
+         * from the kernel, then waited for vblank before continuing to perform
+         * rendering.  The problem was that the kernel might wake the client
+         * up before it dispatched the vblank swap (since the lock has to be
+         * held while touching the ringbuffer), in which case the client would
+         * clear and start the next frame before the swap occurred, and
+         * flicker would occur in addition to likely missing the vblank.
+         *
+         * In the absence of this ioctl, userland falls back to a correct path
+         * of waiting for a vblank, then dispatching the swap on its own.
+         * Context switching to userland and back is plenty fast enough for
+         * meeting the requirements of vblank swapping.
          */
-        ret = drm_vblank_get(dev, pipe);
-        if (ret)
-                return ret;
-        curseq = drm_vblank_count(dev, pipe);
-
-        if (seqtype == _DRM_VBLANK_RELATIVE)
-                swap->sequence += curseq;
-
-        if ((curseq - swap->sequence) <= (1<<23)) {
-                if (swap->seqtype & _DRM_VBLANK_NEXTONMISS) {
-                        swap->sequence = curseq + 1;
-                } else {
-                        DRM_DEBUG("Missed target sequence\n");
-                        drm_vblank_put(dev, pipe);
-                        return -EINVAL;
-                }
-        }
-
-        vbl_swap = drm_calloc(1, sizeof(*vbl_swap), DRM_MEM_DRIVER);
-
-        if (!vbl_swap) {
-                DRM_ERROR("Failed to allocate memory to queue swap\n");
-                drm_vblank_put(dev, pipe);
-                return -ENOMEM;
-        }
-
-        vbl_swap->drw_id = swap->drawable;
-        vbl_swap->pipe = pipe;
-        vbl_swap->sequence = swap->sequence;
-
-        spin_lock_irqsave(&dev_priv->swaps_lock, irqflags);
-
-        list_for_each(list, &dev_priv->vbl_swaps.head) {
-                vbl_old = list_entry(list, drm_i915_vbl_swap_t, head);
-
-                if (vbl_old->drw_id == swap->drawable &&
-                    vbl_old->pipe == pipe &&
-                    vbl_old->sequence == swap->sequence) {
-                        spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
-                        drm_vblank_put(dev, pipe);
-                        drm_free(vbl_swap, sizeof(*vbl_swap), DRM_MEM_DRIVER);
-                        DRM_DEBUG("Already scheduled\n");
-                        return 0;
-                }
-        }
-
-        if (dev_priv->swaps_pending >= 10) {
-                DRM_DEBUG("Too many swaps queued\n");
-                DRM_DEBUG(" pipe 0: %d pipe 1: %d\n",
-                          drm_vblank_count(dev, 0),
-                          drm_vblank_count(dev, 1));
-
-                list_for_each(list, &dev_priv->vbl_swaps.head) {
-                        vbl_old = list_entry(list, drm_i915_vbl_swap_t, head);
-                        DRM_DEBUG("\tdrw %x pipe %d seq %x\n",
-                                  vbl_old->drw_id, vbl_old->pipe,
-                                  vbl_old->sequence);
-                }
-                spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
-                drm_vblank_put(dev, pipe);
-                drm_free(vbl_swap, sizeof(*vbl_swap), DRM_MEM_DRIVER);
-                return -EBUSY;
-        }
-
-        list_add_tail(&vbl_swap->head, &dev_priv->vbl_swaps.head);
-        dev_priv->swaps_pending++;
-
-        spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
-
-        return 0;
+        return -EINVAL;
 }
 
 /* drm_dma.h hooks
@@ -831,11 +485,6 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int ret, num_pipes = 2;
 
-        spin_lock_init(&dev_priv->swaps_lock);
-        INIT_LIST_HEAD(&dev_priv->vbl_swaps.head);
-        INIT_WORK(&dev_priv->vblank_work, i915_vblank_work_handler);
-        dev_priv->swaps_pending = 0;
-
         /* Set initial unmasked IRQs to just the selected vblank pipes. */
         dev_priv->irq_mask_reg = ~0;
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 5c2d9f206d05..0e476eba36e6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -527,6 +527,9 @@
 #define C0DRB3                  0x10206
 #define C1DRB3                  0x10606
 
+/** GM965 GM45 render standby register */
+#define MCHBAR_RENDER_STANDBY   0x111B8
+
 /*
  * Overlay regs
  */
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 603fe742ccd4..5ddc6e595c0c 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -240,6 +240,10 @@ int i915_save_state(struct drm_device *dev)
 
         pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
 
+        /* Render Standby */
+        if (IS_I965G(dev) && IS_MOBILE(dev))
+                dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
+
         /* Display arbitration control */
         dev_priv->saveDSPARB = I915_READ(DSPARB);
 
@@ -365,6 +369,11 @@ int i915_restore_state(struct drm_device *dev)
 
         pci_write_config_byte(dev->pdev, LBB, dev_priv->saveLBB);
 
+        /* Render Standby */
+        if (IS_I965G(dev) && IS_MOBILE(dev))
+                I915_WRITE(MCHBAR_RENDER_STANDBY, dev_priv->saveRENDERSTANDBY);
+
+        /* Display arbitration */
         I915_WRITE(DSPARB, dev_priv->saveDSPARB);
 
         /* Pipe & plane A info */
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 073894824e6b..abdc1ae38467 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -1751,6 +1751,12 @@ int radeon_driver_load(struct drm_device *dev, unsigned long flags)
         else
                 dev_priv->flags |= RADEON_IS_PCI;
 
+        ret = drm_addmap(dev, drm_get_resource_start(dev, 2),
+                         drm_get_resource_len(dev, 2), _DRM_REGISTERS,
+                         _DRM_READ_ONLY | _DRM_DRIVER, &dev_priv->mmio);
+        if (ret != 0)
+                return ret;
+
         DRM_DEBUG("%s card detected\n",
                   ((dev_priv->flags & RADEON_IS_AGP) ? "AGP" : (((dev_priv->flags & RADEON_IS_PCIE) ? "PCIE" : "PCI"))));
         return ret;
@@ -1767,12 +1773,6 @@ int radeon_driver_firstopen(struct drm_device *dev)
 
         dev_priv->gart_info.table_size = RADEON_PCIGART_TABLE_SIZE;
 
-        ret = drm_addmap(dev, drm_get_resource_start(dev, 2),
-                         drm_get_resource_len(dev, 2), _DRM_REGISTERS,
-                         _DRM_READ_ONLY, &dev_priv->mmio);
-        if (ret != 0)
-                return ret;
-
         dev_priv->fb_aper_offset = drm_get_resource_start(dev, 0);
         ret = drm_addmap(dev, dev_priv->fb_aper_offset,
                          drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
@@ -1788,6 +1788,9 @@ int radeon_driver_unload(struct drm_device *dev)
         drm_radeon_private_t *dev_priv = dev->dev_private;
 
         DRM_DEBUG("\n");
+
+        drm_rmmap(dev, dev_priv->mmio);
+
         drm_free(dev_priv, sizeof(*dev_priv), DRM_MEM_DRIVER);
 
         dev->dev_private = NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 02f5575ba395..7a183789be97 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -287,7 +287,6 @@ typedef struct drm_radeon_private {
         unsigned long gart_textures_offset;
 
         drm_local_map_t *sarea;
-        drm_local_map_t *mmio;
         drm_local_map_t *cp_ring;
         drm_local_map_t *ring_rptr;
         drm_local_map_t *gart_textures;
@@ -318,6 +317,7 @@ typedef struct drm_radeon_private {
 
         int num_gb_pipes;
         int track_flush;
+        drm_local_map_t *mmio;
 } drm_radeon_private_t;
 
 typedef struct drm_radeon_buf_priv {
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1903e7515650..d3671b4049c0 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1265,6 +1265,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GENERIC_13BA, USB_DEVICE_ID_GENERIC_13BA_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5cc404291736..f05bcbbbb0d5 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -253,6 +253,9 @@
 #define USB_VENDOR_ID_KBGEAR            0x084e
 #define USB_DEVICE_ID_KBGEAR_JAMSTUDIO  0x1001
 
+#define USB_VENDOR_ID_KWORLD            0x1b80
+#define USB_DEVICE_ID_KWORLD_RADIO_FM700        0xd700
+
 #define USB_VENDOR_ID_LABTEC            0x1020
 #define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD  0x0006
 
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 5689d1f1d444..8557bf12cfb4 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -223,6 +223,8 @@ static void dvb_frontend_init(struct dvb_frontend *fe)
         if (fe->ops.init)
                 fe->ops.init(fe);
         if (fe->ops.tuner_ops.init) {
+                if (fe->ops.i2c_gate_ctrl)
+                        fe->ops.i2c_gate_ctrl(fe, 1);
                 fe->ops.tuner_ops.init(fe);
                 if (fe->ops.i2c_gate_ctrl)
                         fe->ops.i2c_gate_ctrl(fe, 0);
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 3c13bcfa6385..62b68c291d99 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -261,7 +261,7 @@ config DVB_USB_DW2102
           Say Y here to support the DvbWorld DVB-S/S2 USB2.0 receivers
           and the TeVii S650.
 
-config  DVB_USB_CINERGY_T2
+config DVB_USB_CINERGY_T2
         tristate "Terratec CinergyT2/qanu USB 2.0 DVB-T receiver"
         depends on DVB_USB
         help
@@ -283,6 +283,7 @@ config DVB_USB_ANYSEE
 config DVB_USB_DTV5100
         tristate "AME DTV-5100 USB2.0 DVB-T support"
         depends on DVB_USB
+        select DVB_ZL10353 if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_QT1010 if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the AME DTV-5100 USB2.0 DVB-T receiver.
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index cb0829c038ce..847d8fdd9ec4 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -31,13 +31,13 @@
 #include "mc44s80x.h"
 #endif
 
-int dvb_usb_af9015_debug;
+static int dvb_usb_af9015_debug;
 module_param_named(debug, dvb_usb_af9015_debug, int, 0644);
 MODULE_PARM_DESC(debug, "set debugging level" DVB_USB_DEBUG_STATUS);
-int dvb_usb_af9015_remote;
+static int dvb_usb_af9015_remote;
 module_param_named(remote, dvb_usb_af9015_remote, int, 0644);
 MODULE_PARM_DESC(remote, "select remote");
-int dvb_usb_af9015_dual_mode;
+static int dvb_usb_af9015_dual_mode;
 module_param_named(dual_mode, dvb_usb_af9015_dual_mode, int, 0644);
 MODULE_PARM_DESC(dual_mode, "enable dual mode");
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
@@ -46,7 +46,7 @@ static DEFINE_MUTEX(af9015_usb_mutex);
 
 static struct af9015_config af9015_config;
 static struct dvb_usb_device_properties af9015_properties[2];
-int af9015_properties_count = ARRAY_SIZE(af9015_properties);
+static int af9015_properties_count = ARRAY_SIZE(af9015_properties);
 
 static struct af9013_config af9015_af9013_config[] = {
         {
@@ -549,7 +549,7 @@ static int af9015_eeprom_dump(struct dvb_usb_device *d)
         return 0;
 }
 
-int af9015_download_ir_table(struct dvb_usb_device *d)
+static int af9015_download_ir_table(struct dvb_usb_device *d)
 {
         int i, packets = 0, ret;
         u16 addr = 0x9a56; /* ir-table start address */
@@ -999,7 +999,7 @@ static int af9015_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 }
 
 /* init 2nd I2C adapter */
-int af9015_i2c_init(struct dvb_usb_device *d)
+static int af9015_i2c_init(struct dvb_usb_device *d)
 {
         int ret;
         struct af9015_state *state = d->priv;
@@ -1419,7 +1419,7 @@ static int af9015_usb_probe(struct usb_interface *intf,
         return ret;
 }
 
-void af9015_i2c_exit(struct dvb_usb_device *d)
+static void af9015_i2c_exit(struct dvb_usb_device *d)
 {
         struct af9015_state *state = d->priv;
         deb_info("%s: \n", __func__);
diff --git a/drivers/media/dvb/dvb-usb/af9015.h b/drivers/media/dvb/dvb-usb/af9015.h
index 882e8a4b3681..6c3c97293316 100644
--- a/drivers/media/dvb/dvb-usb/af9015.h
+++ b/drivers/media/dvb/dvb-usb/af9015.h
@@ -27,7 +27,6 @@
 #define DVB_USB_LOG_PREFIX "af9015"
 #include "dvb-usb.h"
 
-extern int dvb_usb_af9015_debug;
 #define deb_info(args...) dprintk(dvb_usb_af9015_debug, 0x01, args)
 #define deb_rc(args...)   dprintk(dvb_usb_af9015_debug, 0x02, args)
 #define deb_xfer(args...) dprintk(dvb_usb_af9015_debug, 0x04, args)
diff --git a/drivers/media/dvb/dvb-usb/anysee.c b/drivers/media/dvb/dvb-usb/anysee.c
index c786359fba03..cd2edbcaa097 100644
--- a/drivers/media/dvb/dvb-usb/anysee.c
+++ b/drivers/media/dvb/dvb-usb/anysee.c
@@ -46,7 +46,7 @@ module_param_named(delsys, dvb_usb_anysee_delsys, int, 0644);
 MODULE_PARM_DESC(delsys, "select delivery mode (0=DVB-C, 1=DVB-T)");
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
-static struct mutex anysee_usb_mutex;
+static DEFINE_MUTEX(anysee_usb_mutex);
 
 static int anysee_ctrl_msg(struct dvb_usb_device *d, u8 *sbuf, u8 slen,
         u8 *rbuf, u8 rlen)
@@ -456,8 +456,6 @@ static int anysee_probe(struct usb_interface *intf,
         struct usb_host_interface *alt;
         int ret;
 
-        mutex_init(&anysee_usb_mutex);
-
         /* There is one interface with two alternate settings.
            Alternate setting 0 is for bulk transfer.
            Alternate setting 1 is for isochronous transfer.
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-urb.c b/drivers/media/dvb/dvb-usb/dvb-usb-urb.c
index 5cef12a07f72..6fe71c6745eb 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-urb.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-urb.c
@@ -13,14 +13,14 @@ int dvb_usb_generic_rw(struct dvb_usb_device *d, u8 *wbuf, u16 wlen, u8 *rbuf,
 {
         int actlen,ret = -ENOMEM;
 
+        if (!d || wbuf == NULL || wlen == 0)
+                return -EINVAL;
+
         if (d->props.generic_bulk_ctrl_endpoint == 0) {
                 err("endpoint for generic control not specified.");
                 return -EINVAL;
         }
 
-        if (wbuf == NULL || wlen == 0)
-                return -EINVAL;
-
         if ((ret = mutex_lock_interruptible(&d->usb_mutex)))
                 return ret;
 
diff --git a/drivers/media/dvb/frontends/af9013.c b/drivers/media/dvb/frontends/af9013.c
index 21c1060cf10e..692b68a9e73b 100644
--- a/drivers/media/dvb/frontends/af9013.c
+++ b/drivers/media/dvb/frontends/af9013.c
@@ -1187,7 +1187,7 @@ static int af9013_read_status(struct dvb_frontend *fe, fe_status_t *status)
         if (tmp)
                 *status |= FE_HAS_SYNC | FE_HAS_LOCK;
 
-        if (!*status & FE_HAS_SIGNAL) {
+        if (!(*status & FE_HAS_SIGNAL)) {
                 /* AGC lock */
                 ret = af9013_read_reg_bits(state, 0xd1a0, 6, 1, &tmp);
                 if (ret)
@@ -1196,7 +1196,7 @@ static int af9013_read_status(struct dvb_frontend *fe, fe_status_t *status)
                         *status |= FE_HAS_SIGNAL;
         }
 
-        if (!*status & FE_HAS_CARRIER) {
+        if (!(*status & FE_HAS_CARRIER)) {
                 /* CFO lock */
                 ret = af9013_read_reg_bits(state, 0xd333, 7, 1, &tmp);
                 if (ret)
@@ -1205,7 +1205,7 @@ static int af9013_read_status(struct dvb_frontend *fe, fe_status_t *status)
                         *status |= FE_HAS_CARRIER;
         }
 
-        if (!*status & FE_HAS_CARRIER) {
+        if (!(*status & FE_HAS_CARRIER)) {
                 /* SFOE lock */
                 ret = af9013_read_reg_bits(state, 0xd334, 6, 1, &tmp);
                 if (ret)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index 04cd7c04bdde..5189c4eb439f 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -355,6 +355,20 @@ config USB_SI470X
         tristate "Silicon Labs Si470x FM Radio Receiver support"
         depends on USB && VIDEO_V4L2
         ---help---
+          This is a driver for USB devices with the Silicon Labs SI470x
+          chip. Currently these devices are known to work:
+          - 10c4:818a: Silicon Labs USB FM Radio Reference Design
+          - 06e1:a155: ADS/Tech FM Radio Receiver (formerly Instant FM Music)
+          - 1b80:d700: KWorld USB FM Radio SnapMusic Mobile 700 (FM700)
+
+          Sound is provided by the ALSA USB Audio/MIDI driver. Therefore
+          if you don't want to use the device solely for RDS receiving,
+          it is recommended to also select SND_USB_AUDIO.
+
+          Please have a look at the documentation, especially on how
+          to redirect the audio stream from the radio to your sound device:
+          Documentation/video4linux/si470x.txt
+
           Say Y here if you want to connect this type of radio to your
           computer's USB port.
 
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
index 5920cd306975..3e1830293de5 100644
--- a/drivers/media/radio/radio-si470x.c
+++ b/drivers/media/radio/radio-si470x.c
@@ -4,6 +4,7 @@
  *  Driver for USB radios for the Silicon Labs Si470x FM Radio Receivers:
  *   - Silicon Labs USB FM Radio Reference Design
  *   - ADS/Tech FM Radio Receiver (formerly Instant FM Music) (RDX-155-EF)
+ *   - KWorld USB FM Radio SnapMusic Mobile 700 (FM700)
  *
  *  Copyright (c) 2008 Tobias Lorenz <tobias.lorenz@gmx.net>
  *
@@ -24,19 +25,6 @@
 
 
 /*
- * User Notes:
- * - USB Audio is provided by the alsa snd_usb_audio module.
- *   For listing you have to redirect the sound, for example using:
- *   arecord -D hw:1,0 -r96000 -c2 -f S16_LE | artsdsp aplay -B -
- * - regarding module parameters in /sys/module/radio_si470x/parameters:
- *   the contents of read-only files (0444) are not updated, even if
- *   space, band and de are changed using private video controls
- * - increase tune_timeout, if you often get -EIO errors
- * - hw_freq_seek returns -EAGAIN, when timed out or band limit is reached
- */
-
-
-/*
  * History:
  * 2008-01-12   Tobias Lorenz <tobias.lorenz@gmx.net>
  *              Version 1.0.0
@@ -105,6 +93,9 @@
  *              - afc indication
  *              - more safety checks, let si470x_get_freq return errno
  *              - vidioc behavior corrected according to v4l2 spec
+ * 2008-10-20   Alexey Klimov <klimov.linux@gmail.com>
+ *              - add support for KWorld USB FM Radio FM700
+ *              - blacklisted KWorld radio in hid-core.c and hid-ids.h
  *
  * ToDo:
  * - add firmware download/update support
@@ -145,6 +136,8 @@ static struct usb_device_id si470x_usb_driver_id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x10c4, 0x818a, USB_CLASS_HID, 0, 0) },
         /* ADS/Tech FM Radio Receiver (formerly Instant FM Music) */
         { USB_DEVICE_AND_INTERFACE_INFO(0x06e1, 0xa155, USB_CLASS_HID, 0, 0) },
+        /* KWorld USB FM Radio SnapMusic Mobile 700 (FM700) */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1b80, 0xd700, USB_CLASS_HID, 0, 0) },
         /* Terminating entry */
         { }
 };
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index a8c068e1de1c..1740b9ebdcef 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -1476,12 +1476,9 @@ static int cafe_v4l_open(struct inode *inode, struct file *filp)
 {
         struct cafe_camera *cam;
 
-        lock_kernel();
         cam = cafe_find_dev(iminor(inode));
-        if (cam == NULL) {
-                unlock_kernel();
+        if (cam == NULL)
                 return -ENODEV;
-        }
         filp->private_data = cam;
 
         mutex_lock(&cam->s_mutex);
@@ -1493,7 +1490,6 @@ static int cafe_v4l_open(struct inode *inode, struct file *filp)
         }
         (cam->users)++;
         mutex_unlock(&cam->s_mutex);
-        unlock_kernel();
         return 0;
 }
 
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index bd5d9de5a008..e6ca4012b5f0 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -867,6 +867,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOC_STREAMON32:
         case VIDIOC_STREAMOFF32:
         case VIDIOC_G_PARM:
+        case VIDIOC_S_PARM:
         case VIDIOC_G_STD:
         case VIDIOC_S_STD:
         case VIDIOC_G_TUNER:
@@ -885,6 +886,8 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOC_S_INPUT32:
         case VIDIOC_TRY_FMT32:
         case VIDIOC_S_HW_FREQ_SEEK:
+        case VIDIOC_ENUM_FRAMESIZES:
+        case VIDIOC_ENUM_FRAMEINTERVALS:
                 ret = do_video_ioctl(file, cmd, arg);
                 break;
 
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 7a1a7830a6b3..7874d9790a51 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -448,7 +448,14 @@ static int __devinit cx18_init_struct1(struct cx18 *cx)
         mutex_init(&cx->gpio_lock);
 
         spin_lock_init(&cx->lock);
-        spin_lock_init(&cx->dma_reg_lock);
+
+        cx->work_queue = create_singlethread_workqueue(cx->name);
+        if (cx->work_queue == NULL) {
+                CX18_ERR("Could not create work queue\n");
+                return -1;
+        }
+
+        INIT_WORK(&cx->work, cx18_work_handler);
 
         /* start counting open_id at 1 */
         cx->open_id = 1;
@@ -581,10 +588,10 @@ static void cx18_load_and_init_modules(struct cx18 *cx)
 
 #ifdef MODULE
         /* load modules */
-#ifndef CONFIG_MEDIA_TUNER
+#ifdef CONFIG_MEDIA_TUNER_MODULE
         hw = cx18_request_module(cx, hw, "tuner", CX18_HW_TUNER);
 #endif
-#ifndef CONFIG_VIDEO_CS5345
+#ifdef CONFIG_VIDEO_CS5345_MODULE
         hw = cx18_request_module(cx, hw, "cs5345", CX18_HW_CS5345);
 #endif
 #endif
@@ -832,6 +839,7 @@ free_map:
 free_mem:
         release_mem_region(cx->base_addr, CX18_MEM_SIZE);
 free_workqueue:
+        destroy_workqueue(cx->work_queue);
 err:
         if (retval == 0)
                 retval = -ENODEV;
@@ -932,6 +940,9 @@ static void cx18_remove(struct pci_dev *pci_dev)
 
         cx18_halt_firmware(cx);
 
+        flush_workqueue(cx->work_queue);
+        destroy_workqueue(cx->work_queue);
+
         cx18_streams_cleanup(cx, 1);
 
         exit_cx18_i2c(cx);
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index a4b1708fafe7..bbdd5f25041d 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -199,12 +199,15 @@ struct cx18_options {
 #define CX18_F_S_APPL_IO        8       /* this stream is used read/written by an application */
 
 /* per-cx18, i_flags */
-#define CX18_F_I_LOADED_FW      0       /* Loaded the firmware the first time */
-#define CX18_F_I_EOS            4       /* End of encoder stream reached */
-#define CX18_F_I_RADIO_USER     5       /* The radio tuner is selected */
-#define CX18_F_I_ENC_PAUSED     13      /* the encoder is paused */
-#define CX18_F_I_INITED         21      /* set after first open */
-#define CX18_F_I_FAILED         22      /* set if first open failed */
+#define CX18_F_I_LOADED_FW              0       /* Loaded firmware 1st time */
+#define CX18_F_I_EOS                    4       /* End of encoder stream */
+#define CX18_F_I_RADIO_USER             5       /* radio tuner is selected */
+#define CX18_F_I_ENC_PAUSED             13      /* the encoder is paused */
+#define CX18_F_I_HAVE_WORK              15      /* there is work to be done */
+#define CX18_F_I_WORK_HANDLER_DVB       18      /* work to be done for DVB */
+#define CX18_F_I_INITED                 21      /* set after first open */
+#define CX18_F_I_FAILED                 22      /* set if first open failed */
+#define CX18_F_I_WORK_INITED            23      /* worker thread initialized */
 
 /* These are the VBI types as they appear in the embedded VBI private packets. */
 #define CX18_SLICED_TYPE_TELETEXT_B     (1)
@@ -402,8 +405,6 @@ struct cx18 {
         spinlock_t lock;        /* lock access to this struct */
         int search_pack_header;
 
-        spinlock_t dma_reg_lock; /* lock access to DMA engine registers */
-
         int open_id;            /* incremented each time an open occurs, used as
                                    unique ID. Starts at 1, so 0 can be used as
                                    uninitialized value in the stream->id. */
@@ -433,6 +434,9 @@ struct cx18 {
         /* when the current DMA is finished this queue is woken up */
         wait_queue_head_t dma_waitq;
 
+        struct workqueue_struct *work_queue;
+        struct work_struct work;
+
         /* i2c */
         struct i2c_adapter i2c_adap[2];
         struct i2c_algo_bit_data i2c_algo[2];
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index afc694e7bdb2..4542e2e5e3d7 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -23,6 +23,8 @@
 #include "cx18-dvb.h"
 #include "cx18-io.h"
 #include "cx18-streams.h"
+#include "cx18-queue.h"
+#include "cx18-scb.h"
 #include "cx18-cards.h"
 #include "s5h1409.h"
 #include "mxl5005s.h"
@@ -300,3 +302,24 @@ static int dvb_register(struct cx18_stream *stream)
 
         return ret;
 }
+
+void cx18_dvb_work_handler(struct cx18 *cx)
+{
+        struct cx18_buffer *buf;
+        struct cx18_stream *s = &cx->streams[CX18_ENC_STREAM_TYPE_TS];
+
+        while ((buf = cx18_dequeue(s, &s->q_full)) != NULL) {
+                if (s->dvb.enabled)
+                        dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
+                                         buf->bytesused);
+
+                cx18_enqueue(s, buf, &s->q_free);
+                cx18_buf_sync_for_device(s, buf);
+                if (s->handle == CX18_INVALID_TASK_HANDLE) /* FIXME: improve */
+                        continue;
+
+                cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
+                       (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+                       1, buf->id, s->buf_size);
+        }
+}
diff --git a/drivers/media/video/cx18/cx18-dvb.h b/drivers/media/video/cx18/cx18-dvb.h
index bf8d8f6f5455..bbdcefc87f28 100644
--- a/drivers/media/video/cx18/cx18-dvb.h
+++ b/drivers/media/video/cx18/cx18-dvb.h
@@ -23,3 +23,4 @@
 
 int cx18_dvb_register(struct cx18_stream *stream);
 void cx18_dvb_unregister(struct cx18_stream *stream);
+void cx18_dvb_work_handler(struct cx18 *cx);
diff --git a/drivers/media/video/cx18/cx18-io.c b/drivers/media/video/cx18/cx18-io.c
index 700ab9439c16..220fae8d4ad7 100644
--- a/drivers/media/video/cx18/cx18-io.c
+++ b/drivers/media/video/cx18/cx18-io.c
@@ -88,6 +88,19 @@ void cx18_writel_retry(struct cx18 *cx, u32 val, void __iomem *addr)
         cx18_log_write_retries(cx, i, addr);
 }
 
+void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
+                         u32 eval, u32 mask)
+{
+        int i;
+        eval &= mask;
+        for (i = 0; i < CX18_MAX_MMIO_RETRIES; i++) {
+                cx18_writel_noretry(cx, val, addr);
+                if (eval == (cx18_readl_noretry(cx, addr) & mask))
+                        break;
+        }
+        cx18_log_write_retries(cx, i, addr);
+}
+
 void cx18_writew_retry(struct cx18 *cx, u16 val, void __iomem *addr)
 {
         int i;
@@ -218,7 +231,7 @@ void cx18_memset_io(struct cx18 *cx, void __iomem *addr, int val, size_t count)
 void cx18_sw1_irq_enable(struct cx18 *cx, u32 val)
 {
         u32 r;
-        cx18_write_reg(cx, val, SW1_INT_STATUS);
+        cx18_write_reg_expect(cx, val, SW1_INT_STATUS, ~val, val);
         r = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
         cx18_write_reg(cx, r | val, SW1_INT_ENABLE_PCI);
 }
@@ -233,7 +246,7 @@ void cx18_sw1_irq_disable(struct cx18 *cx, u32 val)
 void cx18_sw2_irq_enable(struct cx18 *cx, u32 val)
 {
         u32 r;
-        cx18_write_reg(cx, val, SW2_INT_STATUS);
+        cx18_write_reg_expect(cx, val, SW2_INT_STATUS, ~val, val);
         r = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
         cx18_write_reg(cx, r | val, SW2_INT_ENABLE_PCI);
 }
diff --git a/drivers/media/video/cx18/cx18-io.h b/drivers/media/video/cx18/cx18-io.h
index 287a5e8bf67b..425244453ea7 100644
--- a/drivers/media/video/cx18/cx18-io.h
+++ b/drivers/media/video/cx18/cx18-io.h
@@ -133,6 +133,8 @@ static inline void cx18_writel(struct cx18 *cx, u32 val, void __iomem *addr)
                 cx18_writel_noretry(cx, val, addr);
 }
 
+void _cx18_writel_expect(struct cx18 *cx, u32 val, void __iomem *addr,
+                         u32 eval, u32 mask);
 
 static inline
 void cx18_writew_noretry(struct cx18 *cx, u16 val, void __iomem *addr)
@@ -271,6 +273,21 @@ static inline void cx18_write_reg(struct cx18 *cx, u32 val, u32 reg)
                 cx18_write_reg_noretry(cx, val, reg);
 }
 
+static inline void _cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
+                                          u32 eval, u32 mask)
+{
+        _cx18_writel_expect(cx, val, cx->reg_mem + reg, eval, mask);
+}
+
+static inline void cx18_write_reg_expect(struct cx18 *cx, u32 val, u32 reg,
+                                         u32 eval, u32 mask)
+{
+        if (cx18_retry_mmio)
+                _cx18_write_reg_expect(cx, val, reg, eval, mask);
+        else
+                cx18_write_reg_noretry(cx, val, reg);
+}
+
 
 static inline u32 cx18_read_reg_noretry(struct cx18 *cx, u32 reg)
 {
diff --git a/drivers/media/video/cx18/cx18-irq.c b/drivers/media/video/cx18/cx18-irq.c
index 360330f5463f..5fbfbd0f1493 100644
--- a/drivers/media/video/cx18/cx18-irq.c
+++ b/drivers/media/video/cx18/cx18-irq.c
@@ -29,8 +29,20 @@
 #include "cx18-mailbox.h"
 #include "cx18-vbi.h"
 #include "cx18-scb.h"
+#include "cx18-dvb.h"
 
-#define DMA_MAGIC_COOKIE 0x000001fe
+void cx18_work_handler(struct work_struct *work)
+{
+        struct cx18 *cx = container_of(work, struct cx18, work);
+        if (test_and_clear_bit(CX18_F_I_WORK_INITED, &cx->i_flags)) {
+                struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
+                /* This thread must use the FIFO scheduler as it
+                 * is realtime sensitive. */
+                sched_setscheduler(current, SCHED_FIFO, &param);
+        }
+        if (test_and_clear_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags))
+                cx18_dvb_work_handler(cx);
+}
 
 static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
 {
@@ -67,17 +79,11 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
         if (buf) {
                 cx18_buf_sync_for_cpu(s, buf);
                 if (s->type == CX18_ENC_STREAM_TYPE_TS && s->dvb.enabled) {
-                        /* process the buffer here */
-                        CX18_DEBUG_HI_DMA("TS recv and sent bytesused=%d\n",
-                                        buf->bytesused);
-
-                        dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
+                        CX18_DEBUG_HI_DMA("TS recv bytesused = %d\n",
                                         buf->bytesused);
 
-                        cx18_buf_sync_for_device(s, buf);
-                        cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-                            (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
-                            1, buf->id, s->buf_size);
+                        set_bit(CX18_F_I_WORK_HANDLER_DVB, &cx->i_flags);
+                        set_bit(CX18_F_I_HAVE_WORK, &cx->i_flags);
                 } else
                         set_bit(CX18_F_B_NEED_BUF_SWAP, &buf->b_flags);
         } else {
@@ -109,7 +115,7 @@ static void epu_debug(struct cx18 *cx, struct cx18_mailbox *mb)
                 CX18_INFO("FW version: %s\n", p - 1);
 }
 
-static void hpu_cmd(struct cx18 *cx, u32 sw1)
+static void epu_cmd(struct cx18 *cx, u32 sw1)
 {
         struct cx18_mailbox mb;
 
@@ -125,12 +131,31 @@ static void hpu_cmd(struct cx18 *cx, u32 sw1)
                         epu_debug(cx, &mb);
                         break;
                 default:
-                        CX18_WARN("Unexpected mailbox command %08x\n", mb.cmd);
+                        CX18_WARN("Unknown CPU_TO_EPU mailbox command %#08x\n",
+                                  mb.cmd);
                         break;
                 }
         }
-        if (sw1 & (IRQ_APU_TO_EPU | IRQ_HPU_TO_EPU))
-                CX18_WARN("Unexpected interrupt %08x\n", sw1);
+
+        if (sw1 & IRQ_APU_TO_EPU) {
+                cx18_memcpy_fromio(cx, &mb, &cx->scb->apu2epu_mb, sizeof(mb));
+                CX18_WARN("Unknown APU_TO_EPU mailbox command %#08x\n", mb.cmd);
+        }
+
+        if (sw1 & IRQ_HPU_TO_EPU) {
+                cx18_memcpy_fromio(cx, &mb, &cx->scb->hpu2epu_mb, sizeof(mb));
+                CX18_WARN("Unknown HPU_TO_EPU mailbox command %#08x\n", mb.cmd);
+        }
+}
+
+static void xpu_ack(struct cx18 *cx, u32 sw2)
+{
+        if (sw2 & IRQ_CPU_TO_EPU_ACK)
+                wake_up(&cx->mb_cpu_waitq);
+        if (sw2 & IRQ_APU_TO_EPU_ACK)
+                wake_up(&cx->mb_apu_waitq);
+        if (sw2 & IRQ_HPU_TO_EPU_ACK)
+                wake_up(&cx->mb_hpu_waitq);
 }
 
 irqreturn_t cx18_irq_handler(int irq, void *dev_id)
@@ -140,43 +165,36 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
         u32 sw2, sw2_mask;
         u32 hw2, hw2_mask;
 
-        spin_lock(&cx->dma_reg_lock);
-
+        sw1_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI);
+        sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & sw1_mask;
+        sw2_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI);
+        sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & sw2_mask;
         hw2_mask = cx18_read_reg(cx, HW2_INT_MASK5_PCI);
         hw2 = cx18_read_reg(cx, HW2_INT_CLR_STATUS) & hw2_mask;
-        sw2_mask = cx18_read_reg(cx, SW2_INT_ENABLE_PCI) | IRQ_EPU_TO_HPU_ACK;
-        sw2 = cx18_read_reg(cx, SW2_INT_STATUS) & sw2_mask;
-        sw1_mask = cx18_read_reg(cx, SW1_INT_ENABLE_PCI) | IRQ_EPU_TO_HPU;
-        sw1 = cx18_read_reg(cx, SW1_INT_STATUS) & sw1_mask;
 
-        cx18_write_reg(cx, sw2&sw2_mask, SW2_INT_STATUS);
-        cx18_write_reg(cx, sw1&sw1_mask, SW1_INT_STATUS);
-        cx18_write_reg(cx, hw2&hw2_mask, HW2_INT_CLR_STATUS);
+        if (sw1)
+                cx18_write_reg_expect(cx, sw1, SW1_INT_STATUS, ~sw1, sw1);
+        if (sw2)
+                cx18_write_reg_expect(cx, sw2, SW2_INT_STATUS, ~sw2, sw2);
+        if (hw2)
+                cx18_write_reg_expect(cx, hw2, HW2_INT_CLR_STATUS, ~hw2, hw2);
 
         if (sw1 || sw2 || hw2)
                 CX18_DEBUG_HI_IRQ("SW1: %x  SW2: %x  HW2: %x\n", sw1, sw2, hw2);
 
         /* To do: interrupt-based I2C handling
-        if (hw2 & 0x00c00000) {
+        if (hw2 & (HW2_I2C1_INT|HW2_I2C2_INT)) {
         }
         */
 
-        if (sw2) {
-                if (sw2 & (cx18_readl(cx, &cx->scb->cpu2hpu_irq_ack) |
-                           cx18_readl(cx, &cx->scb->cpu2epu_irq_ack)))
-                        wake_up(&cx->mb_cpu_waitq);
-                if (sw2 & (cx18_readl(cx, &cx->scb->apu2hpu_irq_ack) |
-                           cx18_readl(cx, &cx->scb->apu2epu_irq_ack)))
-                        wake_up(&cx->mb_apu_waitq);
-                if (sw2 & cx18_readl(cx, &cx->scb->epu2hpu_irq_ack))
-                        wake_up(&cx->mb_epu_waitq);
-                if (sw2 & cx18_readl(cx, &cx->scb->hpu2epu_irq_ack))
-                        wake_up(&cx->mb_hpu_waitq);
-        }
+        if (sw2)
+                xpu_ack(cx, sw2);
 
         if (sw1)
-                hpu_cmd(cx, sw1);
-        spin_unlock(&cx->dma_reg_lock);
+                epu_cmd(cx, sw1);
+
+        if (test_and_clear_bit(CX18_F_I_HAVE_WORK, &cx->i_flags))
+                queue_work(cx->work_queue, &cx->work);
 
-        return (hw2 | sw1 | sw2) ? IRQ_HANDLED : IRQ_NONE;
+        return (sw1 || sw2 || hw2) ? IRQ_HANDLED : IRQ_NONE;
 }
diff --git a/drivers/media/video/cx18/cx18-irq.h b/drivers/media/video/cx18/cx18-irq.h
index 379f704f5cba..6173ca3bc9e4 100644
--- a/drivers/media/video/cx18/cx18-irq.h
+++ b/drivers/media/video/cx18/cx18-irq.h
@@ -32,6 +32,4 @@
 
 irqreturn_t cx18_irq_handler(int irq, void *dev_id);
 
-void cx18_irq_work_handler(struct work_struct *work);
-void cx18_dma_stream_dec_prepare(struct cx18_stream *s, u32 offset, int lock);
-void cx18_unfinished_dma(unsigned long arg);
+void cx18_work_handler(struct work_struct *work);
diff --git a/drivers/media/video/cx18/cx18-mailbox.c b/drivers/media/video/cx18/cx18-mailbox.c
index 9d18dd22de76..acff7dfb60df 100644
--- a/drivers/media/video/cx18/cx18-mailbox.c
+++ b/drivers/media/video/cx18/cx18-mailbox.c
@@ -83,7 +83,7 @@ static const struct cx18_api_info api_info[] = {
         API_ENTRY(CPU, CX18_CPU_DE_SET_MDL_ACK,                 0),
         API_ENTRY(CPU, CX18_CPU_DE_SET_MDL,                     API_FAST),
         API_ENTRY(CPU, CX18_APU_RESETAI,                        API_FAST),
-        API_ENTRY(CPU, CX18_CPU_DE_RELEASE_MDL,                 0),
+        API_ENTRY(CPU, CX18_CPU_DE_RELEASE_MDL,                 API_SLOW),
         API_ENTRY(0, 0,                                         0),
 };
 
@@ -176,7 +176,7 @@ long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb)
 
         cx18_setup_page(cx, SCB_OFFSET);
         cx18_write_sync(cx, mb->request, &ack_mb->ack);
-        cx18_write_reg(cx, ack_irq, SW2_INT_SET);
+        cx18_write_reg_expect(cx, ack_irq, SW2_INT_SET, ack_irq, ack_irq);
         return 0;
 }
 
@@ -225,7 +225,7 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
         }
         if (info->flags & API_FAST)
                 timeout /= 2;
-        cx18_write_reg(cx, irq, SW1_INT_SET);
+        cx18_write_reg_expect(cx, irq, SW1_INT_SET, irq, irq);
 
         while (!sig && cx18_readl(cx, &mb->ack) != cx18_readl(cx, &mb->request)
                && cnt < 660) {
diff --git a/drivers/media/video/cx18/cx18-queue.c b/drivers/media/video/cx18/cx18-queue.c
index a33ba04a2686..174682c2582f 100644
--- a/drivers/media/video/cx18/cx18-queue.c
+++ b/drivers/media/video/cx18/cx18-queue.c
@@ -88,15 +88,13 @@ struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
 
                 if (buf->id != id)
                         continue;
+
                 buf->bytesused = bytesused;
-                /* the transport buffers are handled differently,
-                   they are not moved to the full queue */
-                if (s->type != CX18_ENC_STREAM_TYPE_TS) {
-                        atomic_dec(&s->q_free.buffers);
-                        atomic_inc(&s->q_full.buffers);
-                        s->q_full.bytesused += buf->bytesused;
-                        list_move_tail(&buf->list, &s->q_full.list);
-                }
+                atomic_dec(&s->q_free.buffers);
+                atomic_inc(&s->q_full.buffers);
+                s->q_full.bytesused += buf->bytesused;
+                list_move_tail(&buf->list, &s->q_full.list);
+
                 spin_unlock(&s->qlock);
                 return buf;
         }
diff --git a/drivers/media/video/cx18/cx18-scb.h b/drivers/media/video/cx18/cx18-scb.h
index 86b4cb15d163..594713bbed68 100644
--- a/drivers/media/video/cx18/cx18-scb.h
+++ b/drivers/media/video/cx18/cx18-scb.h
@@ -128,22 +128,22 @@ struct cx18_scb {
         u32 apu2cpu_irq;
         /* Value to write to register SW2 register set (0xC7003140) after the
            command is cleared */
-        u32 apu2cpu_irq_ack;
+        u32 cpu2apu_irq_ack;
         u32 reserved2[13];
 
         u32 hpu2cpu_mb_offset;
         u32 hpu2cpu_irq;
-        u32 hpu2cpu_irq_ack;
+        u32 cpu2hpu_irq_ack;
         u32 reserved3[13];
 
         u32 ppu2cpu_mb_offset;
         u32 ppu2cpu_irq;
-        u32 ppu2cpu_irq_ack;
+        u32 cpu2ppu_irq_ack;
         u32 reserved4[13];
 
         u32 epu2cpu_mb_offset;
         u32 epu2cpu_irq;
-        u32 epu2cpu_irq_ack;
+        u32 cpu2epu_irq_ack;
         u32 reserved5[13];
         u32 reserved6[8];
 
@@ -153,22 +153,22 @@ struct cx18_scb {
         u32 reserved11[7];
         u32 cpu2apu_mb_offset;
         u32 cpu2apu_irq;
-        u32 cpu2apu_irq_ack;
+        u32 apu2cpu_irq_ack;
         u32 reserved12[13];
 
         u32 hpu2apu_mb_offset;
         u32 hpu2apu_irq;
-        u32 hpu2apu_irq_ack;
+        u32 apu2hpu_irq_ack;
         u32 reserved13[13];
 
         u32 ppu2apu_mb_offset;
         u32 ppu2apu_irq;
-        u32 ppu2apu_irq_ack;
+        u32 apu2ppu_irq_ack;
         u32 reserved14[13];
 
         u32 epu2apu_mb_offset;
         u32 epu2apu_irq;
-        u32 epu2apu_irq_ack;
+        u32 apu2epu_irq_ack;
         u32 reserved15[13];
         u32 reserved16[8];
 
@@ -178,22 +178,22 @@ struct cx18_scb {
         u32 reserved21[7];
         u32 cpu2hpu_mb_offset;
         u32 cpu2hpu_irq;
-        u32 cpu2hpu_irq_ack;
+        u32 hpu2cpu_irq_ack;
         u32 reserved22[13];
 
         u32 apu2hpu_mb_offset;
         u32 apu2hpu_irq;
-        u32 apu2hpu_irq_ack;
+        u32 hpu2apu_irq_ack;
         u32 reserved23[13];
 
         u32 ppu2hpu_mb_offset;
         u32 ppu2hpu_irq;
-        u32 ppu2hpu_irq_ack;
+        u32 hpu2ppu_irq_ack;
         u32 reserved24[13];
 
         u32 epu2hpu_mb_offset;
         u32 epu2hpu_irq;
-        u32 epu2hpu_irq_ack;
+        u32 hpu2epu_irq_ack;
         u32 reserved25[13];
         u32 reserved26[8];
 
@@ -203,22 +203,22 @@ struct cx18_scb {
         u32 reserved31[7];
         u32 cpu2ppu_mb_offset;
         u32 cpu2ppu_irq;
-        u32 cpu2ppu_irq_ack;
+        u32 ppu2cpu_irq_ack;
         u32 reserved32[13];
 
         u32 apu2ppu_mb_offset;
         u32 apu2ppu_irq;
-        u32 apu2ppu_irq_ack;
+        u32 ppu2apu_irq_ack;
         u32 reserved33[13];
 
         u32 hpu2ppu_mb_offset;
         u32 hpu2ppu_irq;
-        u32 hpu2ppu_irq_ack;
+        u32 ppu2hpu_irq_ack;
         u32 reserved34[13];
 
         u32 epu2ppu_mb_offset;
         u32 epu2ppu_irq;
-        u32 epu2ppu_irq_ack;
+        u32 ppu2epu_irq_ack;
         u32 reserved35[13];
         u32 reserved36[8];
 
@@ -228,22 +228,22 @@ struct cx18_scb {
         u32 reserved41[7];
         u32 cpu2epu_mb_offset;
         u32 cpu2epu_irq;
-        u32 cpu2epu_irq_ack;
+        u32 epu2cpu_irq_ack;
         u32 reserved42[13];
 
         u32 apu2epu_mb_offset;
         u32 apu2epu_irq;
-        u32 apu2epu_irq_ack;
+        u32 epu2apu_irq_ack;
         u32 reserved43[13];
 
         u32 hpu2epu_mb_offset;
         u32 hpu2epu_irq;
-        u32 hpu2epu_irq_ack;
+        u32 epu2hpu_irq_ack;
         u32 reserved44[13];
 
         u32 ppu2epu_mb_offset;
         u32 ppu2epu_irq;
-        u32 ppu2epu_irq_ack;
+        u32 epu2ppu_irq_ack;
         u32 reserved45[13];
         u32 reserved46[8];
 
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 078be6319556..d3ae5b4dfca7 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -1078,7 +1078,7 @@ static int mpeg_open(struct inode *inode, struct file *file)
                 }
         }
 
-        if (blackbird_initialize_codec(dev) < 0) {
+        if (!atomic_read(&dev->core->mpeg_users) && blackbird_initialize_codec(dev) < 0) {
                 if (drv)
                         drv->request_release(drv);
                 unlock_kernel();
@@ -1109,6 +1109,8 @@ static int mpeg_open(struct inode *inode, struct file *file)
                         fh->mpegq.field);
         unlock_kernel();
 
+        atomic_inc(&dev->core->mpeg_users);
+
         return 0;
 }
 
@@ -1118,7 +1120,7 @@ static int mpeg_release(struct inode *inode, struct file *file)
         struct cx8802_dev *dev = fh->dev;
         struct cx8802_driver *drv = NULL;
 
-        if (dev->mpeg_active)
+        if (dev->mpeg_active && atomic_read(&dev->core->mpeg_users) == 1)
                 blackbird_stop_codec(dev);
 
         cx8802_cancel_buffers(fh->dev);
@@ -1138,6 +1140,8 @@ static int mpeg_release(struct inode *inode, struct file *file)
         if (drv)
                 drv->request_release(drv);
 
+        atomic_dec(&dev->core->mpeg_users);
+
         return 0;
 }
 
@@ -1158,6 +1162,10 @@ static unsigned int
 mpeg_poll(struct file *file, struct poll_table_struct *wait)
 {
         struct cx8802_fh *fh = file->private_data;
+        struct cx8802_dev *dev = fh->dev;
+
+        if (!dev->mpeg_active)
+                blackbird_start_codec(file, fh);
 
         return videobuf_poll_stream(file, &fh->mpegq, wait);
 }
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index cf6c30d4e545..309ca5e68063 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -598,6 +598,11 @@ static int dvb_register(struct cx8802_dev *dev)
         struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
         int mfe_shared = 0; /* bus not shared by default */
 
+        if (0 != core->i2c_rc) {
+                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
+                goto frontend_detach;
+        }
+
         /* Get the first frontend */
         fe0 = videobuf_dvb_get_frontend(&dev->frontends, 1);
         if (!fe0)
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index a1c435b4b1cd..3ebdcd1d83f8 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -769,10 +769,6 @@ static int __devinit cx8802_probe(struct pci_dev *pci_dev,
         struct cx8802_dev *dev;
         struct cx88_core  *core;
         int err;
-#if defined(CONFIG_VIDEO_CX88_DVB) || defined(CONFIG_VIDEO_CX88_DVB_MODULE)
-        struct videobuf_dvb_frontend *demod;
-        int i;
-#endif
 
         /* general setup */
         core = cx88_core_get(pci_dev);
@@ -803,15 +799,21 @@ static int __devinit cx8802_probe(struct pci_dev *pci_dev,
         mutex_init(&dev->frontends.lock);
         INIT_LIST_HEAD(&dev->frontends.felist);
 
-        if (core->board.num_frontends)
-                printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__, core->board.num_frontends);
-
-        for (i = 1; i <= core->board.num_frontends; i++) {
-                demod = videobuf_dvb_alloc_frontend(&dev->frontends, i);
-                if(demod == NULL) {
-                        printk(KERN_ERR "%s() failed to alloc\n", __func__);
-                        err = -ENOMEM;
-                        goto fail_free;
+        if (core->board.num_frontends) {
+                struct videobuf_dvb_frontend *fe;
+                int i;
+
+                printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__,
+                        core->board.num_frontends);
+                for (i = 1; i <= core->board.num_frontends; i++) {
+                        fe = videobuf_dvb_alloc_frontend(&dev->frontends, i);
+                        if(fe == NULL) {
+                                printk(KERN_ERR "%s() failed to alloc\n",
+                                        __func__);
+                                videobuf_dvb_dealloc_frontends(&dev->frontends);
+                                err = -ENOMEM;
+                                goto fail_free;
+                        }
                 }
         }
 #endif
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 61265fd04d56..b96ce991d968 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -1216,8 +1216,12 @@ static int vidioc_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
         struct cx8800_fh  *fh   = priv;
         struct cx8800_dev *dev  = fh->dev;
 
-        if (unlikely(fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE))
+        /* We should remember that this driver also supports teletext,  */
+        /* so we have to test if the v4l2_buf_type is VBI capture data. */
+        if (unlikely((fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) &&
+                     (fh->type != V4L2_BUF_TYPE_VBI_CAPTURE)))
                 return -EINVAL;
+
         if (unlikely(i != fh->type))
                 return -EINVAL;
 
@@ -1232,8 +1236,10 @@ static int vidioc_streamoff(struct file *file, void *priv, enum v4l2_buf_type i)
         struct cx8800_dev *dev  = fh->dev;
         int               err, res;
 
-        if (fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+        if ((fh->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) &&
+            (fh->type != V4L2_BUF_TYPE_VBI_CAPTURE))
                 return -EINVAL;
+
         if (i != fh->type)
                 return -EINVAL;
 
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index 76207c2856b7..f4240965be32 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -352,6 +352,7 @@ struct cx88_core {
         /* various v4l controls */
         u32                        freq;
         atomic_t                   users;
+        atomic_t                   mpeg_users;
 
         /* cx88-video needs to access cx8802 for hybrid tuner pll access. */
         struct cx8802_dev          *dvbdev;
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 4d0817471c9f..6b557c057fac 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -3,16 +3,16 @@ menuconfig USB_GSPCA
         depends on VIDEO_V4L2
         default m
         ---help---
-        Say Y here if you want to enable selecting webcams based
-        on the GSPCA framework.
+          Say Y here if you want to enable selecting webcams based
+          on the GSPCA framework.
 
-        See <file:Documentation/video4linux/gspca.txt> for more info.
+          See <file:Documentation/video4linux/gspca.txt> for more info.
 
-        This driver uses the Video For Linux API. You must say Y or M to
-        "Video For Linux" to use this driver.
+          This driver uses the Video For Linux API. You must say Y or M to
+          "Video For Linux" to use this driver.
 
-        To compile this driver as modules, choose M here: the
-        modules will be called gspca_main.
+          To compile this driver as modules, choose M here: the
+          modules will be called gspca_main.
 
 
 if USB_GSPCA && VIDEO_V4L2
@@ -23,190 +23,190 @@ config USB_GSPCA_CONEX
         tristate "Conexant Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Conexant chip.
+          Say Y here if you want support for cameras based on the Conexant chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_conex.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_conex.
 
 config USB_GSPCA_ETOMS
         tristate "Etoms USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Etoms chip.
+          Say Y here if you want support for cameras based on the Etoms chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_etoms.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_etoms.
 
 config USB_GSPCA_FINEPIX
         tristate "Fujifilm FinePix USB V4L2 driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the FinePix chip.
+          Say Y here if you want support for cameras based on the FinePix chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_finepix.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_finepix.
 
 config USB_GSPCA_MARS
         tristate "Mars USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Mars chip.
+          Say Y here if you want support for cameras based on the Mars chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_mars.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_mars.
 
 config USB_GSPCA_OV519
         tristate "OV519 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the OV519 chip.
+          Say Y here if you want support for cameras based on the OV519 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_ov519.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_ov519.
 
 config USB_GSPCA_PAC207
         tristate "Pixart PAC207 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the PAC207 chip.
+          Say Y here if you want support for cameras based on the PAC207 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_pac207.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_pac207.
 
 config USB_GSPCA_PAC7311
         tristate "Pixart PAC7311 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the PAC7311 chip.
+          Say Y here if you want support for cameras based on the PAC7311 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_pac7311.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_pac7311.
 
 config USB_GSPCA_SONIXB
         tristate "SN9C102 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SONIXB chip.
+          Say Y here if you want support for cameras based on the SONIXB chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_sonixb.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_sonixb.
 
 config USB_GSPCA_SONIXJ
         tristate "SONIX JPEG USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SONIXJ chip.
+          Say Y here if you want support for cameras based on the SONIXJ chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_sonixj
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_sonixj
 
 config USB_GSPCA_SPCA500
         tristate "SPCA500 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA500 chip.
+          Say Y here if you want support for cameras based on the SPCA500 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca500.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca500.
 
 config USB_GSPCA_SPCA501
         tristate "SPCA501 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA501 chip.
+          Say Y here if you want support for cameras based on the SPCA501 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca501.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca501.
 
 config USB_GSPCA_SPCA505
         tristate "SPCA505 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA505 chip.
+          Say Y here if you want support for cameras based on the SPCA505 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca505.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca505.
 
 config USB_GSPCA_SPCA506
         tristate "SPCA506 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA506 chip.
+          Say Y here if you want support for cameras based on the SPCA506 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca506.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca506.
 
 config USB_GSPCA_SPCA508
         tristate "SPCA508 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA508 chip.
+          Say Y here if you want support for cameras based on the SPCA508 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca508.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca508.
 
 config USB_GSPCA_SPCA561
         tristate "SPCA561 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the SPCA561 chip.
+          Say Y here if you want support for cameras based on the SPCA561 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca561.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca561.
 
 config USB_GSPCA_STK014
         tristate "Syntek DV4000 (STK014) USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the STK014 chip.
+          Say Y here if you want support for cameras based on the STK014 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_stk014.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_stk014.
 
 config USB_GSPCA_SUNPLUS
         tristate "SUNPLUS USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the Sunplus
-        SPCA504(abc) SPCA533 SPCA536 chips.
+          Say Y here if you want support for cameras based on the Sunplus
+          SPCA504(abc) SPCA533 SPCA536 chips.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_spca5xx.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_spca5xx.
 
 config USB_GSPCA_T613
         tristate "T613 (JPEG Compliance) USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the T613 chip.
+          Say Y here if you want support for cameras based on the T613 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_t613.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_t613.
 
 config USB_GSPCA_TV8532
         tristate "TV8532 USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the TV8531 chip.
+          Say Y here if you want support for cameras based on the TV8531 chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_tv8532.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_tv8532.
 
 config USB_GSPCA_VC032X
         tristate "VC032X USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the VC032X chip.
+          Say Y here if you want support for cameras based on the VC032X chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_vc032x.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_vc032x.
 
 config USB_GSPCA_ZC3XX
-        tristate "VC3xx USB Camera Driver"
+        tristate "ZC3XX USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
         help
-        Say Y here if you want support for cameras based on the ZC3XX chip.
+          Say Y here if you want support for cameras based on the ZC3XX chip.
 
-        To compile this driver as a module, choose M here: the
-        module will be called gspca_zc3xx.
+          To compile this driver as a module, choose M here: the
+          module will be called gspca_zc3xx.
 
 endif
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index d0a4451dc46f..8b3101d347c3 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -2266,7 +2266,7 @@ static const struct usb_action hdcs2020b_NoFliker[] = {
         {}
 };
 
-static const struct usb_action hv7131bxx_Initial[] = {
+static const struct usb_action hv7131bxx_Initial[] = {          /* 320x240 */
         {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
         {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
         {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -2290,7 +2290,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {0xaa, 0x14, 0x0001},
         {0xaa, 0x15, 0x00e8},
         {0xaa, 0x16, 0x0002},
-        {0xaa, 0x17, 0x0086},
+        {0xaa, 0x17, 0x0086},           /* 00,17,88,aa */
         {0xaa, 0x31, 0x0038},
         {0xaa, 0x32, 0x0038},
         {0xaa, 0x33, 0x0038},
@@ -2309,7 +2309,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
         {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
         {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
-        {0xaa, 0x02, 0x0080},   /* {0xaa, 0x02, 0x0090}; */
+        {0xaa, 0x02, 0x0090},                   /* 00,02,80,aa */
         {0xa1, 0x01, 0x0002},
         {0xa0, 0x00, ZC3XX_R092_I2CADDRESSSELECT},
         {0xa0, 0x02, ZC3XX_R090_I2CCOMMAND},
@@ -2374,7 +2374,7 @@ static const struct usb_action hv7131bxx_Initial[] = {
         {}
 };
 
-static const struct usb_action hv7131bxx_InitialScale[] = {
+static const struct usb_action hv7131bxx_InitialScale[] = {     /* 640x480*/
         {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
         {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
         {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -6388,6 +6388,8 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 /*fixme: is it really write to 011d and 018d for all other sensors? */
         brightness = sd->brightness;
         reg_w(gspca_dev->dev, brightness, 0x011d);
+        if (sd->sensor == SENSOR_HV7131B)
+                return;
         if (brightness < 0x70)
                 brightness += 0x10;
         else
@@ -6529,6 +6531,7 @@ static void setquality(struct gspca_dev *gspca_dev)
 
         switch (sd->sensor) {
         case SENSOR_GC0305:
+        case SENSOR_HV7131B:
         case SENSOR_OV7620:
         case SENSOR_PO2030:
                 return;
@@ -7209,7 +7212,6 @@ static int sd_start(struct gspca_dev *gspca_dev)
         mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
         zc3_init = init_tb[(int) sd->sensor][mode];
         switch (sd->sensor) {
-        case SENSOR_HV7131B:
         case SENSOR_HV7131C:
                 zcxx_probeSensor(gspca_dev);
                 break;
diff --git a/drivers/media/video/ivtv/Kconfig b/drivers/media/video/ivtv/Kconfig
index 0069898bddab..c46bfb1569e3 100644
--- a/drivers/media/video/ivtv/Kconfig
+++ b/drivers/media/video/ivtv/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_IVTV
         tristate "Conexant cx23416/cx23415 MPEG encoder/decoder support"
-        depends on VIDEO_V4L1 && VIDEO_V4L2 && PCI && I2C && EXPERIMENTAL
+        depends on VIDEO_V4L2 && PCI && I2C
         depends on INPUT   # due to VIDEO_IR
         select I2C_ALGOBIT
         select VIDEO_IR
@@ -12,7 +12,6 @@ config VIDEO_IVTV
         select VIDEO_SAA711X
         select VIDEO_SAA717X
         select VIDEO_SAA7127
-        select VIDEO_TVAUDIO
         select VIDEO_CS53L32A
         select VIDEO_M52790
         select VIDEO_WM8775
@@ -32,7 +31,7 @@ config VIDEO_IVTV
 
 config VIDEO_FB_IVTV
         tristate "Conexant cx23415 framebuffer support"
-        depends on VIDEO_IVTV && FB && EXPERIMENTAL
+        depends on VIDEO_IVTV && FB
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index d36485023b68..b69cc1d55e5b 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -875,43 +875,43 @@ static void ivtv_load_and_init_modules(struct ivtv *itv)
 
 #ifdef MODULE
         /* load modules */
-#ifndef CONFIG_MEDIA_TUNER
+#ifdef CONFIG_MEDIA_TUNER_MODULE
         hw = ivtv_request_module(itv, hw, "tuner", IVTV_HW_TUNER);
 #endif
-#ifndef CONFIG_VIDEO_CX25840
+#ifdef CONFIG_VIDEO_CX25840_MODULE
         hw = ivtv_request_module(itv, hw, "cx25840", IVTV_HW_CX25840);
 #endif
-#ifndef CONFIG_VIDEO_SAA711X
+#ifdef CONFIG_VIDEO_SAA711X_MODULE
         hw = ivtv_request_module(itv, hw, "saa7115", IVTV_HW_SAA711X);
 #endif
-#ifndef CONFIG_VIDEO_SAA7127
+#ifdef CONFIG_VIDEO_SAA7127_MODULE
         hw = ivtv_request_module(itv, hw, "saa7127", IVTV_HW_SAA7127);
 #endif
-#ifndef CONFIG_VIDEO_SAA717X
+#ifdef CONFIG_VIDEO_SAA717X_MODULE
         hw = ivtv_request_module(itv, hw, "saa717x", IVTV_HW_SAA717X);
 #endif
-#ifndef CONFIG_VIDEO_UPD64031A
+#ifdef CONFIG_VIDEO_UPD64031A_MODULE
         hw = ivtv_request_module(itv, hw, "upd64031a", IVTV_HW_UPD64031A);
 #endif
-#ifndef CONFIG_VIDEO_UPD64083
+#ifdef CONFIG_VIDEO_UPD64083_MODULE
         hw = ivtv_request_module(itv, hw, "upd64083", IVTV_HW_UPD6408X);
 #endif
-#ifndef CONFIG_VIDEO_MSP3400
+#ifdef CONFIG_VIDEO_MSP3400_MODULE
         hw = ivtv_request_module(itv, hw, "msp3400", IVTV_HW_MSP34XX);
 #endif
-#ifndef CONFIG_VIDEO_VP27SMPX
+#ifdef CONFIG_VIDEO_VP27SMPX_MODULE
         hw = ivtv_request_module(itv, hw, "vp27smpx", IVTV_HW_VP27SMPX);
 #endif
-#ifndef CONFIG_VIDEO_WM8775
+#ifdef CONFIG_VIDEO_WM8775_MODULE
         hw = ivtv_request_module(itv, hw, "wm8775", IVTV_HW_WM8775);
 #endif
-#ifndef CONFIG_VIDEO_WM8739
+#ifdef CONFIG_VIDEO_WM8739_MODULE
         hw = ivtv_request_module(itv, hw, "wm8739", IVTV_HW_WM8739);
 #endif
-#ifndef CONFIG_VIDEO_CS53L32A
+#ifdef CONFIG_VIDEO_CS53L32A_MODULE
         hw = ivtv_request_module(itv, hw, "cs53l32a", IVTV_HW_CS53L32A);
 #endif
-#ifndef CONFIG_VIDEO_M52790
+#ifdef CONFIG_VIDEO_M52790_MODULE
         hw = ivtv_request_module(itv, hw, "m52790", IVTV_HW_M52790);
 #endif
 #endif
diff --git a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
index adf2ba79496a..37860698f782 100644
--- a/drivers/media/video/saa7110.c
+++ b/drivers/media/video/saa7110.c
@@ -47,7 +47,7 @@ module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0-1)");
 
 #define SAA7110_MAX_INPUT       9       /* 6 CVBS, 3 SVHS */
-#define SAA7110_MAX_OUTPUT      0       /* its a decoder only */
+#define SAA7110_MAX_OUTPUT      1       /* 1 YUV */
 
 #define SAA7110_NR_REG          0x35
 
@@ -327,7 +327,7 @@ saa7110_command (struct i2c_client *client,
 
         case DECODER_SET_INPUT:
                 v = *(int *) arg;
-                if (v < 0 || v > SAA7110_MAX_INPUT) {
+                if (v < 0 || v >= SAA7110_MAX_INPUT) {
                         v4l_dbg(1, debug, client, "input=%d not available\n", v);
                         return -EINVAL;
                 }
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 249184452949..dfbe08a9ad9b 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -941,7 +941,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
                        dev->name,(unsigned long long)pci_resource_start(pci_dev,0));
                 goto fail1;
         }
-        dev->lmmio = ioremap(pci_resource_start(pci_dev,0), 0x1000);
+        dev->lmmio = ioremap(pci_resource_start(pci_dev, 0),
+                             pci_resource_len(pci_dev, 0));
         dev->bmmio = (__u8 __iomem *)dev->lmmio;
         if (NULL == dev->lmmio) {
                 err = -EIO;
diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
index 28421d386f1e..c710bcd1df48 100644
--- a/drivers/media/video/usbvideo/ibmcam.c
+++ b/drivers/media/video/usbvideo/ibmcam.c
@@ -3695,7 +3695,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
         unsigned char video_ep = 0;
 
         if (debug >= 1)
-                dev_info(&uvd->dev->dev, "ibmcam_probe(%p,%u.)\n", intf, ifnum);
+                dev_info(&dev->dev, "ibmcam_probe(%p,%u.)\n", intf, ifnum);
 
         /* We don't handle multi-config cameras */
         if (dev->descriptor.bNumConfigurations != 1)
@@ -3746,7 +3746,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         brand = "IBM PC Camera"; /* a.k.a. Xirlink C-It */
                         break;
                 }
-                dev_info(&uvd->dev->dev,
+                dev_info(&dev->dev,
                          "%s USB camera found (model %d, rev. 0x%04x)\n",
                          brand, model, le16_to_cpu(dev->descriptor.bcdDevice));
         } while (0);
@@ -3754,7 +3754,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
         /* Validate found interface: must have one ISO endpoint */
         nas = intf->num_altsetting;
         if (debug > 0)
-                dev_info(&uvd->dev->dev, "Number of alternate settings=%d.\n",
+                dev_info(&dev->dev, "Number of alternate settings=%d.\n",
                          nas);
         if (nas < 2) {
                 err("Too few alternate settings for this camera!");
@@ -3799,7 +3799,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                                 actInterface = i;
                                 maxPS = le16_to_cpu(endpoint->wMaxPacketSize);
                                 if (debug > 0)
-                                        dev_info(&uvd->dev->dev,
+                                        dev_info(&dev->dev,
                                                  "Active setting=%d. "
                                                  "maxPS=%d.\n", i, maxPS);
                         } else
@@ -3840,7 +3840,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         RESTRICT_TO_RANGE(framerate, 0, 5);
                         break;
                 default:
-                        dev_info(&uvd->dev->dev, "IBM camera: using 320x240\n");
+                        dev_info(&dev->dev, "IBM camera: using 320x240\n");
                         size = SIZE_320x240;
                         /* No break here */
                 case SIZE_320x240:
@@ -3869,7 +3869,7 @@ static int ibmcam_probe(struct usb_interface *intf, const struct usb_device_id *
                         canvasY = 120;
                         break;
                 default:
-                        dev_info(&uvd->dev->dev, "IBM NetCamera: using 176x144\n");
+                        dev_info(&dev->dev, "IBM NetCamera: using 176x144\n");
                         size = SIZE_176x144;
                         /* No break here */
                 case SIZE_176x144:
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index a339afbeed38..a3f732418c49 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -706,7 +706,7 @@ tx_err:
         mlx4_en_release_rss_steer(priv);
 rx_err:
         for (i = 0; i < priv->rx_ring_num; i++)
-                mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[rx_index]);
+                mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[i]);
 cq_err:
         while (rx_index--)
                 mlx4_en_deactivate_cq(priv, &priv->rx_cq[rx_index]);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index fa98af58223e..cd0d0873d978 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -174,8 +174,8 @@ static struct efx_ethtool_stat efx_ethtool_stats[] = {
 
 /* EEPROM range with gPXE configuration */
 #define EFX_ETHTOOL_EEPROM_MAGIC 0xEFAB
-#define EFX_ETHTOOL_EEPROM_MIN 0x100U
-#define EFX_ETHTOOL_EEPROM_MAX 0x400U
+#define EFX_ETHTOOL_EEPROM_MIN 0x800U
+#define EFX_ETHTOOL_EEPROM_MAX 0x1800U
 
 /**************************************************************************
  *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 1164c52e2c0a..8e90891f0e42 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2184,19 +2184,20 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
                              struct usb_interface *interface)
 {
         struct hso_net *hso_net = dev2net(hso_dev);
-        struct device *dev = hso_dev->dev;
+        struct device *dev = &hso_net->net->dev;
         char *rfkn;
 
         hso_net->rfkill = rfkill_allocate(&interface_to_usbdev(interface)->dev,
-                                 RFKILL_TYPE_WLAN);
+                                 RFKILL_TYPE_WWAN);
         if (!hso_net->rfkill) {
-                dev_err(dev, "%s - Out of memory", __func__);
+                dev_err(dev, "%s - Out of memory\n", __func__);
                 return;
         }
         rfkn = kzalloc(20, GFP_KERNEL);
         if (!rfkn) {
                 rfkill_free(hso_net->rfkill);
-                dev_err(dev, "%s - Out of memory", __func__);
+                hso_net->rfkill = NULL;
+                dev_err(dev, "%s - Out of memory\n", __func__);
                 return;
         }
         snprintf(rfkn, 20, "hso-%d",
@@ -2209,7 +2210,8 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
                 kfree(rfkn);
                 hso_net->rfkill->name = NULL;
                 rfkill_free(hso_net->rfkill);
-                dev_err(dev, "%s - Failed to register rfkill", __func__);
+                hso_net->rfkill = NULL;
+                dev_err(dev, "%s - Failed to register rfkill\n", __func__);
                 return;
         }
 }
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index 307b1f62d949..b1b947edcf01 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -1,10 +1,11 @@
-menu "Sonics Silicon Backplane"
-
 config SSB_POSSIBLE
         bool
         depends on HAS_IOMEM && HAS_DMA
         default y
 
+menu "Sonics Silicon Backplane"
+        depends on SSB_POSSIBLE
+
 config SSB
         tristate "Sonics Silicon Backplane support"
         depends on SSB_POSSIBLE
diff --git a/drivers/telephony/phonedev.c b/drivers/telephony/phonedev.c
index 37caf4d69037..b52cc830c0b4 100644
--- a/drivers/telephony/phonedev.c
+++ b/drivers/telephony/phonedev.c
@@ -8,7 +8,7 @@
  *              as published by the Free Software Foundation; either version
  *              2 of the License, or (at your option) any later version.
  *
- * Author:      Alan Cox, <alan@redhat.com>
+ * Author:      Alan Cox, <alan@lxorguk.ukuu.org.uk>
  *
  * Fixes:       Mar 01 2000 Thomas Sparr, <thomas.l.sparr@telia.com>
  *              phone_register_device now works with unit!=PHONE_UNIT_ANY
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index b679a556b98d..4e2cda93da59 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -26,7 +26,7 @@
  *      Introduced common header to be used also in USB Gadget Framework.
  *      Still needs some other style fixes.
  *
- * 2007_Jun_21  Alan Cox <alan@redhat.com>
+ * 2007_Jun_21  Alan Cox <alan@lxorguk.ukuu.org.uk>
  *      Minimal cleanups for some of the driver problens and tty layer abuse.
  *      Still needs fixing to allow multiple dongles.
  *
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index c3b78a76f173..225398fd5049 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -42,8 +42,10 @@ u32 booke_wdt_period = WDT_PERIOD_DEFAULT;
 
 #ifdef  CONFIG_FSL_BOOKE
 #define WDTP(x)         ((((63-x)&0x3)<<30)|(((63-x)&0x3c)<<15))
+#define WDTP_MASK       (WDTP(0))
 #else
 #define WDTP(x)         (TCR_WP(x))
+#define WDTP_MASK       (TCR_WP_MASK)
 #endif
 
 static DEFINE_SPINLOCK(booke_wdt_lock);
@@ -65,6 +67,7 @@ static void __booke_wdt_enable(void *data)
         /* clear status before enabling watchdog */
         __booke_wdt_ping(NULL);
         val = mfspr(SPRN_TCR);
+        val &= ~WDTP_MASK;
         val |= (TCR_WIE|TCR_WRC(WRC_CHIP)|WDTP(booke_wdt_period));
 
         mtspr(SPRN_TCR, val);
@@ -114,7 +117,7 @@ static long booke_wdt_ioctl(struct file *file,
         case WDIOC_SETTIMEOUT:
                 if (get_user(booke_wdt_period, p))
                         return -EFAULT;
-                mtspr(SPRN_TCR, (mfspr(SPRN_TCR) & ~WDTP(0)) |
+                mtspr(SPRN_TCR, (mfspr(SPRN_TCR) & ~WDTP_MASK) |
                                                 WDTP(booke_wdt_period));
                 return 0;
         case WDIOC_GETTIMEOUT: