Merge branch 'linus' into timers/core

Reason: Pick up the hrtimer_clock_to_base_table fix from mainline

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

62 files changed, 511 insertions, 211 deletions

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b136c9c1e531..449c556274c0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -943,6 +943,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
         if (ACPI_SUCCESS(status))
                 device->flags.lockable = 1;
 
+        /* Power resources cannot be power manageable. */
+        if (device->device_type == ACPI_BUS_TYPE_POWER)
+                return 0;
+
         /* Presence of _PS0|_PR0 indicates 'power manageable' */
         status = acpi_get_handle(device->handle, "_PS0", &temp);
         if (ACPI_FAILURE(status))
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index fbc5b6e7c591..abe3ab709e87 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -63,6 +63,7 @@ void device_pm_init(struct device *dev)
         dev->power.wakeup = NULL;
         spin_lock_init(&dev->power.lock);
         pm_runtime_init(dev);
+        INIT_LIST_HEAD(&dev->power.entry);
 }
 
 /**
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 4573c83df6dd..abbbd33e8d8a 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -258,7 +258,7 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
         if (!!dev->power.can_wakeup == !!capable)
                 return;
 
-        if (device_is_registered(dev)) {
+        if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                 if (capable) {
                         if (wakeup_sysfs_add(dev))
                                 return;
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index c58f691ec3ce..b493663c7ba7 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
         depends on DRM
         select FB
         select FRAMEBUFFER_CONSOLE if !EXPERT
+        select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
         help
           FB and CRTC helpers for KMS drivers.
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 950720473967..11d7a72c22d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,9 +342,22 @@ int drm_fb_helper_debug_leave(struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_debug_leave);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
+{
+        bool error = false;
+        int i, ret;
+        for (i = 0; i < fb_helper->crtc_count; i++) {
+                struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
+                ret = drm_crtc_helper_set_config(mode_set);
+                if (ret)
+                        error = true;
+        }
+        return error;
+}
+EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode);
+
 bool drm_fb_helper_force_kernel_mode(void)
 {
-        int i = 0;
         bool ret, error = false;
         struct drm_fb_helper *helper;
 
@@ -352,12 +365,12 @@ bool drm_fb_helper_force_kernel_mode(void)
                 return false;
 
         list_for_each_entry(helper, &kernel_fb_helper_list, kernel_fb_list) {
-                for (i = 0; i < helper->crtc_count; i++) {
-                        struct drm_mode_set *mode_set = &helper->crtc_info[i].mode_set;
-                        ret = drm_crtc_helper_set_config(mode_set);
-                        if (ret)
-                                error = true;
-                }
+                if (helper->dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                        continue;
+
+                ret = drm_fb_helper_restore_fbdev_mode(helper);
+                if (ret)
+                        error = true;
         }
         return error;
 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 72730377a01b..12876f2795d2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2207,7 +2207,7 @@ void i915_driver_lastclose(struct drm_device * dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
 
         if (!dev_priv || drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_fb_helper_restore();
+                intel_fb_restore_mode(dev);
                 vga_switcheroo_process_delayed_switch();
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f5b0d8306d83..1d20712d527f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -338,4 +338,5 @@ extern int intel_overlay_attrs(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 
 extern void intel_fb_output_poll_changed(struct drm_device *dev);
+extern void intel_fb_restore_mode(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 512782728e51..ec49bae73382 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -264,3 +264,13 @@ void intel_fb_output_poll_changed(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
 }
+
+void intel_fb_restore_mode(struct drm_device *dev)
+{
+        int ret;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+}
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bf7d4c061451..871df0376b1c 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -221,6 +221,19 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_NUM_TILE_PIPES:
+                if (rdev->family >= CHIP_CAYMAN)
+                        value = rdev->config.cayman.max_tile_pipes;
+                else if (rdev->family >= CHIP_CEDAR)
+                        value = rdev->config.evergreen.max_tile_pipes;
+                else if (rdev->family >= CHIP_RV770)
+                        value = rdev->config.rv770.max_tile_pipes;
+                else if (rdev->family >= CHIP_R600)
+                        value = rdev->config.r600.max_tile_pipes;
+                else {
+                        return -EINVAL;
+                }
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index af0da4ae3f55..92f1900dc7ca 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -708,6 +708,7 @@ r600 0x9400
 0x00028D0C DB_RENDER_CONTROL
 0x00028D10 DB_RENDER_OVERRIDE
 0x0002880C DB_SHADER_CONTROL
+0x00028D28 DB_SRESULTS_COMPARE_STATE0
 0x00028D2C DB_SRESULTS_COMPARE_STATE1
 0x00028430 DB_STENCILREFMASK
 0x00028434 DB_STENCILREFMASK_BF
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 060ef6327876..50e40dbd8bb6 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -110,8 +110,7 @@ config SENSORS_ADM1021
         help
           If you say yes here you get support for Analog Devices ADM1021
           and ADM1023 sensor chips and clones: Maxim MAX1617 and MAX1617A,
-          Genesys Logic GL523SM, National Semiconductor LM84, TI THMC10,
-          and the XEON processor built-in sensor.
+          Genesys Logic GL523SM, National Semiconductor LM84 and TI THMC10.
 
           This driver can also be built as a module.  If so, the module
           will be called adm1021.
@@ -618,10 +617,10 @@ config SENSORS_LM90
         depends on I2C
         help
           If you say yes here you get support for National Semiconductor LM90,
-          LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, Maxim
-          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
-          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, and Winbond/Nuvoton
-          W83L771W/G/AWG/ASG sensor chips.
+          LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
+          Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
+          and Winbond/Nuvoton W83L771W/G/AWG/ASG sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 250d099ca398..da72dc12068c 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1094,6 +1094,7 @@ static struct attribute *lm85_attributes_minctl[] = {
         &sensor_dev_attr_pwm1_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm2_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm3_auto_pwm_minctl.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_minctl = {
@@ -1104,6 +1105,7 @@ static struct attribute *lm85_attributes_temp_off[] = {
         &sensor_dev_attr_temp1_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp2_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp3_auto_temp_off.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_temp_off = {
@@ -1329,11 +1331,11 @@ static int lm85_probe(struct i2c_client *client,
         if (data->type != emc6d103s) {
                 err = sysfs_create_group(&client->dev.kobj, &lm85_group_minctl);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
                 err = sysfs_create_group(&client->dev.kobj,
                                          &lm85_group_temp_off);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
         }
 
         /* The ADT7463/68 have an optional VRM 10 mode where pin 21 is used
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c43b4e9f96a9..2f94f9504804 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -49,10 +49,10 @@
  * chips, but support three temperature sensors instead of two. MAX6695
  * and MAX6696 only differ in the pinout so they can be treated identically.
  *
- * This driver also supports the ADT7461 chip from Analog Devices.
- * It's supported in both compatibility and extended mode. It is mostly
- * compatible with LM90 except for a data format difference for the
- * temperature value registers.
+ * This driver also supports ADT7461 and ADT7461A from Analog Devices as well as
+ * NCT1008 from ON Semiconductor. The chips are supported in both compatibility
+ * and extended mode. They are mostly compatible with LM90 except for a data
+ * format difference for the temperature value registers.
  *
  * Since the LM90 was the first chipset supported by this driver, most
  * comments will refer to this chipset, but are actually general and
@@ -88,9 +88,10 @@
  * Addresses to scan
  * Address is fully defined internally and cannot be changed except for
  * MAX6659, MAX6680 and MAX6681.
- * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, MAX6649, MAX6657,
- * MAX6658 and W83L771 have address 0x4c.
- * ADM1032-2, ADT7461-2, LM89-1, LM99-1 and MAX6646 have address 0x4d.
+ * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, ADT7461A, MAX6649,
+ * MAX6657, MAX6658, NCT1008 and W83L771 have address 0x4c.
+ * ADM1032-2, ADT7461-2, ADT7461A-2, LM89-1, LM99-1, MAX6646, and NCT1008D
+ * have address 0x4d.
  * MAX6647 has address 0x4e.
  * MAX6659 can have address 0x4c, 0x4d or 0x4e.
  * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
@@ -174,6 +175,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
 static const struct i2c_device_id lm90_id[] = {
         { "adm1032", adm1032 },
         { "adt7461", adt7461 },
+        { "adt7461a", adt7461 },
         { "lm90", lm90 },
         { "lm86", lm86 },
         { "lm89", lm86 },
@@ -188,6 +190,7 @@ static const struct i2c_device_id lm90_id[] = {
         { "max6681", max6680 },
         { "max6695", max6696 },
         { "max6696", max6696 },
+        { "nct1008", adt7461 },
         { "w83l771", w83l771 },
         { }
 };
@@ -1153,6 +1156,11 @@ static int lm90_detect(struct i2c_client *new_client,
                  && (reg_config1 & 0x1B) == 0x00
                  && reg_convrate <= 0x0A) {
                         name = "adt7461";
+                } else
+                if (chip_id == 0x57 /* ADT7461A, NCT1008 */
+                 && (reg_config1 & 0x1B) == 0x00
+                 && reg_convrate <= 0x0A) {
+                        name = "adt7461a";
                 }
         } else
         if (man_id == 0x4D) { /* Maxim */
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index de5819199e2e..57240740b161 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -98,7 +98,6 @@ static const struct attribute_group twl4030_madc_group = {
 static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
 {
         int ret;
-        int status;
         struct device *hwmon;
 
         ret = sysfs_create_group(&pdev->dev.kobj, &twl4030_madc_group);
@@ -107,7 +106,7 @@ static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
         hwmon = hwmon_device_register(&pdev->dev);
         if (IS_ERR(hwmon)) {
                 dev_err(&pdev->dev, "hwmon_device_register failed.\n");
-                status = PTR_ERR(hwmon);
+                ret = PTR_ERR(hwmon);
                 goto err_reg;
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 72c0415f6f94..455e909bc768 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -134,10 +134,15 @@
                                  SMBHSTSTS_BUS_ERR | SMBHSTSTS_DEV_ERR | \
                                  SMBHSTSTS_INTR)
 
+/* Older devices have their ID defined in <linux/pci_ids.h> */
+#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
+#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF0 0x1d70
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF1 0x1d71
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF2 0x1d72
+#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
+#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 
 struct i801_priv {
         struct i2c_adapter adapter;
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index 0eb1515541e7..2dbba163b102 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -1,7 +1,7 @@
 /* ------------------------------------------------------------------------ *
  * i2c-parport.c I2C bus over parallel port                                 *
  * ------------------------------------------------------------------------ *
-   Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
+   Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>
    
    Based on older i2c-philips-par.c driver
    Copyright (C) 1995-2000 Simon G. Vogl
@@ -33,6 +33,8 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/i2c-smbus.h>
 #include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include "i2c-parport.h"
 
 /* ----- Device list ------------------------------------------------------ */
@@ -43,10 +45,11 @@ struct i2c_par {
         struct i2c_algo_bit_data algo_data;
         struct i2c_smbus_alert_setup alert_data;
         struct i2c_client *ara;
-        struct i2c_par *next;
+        struct list_head node;
 };
 
-static struct i2c_par *adapter_list;
+static LIST_HEAD(adapter_list);
+static DEFINE_MUTEX(adapter_list_lock);
 
 /* ----- Low-level parallel port access ----------------------------------- */
 
@@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
         }
 
         /* Add the new adapter to the list */
-        adapter->next = adapter_list;
-        adapter_list = adapter;
+        mutex_lock(&adapter_list_lock);
+        list_add_tail(&adapter->node, &adapter_list);
+        mutex_unlock(&adapter_list_lock);
         return;
 
 ERROR1:
@@ -241,11 +245,11 @@ ERROR0:
 
 static void i2c_parport_detach (struct parport *port)
 {
-        struct i2c_par *adapter, *prev;
+        struct i2c_par *adapter, *_n;
 
         /* Walk the list */
-        for (prev = NULL, adapter = adapter_list; adapter;
-             prev = adapter, adapter = adapter->next) {
+        mutex_lock(&adapter_list_lock);
+        list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
                 if (adapter->pdev->port == port) {
                         if (adapter->ara) {
                                 parport_disable_irq(port);
@@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)
                                 
                         parport_release(adapter->pdev);
                         parport_unregister_device(adapter->pdev);
-                        if (prev)
-                                prev->next = adapter->next;
-                        else
-                                adapter_list = adapter->next;
+                        list_del(&adapter->node);
                         kfree(adapter);
-                        return;
                 }
         }
+        mutex_unlock(&adapter_list_lock);
 }
 
 static struct parport_driver i2c_parport_driver = {
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 7de4b7ebffc5..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 74fe0360bec7..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -2111,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 55de3cf3441c..6bab3eaea70f 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3299,7 +3299,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
         dd->flags |= QIB_DOING_RESET;
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 5466d47db899..aae40e52af5b 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -533,16 +533,7 @@ int tda18271_calc_main_pll(struct dvb_frontend *fe, u32 freq)
         if (tda_fail(ret))
                 goto fail;
 
-        regs[R_MPD]   = (0x77 & pd);
-
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x08;
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |=  0x08;
-                break;
-        }
+        regs[R_MPD]   = (0x7f & pd);
 
         div =  ((d * (freq / 1000)) << 7) / 125;
 
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 9ad4454a148d..d884f5eee73c 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -579,8 +579,8 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 #define RF3 2
         u32 rf_default[3];
         u32 rf_freq[3];
-        u8 prog_cal[3];
-        u8 prog_tab[3];
+        s32 prog_cal[3];
+        s32 prog_tab[3];
 
         i = tda18271_lookup_rf_band(fe, &freq, NULL);
 
@@ -602,32 +602,33 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
                         return bcal;
 
                 tda18271_calc_rf_cal(fe, &rf_freq[rf]);
-                prog_tab[rf] = regs[R_EB14];
+                prog_tab[rf] = (s32)regs[R_EB14];
 
                 if (1 == bcal)
-                        prog_cal[rf] = tda18271_calibrate_rf(fe, rf_freq[rf]);
+                        prog_cal[rf] =
+                                (s32)tda18271_calibrate_rf(fe, rf_freq[rf]);
                 else
                         prog_cal[rf] = prog_tab[rf];
 
                 switch (rf) {
                 case RF1:
                         map[i].rf_a1 = 0;
-                        map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
+                        map[i].rf_b1 = (prog_cal[RF1] - prog_tab[RF1]);
                         map[i].rf1   = rf_freq[RF1] / 1000;
                         break;
                 case RF2:
-                        dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
-                                   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+                        dividend = (prog_cal[RF2] - prog_tab[RF2] -
+                                    prog_cal[RF1] + prog_tab[RF1]);
                         divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
                         map[i].rf_a1 = (dividend / divisor);
                         map[i].rf2   = rf_freq[RF2] / 1000;
                         break;
                 case RF3:
-                        dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
-                                   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+                        dividend = (prog_cal[RF3] - prog_tab[RF3] -
+                                    prog_cal[RF2] + prog_tab[RF2]);
                         divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
                         map[i].rf_a2 = (dividend / divisor);
-                        map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
+                        map[i].rf_b2 = (prog_cal[RF2] - prog_tab[RF2]);
                         map[i].rf3   = rf_freq[RF3] / 1000;
                         break;
                 default:
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e7f84c705da8..3d5b6ab7e332 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -229,8 +229,7 @@ static struct tda18271_map tda18271c2_km[] = {
 static struct tda18271_map tda18271_rf_band[] = {
         { .rfmax =  47900, .val = 0x00 },
         { .rfmax =  61100, .val = 0x01 },
-/*      { .rfmax = 152600, .val = 0x02 }, */
-        { .rfmax = 121200, .val = 0x02 },
+        { .rfmax = 152600, .val = 0x02 },
         { .rfmax = 164700, .val = 0x03 },
         { .rfmax = 203500, .val = 0x04 },
         { .rfmax = 457800, .val = 0x05 },
@@ -448,7 +447,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 150000, .val = 0xb0 },
         { .rfmax = 151000, .val = 0xb1 },
         { .rfmax = 152000, .val = 0xb7 },
-        { .rfmax = 153000, .val = 0xbd },
+        { .rfmax = 152600, .val = 0xbd },
         { .rfmax = 154000, .val = 0x20 },
         { .rfmax = 155000, .val = 0x22 },
         { .rfmax = 156000, .val = 0x24 },
@@ -459,7 +458,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 161000, .val = 0x2d },
         { .rfmax = 163000, .val = 0x2e },
         { .rfmax = 164000, .val = 0x2f },
-        { .rfmax = 165000, .val = 0x30 },
+        { .rfmax = 164700, .val = 0x30 },
         { .rfmax = 166000, .val = 0x11 },
         { .rfmax = 167000, .val = 0x12 },
         { .rfmax = 168000, .val = 0x13 },
@@ -510,7 +509,8 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 236000, .val = 0x1b },
         { .rfmax = 237000, .val = 0x1c },
         { .rfmax = 240000, .val = 0x1d },
-        { .rfmax = 242000, .val = 0x1f },
+        { .rfmax = 242000, .val = 0x1e },
+        { .rfmax = 244000, .val = 0x1f },
         { .rfmax = 247000, .val = 0x20 },
         { .rfmax = 249000, .val = 0x21 },
         { .rfmax = 252000, .val = 0x22 },
@@ -624,7 +624,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 453000, .val = 0x93 },
         { .rfmax = 454000, .val = 0x94 },
         { .rfmax = 456000, .val = 0x96 },
-        { .rfmax = 457000, .val = 0x98 },
+        { .rfmax = 457800, .val = 0x98 },
         { .rfmax = 461000, .val = 0x11 },
         { .rfmax = 468000, .val = 0x12 },
         { .rfmax = 472000, .val = 0x13 },
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 955254090a0e..03f96d6ca894 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index fe4f894183ff..ccbd39a38c46 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -362,7 +362,7 @@ config DVB_USB_LME2510
 config DVB_USB_TECHNISAT_USB2
         tristate "Technisat DVB-S/S2 USB2.0 support"
         depends on DVB_USB
-        select DVB_STB0899 if !DVB_FE_CUSTOMISE
-        select DVB_STB6100 if !DVB_FE_CUSTOMISE
+        select DVB_STV090x if !DVB_FE_CUSTOMISE
+        select DVB_STV6110x if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the Technisat USB2 DVB-S/S2 device
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 97af266d7f1d..65214af5cd74 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -2162,7 +2162,7 @@ struct dibx000_agc_config dib7090_agc_config[2] = {
                 .agc1_pt3       = 98,
                 .agc1_slope1    = 0,
                 .agc1_slope2    = 167,
-                .agc1_pt1       = 98,
+                .agc2_pt1       = 98,
                 .agc2_pt2       = 255,
                 .agc2_slope1    = 104,
                 .agc2_slope2    = 0,
@@ -2440,11 +2440,11 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
         dib0700_set_i2c_speed(adap->dev, 340);
         adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x90, &tfe7090pvr_dib7000p_config[0]);
 
-        dib7090_slave_reset(adap->fe);
-
         if (adap->fe == NULL)
                 return -ENODEV;
 
+        dib7090_slave_reset(adap->fe);
+
         return 0;
 }
 
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index 23640ed44d85..056138f63c7d 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -378,7 +378,6 @@ EXPORT_SYMBOL_GPL(media_entity_create_link);
 
 static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 {
-        const u32 mask = MEDIA_LNK_FL_ENABLED;
         int ret;
 
         /* Notify both entities. */
@@ -395,7 +394,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
                 return ret;
         }
 
-        link->flags = (link->flags & ~mask) | (flags & mask);
+        link->flags = flags;
         link->reverse->flags = link->flags;
 
         return 0;
@@ -417,6 +416,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
  */
 int __media_entity_setup_link(struct media_link *link, u32 flags)
 {
+        const u32 mask = MEDIA_LNK_FL_ENABLED;
         struct media_device *mdev;
         struct media_entity *source, *sink;
         int ret = -EBUSY;
@@ -424,6 +424,10 @@ int __media_entity_setup_link(struct media_link *link, u32 flags)
         if (link == NULL)
                 return -EINVAL;
 
+        /* The non-modifiable link flags must not be modified. */
+        if ((link->flags & ~mask) != (flags & ~mask))
+                return -EINVAL;
+
         if (link->flags & MEDIA_LNK_FL_IMMUTABLE)
                 return link->flags == flags ? 0 : -EINVAL;
 
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index dc3f04c52d5e..87bad7678d92 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -170,7 +170,7 @@ static int fmr2_setfreq(struct fmr2 *dev)
         return 0;
 }
 
-/* !!! not tested, in my card this does't work !!! */
+/* !!! not tested, in my card this doesn't work !!! */
 static int fmr2_setvolume(struct fmr2 *dev)
 {
         int vol[16] = { 0x021, 0x084, 0x090, 0x104,
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 4498b944dec8..00f51dd121f3 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -875,7 +875,7 @@ config MX3_VIDEO
 config VIDEO_MX3
         tristate "i.MX3x Camera Sensor Interface driver"
         depends on VIDEO_DEV && MX3_IPU && SOC_CAMERA
-        select VIDEOBUF_DMA_CONTIG
+        select VIDEOBUF2_DMA_CONTIG
         select MX3_VIDEO
         ---help---
           This is a v4l2 driver for the i.MX3x Camera Sensor Interface
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index c6e2ca3b1149..6fbc356113c1 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -350,9 +350,17 @@ void cx18_streams_cleanup(struct cx18 *cx, int unregister)
 
                 /* No struct video_device, but can have buffers allocated */
                 if (type == CX18_ENC_STREAM_TYPE_IDX) {
+                        /* If the module params didn't inhibit IDX ... */
                         if (cx->stream_buffers[type] != 0) {
                                 cx->stream_buffers[type] = 0;
-                                cx18_stream_free(&cx->streams[type]);
+                                /*
+                                 * Before calling cx18_stream_free(),
+                                 * check if the IDX stream was actually set up.
+                                 * Needed, since the cx18_probe() error path
+                                 * exits through here as well as normal clean up
+                                 */
+                                if (cx->streams[type].buffers != 0)
+                                        cx18_stream_free(&cx->streams[type]);
                         }
                         continue;
                 }
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index 3b6e7f28568e..caab1bfb79e2 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_CX23885
         select DVB_CX24116 if !DVB_FE_CUSTOMISE
         select DVB_STV0900 if !DVB_FE_CUSTOMISE
         select DVB_DS3000 if !DVB_FE_CUSTOMISE
+        select DVB_STV0367 if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/imx074.c b/drivers/media/video/imx074.c
index 1a1169115716..0382ea752e6f 100644
--- a/drivers/media/video/imx074.c
+++ b/drivers/media/video/imx074.c
@@ -298,7 +298,7 @@ static unsigned long imx074_query_bus_param(struct soc_camera_device *icd)
 static int imx074_set_bus_param(struct soc_camera_device *icd,
                                  unsigned long flags)
 {
-        return -1;
+        return -EINVAL;
 }
 
 static struct soc_camera_ops imx074_ops = {
diff --git a/drivers/media/video/omap3isp/isp.c b/drivers/media/video/omap3isp/isp.c
index 503bd7922bd6..472a69359e60 100644
--- a/drivers/media/video/omap3isp/isp.c
+++ b/drivers/media/video/omap3isp/isp.c
@@ -215,20 +215,21 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         switch (xclksel) {
-        case 0:
+        case ISP_XCLK_A:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVA_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVA_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclka set to %d Hz\n",
                         currentxclk);
                 break;
-        case 1:
+        case ISP_XCLK_B:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVB_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVB_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclkb set to %d Hz\n",
                         currentxclk);
                 break;
+        case ISP_XCLK_NONE:
         default:
                 omap3isp_put(isp);
                 dev_dbg(isp->dev, "ISP_ERR: isp_set_xclk(): Invalid requested "
@@ -237,13 +238,13 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         /* Do we go from stable whatever to clock? */
-        if (divisor >= 2 && isp->xclk_divisor[xclksel] < 2)
+        if (divisor >= 2 && isp->xclk_divisor[xclksel - 1] < 2)
                 omap3isp_get(isp);
         /* Stopping the clock. */
-        else if (divisor < 2 && isp->xclk_divisor[xclksel] >= 2)
+        else if (divisor < 2 && isp->xclk_divisor[xclksel - 1] >= 2)
                 omap3isp_put(isp);
 
-        isp->xclk_divisor[xclksel] = divisor;
+        isp->xclk_divisor[xclksel - 1] = divisor;
 
         omap3isp_put(isp);
 
@@ -285,7 +286,8 @@ static void isp_power_settings(struct isp_device *isp, int idle)
  */
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata)
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift)
 {
         u32 ispctrl_val;
 
@@ -298,9 +300,9 @@ void omap3isp_configure_bridge(struct isp_device *isp,
         switch (input) {
         case CCDC_INPUT_PARALLEL:
                 ispctrl_val |= ISPCTRL_PAR_SER_CLK_SEL_PARALLEL;
-                ispctrl_val |= pdata->data_lane_shift << ISPCTRL_SHIFT_SHIFT;
                 ispctrl_val |= pdata->clk_pol << ISPCTRL_PAR_CLK_POL_SHIFT;
                 ispctrl_val |= pdata->bridge << ISPCTRL_PAR_BRIDGE_SHIFT;
+                shift += pdata->data_lane_shift * 2;
                 break;
 
         case CCDC_INPUT_CSI2A:
@@ -319,6 +321,8 @@ void omap3isp_configure_bridge(struct isp_device *isp,
                 return;
         }
 
+        ispctrl_val |= ((shift/2) << ISPCTRL_SHIFT_SHIFT) & ISPCTRL_SHIFT_MASK;
+
         ispctrl_val &= ~ISPCTRL_SYNC_DETECT_MASK;
         ispctrl_val |= ISPCTRL_SYNC_DETECT_VSRISE;
 
@@ -658,6 +662,8 @@ int omap3isp_pipeline_pm_use(struct media_entity *entity, int use)
 
         /* Apply power change to connected non-nodes. */
         ret = isp_pipeline_pm_power(entity, change);
+        if (ret < 0)
+                entity->use_count -= change;
 
         mutex_unlock(&entity->parent->graph_mutex);
 
@@ -872,6 +878,9 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
                 }
         }
 
+        if (failure < 0)
+                isp->needs_reset = true;
+
         return failure;
 }
 
@@ -884,7 +893,8 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
  * single-shot or continuous mode.
  *
  * Return 0 if successful, or the return value of the failed video::s_stream
- * operation otherwise.
+ * operation otherwise. The pipeline state is not updated when the operation
+ * fails, except when stopping the pipeline.
  */
 int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state)
@@ -895,7 +905,9 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                 ret = isp_pipeline_disable(pipe);
         else
                 ret = isp_pipeline_enable(pipe, state);
-        pipe->stream_state = state;
+
+        if (ret == 0 || state == ISP_PIPELINE_STREAM_STOPPED)
+                pipe->stream_state = state;
 
         return ret;
 }
@@ -1481,6 +1493,10 @@ void omap3isp_put(struct isp_device *isp)
         if (--isp->ref_count == 0) {
                 isp_disable_interrupts(isp);
                 isp_save_ctx(isp);
+                if (isp->needs_reset) {
+                        isp_reset(isp);
+                        isp->needs_reset = false;
+                }
                 isp_disable_clocks(isp);
         }
         mutex_unlock(&isp->isp_mutex);
diff --git a/drivers/media/video/omap3isp/isp.h b/drivers/media/video/omap3isp/isp.h
index cf5214e95a92..2620c405f5e4 100644
--- a/drivers/media/video/omap3isp/isp.h
+++ b/drivers/media/video/omap3isp/isp.h
@@ -132,7 +132,6 @@ struct isp_reg {
 
 /**
  * struct isp_parallel_platform_data - Parallel interface platform data
- * @width: Parallel bus width in bits (8, 10, 11 or 12)
  * @data_lane_shift: Data lane shifter
  *              0 - CAMEXT[13:0] -> CAM[13:0]
  *              1 - CAMEXT[13:2] -> CAM[11:0]
@@ -146,7 +145,6 @@ struct isp_reg {
  *              ISPCTRL_PAR_BRIDGE_BENDIAN - Big endian
  */
 struct isp_parallel_platform_data {
-        unsigned int width;
         unsigned int data_lane_shift:2;
         unsigned int clk_pol:1;
         unsigned int bridge:4;
@@ -262,6 +260,7 @@ struct isp_device {
         /* ISP Obj */
         spinlock_t stat_lock;   /* common lock for statistic drivers */
         struct mutex isp_mutex; /* For handling ref_count field */
+        bool needs_reset;
         int has_context;
         int ref_count;
         unsigned int autoidle;
@@ -311,11 +310,12 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state);
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata);
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift);
 
-#define ISP_XCLK_NONE                   -1
-#define ISP_XCLK_A                      0
-#define ISP_XCLK_B                      1
+#define ISP_XCLK_NONE                   0
+#define ISP_XCLK_A                      1
+#define ISP_XCLK_B                      2
 
 struct isp_device *omap3isp_get(struct isp_device *isp);
 void omap3isp_put(struct isp_device *isp);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 5ff9d14ce710..39d501bda636 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -43,6 +43,12 @@ __ccdc_get_format(struct isp_ccdc_device *ccdc, struct v4l2_subdev_fh *fh,
 
 static const unsigned int ccdc_fmts[] = {
         V4L2_MBUS_FMT_Y8_1X8,
+        V4L2_MBUS_FMT_Y10_1X10,
+        V4L2_MBUS_FMT_Y12_1X12,
+        V4L2_MBUS_FMT_SGRBG8_1X8,
+        V4L2_MBUS_FMT_SRGGB8_1X8,
+        V4L2_MBUS_FMT_SBGGR8_1X8,
+        V4L2_MBUS_FMT_SGBRG8_1X8,
         V4L2_MBUS_FMT_SGRBG10_1X10,
         V4L2_MBUS_FMT_SRGGB10_1X10,
         V4L2_MBUS_FMT_SBGGR10_1X10,
@@ -1110,21 +1116,38 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
         struct isp_parallel_platform_data *pdata = NULL;
         struct v4l2_subdev *sensor;
         struct v4l2_mbus_framefmt *format;
+        const struct isp_format_info *fmt_info;
+        struct v4l2_subdev_format fmt_src;
+        unsigned int depth_out;
+        unsigned int depth_in = 0;
         struct media_pad *pad;
         unsigned long flags;
+        unsigned int shift;
         u32 syn_mode;
         u32 ccdc_pattern;
 
-        if (ccdc->input == CCDC_INPUT_PARALLEL) {
-                pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
-                sensor = media_entity_to_v4l2_subdev(pad->entity);
+        pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
+        sensor = media_entity_to_v4l2_subdev(pad->entity);
+        if (ccdc->input == CCDC_INPUT_PARALLEL)
                 pdata = &((struct isp_v4l2_subdevs_group *)sensor->host_priv)
                         ->bus.parallel;
+
+        /* Compute shift value for lane shifter to configure the bridge. */
+        fmt_src.pad = pad->index;
+        fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+        if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
+                fmt_info = omap3isp_video_format_info(fmt_src.format.code);
+                depth_in = fmt_info->bpp;
         }
 
-        omap3isp_configure_bridge(isp, ccdc->input, pdata);
+        fmt_info = omap3isp_video_format_info
+                (isp->isp_ccdc.formats[CCDC_PAD_SINK].code);
+        depth_out = fmt_info->bpp;
+
+        shift = depth_in - depth_out;
+        omap3isp_configure_bridge(isp, ccdc->input, pdata, shift);
 
-        ccdc->syncif.datsz = pdata ? pdata->width : 10;
+        ccdc->syncif.datsz = depth_out;
         ccdc_config_sync_if(ccdc, &ccdc->syncif);
 
         /* CCDC_PAD_SINK */
@@ -1338,7 +1361,7 @@ static int ccdc_sbl_wait_idle(struct isp_ccdc_device *ccdc,
  * @ccdc: Pointer to ISP CCDC device.
  * @event: Pointing which event trigger handler
  *
- * Return 1 when the event and stopping request combination is satisfyied,
+ * Return 1 when the event and stopping request combination is satisfied,
  * zero otherwise.
  */
 static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
@@ -1618,7 +1641,7 @@ static int ccdc_video_queue(struct isp_video *video, struct isp_buffer *buffer)
 
         ccdc_set_outaddr(ccdc, buffer->isp_addr);
 
-        /* We now have a buffer queued on the output, restart the pipeline in
+        /* We now have a buffer queued on the output, restart the pipeline
          * on the next CCDC interrupt if running in continuous mode (or when
          * starting the stream).
          */
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 2b16988a501d..aba537af87e4 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -755,7 +755,7 @@ static struct preview_update update_attrs[] = {
  * @configs - pointer to update config structure.
  * @config - return pointer to appropriate structure field.
  * @bit - for which feature to return pointers.
- * Return size of coresponding prev_params member
+ * Return size of corresponding prev_params member
  */
 static u32
 __preview_get_ptrs(struct prev_params *params, void **param,
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 8fddc5806b0d..9c317148205f 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -339,7 +339,7 @@ static int isp_video_buffer_prepare_user(struct isp_video_buffer *buf)
         up_read(&current->mm->mmap_sem);
 
         if (ret != buf->npages) {
-                buf->npages = ret;
+                buf->npages = ret < 0 ? 0 : ret;
                 isp_video_buffer_cleanup(buf);
                 return -EFAULT;
         }
@@ -408,8 +408,8 @@ done:
  * isp_video_buffer_prepare_vm_flags - Get VMA flags for a userspace address
  *
  * This function locates the VMAs for the buffer's userspace address and checks
- * that their flags match. The onlflag that we need to care for at the moment is
- * VM_PFNMAP.
+ * that their flags match. The only flag that we need to care for at the moment
+ * is VM_PFNMAP.
  *
  * The buffer vm_flags field is set to the first VMA flags.
  *
diff --git a/drivers/media/video/omap3isp/ispresizer.c b/drivers/media/video/omap3isp/ispresizer.c
index 653f88ba56db..0bb0f8cd36f5 100644
--- a/drivers/media/video/omap3isp/ispresizer.c
+++ b/drivers/media/video/omap3isp/ispresizer.c
@@ -714,19 +714,50 @@ static void resizer_print_status(struct isp_res_device *res)
  * iw and ih are the input width and height after cropping. Those equations need
  * to be satisfied exactly for the resizer to work correctly.
  *
- * Reverting the equations, we can compute the resizing ratios with
+ * The equations can't be easily reverted, as the >> 8 operation is not linear.
+ * In addition, not all input sizes can be achieved for a given output size. To
+ * get the highest input size lower than or equal to the requested input size,
+ * we need to compute the highest resizing ratio that satisfies the following
+ * inequality (taking the 4-tap mode width equation as an example)
+ *
+ *      iw >= (32 * sph + (ow - 1) * hrsz + 16) >> 8 - 7
+ *
+ * (where iw is the requested input width) which can be rewritten as
+ *
+ *        iw - 7            >= (32 * sph + (ow - 1) * hrsz + 16) >> 8
+ *       (iw - 7) << 8      >=  32 * sph + (ow - 1) * hrsz + 16 - b
+ *      ((iw - 7) << 8) + b >=  32 * sph + (ow - 1) * hrsz + 16
+ *
+ * where b is the value of the 8 least significant bits of the right hand side
+ * expression of the last inequality. The highest resizing ratio value will be
+ * achieved when b is equal to its maximum value of 255. That resizing ratio
+ * value will still satisfy the original inequality, as b will disappear when
+ * the expression will be shifted right by 8.
+ *
+ * The reverted the equations thus become
  *
  * - 8-phase, 4-tap mode
- *      hrsz = ((iw - 7) * 256 - 16 - 32 * sph) / (ow - 1)
- *      vrsz = ((ih - 4) * 256 - 16 - 32 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 16 - 32 * sph) / (ow - 1)
+ *      vrsz = ((ih - 4) * 256 + 255 - 16 - 32 * spv) / (oh - 1)
  * - 4-phase, 7-tap mode
- *      hrsz = ((iw - 7) * 256 - 32 - 64 * sph) / (ow - 1)
- *      vrsz = ((ih - 7) * 256 - 32 - 64 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 32 - 64 * sph) / (ow - 1)
+ *      vrsz = ((ih - 7) * 256 + 255 - 32 - 64 * spv) / (oh - 1)
  *
- * The ratios are integer values, and must be rounded down to ensure that the
- * cropped input size is not bigger than the uncropped input size. As the ratio
- * in 7-tap mode is always smaller than the ratio in 4-tap mode, we can use the
- * 7-tap mode equations to compute a ratio approximation.
+ * The ratios are integer values, and are rounded down to ensure that the
+ * cropped input size is not bigger than the uncropped input size.
+ *
+ * As the number of phases/taps, used to select the correct equations to compute
+ * the ratio, depends on the ratio, we start with the 4-tap mode equations to
+ * compute an approximation of the ratio, and switch to the 7-tap mode equations
+ * if the approximation is higher than the ratio threshold.
+ *
+ * As the 7-tap mode equations will return a ratio smaller than or equal to the
+ * 4-tap mode equations, the resulting ratio could become lower than or equal to
+ * the ratio threshold. This 'equations loop' isn't an issue as long as the
+ * correct equations are used to compute the final input size. Starting with the
+ * 4-tap mode equations ensure that, in case of values resulting in a 'ratio
+ * loop', the smallest of the ratio values will be used, never exceeding the
+ * requested input size.
  *
  * We first clamp the output size according to the hardware capabilitie to avoid
  * auto-cropping the input more than required to satisfy the TRM equations. The
@@ -775,6 +806,8 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         unsigned int max_width;
         unsigned int max_height;
         unsigned int width_alignment;
+        unsigned int width;
+        unsigned int height;
 
         /*
          * Clamp the output height based on the hardware capabilities and
@@ -786,19 +819,22 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         max_height = min_t(unsigned int, max_height, MAX_OUT_HEIGHT);
         output->height = clamp(output->height, min_height, max_height);
 
-        ratio->vert = ((input->height - 7) * 256 - 32 - 64 * spv)
+        ratio->vert = ((input->height - 4) * 256 + 255 - 16 - 32 * spv)
                     / (output->height - 1);
+        if (ratio->vert > MID_RESIZE_VALUE)
+                ratio->vert = ((input->height - 7) * 256 + 255 - 32 - 64 * spv)
+                            / (output->height - 1);
         ratio->vert = clamp_t(unsigned int, ratio->vert,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->vert <= MID_RESIZE_VALUE) {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 32 * spv + 16;
-                input->height = (upscaled_height >> 8) + 4;
+                height = (upscaled_height >> 8) + 4;
         } else {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 64 * spv + 32;
-                input->height = (upscaled_height >> 8) + 7;
+                height = (upscaled_height >> 8) + 7;
         }
 
         /*
@@ -854,20 +890,29 @@ static void resizer_calc_ratios(struct isp_res_device *res,
                               max_width & ~(width_alignment - 1));
         output->width = ALIGN(output->width, width_alignment);
 
-        ratio->horz = ((input->width - 7) * 256 - 32 - 64 * sph)
+        ratio->horz = ((input->width - 7) * 256 + 255 - 16 - 32 * sph)
                     / (output->width - 1);
+        if (ratio->horz > MID_RESIZE_VALUE)
+                ratio->horz = ((input->width - 7) * 256 + 255 - 32 - 64 * sph)
+                            / (output->width - 1);
         ratio->horz = clamp_t(unsigned int, ratio->horz,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->horz <= MID_RESIZE_VALUE) {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 32 * sph + 16;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         } else {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 64 * sph + 32;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         }
+
+        /* Center the new crop rectangle. */
+        input->left += (input->width - width) / 2;
+        input->top += (input->height - height) / 2;
+        input->width = width;
+        input->height = height;
 }
 
 /*
diff --git a/drivers/media/video/omap3isp/ispstat.h b/drivers/media/video/omap3isp/ispstat.h
index 820950c9ef46..d86da94fa50d 100644
--- a/drivers/media/video/omap3isp/ispstat.h
+++ b/drivers/media/video/omap3isp/ispstat.h
@@ -131,9 +131,9 @@ struct ispstat {
 struct ispstat_generic_config {
         /*
          * Fields must be in the same order as in:
-         *  - isph3a_aewb_config
-         *  - isph3a_af_config
-         *  - isphist_config
+         *  - omap3isp_h3a_aewb_config
+         *  - omap3isp_h3a_af_config
+         *  - omap3isp_hist_config
          */
         u32 buf_size;
         u16 config_counter;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index 208a7ec739d7..9cd8f1aa567b 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -47,29 +47,59 @@
 
 static struct isp_format_info formats[] = {
         { V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
-          V4L2_MBUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 8, },
+          V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_GREY, 8, },
+        { V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y10, 10, },
+        { V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y12, 12, },
+        { V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR8, 8, },
+        { V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG8, 8, },
+        { V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG8, 8, },
+        { V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB8, 8, },
         { V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8, V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, 0,
+          V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
         { V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10, 10, },
+          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR10, 10, },
         { V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10, 10, },
+          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG10, 10, },
         { V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10, 10, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG10, 10, },
         { V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10, 10, },
+          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB10, 10, },
         { V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12, 12, },
+          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR12, 12, },
         { V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12, 12, },
+          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG12, 12, },
         { V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12, 12, },
+          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG12, 12, },
         { V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12, 12, },
+          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB12, 12, },
         { V4L2_MBUS_FMT_UYVY8_1X16, V4L2_MBUS_FMT_UYVY8_1X16,
-          V4L2_MBUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 16, },
+          V4L2_MBUS_FMT_UYVY8_1X16, 0,
+          V4L2_PIX_FMT_UYVY, 16, },
         { V4L2_MBUS_FMT_YUYV8_1X16, V4L2_MBUS_FMT_YUYV8_1X16,
-          V4L2_MBUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 16, },
+          V4L2_MBUS_FMT_YUYV8_1X16, 0,
+          V4L2_PIX_FMT_YUYV, 16, },
 };
 
 const struct isp_format_info *
@@ -86,6 +116,37 @@ omap3isp_video_format_info(enum v4l2_mbus_pixelcode code)
 }
 
 /*
+ * Decide whether desired output pixel code can be obtained with
+ * the lane shifter by shifting the input pixel code.
+ * @in: input pixelcode to shifter
+ * @out: output pixelcode from shifter
+ * @additional_shift: # of bits the sensor's LSB is offset from CAMEXT[0]
+ *
+ * return true if the combination is possible
+ * return false otherwise
+ */
+static bool isp_video_is_shiftable(enum v4l2_mbus_pixelcode in,
+                enum v4l2_mbus_pixelcode out,
+                unsigned int additional_shift)
+{
+        const struct isp_format_info *in_info, *out_info;
+
+        if (in == out)
+                return true;
+
+        in_info = omap3isp_video_format_info(in);
+        out_info = omap3isp_video_format_info(out);
+
+        if ((in_info->flavor == 0) || (out_info->flavor == 0))
+                return false;
+
+        if (in_info->flavor != out_info->flavor)
+                return false;
+
+        return in_info->bpp - out_info->bpp + additional_shift <= 6;
+}
+
+/*
  * isp_video_mbus_to_pix - Convert v4l2_mbus_framefmt to v4l2_pix_format
  * @video: ISP video instance
  * @mbus: v4l2_mbus_framefmt format (input)
@@ -235,6 +296,7 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                 return -EPIPE;
 
         while (1) {
+                unsigned int shifter_link;
                 /* Retrieve the sink format */
                 pad = &subdev->entity.pads[0];
                 if (!(pad->flags & MEDIA_PAD_FL_SINK))
@@ -263,6 +325,10 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                                 return -ENOSPC;
                 }
 
+                /* If sink pad is on CCDC, the link has the lane shifter
+                 * in the middle of it. */
+                shifter_link = subdev == &isp->isp_ccdc.subdev;
+
                 /* Retrieve the source format */
                 pad = media_entity_remote_source(pad);
                 if (pad == NULL ||
@@ -278,10 +344,24 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                         return -EPIPE;
 
                 /* Check if the two ends match */
-                if (fmt_source.format.code != fmt_sink.format.code ||
-                    fmt_source.format.width != fmt_sink.format.width ||
+                if (fmt_source.format.width != fmt_sink.format.width ||
                     fmt_source.format.height != fmt_sink.format.height)
                         return -EPIPE;
+
+                if (shifter_link) {
+                        unsigned int parallel_shift = 0;
+                        if (isp->isp_ccdc.input == CCDC_INPUT_PARALLEL) {
+                                struct isp_parallel_platform_data *pdata =
+                                        &((struct isp_v4l2_subdevs_group *)
+                                              subdev->host_priv)->bus.parallel;
+                                parallel_shift = pdata->data_lane_shift * 2;
+                        }
+                        if (!isp_video_is_shiftable(fmt_source.format.code,
+                                                fmt_sink.format.code,
+                                                parallel_shift))
+                                return -EPIPE;
+                } else if (fmt_source.format.code != fmt_sink.format.code)
+                        return -EPIPE;
         }
 
         return 0;
diff --git a/drivers/media/video/omap3isp/ispvideo.h b/drivers/media/video/omap3isp/ispvideo.h
index 524a1acd0906..911bea64e78a 100644
--- a/drivers/media/video/omap3isp/ispvideo.h
+++ b/drivers/media/video/omap3isp/ispvideo.h
@@ -49,6 +49,8 @@ struct v4l2_pix_format;
  *      bits. Identical to @code if the format is 10 bits wide or less.
  * @uncompressed: V4L2 media bus format code for the corresponding uncompressed
  *      format. Identical to @code if the format is not DPCM compressed.
+ * @flavor: V4L2 media bus format code for the same pixel layout but
+ *      shifted to be 8 bits per pixel. =0 if format is not shiftable.
  * @pixelformat: V4L2 pixel format FCC identifier
  * @bpp: Bits per pixel
  */
@@ -56,6 +58,7 @@ struct isp_format_info {
         enum v4l2_mbus_pixelcode code;
         enum v4l2_mbus_pixelcode truncated;
         enum v4l2_mbus_pixelcode uncompressed;
+        enum v4l2_mbus_pixelcode flavor;
         u32 pixelformat;
         unsigned int bpp;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 95f8b4e11e46..d142b40ea64e 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -527,7 +527,7 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
         if (ret)
                 return ret;
 
-        if (vb2_is_streaming(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
+        if (vb2_is_busy(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
                 return -EBUSY;
 
         frame = &ctx->d_frame;
@@ -539,8 +539,10 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) >> 3;
+        }
 
         /* Output DMA frame pixel size and offsets. */
         frame->f_width = pix->plane_fmt[0].bytesperline * 8
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 6c919b38a3d8..dc91a8511af6 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -361,10 +361,20 @@ static void fimc_capture_irq_handler(struct fimc_dev *fimc)
 {
         struct fimc_vid_cap *cap = &fimc->vid_cap;
         struct fimc_vid_buffer *v_buf;
+        struct timeval *tv;
+        struct timespec ts;
 
         if (!list_empty(&cap->active_buf_q) &&
             test_bit(ST_CAPT_RUN, &fimc->state)) {
+                ktime_get_real_ts(&ts);
+
                 v_buf = active_queue_pop(cap);
+
+                tv = &v_buf->vb.v4l2_buf.timestamp;
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+                v_buf->vb.v4l2_buf.sequence = cap->frame_count++;
+
                 vb2_buffer_done(&v_buf->vb, VB2_BUF_STATE_DONE);
         }
 
@@ -758,7 +768,7 @@ static void fimc_unlock(struct vb2_queue *vq)
         mutex_unlock(&ctx->fimc_dev->lock);
 }
 
-struct vb2_ops fimc_qops = {
+static struct vb2_ops fimc_qops = {
         .queue_setup     = fimc_queue_setup,
         .buf_prepare     = fimc_buf_prepare,
         .buf_queue       = fimc_buf_queue,
@@ -927,23 +937,23 @@ int fimc_vidioc_try_fmt_mplane(struct file *file, void *priv,
         pix->num_planes = fmt->memplanes;
         pix->colorspace = V4L2_COLORSPACE_JPEG;
 
-        for (i = 0; i < pix->num_planes; ++i) {
-                int bpl = pix->plane_fmt[i].bytesperline;
 
-                dbg("[%d] bpl: %d, depth: %d, w: %d, h: %d",
-                    i, bpl, fmt->depth[i], pix->width, pix->height);
+        for (i = 0; i < pix->num_planes; ++i) {
+                u32 bpl = pix->plane_fmt[i].bytesperline;
+                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
 
-                if (!bpl || (bpl * 8 / fmt->depth[i]) > pix->width)
-                        bpl = (pix->width * fmt->depth[0]) >> 3;
+                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
+                        bpl = pix->width; /* Planar */
 
-                if (!pix->plane_fmt[i].sizeimage)
-                        pix->plane_fmt[i].sizeimage = pix->height * bpl;
+                if (fmt->colplanes == 1 && /* Packed */
+                    (bpl == 0 || ((bpl * 8) / fmt->depth[i]) < pix->width))
+                        bpl = (pix->width * fmt->depth[0]) / 8;
 
-                pix->plane_fmt[i].bytesperline = bpl;
+                if (i == 0) /* Same bytesperline for each plane. */
+                        mod_x = bpl;
 
-                dbg("[%d]: bpl: %d, sizeimage: %d",
-                    i, pix->plane_fmt[i].bytesperline,
-                    pix->plane_fmt[i].sizeimage);
+                pix->plane_fmt[i].bytesperline = mod_x;
+                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
         }
 
         return 0;
@@ -965,7 +975,7 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
 
-        if (vb2_is_streaming(vq)) {
+        if (vb2_is_busy(vq)) {
                 v4l2_err(&fimc->m2m.v4l2_dev, "queue (%d) busy\n", f->type);
                 return -EBUSY;
         }
@@ -985,8 +995,10 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
         if (!frame->fmt)
                 return -EINVAL;
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) / 8;
+        }
 
         frame->f_width  = pix->plane_fmt[0].bytesperline * 8 /
                 frame->fmt->depth[0];
@@ -1750,7 +1762,7 @@ static int __devexit fimc_remove(struct platform_device *pdev)
 }
 
 /* Image pixel limits, similar across several FIMC HW revisions. */
-static struct fimc_pix_limit s5p_pix_limit[3] = {
+static struct fimc_pix_limit s5p_pix_limit[4] = {
         [0] = {
                 .scaler_en_w    = 3264,
                 .scaler_dis_w   = 8192,
@@ -1775,6 +1787,14 @@ static struct fimc_pix_limit s5p_pix_limit[3] = {
                 .out_rot_en_w   = 1280,
                 .out_rot_dis_w  = 1920,
         },
+        [3] = {
+                .scaler_en_w    = 1920,
+                .scaler_dis_w   = 8192,
+                .in_rot_en_h    = 1366,
+                .in_rot_dis_w   = 8192,
+                .out_rot_en_w   = 1366,
+                .out_rot_dis_w  = 1920,
+        },
 };
 
 static struct samsung_fimc_variant fimc0_variant_s5p = {
@@ -1827,7 +1847,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
         .pix_limit       = &s5p_pix_limit[2],
 };
 
-static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc0_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_inp_rot     = 1,
         .has_out_rot     = 1,
@@ -1840,7 +1860,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
         .pix_limit       = &s5p_pix_limit[1],
 };
 
-static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc2_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_cistatus2   = 1,
         .has_mainscaler_ext = 1,
@@ -1848,7 +1868,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
         .min_out_pixsize = 16,
         .hor_offs_align  = 1,
         .out_buf_count   = 32,
-        .pix_limit       = &s5p_pix_limit[2],
+        .pix_limit       = &s5p_pix_limit[3],
 };
 
 /* S5PC100 */
@@ -1874,12 +1894,12 @@ static struct samsung_fimc_driverdata fimc_drvdata_s5pv210 = {
 };
 
 /* S5PV310, S5PC210 */
-static struct samsung_fimc_driverdata fimc_drvdata_s5pv310 = {
+static struct samsung_fimc_driverdata fimc_drvdata_exynos4 = {
         .variant = {
-                [0] = &fimc0_variant_s5pv310,
-                [1] = &fimc0_variant_s5pv310,
-                [2] = &fimc0_variant_s5pv310,
-                [3] = &fimc2_variant_s5pv310,
+                [0] = &fimc0_variant_exynos4,
+                [1] = &fimc0_variant_exynos4,
+                [2] = &fimc0_variant_exynos4,
+                [3] = &fimc2_variant_exynos4,
         },
         .num_entities = 4,
         .lclk_frequency = 166000000UL,
@@ -1893,8 +1913,8 @@ static struct platform_device_id fimc_driver_ids[] = {
                 .name           = "s5pv210-fimc",
                 .driver_data    = (unsigned long)&fimc_drvdata_s5pv210,
         }, {
-                .name           = "s5pv310-fimc",
-                .driver_data    = (unsigned long)&fimc_drvdata_s5pv310,
+                .name           = "exynos4-fimc",
+                .driver_data    = (unsigned long)&fimc_drvdata_exynos4,
         },
         {},
 };
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 3fe54bf41142..134e86bf6d97 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -922,7 +922,7 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                         /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                         mf.width        = 2560 >> shift;
                         mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          s_mbus_fmt, &mf);
                         if (ret < 0)
                                 return ret;
@@ -1224,7 +1224,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
         struct v4l2_cropcap cap;
         int ret;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                          s_mbus_fmt, mf);
         if (ret < 0)
                 return ret;
@@ -1254,7 +1254,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
                 tmp_h = min(2 * tmp_h, max_height);
                 mf->width = tmp_w;
                 mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                  s_mbus_fmt, mf);
                 dev_geo(dev, "Camera scaled to %ux%u\n",
                         mf->width, mf->height);
@@ -1658,7 +1658,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         mf.code         = xlate->code;
         mf.colorspace   = pix->colorspace;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
         if (ret < 0)
                 return ret;
 
@@ -1682,7 +1682,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                          */
                         mf.width = 2560;
                         mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          try_mbus_fmt, &mf);
                         if (ret < 0) {
                                 /* Shouldn't actually happen... */
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index dd1b81b1442b..98b87481fa94 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -38,6 +38,8 @@ struct sh_csi2 {
         void __iomem                    *base;
         struct platform_device          *pdev;
         struct sh_csi2_client_config    *client;
+        unsigned long (*query_bus_param)(struct soc_camera_device *);
+        int (*set_bus_param)(struct soc_camera_device *, unsigned long);
 };
 
 static int sh_csi2_try_fmt(struct v4l2_subdev *sd,
@@ -208,6 +210,7 @@ static int sh_csi2_notify(struct notifier_block *nb,
         case BUS_NOTIFY_BOUND_DRIVER:
                 snprintf(priv->subdev.name, V4L2_SUBDEV_NAME_SIZE, "%s%s",
                          dev_name(v4l2_dev->dev), ".mipi-csi");
+                priv->subdev.grp_id = (long)icd;
                 ret = v4l2_device_register_subdev(v4l2_dev, &priv->subdev);
                 dev_dbg(dev, "%s(%p): ret(register_subdev) = %d\n", __func__, priv, ret);
                 if (ret < 0)
@@ -215,6 +218,8 @@ static int sh_csi2_notify(struct notifier_block *nb,
 
                 priv->client = pdata->clients + i;
 
+                priv->set_bus_param             = icd->ops->set_bus_param;
+                priv->query_bus_param           = icd->ops->query_bus_param;
                 icd->ops->set_bus_param         = sh_csi2_set_bus_param;
                 icd->ops->query_bus_param       = sh_csi2_query_bus_param;
 
@@ -226,8 +231,10 @@ static int sh_csi2_notify(struct notifier_block *nb,
                 priv->client = NULL;
 
                 /* Driver is about to be unbound */
-                icd->ops->set_bus_param         = NULL;
-                icd->ops->query_bus_param       = NULL;
+                icd->ops->set_bus_param         = priv->set_bus_param;
+                icd->ops->query_bus_param       = priv->query_bus_param;
+                priv->set_bus_param             = NULL;
+                priv->query_bus_param           = NULL;
 
                 v4l2_device_unregister_subdev(&priv->subdev);
 
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 46284489e4eb..3973f9a94753 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -996,10 +996,11 @@ static void soc_camera_free_i2c(struct soc_camera_device *icd)
 {
         struct i2c_client *client =
                 to_i2c_client(to_soc_camera_control(icd));
+        struct i2c_adapter *adap = client->adapter;
         dev_set_drvdata(&icd->dev, NULL);
         v4l2_device_unregister_subdev(i2c_get_clientdata(client));
         i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        i2c_put_adapter(adap);
 }
 #else
 #define soc_camera_init_i2c(icd, icl)   (-ENODEV)
@@ -1071,6 +1072,9 @@ static int soc_camera_probe(struct device *dev)
                 }
         }
 
+        sd = soc_camera_to_subdev(icd);
+        sd->grp_id = (long)icd;
+
         /* At this point client .probe() should have run already */
         ret = soc_camera_init_user_formats(icd);
         if (ret < 0)
@@ -1092,7 +1096,6 @@ static int soc_camera_probe(struct device *dev)
                 goto evidstart;
 
         /* Try to improve our guess of a reasonable window format */
-        sd = soc_camera_to_subdev(icd);
         if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
                 icd->user_width         = mf.width;
                 icd->user_height        = mf.height;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 498e6742579e..6dc7196296b3 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -389,7 +389,8 @@ static int v4l2_open(struct inode *inode, struct file *filp)
         video_get(vdev);
         mutex_unlock(&videodev_lock);
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 entity = media_entity_get(&vdev->entity);
                 if (!entity) {
                         ret = -EBUSY;
@@ -415,7 +416,8 @@ err:
         /* decrease the refcount in case of an error */
         if (ret) {
 #if defined(CONFIG_MEDIA_CONTROLLER)
-                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+                    vdev->vfl_type != VFL_TYPE_SUBDEV)
                         media_entity_put(entity);
 #endif
                 video_put(vdev);
@@ -437,7 +439,8 @@ static int v4l2_release(struct inode *inode, struct file *filp)
                         mutex_unlock(vdev->lock);
         }
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_entity_put(&vdev->entity);
 #endif
         /* decrease the refcount unconditionally since the release()
@@ -686,7 +689,8 @@ int __video_register_device(struct video_device *vdev, int type, int nr,
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
         /* Part 5: Register the entity. */
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 vdev->entity.type = MEDIA_ENT_T_DEVNODE_V4L;
                 vdev->entity.name = vdev->name;
                 vdev->entity.v4l.major = VIDEO_MAJOR;
@@ -733,7 +737,8 @@ void video_unregister_device(struct video_device *vdev)
                 return;
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_device_unregister_entity(&vdev->entity);
 #endif
 
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77e0f64..6ba1461d51ef 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -37,6 +37,9 @@ module_param(debug, int, 0644);
 #define call_qop(q, op, args...)                                        \
         (((q)->ops->op) ? ((q)->ops->op(args)) : 0)
 
+#define V4L2_BUFFER_STATE_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
+                                 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR)
+
 /**
  * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
  */
@@ -51,7 +54,7 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb,
         for (plane = 0; plane < vb->num_planes; ++plane) {
                 mem_priv = call_memop(q, plane, alloc, q->alloc_ctx[plane],
                                         plane_sizes[plane]);
-                if (!mem_priv)
+                if (IS_ERR_OR_NULL(mem_priv))
                         goto free;
 
                 /* Associate allocator private data with this plane */
@@ -284,7 +287,7 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
         struct vb2_queue *q = vb->vb2_queue;
         int ret = 0;
 
-        /* Copy back data such as timestamp, input, etc. */
+        /* Copy back data such as timestamp, flags, input, etc. */
         memcpy(b, &vb->v4l2_buf, offsetof(struct v4l2_buffer, m));
         b->input = vb->v4l2_buf.input;
         b->reserved = vb->v4l2_buf.reserved;
@@ -313,7 +316,10 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
                         b->m.userptr = vb->v4l2_planes[0].m.userptr;
         }
 
-        b->flags = 0;
+        /*
+         * Clear any buffer state related flags.
+         */
+        b->flags &= ~V4L2_BUFFER_STATE_FLAGS;
 
         switch (vb->state) {
         case VB2_BUF_STATE_QUEUED:
@@ -519,6 +525,7 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
         num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
         memset(plane_sizes, 0, sizeof(plane_sizes));
         memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
+        q->memory = req->memory;
 
         /*
          * Ask the driver how many buffers and planes per buffer it requires.
@@ -560,8 +567,6 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
                 ret = num_buffers;
         }
 
-        q->memory = req->memory;
-
         /*
          * Return the number of successfully allocated buffers
          * to the userspace.
@@ -715,6 +720,8 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b,
 
         vb->v4l2_buf.field = b->field;
         vb->v4l2_buf.timestamp = b->timestamp;
+        vb->v4l2_buf.input = b->input;
+        vb->v4l2_buf.flags = b->flags & ~V4L2_BUFFER_STATE_FLAGS;
 
         return 0;
 }
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index 58205d596138..a790a5f8c06f 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -46,7 +46,7 @@ static void *vb2_dma_contig_alloc(void *alloc_ctx, unsigned long size)
                                         GFP_KERNEL);
         if (!buf->vaddr) {
                 dev_err(conf->dev, "dma_alloc_coherent of size %ld failed\n",
-                        buf->size);
+                        size);
                 kfree(buf);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 96c0b34ba8db..657b9f4b6f9b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -400,7 +400,7 @@ static uint16_t __init doc200x_ident_chip(struct mtd_info *mtd, int nr)
         doc200x_hwcontrol(mtd, 0, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
         doc200x_hwcontrol(mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
 
-        /* We can't' use dev_ready here, but at least we wait for the
+        /* We can't use dev_ready here, but at least we wait for the
          * command to complete
          */
         udelay(50);
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index fe77e8223841..e8c19def1b0f 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -173,7 +173,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&p_dev->dev, "Configuration isn't't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isn't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
diff --git a/drivers/rtc/rtc-max8925.c b/drivers/rtc/rtc-max8925.c
index 174036dda786..20494b5edc3c 100644
--- a/drivers/rtc/rtc-max8925.c
+++ b/drivers/rtc/rtc-max8925.c
@@ -257,6 +257,8 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_irq;
         }
 
+        dev_set_drvdata(&pdev->dev, info);
+
         info->rtc_dev = rtc_device_register("max8925-rtc", &pdev->dev,
                                         &max8925_rtc_ops, THIS_MODULE);
         ret = PTR_ERR(info->rtc_dev);
@@ -265,7 +267,6 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_rtc;
         }
 
-        dev_set_drvdata(&pdev->dev, info);
         platform_set_drvdata(pdev, info);
 
         return 0;
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 29143eda9dd9..85dddb1e4126 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -239,7 +239,6 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         addr_t ip;
         int rc;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         switch (ext_int_code >> 24) {
         case DASD_DIAG_CODE_31BIT:
                 ip = (addr_t) param32;
@@ -250,6 +249,7 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         default:
                 return;
         }
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 414427d64a8f..607998f0b7d8 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -381,10 +381,10 @@ static void kvm_extint_handler(unsigned int ext_int_code,
         u16 subcode;
         u32 param;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 564e6ecd17c2..0119b8147797 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -394,12 +394,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         unsigned long flags;
         struct scsi_device *sdev;
         struct scsi_device_handler *scsi_dh = NULL;
+        struct device *dev = NULL;
 
         spin_lock_irqsave(q->queue_lock, flags);
         sdev = q->queuedata;
         if (sdev && sdev->scsi_dh_data)
                 scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
+        dev = get_device(&sdev->sdev_gendev);
+        if (!scsi_dh || !dev ||
             sdev->sdev_state == SDEV_CANCEL ||
             sdev->sdev_state == SDEV_DEL)
                 err = SCSI_DH_NOSYS;
@@ -410,12 +412,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         if (err) {
                 if (fn)
                         fn(data, err);
-                return err;
+                goto out;
         }
 
         if (scsi_dh->activate)
                 err = scsi_dh->activate(sdev, fn, data);
-        put_device(&sdev->sdev_gendev);
+out:
+        put_device(dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(scsi_dh_activate);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 1c6d2b405eef..d72f1f2b1392 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                 goto out;
         }
 
+        /* Check for overflow and wraparound */
+        if (karg.data_sge_offset * 4 > ioc->request_sz ||
+            karg.data_sge_offset > (UINT_MAX / 4)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         /* copy in request message frame from user */
         if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
         Mpi2DiagBufferPostReply_t *mpi_reply;
         int rc, i;
         u8 buffer_type;
-        unsigned long timeleft;
+        unsigned long timeleft, request_size, copy_size;
         u16 smid;
         u16 ioc_status;
         u8 issue_reset = 0;
@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -ENOMEM;
         }
 
+        request_size = ioc->diag_buffer_sz[buffer_type];
+
         if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
                 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
                     "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -EINVAL;
         }
 
+        if (karg.starting_offset > request_size)
+                return -EINVAL;
+
         diag_data = (void *)(request_data + karg.starting_offset);
         dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
             "offset(%d), sz(%d)\n", ioc->name, __func__,
             diag_data, karg.starting_offset, karg.bytes_to_read));
 
+        /* Truncate data on requests that are too large */
+        if ((diag_data + karg.bytes_to_read < diag_data) ||
+            (diag_data + karg.bytes_to_read > request_data + request_size))
+                copy_size = request_size - karg.starting_offset;
+        else
+                copy_size = karg.bytes_to_read;
+
         if (copy_to_user((void __user *)uarg->diagnostic_data,
-            diag_data, karg.bytes_to_read)) {
+            diag_data, copy_size)) {
                 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
                     "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
                     __func__, diag_data);
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 96d5ad0c1e42..7f636b118287 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
                         rc = -EFAULT;
                         goto out_free_buffer;
                 }
+        } else if (request_size < 0) {
+                rc = -EINVAL;
+                goto out_free_buffer;
         }
 
         /* check if we have any additional command parameters */
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e44ff64233fd..e63912510fb9 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                 kfree(evt);
         }
 
-        if (sdev->request_queue) {
-                sdev->request_queue->queuedata = NULL;
-                /* user context needed to free queue */
-                scsi_free_queue(sdev->request_queue);
-                /* temporary expedient, try to catch use of queue lock
-                 * after free of sdev */
-                sdev->request_queue = NULL;
-        }
+        /* NULL queue means the device can't be used */
+        sdev->request_queue = NULL;
 
         scsi_target_reap(scsi_target(sdev));
 
@@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
+
+        /* cause the request function to reject all I/O requests */
+        sdev->request_queue->queuedata = NULL;
+
+        /* Freeing the queue signals to block that we're done */
+        scsi_free_queue(sdev->request_queue);
         put_device(dev);
 }
 
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
index bef0bbd8cef7..f01a51c381f1 100644
--- a/drivers/staging/rt2860/common/cmm_data_pci.c
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -444,7 +444,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                         return (NDIS_STATUS_FAILURE);
                 }
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
index 5637857ae9eb..83a62faa7e57 100644
--- a/drivers/staging/rt2860/common/cmm_data_usb.c
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -860,7 +860,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
                 return NDIS_STATUS_FAILURE;
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index 20dae73d3b78..506547b603e1 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -653,7 +653,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
         }
         dev->queue->queuedata = dev;
 
-        /* As Linux block layer does't support >4KB hardware sector,  */
+        /* As Linux block layer doesn't support >4KB hardware sector,  */
         /* Here we force report 512 byte hardware sector size to Kernel */
         blk_queue_logical_block_size(dev->queue, 512);
 
diff --git a/drivers/staging/tidspbridge/dynload/cload.c b/drivers/staging/tidspbridge/dynload/cload.c
index 5cecd237e3f6..fe1ef0addb09 100644
--- a/drivers/staging/tidspbridge/dynload/cload.c
+++ b/drivers/staging/tidspbridge/dynload/cload.c
@@ -718,7 +718,7 @@ static void dload_symbols(struct dload_state *dlthis)
          * as a temporary for .dllview record construction.
          * Allocate storage for the whole table.  Add 1 to the section count
          * in case a trampoline section is auto-generated as well as the
-         * size of the trampoline section name so DLLView does't get lost.
+         * size of the trampoline section name so DLLView doesn't get lost.
          */
 
         siz = sym_count * sizeof(struct local_symbol);
diff --git a/drivers/staging/tty/specialix.c b/drivers/staging/tty/specialix.c
index cb24c6d999db..5c3598ec7456 100644
--- a/drivers/staging/tty/specialix.c
+++ b/drivers/staging/tty/specialix.c
@@ -978,7 +978,7 @@ static void sx_change_speed(struct specialix_board *bp,
         spin_lock_irqsave(&bp->lock, flags);
         sx_out(bp, CD186x_CAR, port_No(port));
 
-        /* The Specialix board does't implement the RTS lines.
+        /* The Specialix board doesn't implement the RTS lines.
            They are used to set the IRQ level. Don't touch them. */
         if (sx_crtscts(tty))
                 port->MSVR = MSVR_DTR | (sx_in(bp, CD186x_MSVR) & MSVR_RTS);