89 files changed, 638 insertions, 368 deletions
diff --git a/Documentation/DocBook/media/v4l/dev-codec.xml b/Documentation/DocBook/media/v4l/dev-codec.xml
index dca0ecd54dc6..ff44c16fc080 100644
--- a/Documentation/DocBook/media/v4l/dev-codec.xml
+++ b/Documentation/DocBook/media/v4l/dev-codec.xml
@@ -1,18 +1,27 @@
  <title>Codec Interface</title>
-  <note>
+  <para>A V4L2 codec can compress, decompress, transform, or otherwise
-    <title>Suspended</title>
+convert video data from one format into another format, in memory. Typically
+such devices are memory-to-memory devices (i.e. devices with the
+<constant>V4L2_CAP_VIDEO_M2M</constant> or <constant>V4L2_CAP_VIDEO_M2M_MPLANE</constant>
+capability set).
+</para>
-    <para>This interface has been be suspended from the V4L2 API
+  <para>A memory-to-memory video node acts just like a normal video node, but it
-implemented in Linux 2.6 until we have more experience with codec
+supports both output (sending frames from memory to the codec hardware) and
-device interfaces.</para>
+capture (receiving the processed frames from the codec hardware into memory)
-  </note>
+stream I/O. An application will have to setup the stream
+I/O for both sides and finally call &VIDIOC-STREAMON; for both capture and output
+to start the codec.</para>
-  <para>A V4L2 codec can compress, decompress, transform, or otherwise
+  <para>Video compression codecs use the MPEG controls to setup their codec parameters
-convert video data from one format into another format, in memory.
+(note that the MPEG controls actually support many more codecs than just MPEG).
-Applications send data to be converted to the driver through a
+See <xref linkend="mpeg-controls"></xref>.</para>
-&func-write; call, and receive the converted data through a
-&func-read; call. For efficiency a driver may also support streaming
-I/O.</para>
-  <para>[to do]</para>
+  <para>Memory-to-memory devices can often be used as a shared resource: you can
+open the video node multiple times, each application setting up their own codec properties
+that are local to the file handle, and each can use it independently from the others.
+The driver will arbitrate access to the codec and reprogram it whenever another file
+handler gets access. This is different from the usual video node behavior where the video properties
+are global to the device (i.e. changing something through one file handle is visible
+through another file handle).</para>
diff --git a/Documentation/DocBook/media/v4l/v4l2.xml b/Documentation/DocBook/media/v4l/v4l2.xml
index bfc93cdcf696..bfe823dd0f31 100644
--- a/Documentation/DocBook/media/v4l/v4l2.xml
+++ b/Documentation/DocBook/media/v4l/v4l2.xml
@@ -493,7 +493,7 @@ and discussions on the V4L mailing list.</revremark>
 </partinfo>
 <title>Video for Linux Two API Specification</title>
- <subtitle>Revision 3.9</subtitle>
+ <subtitle>Revision 3.10</subtitle>
  <chapter id="common">
    &sub-common;
diff --git a/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt b/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
index 3f62adfb3e0b..de9f6b78ee51 100644
--- a/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
+++ b/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
@@ -2,7 +2,7 @@ Exynos4x12/Exynos5 SoC series camera host interface (FIMC-LITE)
 Required properties:
- compatible    : should be "samsung,exynos4212-fimc" for Exynos4212 and
+- compatible    : should be "samsung,exynos4212-fimc-lite" for Exynos4212 and
                  Exynos4412 SoCs;
 - reg           : physical base address and size of the device memory mapped
                  registers;
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index bb8b0dc532b8..77d68e23b247 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -29,6 +29,8 @@ ALC269/270/275/276/280/282
  alc271-dmic   Enable ALC271X digital mic workaround
  inv-dmic      Inverted internal mic workaround
  lenovo-dock   Enables docking station I/O for some Lenovos
+  dell-headset-multi    Headset jack, which can also be used as mic-in
+  dell-headset-dock     Headset jack (without mic-in), and also dock I/O
 ALC662/663/272
 ==============
@@ -42,6 +44,7 @@ ALC662/663/272
  asus-mode7    ASUS
  asus-mode8    ASUS
  inv-dmic      Inverted internal mic workaround
+  dell-headset-multi    Headset jack, which can also be used as mic-in
 ALC680
 ======
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 49d993cee512..2651b1da1c56 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1189,6 +1189,16 @@ config PL310_ERRATA_588369
           is not correctly implemented in PL310 as clean lines are not
           invalidated as a result of these operations.
+config ARM_ERRATA_643719
+        bool "ARM errata: LoUIS bit field in CLIDR register is incorrect"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for the 643719 Cortex-A9 (prior to
+          r1p0) erratum. On affected cores the LoUIS bit field of the CLIDR
+          register returns zero when it should return one. The workaround
+          corrects this value, ensuring cache maintenance operations which use
+          it behave as intended and avoiding data corruption.
 config ARM_ERRATA_720789
        bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
        depends on CPU_V7
@@ -2006,7 +2016,7 @@ config XIP_PHYS_ADDR
 config KEXEC
        bool "Kexec system call (EXPERIMENTAL)"
-        depends on (!SMP || HOTPLUG_CPU)
+        depends on (!SMP || PM_SLEEP_SMP)
        help
          kexec is a system call that implements the ability to shutdown your
          current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 79e9bdbfc491..120b83bfde20 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -116,7 +116,8 @@ targets       := vmlinux vmlinux.lds \
 # Make sure files are removed during clean
 extra-y       += piggy.gzip piggy.lzo piggy.lzma piggy.xzkern \
-                 lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs)
+                 lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs) \
+                 hyp-stub.S
 ifeq ($(CONFIG_FUNCTION_TRACER),y)
 ORIG_CFLAGS := $(KBUILD_CFLAGS)
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index bff71388e72a..17d0ae8672fa 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -320,9 +320,7 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
 }
 #define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
-static inline void flush_kernel_dcache_page(struct page *page)
+extern void flush_kernel_dcache_page(struct page *);
-{
-}
 #define flush_dcache_mmap_lock(mapping) \
        spin_lock_irq(&(mapping)->tree_lock)
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 8ef8c9337809..4fb074c446bf 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -134,6 +134,10 @@ void machine_kexec(struct kimage *image)
        unsigned long reboot_code_buffer_phys;
        void *reboot_code_buffer;
+        if (num_online_cpus() > 1) {
+                pr_err("kexec: error: multiple CPUs still online\n");
+                return;
+        }
        page_list = image->head & PAGE_MASK;
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 282de4826abb..6e8931ccf13e 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -184,30 +184,61 @@ int __init reboot_setup(char *str)
 __setup("reboot=", reboot_setup);
+/*
+ * Called by kexec, immediately prior to machine_kexec().
+ *
+ * This must completely disable all secondary CPUs; simply causing those CPUs
+ * to execute e.g. a RAM-based pin loop is not sufficient. This allows the
+ * kexec'd kernel to use any and all RAM as it sees fit, without having to
+ * avoid any code or data used by any SW CPU pin loop. The CPU hotplug
+ * functionality embodied in disable_nonboot_cpus() to achieve this.
+ */
 void machine_shutdown(void)
 {
-#ifdef CONFIG_SMP
+        disable_nonboot_cpus();
-        smp_send_stop();
-#endif
 }
+/*
+ * Halting simply requires that the secondary CPUs stop performing any
+ * activity (executing tasks, handling interrupts). smp_send_stop()
+ * achieves this.
+ */
 void machine_halt(void)
 {
-        machine_shutdown();
+        smp_send_stop();
        local_irq_disable();
        while (1);
 }
+/*
+ * Power-off simply requires that the secondary CPUs stop performing any
+ * activity (executing tasks, handling interrupts). smp_send_stop()
+ * achieves this. When the system power is turned off, it will take all CPUs
+ * with it.
+ */
 void machine_power_off(void)
 {
-        machine_shutdown();
+        smp_send_stop();
        if (pm_power_off)
                pm_power_off();
 }
+/*
+ * Restart requires that the secondary CPUs stop performing any activity
+ * while the primary CPU resets the system. Systems with a single CPU can
+ * use soft_restart() as their machine descriptor's .restart hook, since that
+ * will cause the only available CPU to reset. Systems with multiple CPUs must
+ * provide a HW restart implementation, to ensure that all CPUs reset at once.
+ * This is required so that any code running after reset on the primary CPU
+ * doesn't have to co-ordinate with other CPUs to ensure they aren't still
+ * executing pre-reset code, and using RAM that the primary CPU's code wishes
+ * to use. Implementing such co-ordination would be essentially impossible.
+ */
 void machine_restart(char *cmd)
 {
-        machine_shutdown();
+        smp_send_stop();
        arm_pm_restart(reboot_mode, cmd);
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 550d63cef68e..5919eb451bb9 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -651,17 +651,6 @@ void smp_send_reschedule(int cpu)
        smp_cross_call(cpumask_of(cpu), IPI_RESCHEDULE);
 }
-#ifdef CONFIG_HOTPLUG_CPU
-static void smp_kill_cpus(cpumask_t *mask)
-{
-        unsigned int cpu;
-        for_each_cpu(cpu, mask)
-                platform_cpu_kill(cpu);
-}
-#else
-static void smp_kill_cpus(cpumask_t *mask) { }
-#endif
 void smp_send_stop(void)
 {
        unsigned long timeout;
@@ -679,8 +668,6 @@ void smp_send_stop(void)
        if (num_online_cpus() > 1)
                pr_warning("SMP: failed to stop secondary CPUs\n");
-        smp_kill_cpus(&mask);
 }
 /*
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 15451ee4acc8..515b00064da8 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -92,6 +92,14 @@ ENTRY(v7_flush_dcache_louis)
        mrc     p15, 1, r0, c0, c0, 1           @ read clidr, r0 = clidr
        ALT_SMP(ands    r3, r0, #(7 << 21))     @ extract LoUIS from clidr
        ALT_UP(ands     r3, r0, #(7 << 27))     @ extract LoUU from clidr
+#ifdef CONFIG_ARM_ERRATA_643719
+        ALT_SMP(mrceq   p15, 0, r2, c0, c0, 0)  @ read main ID register
+        ALT_UP(moveq    pc, lr)                 @ LoUU is zero, so nothing to do
+        ldreq   r1, =0x410fc090                 @ ID of ARM Cortex A9 r0p?
+        biceq   r2, r2, #0x0000000f             @ clear minor revision number
+        teqeq   r2, r1                          @ test for errata affected core and if so...
+        orreqs  r3, #(1 << 21)                  @   fix LoUIS value (and set flags state to 'ne')
+#endif
        ALT_SMP(mov     r3, r3, lsr #20)        @ r3 = LoUIS * 2
        ALT_UP(mov      r3, r3, lsr #26)        @ r3 = LoUU * 2
        moveq   pc, lr                          @ return if level == 0
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 0d473cce501c..32aa5861119f 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -301,6 +301,39 @@ void flush_dcache_page(struct page *page)
 EXPORT_SYMBOL(flush_dcache_page);
 /*
+ * Ensure cache coherency for the kernel mapping of this page. We can
+ * assume that the page is pinned via kmap.
+ *
+ * If the page only exists in the page cache and there are no user
+ * space mappings, this is a no-op since the page was already marked
+ * dirty at creation.  Otherwise, we need to flush the dirty kernel
+ * cache lines directly.
+ */
+void flush_kernel_dcache_page(struct page *page)
+{
+        if (cache_is_vivt() || cache_is_vipt_aliasing()) {
+                struct address_space *mapping;
+                mapping = page_mapping(page);
+                if (!mapping || mapping_mapped(mapping)) {
+                        void *addr;
+                        addr = page_address(page);
+                        /*
+                         * kmap_atomic() doesn't set the page virtual
+                         * address for highmem pages, and
+                         * kunmap_atomic() takes care of cache
+                         * flushing already.
+                         */
+                        if (!IS_ENABLED(CONFIG_HIGHMEM) || addr)
+                                __cpuc_flush_dcache_area(addr, PAGE_SIZE);
+                }
+        }
+}
+EXPORT_SYMBOL(flush_kernel_dcache_page);
+/*
 * Flush an anonymous page so that users of get_user_pages()
 * can safely access the data.  The expected sequence is:
 *
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e0d8565671a6..4d409e6a552d 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -616,10 +616,12 @@ static void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,
        } while (pte++, addr += PAGE_SIZE, addr != end);
 }
-static void __init map_init_section(pmd_t *pmd, unsigned long addr,
+static void __init __map_init_section(pmd_t *pmd, unsigned long addr,
                        unsigned long end, phys_addr_t phys,
                        const struct mem_type *type)
 {
+        pmd_t *p = pmd;
 #ifndef CONFIG_ARM_LPAE
        /*
         * In classic MMU format, puds and pmds are folded in to
@@ -638,7 +640,7 @@ static void __init map_init_section(pmd_t *pmd, unsigned long addr,
                phys += SECTION_SIZE;
        } while (pmd++, addr += SECTION_SIZE, addr != end);
-        flush_pmd_entry(pmd);
+        flush_pmd_entry(p);
 }
 static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
@@ -661,7 +663,7 @@ static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
                 */
                if (type->prot_sect &&
                                ((addr | next | phys) & ~SECTION_MASK) == 0) {
-                        map_init_section(pmd, addr, next, phys, type);
+                        __map_init_section(pmd, addr, next, phys, type);
                } else {
                        alloc_init_pte(pmd, addr, next,
                                                __phys_to_pfn(phys), type);
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 2c73a7301ff7..4c8c9c10a388 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -409,8 +409,8 @@ __v7_ca9mp_proc_info:
         */
        .type   __v7_pj4b_proc_info, #object
 __v7_pj4b_proc_info:
-        .long   0x562f5840
+        .long   0x560f5800
-        .long   0xfffffff0
+        .long   0xff0fff00
        __v7_proc __v7_pj4b_setup
        .size   __v7_pj4b_proc_info, . - __v7_pj4b_proc_info
diff --git a/arch/ia64/include/asm/irqflags.h b/arch/ia64/include/asm/irqflags.h
index 1bf2cf2f4ab4..cec6c06b52c0 100644
--- a/arch/ia64/include/asm/irqflags.h
+++ b/arch/ia64/include/asm/irqflags.h
@@ -11,6 +11,7 @@
 #define _ASM_IA64_IRQFLAGS_H
 #include <asm/pal.h>
+#include <asm/kregs.h>
 #ifdef CONFIG_IA64_DEBUG_IRQ
 extern unsigned long last_cli_ip;
diff --git a/arch/metag/include/asm/hugetlb.h b/arch/metag/include/asm/hugetlb.h
index f545477e61f3..471f481e67f3 100644
--- a/arch/metag/include/asm/hugetlb.h
+++ b/arch/metag/include/asm/hugetlb.h
@@ -2,6 +2,7 @@
 #define _ASM_METAG_HUGETLB_H
 #include <asm/page.h>
+#include <asm-generic/hugetlb.h>
 static inline int is_hugepage_only_range(struct mm_struct *mm,
diff --git a/arch/mn10300/include/asm/irqflags.h b/arch/mn10300/include/asm/irqflags.h
index 678f68d5f37b..8730c0a3c37d 100644
--- a/arch/mn10300/include/asm/irqflags.h
+++ b/arch/mn10300/include/asm/irqflags.h
@@ -13,9 +13,8 @@
 #define _ASM_IRQFLAGS_H
 #include <asm/cpu-regs.h>
-#ifndef __ASSEMBLY__
+/* linux/smp.h <- linux/irqflags.h needs asm/smp.h first */
-#include <linux/smp.h>
+#include <asm/smp.h>
-#endif
 /*
 * interrupt control
diff --git a/arch/mn10300/include/asm/smp.h b/arch/mn10300/include/asm/smp.h
index 6745dbe64944..56c42417d428 100644
--- a/arch/mn10300/include/asm/smp.h
+++ b/arch/mn10300/include/asm/smp.h
@@ -24,6 +24,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/threads.h>
 #include <linux/cpumask.h>
+#include <linux/thread_info.h>
 #endif
 #ifdef CONFIG_SMP
@@ -85,7 +86,7 @@ extern cpumask_t cpu_boot_map;
 extern void smp_init_cpus(void);
 extern void smp_cache_interrupt(void);
 extern void send_IPI_allbutself(int irq);
-extern int smp_nmi_call_function(smp_call_func_t func, void *info, int wait);
+extern int smp_nmi_call_function(void (*func)(void *), void *info, int wait);
 extern void arch_send_call_function_single_ipi(int cpu);
 extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
@@ -100,6 +101,7 @@ extern void __cpu_die(unsigned int cpu);
 #ifndef __ASSEMBLY__
 static inline void smp_init_cpus(void) {}
+#define raw_smp_processor_id() 0
 #endif /* __ASSEMBLY__ */
 #endif /* CONFIG_SMP */
diff --git a/arch/parisc/include/asm/mmzone.h b/arch/parisc/include/asm/mmzone.h
index cc50d33b7b88..b6b34a0987e7 100644
--- a/arch/parisc/include/asm/mmzone.h
+++ b/arch/parisc/include/asm/mmzone.h
@@ -27,7 +27,7 @@ extern struct node_map_data node_data[];
 #define PFNNID_SHIFT (30 - PAGE_SHIFT)
 #define PFNNID_MAP_MAX  512     /* support 512GB */
-extern unsigned char pfnnid_map[PFNNID_MAP_MAX];
+extern signed char pfnnid_map[PFNNID_MAP_MAX];
 #ifndef CONFIG_64BIT
 #define pfn_is_io(pfn) ((pfn & (0xf0000000UL >> PAGE_SHIFT)) == (0xf0000000UL >> PAGE_SHIFT))
@@ -46,7 +46,7 @@ static inline int pfn_to_nid(unsigned long pfn)
        i = pfn >> PFNNID_SHIFT;
        BUG_ON(i >= ARRAY_SIZE(pfnnid_map));
-        return (int)pfnnid_map[i];
+        return pfnnid_map[i];
 }
 static inline int pfn_valid(int pfn)
diff --git a/arch/parisc/include/asm/pci.h b/arch/parisc/include/asm/pci.h
index 3234f492d575..465154076d23 100644
--- a/arch/parisc/include/asm/pci.h
+++ b/arch/parisc/include/asm/pci.h
@@ -225,4 +225,9 @@ static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
        return channel ? 15 : 14;
 }
+#define HAVE_PCI_MMAP
+extern int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
+        enum pci_mmap_state mmap_state, int write_combine);
 #endif /* __ASM_PARISC_PCI_H */
diff --git a/arch/parisc/kernel/hardware.c b/arch/parisc/kernel/hardware.c
index 9e2d2e408529..872275659d98 100644
--- a/arch/parisc/kernel/hardware.c
+++ b/arch/parisc/kernel/hardware.c
@@ -1205,6 +1205,7 @@ static struct hp_hardware hp_hardware_list[] = {
        {HPHW_FIO, 0x004, 0x00320, 0x0, "Metheus Frame Buffer"}, 
        {HPHW_FIO, 0x004, 0x00340, 0x0, "BARCO CX4500 VME Grphx Cnsl"}, 
        {HPHW_FIO, 0x004, 0x00360, 0x0, "Hughes TOG VME FDDI"}, 
+        {HPHW_FIO, 0x076, 0x000AD, 0x00, "Crestone Peak RS-232"},
        {HPHW_IOA, 0x185, 0x0000B, 0x00, "Java BC Summit Port"}, 
        {HPHW_IOA, 0x1FF, 0x0000B, 0x00, "Hitachi Ghostview Summit Port"}, 
        {HPHW_IOA, 0x580, 0x0000B, 0x10, "U2-IOA BC Runway Port"}, 
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 36d7f402e48e..b743a80eaba0 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -860,7 +860,7 @@ ENTRY(flush_dcache_page_asm)
 #endif
        ldil            L%dcache_stride, %r1
-        ldw             R%dcache_stride(%r1), %r1
+        ldw             R%dcache_stride(%r1), r31
 #ifdef CONFIG_64BIT
        depdi,z         1, 63-PAGE_SHIFT,1, %r25
@@ -868,26 +868,26 @@ ENTRY(flush_dcache_page_asm)
        depwi,z         1, 31-PAGE_SHIFT,1, %r25
 #endif
        add             %r28, %r25, %r25
-        sub             %r25, %r1, %r25
+        sub             %r25, r31, %r25
-1:      fdc,m           %r1(%r28)
+1:      fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
        cmpb,COND(<<)           %r28, %r25,1b
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
        sync
@@ -936,7 +936,7 @@ ENTRY(flush_icache_page_asm)
 #endif
        ldil            L%icache_stride, %r1
-        ldw             R%icache_stride(%r1), %r1
+        ldw             R%icache_stride(%r1), %r31
 #ifdef CONFIG_64BIT
        depdi,z         1, 63-PAGE_SHIFT,1, %r25
@@ -944,28 +944,28 @@ ENTRY(flush_icache_page_asm)
        depwi,z         1, 31-PAGE_SHIFT,1, %r25
 #endif
        add             %r28, %r25, %r25
-        sub             %r25, %r1, %r25
+        sub             %r25, %r31, %r25
        /* fic only has the type 26 form on PA1.1, requiring an
         * explicit space specification, so use %sr4 */
-1:      fic,m           %r1(%sr4,%r28)
+1:      fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
        cmpb,COND(<<)   %r28, %r25,1b
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
        sync
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 60309051875e..64f2764a8cef 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -220,6 +220,33 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
 }
+int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
+                        enum pci_mmap_state mmap_state, int write_combine)
+{
+        unsigned long prot;
+        /*
+         * I/O space can be accessed via normal processor loads and stores on
+         * this platform but for now we elect not to do this and portable
+         * drivers should not do this anyway.
+         */
+        if (mmap_state == pci_mmap_io)
+                return -EINVAL;
+        if (write_combine)
+                return -EINVAL;
+        /*
+         * Ignore write-combine; for now only return uncached mappings.
+         */
+        prot = pgprot_val(vma->vm_page_prot);
+        prot |= _PAGE_NO_CACHE;
+        vma->vm_page_prot = __pgprot(prot);
+        return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+                vma->vm_end - vma->vm_start, vma->vm_page_prot);
+}
 /*
 * A driver is enabling the device.  We make sure that all the appropriate
 * bits are set to allow the device to operate as the driver is expecting.
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 1c965642068b..505b56c6b9b9 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -47,7 +47,7 @@ pte_t pg0[PT_INITIAL * PTRS_PER_PTE] __attribute__ ((__section__ (".data..vm0.pt
 #ifdef CONFIG_DISCONTIGMEM
 struct node_map_data node_data[MAX_NUMNODES] __read_mostly;
-unsigned char pfnnid_map[PFNNID_MAP_MAX] __read_mostly;
+signed char pfnnid_map[PFNNID_MAP_MAX] __read_mostly;
 #endif
 static struct resource data_resource = {
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index ff18e3cfb6b1..7e4a97fbded4 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -6,6 +6,7 @@ generic-y += cputime.h
 generic-y += div64.h
 generic-y += emergency-restart.h
 generic-y += exec.h
+generic-y += linkage.h
 generic-y += local64.h
 generic-y += mutex.h
 generic-y += irq_regs.h
diff --git a/arch/sparc/include/asm/leon.h b/arch/sparc/include/asm/leon.h
index 15a716934e4d..b836e9297f2a 100644
--- a/arch/sparc/include/asm/leon.h
+++ b/arch/sparc/include/asm/leon.h
@@ -135,7 +135,7 @@ static inline int sparc_leon3_cpuid(void)
 #ifdef CONFIG_SMP
 # define LEON3_IRQ_IPI_DEFAULT          13
-# define LEON3_IRQ_TICKER               (leon3_ticker_irq)
+# define LEON3_IRQ_TICKER               (leon3_gptimer_irq)
 # define LEON3_IRQ_CROSS_CALL           15
 #endif
diff --git a/arch/sparc/include/asm/leon_amba.h b/arch/sparc/include/asm/leon_amba.h
index f3034eddf468..24ec48c3ff90 100644
--- a/arch/sparc/include/asm/leon_amba.h
+++ b/arch/sparc/include/asm/leon_amba.h
@@ -47,6 +47,7 @@ struct amba_prom_registers {
 #define LEON3_GPTIMER_LD 4
 #define LEON3_GPTIMER_IRQEN 8
 #define LEON3_GPTIMER_SEPIRQ 8
+#define LEON3_GPTIMER_TIMERS 0x7
 #define LEON23_REG_TIMER_CONTROL_EN    0x00000001 /* 1 = enable counting */
 /* 0 = hold scalar and counter */
diff --git a/arch/sparc/include/asm/linkage.h b/arch/sparc/include/asm/linkage.h
deleted file mode 100644
index 291c2d01c44f..000000000000
--- a/arch/sparc/include/asm/linkage.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_LINKAGE_H
-#define __ASM_LINKAGE_H
-/* Nothing to see here... */
-#endif
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 75bb608c423e..5ef48dab5636 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -843,7 +843,8 @@ void ldom_reboot(const char *boot_command)
                unsigned long len;
                strcpy(full_boot_str, "boot ");
-                strcpy(full_boot_str + strlen("boot "), boot_command);
+                strlcpy(full_boot_str + strlen("boot "), boot_command,
+                        sizeof(full_boot_str + strlen("boot ")));
                len = strlen(full_boot_str);
                if (reboot_data_supported) {
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index 7c0231dabe44..b7c68976cbc7 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -38,7 +38,6 @@ static DEFINE_SPINLOCK(leon_irq_lock);
 unsigned long leon3_gptimer_irq; /* interrupt controller irq number */
 unsigned long leon3_gptimer_idx; /* Timer Index (0..6) within Timer Core */
-int leon3_ticker_irq; /* Timer ticker IRQ */
 unsigned int sparc_leon_eirq;
 #define LEON_IMASK(cpu) (&leon3_irqctrl_regs->mask[cpu])
 #define LEON_IACK (&leon3_irqctrl_regs->iclear)
@@ -278,6 +277,9 @@ irqreturn_t leon_percpu_timer_ce_interrupt(int irq, void *unused)
        leon_clear_profile_irq(cpu);
+        if (cpu == boot_cpu_id)
+                timer_interrupt(irq, NULL);
        ce = &per_cpu(sparc32_clockevent, cpu);
        irq_enter();
@@ -299,6 +301,7 @@ void __init leon_init_timers(void)
        int icsel;
        int ampopts;
        int err;
+        u32 config;
        sparc_config.get_cycles_offset = leon_cycles_offset;
        sparc_config.cs_period = 1000000 / HZ;
@@ -377,23 +380,6 @@ void __init leon_init_timers(void)
        LEON3_BYPASS_STORE_PA(
                        &leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl, 0);
-#ifdef CONFIG_SMP
-        leon3_ticker_irq = leon3_gptimer_irq + 1 + leon3_gptimer_idx;
-        if (!(LEON3_BYPASS_LOAD_PA(&leon3_gptimer_regs->config) &
-              (1<<LEON3_GPTIMER_SEPIRQ))) {
-                printk(KERN_ERR "timer not configured with separate irqs\n");
-                BUG();
-        }
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].val,
-                                0);
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].rld,
-                                (((1000000/HZ) - 1)));
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].ctrl,
-                                0);
-#endif
        /*
         * The IRQ controller may (if implemented) consist of multiple
         * IRQ controllers, each mapped on a 4Kb boundary.
@@ -416,13 +402,6 @@ void __init leon_init_timers(void)
        if (eirq != 0)
                leon_eirq_setup(eirq);
-        irq = _leon_build_device_irq(NULL, leon3_gptimer_irq+leon3_gptimer_idx);
-        err = request_irq(irq, timer_interrupt, IRQF_TIMER, "timer", NULL);
-        if (err) {
-                printk(KERN_ERR "unable to attach timer IRQ%d\n", irq);
-                prom_halt();
-        }
 #ifdef CONFIG_SMP
        {
                unsigned long flags;
@@ -439,30 +418,31 @@ void __init leon_init_timers(void)
        }
 #endif
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl,
+        config = LEON3_BYPASS_LOAD_PA(&leon3_gptimer_regs->config);
-                              LEON3_GPTIMER_EN |
+        if (config & (1 << LEON3_GPTIMER_SEPIRQ))
-                              LEON3_GPTIMER_RL |
+                leon3_gptimer_irq += leon3_gptimer_idx;
-                              LEON3_GPTIMER_LD |
+        else if ((config & LEON3_GPTIMER_TIMERS) > 1)
-                              LEON3_GPTIMER_IRQEN);
+                pr_warn("GPTIMER uses shared irqs, using other timers of the same core will fail.\n");
 #ifdef CONFIG_SMP
        /* Install per-cpu IRQ handler for broadcasted ticker */
-        irq = leon_build_device_irq(leon3_ticker_irq, handle_percpu_irq,
+        irq = leon_build_device_irq(leon3_gptimer_irq, handle_percpu_irq,
                                    "per-cpu", 0);
        err = request_irq(irq, leon_percpu_timer_ce_interrupt,
-                          IRQF_PERCPU | IRQF_TIMER, "ticker",
+                          IRQF_PERCPU | IRQF_TIMER, "timer", NULL);
-                          NULL);
+#else
+        irq = _leon_build_device_irq(NULL, leon3_gptimer_irq);
+        err = request_irq(irq, timer_interrupt, IRQF_TIMER, "timer", NULL);
+#endif
        if (err) {
-                printk(KERN_ERR "unable to attach ticker IRQ%d\n", irq);
+                pr_err("Unable to attach timer IRQ%d\n", irq);
                prom_halt();
        }
+        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl,
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].ctrl,
                              LEON3_GPTIMER_EN |
                              LEON3_GPTIMER_RL |
                              LEON3_GPTIMER_LD |
                              LEON3_GPTIMER_IRQEN);
-#endif
        return;
 bad:
        printk(KERN_ERR "No Timer/irqctrl found\n");
diff --git a/arch/sparc/kernel/leon_pci_grpci1.c b/arch/sparc/kernel/leon_pci_grpci1.c
index 7739a54315e2..6df26e37f879 100644
--- a/arch/sparc/kernel/leon_pci_grpci1.c
+++ b/arch/sparc/kernel/leon_pci_grpci1.c
@@ -536,11 +536,9 @@ static int grpci1_of_probe(struct platform_device *ofdev)
        /* find device register base address */
        res = platform_get_resource(ofdev, IORESOURCE_MEM, 0);
-        regs = devm_request_and_ioremap(&ofdev->dev, res);
+        regs = devm_ioremap_resource(&ofdev->dev, res);
-        if (!regs) {
+        if (IS_ERR(regs))
-                dev_err(&ofdev->dev, "io-regs mapping failed\n");
+                return PTR_ERR(regs);
-                return -EADDRNOTAVAIL;
-        }
        /*
         * check that we're in Host Slot and that we can act as a Host Bridge
diff --git a/arch/sparc/kernel/leon_pmc.c b/arch/sparc/kernel/leon_pmc.c
index bdf53d9a8d46..b0b3967a2dd2 100644
--- a/arch/sparc/kernel/leon_pmc.c
+++ b/arch/sparc/kernel/leon_pmc.c
@@ -47,6 +47,10 @@ void pmc_leon_idle_fixup(void)
         * MMU does not get a TLB miss here by using the MMU BYPASS ASI.
         */
        register unsigned int address = (unsigned int)leon3_irqctrl_regs;
+        /* Interrupts need to be enabled to not hang the CPU */
+        local_irq_enable();
        __asm__ __volatile__ (
                "wr     %%g0, %%asr19\n"
                "lda    [%0] %1, %%g0\n"
@@ -60,6 +64,9 @@ void pmc_leon_idle_fixup(void)
 */
 void pmc_leon_idle(void)
 {
+        /* Interrupts need to be enabled to not hang the CPU */
+        local_irq_enable();
        /* For systems without power-down, this will be no-op */
        __asm__ __volatile__ ("wr       %g0, %asr19\n\t");
 }
diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
index 38bf80a22f02..1434526970a6 100644
--- a/arch/sparc/kernel/setup_32.c
+++ b/arch/sparc/kernel/setup_32.c
@@ -304,7 +304,7 @@ void __init setup_arch(char **cmdline_p)
        /* Initialize PROM console and command line. */
        *cmdline_p = prom_getbootargs();
-        strcpy(boot_command_line, *cmdline_p);
+        strlcpy(boot_command_line, *cmdline_p, COMMAND_LINE_SIZE);
        parse_early_param();
        boot_flags_init(*cmdline_p);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 88a127b9c69e..13785547e435 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -555,7 +555,7 @@ void __init setup_arch(char **cmdline_p)
 {
        /* Initialize PROM console and command line. */
        *cmdline_p = prom_getbootargs();
-        strcpy(boot_command_line, *cmdline_p);
+        strlcpy(boot_command_line, *cmdline_p, COMMAND_LINE_SIZE);
        parse_early_param();
        boot_flags_init(*cmdline_p);
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index a7171997adfd..04fd55a6e461 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -1098,7 +1098,14 @@ static int __init grab_mblocks(struct mdesc_handle *md)
                m->size = *val;
                val = mdesc_get_property(md, node,
                                         "address-congruence-offset", NULL);
-                m->offset = *val;
+                /* The address-congruence-offset property is optional.
+                 * Explicity zero it be identifty this.
+                 */
+                if (val)
+                        m->offset = *val;
+                else
+                        m->offset = 0UL;
                numadbg("MBLOCK[%d]: base[%llx] size[%llx] offset[%llx]\n",
                        count - 1, m->base, m->size, m->offset);
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 83d89bcb44af..37e7bc4c95b3 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -85,8 +85,8 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
        }
        if (!tb->active) {
-                global_flush_tlb_page(mm, vaddr);
                flush_tsb_user_page(mm, vaddr);
+                global_flush_tlb_page(mm, vaddr);
                goto out;
        }
diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e0d419..d2b49d2365e7 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
                return barg_buf;
        }
-        switch(prom_vers) {
+        switch (prom_vers) {
        case PROM_V0:
                cp = barg_buf;
                /* Start from 1 and go over fd(0,0,0)kernel */
-                for(iter = 1; iter < 8; iter++) {
+                for (iter = 1; iter < 8; iter++) {
                        arg = (*(romvec->pv_v0bootargs))->argv[iter];
                        if (arg == NULL)
                                break;
-                        while(*arg != 0) {
+                        while (*arg != 0) {
                                /* Leave place for space and null. */
-                                if(cp >= barg_buf + BARG_LEN-2){
+                                if (cp >= barg_buf + BARG_LEN - 2)
                                        /* We might issue a warning here. */
                                        break;
-                                }
                                *cp++ = *arg++;
                        }
                        *cp++ = ' ';
+                        if (cp >= barg_buf + BARG_LEN - 1)
+                                /* We might issue a warning here. */
+                                break;
                }
                *cp = 0;
                break;
diff --git a/arch/sparc/prom/tree_64.c b/arch/sparc/prom/tree_64.c
index 92204c3800b5..bd1b2a3ac34e 100644
--- a/arch/sparc/prom/tree_64.c
+++ b/arch/sparc/prom/tree_64.c
@@ -39,7 +39,7 @@ inline phandle __prom_getchild(phandle node)
        return prom_node_to_node("child", node);
 }
-inline phandle prom_getchild(phandle node)
+phandle prom_getchild(phandle node)
 {
        phandle cnode;
@@ -72,7 +72,7 @@ inline phandle __prom_getsibling(phandle node)
        return prom_node_to_node(prom_peer_name, node);
 }
-inline phandle prom_getsibling(phandle node)
+phandle prom_getsibling(phandle node)
 {
        phandle sibnode;
@@ -89,7 +89,7 @@ EXPORT_SYMBOL(prom_getsibling);
 /* Return the length in bytes of property 'prop' at node 'node'.
 * Return -1 on error.
 */
-inline int prom_getproplen(phandle node, const char *prop)
+int prom_getproplen(phandle node, const char *prop)
 {
        unsigned long args[6];
@@ -113,8 +113,8 @@ EXPORT_SYMBOL(prom_getproplen);
 * 'buffer' which has a size of 'bufsize'.  If the acquisition
 * was successful the length will be returned, else -1 is returned.
 */
-inline int prom_getproperty(phandle node, const char *prop,
+int prom_getproperty(phandle node, const char *prop,
-                            char *buffer, int bufsize)
+                     char *buffer, int bufsize)
 {
        unsigned long args[8];
        int plen;
@@ -141,7 +141,7 @@ EXPORT_SYMBOL(prom_getproperty);
 /* Acquire an integer property and return its value.  Returns -1
 * on failure.
 */
-inline int prom_getint(phandle node, const char *prop)
+int prom_getint(phandle node, const char *prop)
 {
        int intprop;
@@ -235,7 +235,7 @@ static const char *prom_nextprop_name = "nextprop";
 /* Return the first property type for node 'node'.
 * buffer should be at least 32B in length
 */
-inline char *prom_firstprop(phandle node, char *buffer)
+char *prom_firstprop(phandle node, char *buffer)
 {
        unsigned long args[7];
@@ -261,7 +261,7 @@ EXPORT_SYMBOL(prom_firstprop);
 * at node 'node' .  Returns NULL string if no more
 * property types for this node.
 */
-inline char *prom_nextprop(phandle node, const char *oprop, char *buffer)
+char *prom_nextprop(phandle node, const char *oprop, char *buffer)
 {
        unsigned long args[7];
        char buf[32];
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 934cfd18f72d..1144e8c7579d 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1955,6 +1955,7 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
                /* XXX the notifier code should handle this better */
                if (!cn->notifier_head.head) {
                        srcu_cleanup_notifier_head(&cn->notifier_head);
+                        list_del(&cn->node);
                        kfree(cn);
                }
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index 5c97e75924a8..22d7699e7ced 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -155,7 +155,7 @@ static __initdata unsigned long exynos5250_clk_regs[] = {
 /* list of all parent clock list */
 PNAME(mout_apll_p)      = { "fin_pll", "fout_apll", };
-PNAME(mout_cpu_p)       = { "mout_apll", "mout_mpll", };
+PNAME(mout_cpu_p)       = { "mout_apll", "sclk_mpll", };
 PNAME(mout_mpll_fout_p) = { "fout_mplldiv2", "fout_mpll" };
 PNAME(mout_mpll_p)      = { "fin_pll", "mout_mpll_fout" };
 PNAME(mout_bpll_fout_p) = { "fout_bplldiv2", "fout_bpll" };
@@ -208,10 +208,10 @@ struct samsung_fixed_factor_clock exynos5250_fixed_factor_clks[] __initdata = {
 };
 struct samsung_mux_clock exynos5250_mux_clks[] __initdata = {
-        MUX(none, "mout_apll", mout_apll_p, SRC_CPU, 0, 1),
+        MUX_A(none, "mout_apll", mout_apll_p, SRC_CPU, 0, 1, "mout_apll"),
-        MUX(none, "mout_cpu", mout_cpu_p, SRC_CPU, 16, 1),
+        MUX_A(none, "mout_cpu", mout_cpu_p, SRC_CPU, 16, 1, "mout_cpu"),
        MUX(none, "mout_mpll_fout", mout_mpll_fout_p, PLL_DIV2_SEL, 4, 1),
-        MUX(none, "sclk_mpll", mout_mpll_p, SRC_CORE1, 8, 1),
+        MUX_A(none, "sclk_mpll", mout_mpll_p, SRC_CORE1, 8, 1, "mout_mpll"),
        MUX(none, "mout_bpll_fout", mout_bpll_fout_p, PLL_DIV2_SEL, 0, 1),
        MUX(none, "sclk_bpll", mout_bpll_p, SRC_CDREX, 0, 1),
        MUX(none, "mout_vpllsrc", mout_vpllsrc_p, SRC_TOP2, 0, 1),
@@ -378,7 +378,7 @@ struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
        GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
        GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
-        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, 0, 0),
+        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
        GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
        GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
        GATE(tzpc2, "tzpc2", "aclk66", GATE_IP_PERIS, 8, 0, 0),
diff --git a/drivers/clk/samsung/clk-pll.c b/drivers/clk/samsung/clk-pll.c
index 89135f6be116..362f12dcd944 100644
--- a/drivers/clk/samsung/clk-pll.c
+++ b/drivers/clk/samsung/clk-pll.c
@@ -111,7 +111,8 @@ static unsigned long samsung_pll36xx_recalc_rate(struct clk_hw *hw,
                                unsigned long parent_rate)
 {
        struct samsung_clk_pll36xx *pll = to_clk_pll36xx(hw);
-        u32 mdiv, pdiv, sdiv, kdiv, pll_con0, pll_con1;
+        u32 mdiv, pdiv, sdiv, pll_con0, pll_con1;
+        s16 kdiv;
        u64 fvco = parent_rate;
        pll_con0 = __raw_readl(pll->con_reg);
@@ -119,7 +120,7 @@ static unsigned long samsung_pll36xx_recalc_rate(struct clk_hw *hw,
        mdiv = (pll_con0 >> PLL36XX_MDIV_SHIFT) & PLL36XX_MDIV_MASK;
        pdiv = (pll_con0 >> PLL36XX_PDIV_SHIFT) & PLL36XX_PDIV_MASK;
        sdiv = (pll_con0 >> PLL36XX_SDIV_SHIFT) & PLL36XX_SDIV_MASK;
-        kdiv = pll_con1 & PLL36XX_KDIV_MASK;
+        kdiv = (s16)(pll_con1 & PLL36XX_KDIV_MASK);
        fvco *= (mdiv << 16) + kdiv;
        do_div(fvco, (pdiv << sdiv));
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index f9ec43fd1320..080c3c5e33f6 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -369,7 +369,7 @@ static void __init spear320_clk_init(void __iomem *soc_config_base)
        clk_register_clkdev(clk, NULL, "60100000.serial");
 }
 #else
-static inline void spear320_clk_init(void) { }
+static inline void spear320_clk_init(void __iomem *soc_config_base) { }
 #endif
 void __init spear3xx_clk_init(void __iomem *misc_base, void __iomem *soc_config_base)
diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
index c6921f538e28..ba99e3844106 100644
--- a/drivers/clk/tegra/clk-tegra30.c
+++ b/drivers/clk/tegra/clk-tegra30.c
@@ -1598,6 +1598,12 @@ static void __init tegra30_periph_clk_init(void)
        clk_register_clkdev(clk, "afi", "tegra-pcie");
        clks[afi] = clk;
+        /* pciex */
+        clk = tegra_clk_register_periph_gate("pciex", "pll_e", 0, clk_base, 0,
+                                    74, &periph_u_regs, periph_clk_enb_refcnt);
+        clk_register_clkdev(clk, "pciex", "tegra-pcie");
+        clks[pciex] = clk;
        /* kfuse */
        clk = tegra_clk_register_periph_gate("kfuse", "clk_m",
                                    TEGRA_PERIPH_ON_APB,
@@ -1716,11 +1722,6 @@ static void __init tegra30_fixed_clk_init(void)
                                1, 0, &cml_lock);
        clk_register_clkdev(clk, "cml1", NULL);
        clks[cml1] = clk;
-        /* pciex */
-        clk = clk_register_fixed_rate(NULL, "pciex", "pll_e", 0, 100000000);
-        clk_register_clkdev(clk, "pciex", NULL);
-        clks[pciex] = clk;
 }
 static void __init tegra30_osc_clk_init(void)
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index cb52438e53ac..9eac5310942f 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -956,7 +956,7 @@ static int s5c73m3_oif_enum_frame_interval(struct v4l2_subdev *sd,
        if (fie->pad != OIF_SOURCE_PAD)
                return -EINVAL;
-        if (fie->index > ARRAY_SIZE(s5c73m3_intervals))
+        if (fie->index >= ARRAY_SIZE(s5c73m3_intervals))
                return -EINVAL;
        mutex_lock(&state->lock);
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 27d62623274b..aba5b1c649e6 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -615,7 +615,7 @@ static int snd_cx88_volume_put(struct snd_kcontrol *kcontrol,
        int changed = 0;
        u32 old;
-        if (core->board.audio_chip == V4L2_IDENT_WM8775)
+        if (core->sd_wm8775)
                snd_cx88_wm8775_volume_put(kcontrol, value);
        left = value->value.integer.value[0] & 0x3f;
@@ -682,8 +682,7 @@ static int snd_cx88_switch_put(struct snd_kcontrol *kcontrol,
                vol ^= bit;
                cx_swrite(SHADOW_AUD_VOL_CTL, AUD_VOL_CTL, vol);
                /* Pass mute onto any WM8775 */
-                if ((core->board.audio_chip == V4L2_IDENT_WM8775) &&
+                if (core->sd_wm8775 && ((1<<6) == bit))
-                    ((1<<6) == bit))
                        wm8775_s_ctrl(core, V4L2_CID_AUDIO_MUTE, 0 != (vol & bit));
                ret = 1;
        }
@@ -903,7 +902,7 @@ static int cx88_audio_initdev(struct pci_dev *pci,
                goto error;
        /* If there's a wm8775 then add a Line-In ALC switch */
-        if (core->board.audio_chip == V4L2_IDENT_WM8775)
+        if (core->sd_wm8775)
                snd_ctl_add(card, snd_ctl_new1(&snd_cx88_alc_switch, chip));
        strcpy (card->driver, "CX88x");
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 1b00615fd395..c7a9be1065c0 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -385,8 +385,7 @@ int cx88_video_mux(struct cx88_core *core, unsigned int input)
                /* The wm8775 module has the "2" route hardwired into
                   the initialization. Some boards may use different
                   routes for different inputs. HVR-1300 surely does */
-                if (core->board.audio_chip &&
+                if (core->sd_wm8775) {
-                    core->board.audio_chip == V4L2_IDENT_WM8775) {
                        call_all(core, audio, s_routing,
                                 INPUT(input).audioroute, 0, 0);
                }
@@ -771,8 +770,7 @@ static int video_open(struct file *file)
                cx_write(MO_GP1_IO, core->board.radio.gpio1);
                cx_write(MO_GP2_IO, core->board.radio.gpio2);
                if (core->board.radio.audioroute) {
-                        if(core->board.audio_chip &&
+                        if (core->sd_wm8775) {
-                                core->board.audio_chip == V4L2_IDENT_WM8775) {
                                call_all(core, audio, s_routing,
                                        core->board.radio.audioroute, 0, 0);
                        }
@@ -959,7 +957,7 @@ static int cx8800_s_aud_ctrl(struct v4l2_ctrl *ctrl)
        u32 value,mask;
        /* Pass changes onto any WM8775 */
-        if (core->board.audio_chip == V4L2_IDENT_WM8775) {
+        if (core->sd_wm8775) {
                switch (ctrl->id) {
                case V4L2_CID_AUDIO_MUTE:
                        wm8775_s_ctrl(core, ctrl->id, ctrl->val);
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index 48b8d7af386d..9d1481a60bd9 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -576,6 +576,14 @@ static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
        return v4l2_m2m_dqbuf(file, ctx->m2m_ctx, buf);
 }
+static int vidioc_create_bufs(struct file *file, void *priv,
+                              struct v4l2_create_buffers *create)
+{
+        struct coda_ctx *ctx = fh_to_ctx(priv);
+        return v4l2_m2m_create_bufs(file, ctx->m2m_ctx, create);
+}
 static int vidioc_streamon(struct file *file, void *priv,
                           enum v4l2_buf_type type)
 {
@@ -610,6 +618,7 @@ static const struct v4l2_ioctl_ops coda_ioctl_ops = {
        .vidioc_qbuf            = vidioc_qbuf,
        .vidioc_dqbuf           = vidioc_dqbuf,
+        .vidioc_create_bufs     = vidioc_create_bufs,
        .vidioc_streamon        = vidioc_streamon,
        .vidioc_streamoff       = vidioc_streamoff,
diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
index 1802f11e939f..d0b375cf565f 100644
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -916,6 +916,21 @@ static int vpbe_display_s_fmt(struct file *file, void *priv,
        other video window */
        layer->pix_fmt = *pixfmt;
+        if (pixfmt->pixelformat == V4L2_PIX_FMT_NV12) {
+                struct vpbe_layer *otherlayer;
+                otherlayer = _vpbe_display_get_other_win_layer(disp_dev, layer);
+                /* if other layer is available, only
+                 * claim it, do not configure it
+                 */
+                ret = osd_device->ops.request_layer(osd_device,
+                                                    otherlayer->layer_info.id);
+                if (ret < 0) {
+                        v4l2_err(&vpbe_dev->v4l2_dev,
+                                 "Display Manager failed to allocate layer\n");
+                        return -EBUSY;
+                }
+        }
        /* Get osd layer config */
        osd_device->ops.get_layer_config(osd_device,
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index 8c50d3074866..93609091cb23 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -1837,7 +1837,7 @@ static int vpfe_probe(struct platform_device *pdev)
        if (NULL == ccdc_cfg) {
                v4l2_err(pdev->dev.driver,
                         "Memory allocation failed for ccdc_cfg\n");
-                goto probe_free_lock;
+                goto probe_free_dev_mem;
        }
        mutex_lock(&ccdc_lock);
@@ -1991,7 +1991,6 @@ probe_out_release_irq:
        free_irq(vpfe_dev->ccdc_irq0, vpfe_dev);
 probe_free_ccdc_cfg_mem:
        kfree(ccdc_cfg);
-probe_free_lock:
        mutex_unlock(&ccdc_lock);
 probe_free_dev_mem:
        kfree(vpfe_dev);
diff --git a/drivers/media/platform/exynos4-is/fimc-is-regs.c b/drivers/media/platform/exynos4-is/fimc-is-regs.c
index b0ff67bc1b05..d05eaa2c8490 100644
--- a/drivers/media/platform/exynos4-is/fimc-is-regs.c
+++ b/drivers/media/platform/exynos4-is/fimc-is-regs.c
@@ -174,7 +174,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is)
                HIC_CAPTURE_STILL, HIC_CAPTURE_VIDEO,
        };
-        if (WARN_ON(is->config_index > ARRAY_SIZE(cmd)))
+        if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd)))
                return -EINVAL;
        mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0));
diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
index 47c6363d04e2..520e4398b69c 100644
--- a/drivers/media/platform/exynos4-is/fimc-is.c
+++ b/drivers/media/platform/exynos4-is/fimc-is.c
@@ -48,7 +48,6 @@ static char *fimc_is_clocks[ISS_CLKS_MAX] = {
        [ISS_CLK_LITE0]                 = "lite0",
        [ISS_CLK_LITE1]                 = "lite1",
        [ISS_CLK_MPLL]                  = "mpll",
-        [ISS_CLK_SYSREG]                = "sysreg",
        [ISS_CLK_ISP]                   = "isp",
        [ISS_CLK_DRC]                   = "drc",
        [ISS_CLK_FD]                    = "fd",
@@ -71,7 +70,6 @@ static void fimc_is_put_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_CLKS_MAX; i++) {
                if (IS_ERR(is->clocks[i]))
                        continue;
-                clk_unprepare(is->clocks[i]);
                clk_put(is->clocks[i]);
                is->clocks[i] = ERR_PTR(-EINVAL);
        }
@@ -90,12 +88,6 @@ static int fimc_is_get_clocks(struct fimc_is *is)
                        ret = PTR_ERR(is->clocks[i]);
                        goto err;
                }
-                ret = clk_prepare(is->clocks[i]);
-                if (ret < 0) {
-                        clk_put(is->clocks[i]);
-                        is->clocks[i] = ERR_PTR(-EINVAL);
-                        goto err;
-                }
        }
        return 0;
@@ -103,7 +95,7 @@ err:
        fimc_is_put_clocks(is);
        dev_err(&is->pdev->dev, "failed to get clock: %s\n",
                fimc_is_clocks[i]);
-        return -ENXIO;
+        return ret;
 }
 static int fimc_is_setup_clocks(struct fimc_is *is)
@@ -144,7 +136,7 @@ int fimc_is_enable_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_GATE_CLKS_MAX; i++) {
                if (IS_ERR(is->clocks[i]))
                        continue;
-                ret = clk_enable(is->clocks[i]);
+                ret = clk_prepare_enable(is->clocks[i]);
                if (ret < 0) {
                        dev_err(&is->pdev->dev, "clock %s enable failed\n",
                                fimc_is_clocks[i]);
@@ -163,7 +155,7 @@ void fimc_is_disable_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_GATE_CLKS_MAX; i++) {
                if (!IS_ERR(is->clocks[i])) {
-                        clk_disable(is->clocks[i]);
+                        clk_disable_unprepare(is->clocks[i]);
                        pr_debug("disabled clock: %s\n", fimc_is_clocks[i]);
                }
        }
@@ -326,6 +318,11 @@ int fimc_is_start_firmware(struct fimc_is *is)
        struct device *dev = &is->pdev->dev;
        int ret;
+        if (is->fw.f_w == NULL) {
+                dev_err(dev, "firmware is not loaded\n");
+                return -EINVAL;
+        }
        memcpy(is->memory.vaddr, is->fw.f_w->data, is->fw.f_w->size);
        wmb();
@@ -941,7 +938,8 @@ static int fimc_is_remove(struct platform_device *pdev)
        vb2_dma_contig_cleanup_ctx(is->alloc_ctx);
        fimc_is_put_clocks(is);
        fimc_is_debugfs_remove(is);
-        release_firmware(is->fw.f_w);
+        if (is->fw.f_w)
+                release_firmware(is->fw.f_w);
        fimc_is_free_cpu_memory(is);
        return 0;
diff --git a/drivers/media/platform/exynos4-is/fimc-is.h b/drivers/media/platform/exynos4-is/fimc-is.h
index f5275a5b0156..606a7c9fe526 100644
--- a/drivers/media/platform/exynos4-is/fimc-is.h
+++ b/drivers/media/platform/exynos4-is/fimc-is.h
@@ -73,7 +73,6 @@ enum {
        ISS_CLK_LITE0,
        ISS_CLK_LITE1,
        ISS_CLK_MPLL,
-        ISS_CLK_SYSREG,
        ISS_CLK_ISP,
        ISS_CLK_DRC,
        ISS_CLK_FD,
diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
index d63947f7b302..7ede30b5910f 100644
--- a/drivers/media/platform/exynos4-is/fimc-isp.c
+++ b/drivers/media/platform/exynos4-is/fimc-isp.c
@@ -138,7 +138,7 @@ static int fimc_isp_subdev_get_fmt(struct v4l2_subdev *sd,
                return 0;
        }
-        mf->colorspace = V4L2_COLORSPACE_JPEG;
+        mf->colorspace = V4L2_COLORSPACE_SRGB;
        mutex_lock(&isp->subdev_lock);
        __is_get_frame_size(is, &cur_fmt);
@@ -194,7 +194,7 @@ static int fimc_isp_subdev_set_fmt(struct v4l2_subdev *sd,
        v4l2_dbg(1, debug, sd, "%s: pad%d: code: 0x%x, %dx%d\n",
                 __func__, fmt->pad, mf->code, mf->width, mf->height);
-        mf->colorspace = V4L2_COLORSPACE_JPEG;
+        mf->colorspace = V4L2_COLORSPACE_SRGB;
        mutex_lock(&isp->subdev_lock);
        __isp_subdev_try_format(isp, fmt);
diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
index a2eda9d5ac87..254d70fe762a 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -746,7 +746,7 @@ static int s5pcsis_parse_dt(struct platform_device *pdev,
        node = v4l2_of_get_next_endpoint(node, NULL);
        if (!node) {
                dev_err(&pdev->dev, "No port node at %s\n",
-                                        node->full_name);
+                                pdev->dev.of_node->full_name);
                return -EINVAL;
        }
        /* Get port node and validate MIPI-CSI channel id. */
diff --git a/drivers/media/platform/s3c-camif/camif-core.h b/drivers/media/platform/s3c-camif/camif-core.h
index 261134baa655..35d2fcdc0036 100644
--- a/drivers/media/platform/s3c-camif/camif-core.h
+++ b/drivers/media/platform/s3c-camif/camif-core.h
@@ -229,7 +229,7 @@ struct camif_vp {
        unsigned int            state;
        u16                     fmt_flags;
        u8                      id;
-        u8                      rotation;
+        u16                     rotation;
        u8                      hflip;
        u8                      vflip;
        unsigned int            offset;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 01f9ae0dadb0..d12faa691af8 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -397,7 +397,7 @@ static void s5p_mfc_handle_frame(struct s5p_mfc_ctx *ctx,
 leave_handle_frame:
        spin_unlock_irqrestore(&dev->irqlock, flags);
        if ((ctx->src_queue_cnt == 0 && ctx->state != MFCINST_FINISHING)
-                                    || ctx->dst_queue_cnt < ctx->dpb_count)
+                                    || ctx->dst_queue_cnt < ctx->pb_count)
                clear_work_bit(ctx);
        s5p_mfc_hw_call(dev->mfc_ops, clear_int_flags, dev);
        wake_up_ctx(ctx, reason, err);
@@ -473,7 +473,7 @@ static void s5p_mfc_handle_seq_done(struct s5p_mfc_ctx *ctx,
                s5p_mfc_hw_call(dev->mfc_ops, dec_calc_dpb_size, ctx);
-                ctx->dpb_count = s5p_mfc_hw_call(dev->mfc_ops, get_dpb_count,
+                ctx->pb_count = s5p_mfc_hw_call(dev->mfc_ops, get_dpb_count,
                                dev);
                ctx->mv_count = s5p_mfc_hw_call(dev->mfc_ops, get_mv_count,
                                dev);
@@ -562,7 +562,7 @@ static void s5p_mfc_handle_stream_complete(struct s5p_mfc_ctx *ctx,
        struct s5p_mfc_dev *dev = ctx->dev;
        struct s5p_mfc_buf *mb_entry;
-        mfc_debug(2, "Stream completed");
+        mfc_debug(2, "Stream completed\n");
        s5p_mfc_clear_int_flags(dev);
        ctx->int_type = reason;
@@ -1362,7 +1362,6 @@ static struct s5p_mfc_variant mfc_drvdata_v5 = {
        .port_num       = MFC_NUM_PORTS,
        .buf_size       = &buf_size_v5,
        .buf_align      = &mfc_buf_align_v5,
-        .mclk_name      = "sclk_mfc",
        .fw_name        = "s5p-mfc.fw",
 };
@@ -1389,7 +1388,6 @@ static struct s5p_mfc_variant mfc_drvdata_v6 = {
        .port_num       = MFC_NUM_PORTS_V6,
        .buf_size       = &buf_size_v6,
        .buf_align      = &mfc_buf_align_v6,
-        .mclk_name      = "aclk_333",
        .fw_name        = "s5p-mfc-v6.fw",
 };
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
index 202d1d7a37a8..ef4074cd5316 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@@ -138,6 +138,7 @@ enum s5p_mfc_inst_state {
        MFCINST_INIT = 100,
        MFCINST_GOT_INST,
        MFCINST_HEAD_PARSED,
+        MFCINST_HEAD_PRODUCED,
        MFCINST_BUFS_SET,
        MFCINST_RUNNING,
        MFCINST_FINISHING,
@@ -231,7 +232,6 @@ struct s5p_mfc_variant {
        unsigned int port_num;
        struct s5p_mfc_buf_size *buf_size;
        struct s5p_mfc_buf_align *buf_align;
-        char    *mclk_name;
        char    *fw_name;
 };
@@ -438,7 +438,7 @@ struct s5p_mfc_enc_params {
        u32 rc_framerate_num;
        u32 rc_framerate_denom;
-        union {
+        struct {
                struct s5p_mfc_h264_enc_params h264;
                struct s5p_mfc_mpeg4_enc_params mpeg4;
        } codec;
@@ -602,7 +602,7 @@ struct s5p_mfc_ctx {
        int after_packed_pb;
        int sei_fp_parse;
-        int dpb_count;
+        int pb_count;
        int total_dpb_count;
        int mv_count;
        /* Buffers */
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
index 2e5f30b40dea..dc1fc94a488d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
@@ -38,7 +38,7 @@ int s5p_mfc_alloc_firmware(struct s5p_mfc_dev *dev)
        dev->fw_virt_addr = dma_alloc_coherent(dev->mem_dev_l, dev->fw_size,
                                        &dev->bank1, GFP_KERNEL);
-        if (IS_ERR(dev->fw_virt_addr)) {
+        if (IS_ERR_OR_NULL(dev->fw_virt_addr)) {
                dev->fw_virt_addr = NULL;
                mfc_err("Allocating bitprocessor buffer failed\n");
                return -ENOMEM;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h b/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
index bd5cd4ae993c..8e608f5aa0d7 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
@@ -30,8 +30,8 @@ extern int debug;
 #define mfc_debug(level, fmt, args...)
 #endif
-#define mfc_debug_enter() mfc_debug(5, "enter")
+#define mfc_debug_enter() mfc_debug(5, "enter\n")
-#define mfc_debug_leave() mfc_debug(5, "leave")
+#define mfc_debug_leave() mfc_debug(5, "leave\n")
 #define mfc_err(fmt, args...)                           \
        do {                                            \
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
index 4af53bd2f182..00b07032f4f0 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
@@ -210,11 +210,11 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
        /* Context is to decode a frame */
        if (ctx->src_queue_cnt >= 1 &&
            ctx->state == MFCINST_RUNNING &&
-            ctx->dst_queue_cnt >= ctx->dpb_count)
+            ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        /* Context is to return last frame */
        if (ctx->state == MFCINST_FINISHING &&
-            ctx->dst_queue_cnt >= ctx->dpb_count)
+            ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        /* Context is to set buffers */
        if (ctx->src_queue_cnt >= 1 &&
@@ -224,7 +224,7 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
        /* Resolution change */
        if ((ctx->state == MFCINST_RES_CHANGE_INIT ||
                ctx->state == MFCINST_RES_CHANGE_FLUSH) &&
-                ctx->dst_queue_cnt >= ctx->dpb_count)
+                ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        if (ctx->state == MFCINST_RES_CHANGE_END &&
                ctx->src_queue_cnt >= 1)
@@ -537,7 +537,7 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                        mfc_err("vb2_reqbufs on capture failed\n");
                        return ret;
                }
-                if (reqbufs->count < ctx->dpb_count) {
+                if (reqbufs->count < ctx->pb_count) {
                        mfc_err("Not enough buffers allocated\n");
                        reqbufs->count = 0;
                        s5p_mfc_clock_on();
@@ -751,7 +751,7 @@ static int s5p_mfc_dec_g_v_ctrl(struct v4l2_ctrl *ctrl)
        case V4L2_CID_MIN_BUFFERS_FOR_CAPTURE:
                if (ctx->state >= MFCINST_HEAD_PARSED &&
                    ctx->state < MFCINST_ABORT) {
-                        ctrl->val = ctx->dpb_count;
+                        ctrl->val = ctx->pb_count;
                        break;
                } else if (ctx->state != MFCINST_INIT) {
                        v4l2_err(&dev->v4l2_dev, "Decoding not initialised\n");
@@ -763,7 +763,7 @@ static int s5p_mfc_dec_g_v_ctrl(struct v4l2_ctrl *ctrl)
                                S5P_MFC_R2H_CMD_SEQ_DONE_RET, 0);
                if (ctx->state >= MFCINST_HEAD_PARSED &&
                    ctx->state < MFCINST_ABORT) {
-                        ctrl->val = ctx->dpb_count;
+                        ctrl->val = ctx->pb_count;
                } else {
                        v4l2_err(&dev->v4l2_dev, "Decoding not initialised\n");
                        return -EINVAL;
@@ -924,10 +924,10 @@ static int s5p_mfc_queue_setup(struct vb2_queue *vq,
                /* Output plane count is 2 - one for Y and one for CbCr */
                *plane_count = 2;
                /* Setup buffer count */
-                if (*buf_count < ctx->dpb_count)
+                if (*buf_count < ctx->pb_count)
-                        *buf_count = ctx->dpb_count;
+                        *buf_count = ctx->pb_count;
-                if (*buf_count > ctx->dpb_count + MFC_MAX_EXTRA_DPB)
+                if (*buf_count > ctx->pb_count + MFC_MAX_EXTRA_DPB)
-                        *buf_count = ctx->dpb_count + MFC_MAX_EXTRA_DPB;
+                        *buf_count = ctx->pb_count + MFC_MAX_EXTRA_DPB;
                if (*buf_count > MFC_MAX_BUFFERS)
                        *buf_count = MFC_MAX_BUFFERS;
        } else {
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 4f6b553c4b2d..2549967b2f85 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -592,7 +592,7 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
                return 1;
        /* context is ready to encode a frame */
        if ((ctx->state == MFCINST_RUNNING ||
-                ctx->state == MFCINST_HEAD_PARSED) &&
+                ctx->state == MFCINST_HEAD_PRODUCED) &&
                ctx->src_queue_cnt >= 1 && ctx->dst_queue_cnt >= 1)
                return 1;
        /* context is ready to encode remaining frames */
@@ -649,6 +649,7 @@ static int enc_post_seq_start(struct s5p_mfc_ctx *ctx)
        struct s5p_mfc_enc_params *p = &ctx->enc_params;
        struct s5p_mfc_buf *dst_mb;
        unsigned long flags;
+        unsigned int enc_pb_count;
        if (p->seq_hdr_mode == V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) {
                spin_lock_irqsave(&dev->irqlock, flags);
@@ -661,18 +662,19 @@ static int enc_post_seq_start(struct s5p_mfc_ctx *ctx)
                vb2_buffer_done(dst_mb->b, VB2_BUF_STATE_DONE);
                spin_unlock_irqrestore(&dev->irqlock, flags);
        }
-        if (IS_MFCV6(dev)) {
-                ctx->state = MFCINST_HEAD_PARSED; /* for INIT_BUFFER cmd */
+        if (!IS_MFCV6(dev)) {
-        } else {
                ctx->state = MFCINST_RUNNING;
                if (s5p_mfc_ctx_ready(ctx))
                        set_work_bit_irqsave(ctx);
                s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
-        }
+        } else {
+                enc_pb_count = s5p_mfc_hw_call(dev->mfc_ops,
-        if (IS_MFCV6(dev))
-                ctx->dpb_count = s5p_mfc_hw_call(dev->mfc_ops,
                                get_enc_dpb_count, dev);
+                if (ctx->pb_count < enc_pb_count)
+                        ctx->pb_count = enc_pb_count;
+                ctx->state = MFCINST_HEAD_PRODUCED;
+        }
        return 0;
 }
@@ -717,9 +719,9 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx)
        slice_type = s5p_mfc_hw_call(dev->mfc_ops, get_enc_slice_type, dev);
        strm_size = s5p_mfc_hw_call(dev->mfc_ops, get_enc_strm_size, dev);
-        mfc_debug(2, "Encoded slice type: %d", slice_type);
+        mfc_debug(2, "Encoded slice type: %d\n", slice_type);
-        mfc_debug(2, "Encoded stream size: %d", strm_size);
+        mfc_debug(2, "Encoded stream size: %d\n", strm_size);
-        mfc_debug(2, "Display order: %d",
+        mfc_debug(2, "Display order: %d\n",
                  mfc_read(dev, S5P_FIMV_ENC_SI_PIC_CNT));
        spin_lock_irqsave(&dev->irqlock, flags);
        if (slice_type >= 0) {
@@ -1055,15 +1057,13 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                }
                ctx->capture_state = QUEUE_BUFS_REQUESTED;
-                if (!IS_MFCV6(dev)) {
+                ret = s5p_mfc_hw_call(ctx->dev->mfc_ops,
-                        ret = s5p_mfc_hw_call(ctx->dev->mfc_ops,
+                                alloc_codec_buffers, ctx);
-                                        alloc_codec_buffers, ctx);
+                if (ret) {
-                        if (ret) {
+                        mfc_err("Failed to allocate encoding buffers\n");
-                                mfc_err("Failed to allocate encoding buffers\n");
+                        reqbufs->count = 0;
-                                reqbufs->count = 0;
+                        ret = vb2_reqbufs(&ctx->vq_dst, reqbufs);
-                                ret = vb2_reqbufs(&ctx->vq_dst, reqbufs);
+                        return -ENOMEM;
-                                return -ENOMEM;
-                        }
                }
        } else if (reqbufs->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
                if (ctx->output_state != QUEUE_FREE) {
@@ -1071,6 +1071,19 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                                                        ctx->output_state);
                        return -EINVAL;
                }
+                if (IS_MFCV6(dev)) {
+                        /* Check for min encoder buffers */
+                        if (ctx->pb_count &&
+                                (reqbufs->count < ctx->pb_count)) {
+                                reqbufs->count = ctx->pb_count;
+                                mfc_debug(2, "Minimum %d output buffers needed\n",
+                                                ctx->pb_count);
+                        } else {
+                                ctx->pb_count = reqbufs->count;
+                        }
+                }
                ret = vb2_reqbufs(&ctx->vq_src, reqbufs);
                if (ret != 0) {
                        mfc_err("error in vb2_reqbufs() for E(S)\n");
@@ -1533,14 +1546,14 @@ int vidioc_encoder_cmd(struct file *file, void *priv,
                spin_lock_irqsave(&dev->irqlock, flags);
                if (list_empty(&ctx->src_queue)) {
-                        mfc_debug(2, "EOS: empty src queue, entering finishing state");
+                        mfc_debug(2, "EOS: empty src queue, entering finishing state\n");
                        ctx->state = MFCINST_FINISHING;
                        if (s5p_mfc_ctx_ready(ctx))
                                set_work_bit_irqsave(ctx);
                        spin_unlock_irqrestore(&dev->irqlock, flags);
                        s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
                } else {
-                        mfc_debug(2, "EOS: marking last buffer of stream");
+                        mfc_debug(2, "EOS: marking last buffer of stream\n");
                        buf = list_entry(ctx->src_queue.prev,
                                                struct s5p_mfc_buf, list);
                        if (buf->flags & MFC_BUF_FLAG_USED)
@@ -1609,9 +1622,9 @@ static int check_vb_with_fmt(struct s5p_mfc_fmt *fmt, struct vb2_buffer *vb)
                        mfc_err("failed to get plane cookie\n");
                        return -EINVAL;
                }
-                mfc_debug(2, "index: %d, plane[%d] cookie: 0x%08zx",
+                mfc_debug(2, "index: %d, plane[%d] cookie: 0x%08zx\n",
-                                vb->v4l2_buf.index, i,
+                          vb->v4l2_buf.index, i,
-                                vb2_dma_contig_plane_dma_addr(vb, i));
+                          vb2_dma_contig_plane_dma_addr(vb, i));
        }
        return 0;
 }
@@ -1760,11 +1773,27 @@ static int s5p_mfc_start_streaming(struct vb2_queue *q, unsigned int count)
        struct s5p_mfc_ctx *ctx = fh_to_ctx(q->drv_priv);
        struct s5p_mfc_dev *dev = ctx->dev;
-        v4l2_ctrl_handler_setup(&ctx->ctrl_handler);
+        if (IS_MFCV6(dev) && (q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+                if ((ctx->state == MFCINST_GOT_INST) &&
+                        (dev->curr_ctx == ctx->num) && dev->hw_lock) {
+                        s5p_mfc_wait_for_done_ctx(ctx,
+                                                S5P_MFC_R2H_CMD_SEQ_DONE_RET,
+                                                0);
+                }
+                if (ctx->src_bufs_cnt < ctx->pb_count) {
+                        mfc_err("Need minimum %d OUTPUT buffers\n",
+                                        ctx->pb_count);
+                        return -EINVAL;
+                }
+        }
        /* If context is ready then dev = work->data;schedule it to run */
        if (s5p_mfc_ctx_ready(ctx))
                set_work_bit_irqsave(ctx);
        s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
        return 0;
 }
@@ -1920,6 +1949,7 @@ int s5p_mfc_enc_ctrls_setup(struct s5p_mfc_ctx *ctx)
                if (controls[i].is_volatile && ctx->ctrls[i])
                        ctx->ctrls[i]->flags |= V4L2_CTRL_FLAG_VOLATILE;
        }
+        v4l2_ctrl_handler_setup(&ctx->ctrl_handler);
        return 0;
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
index 0af05a2d1cd4..368582b091bf 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
@@ -1275,8 +1275,8 @@ static int s5p_mfc_run_enc_frame(struct s5p_mfc_ctx *ctx)
        spin_unlock_irqrestore(&dev->irqlock, flags);
        dev->curr_ctx = ctx->num;
        s5p_mfc_clean_ctx_int_flags(ctx);
-        mfc_debug(2, "encoding buffer with index=%d state=%d",
+        mfc_debug(2, "encoding buffer with index=%d state=%d\n",
-                        src_mb ? src_mb->b->v4l2_buf.index : -1, ctx->state);
+                  src_mb ? src_mb->b->v4l2_buf.index : -1, ctx->state);
        s5p_mfc_encode_one_frame_v5(ctx);
        return 0;
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
index 7e76fce2e524..66f0d042357f 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
@@ -62,12 +62,6 @@ static void s5p_mfc_release_dec_desc_buffer_v6(struct s5p_mfc_ctx *ctx)
        /* NOP */
 }
-static int s5p_mfc_get_dec_status_v6(struct s5p_mfc_dev *dev)
-{
-        /* NOP */
-        return -1;
-}
 /* Allocate codec buffers */
 static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
 {
@@ -167,7 +161,7 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                                S5P_FIMV_SCRATCH_BUFFER_ALIGN_V6);
                ctx->bank1.size =
                        ctx->scratch_buf_size + ctx->tmv_buffer_size +
-                        (ctx->dpb_count * (ctx->luma_dpb_size +
+                        (ctx->pb_count * (ctx->luma_dpb_size +
                        ctx->chroma_dpb_size + ctx->me_buffer_size));
                ctx->bank2.size = 0;
                break;
@@ -181,7 +175,7 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                                S5P_FIMV_SCRATCH_BUFFER_ALIGN_V6);
                ctx->bank1.size =
                        ctx->scratch_buf_size + ctx->tmv_buffer_size +
-                        (ctx->dpb_count * (ctx->luma_dpb_size +
+                        (ctx->pb_count * (ctx->luma_dpb_size +
                        ctx->chroma_dpb_size + ctx->me_buffer_size));
                ctx->bank2.size = 0;
                break;
@@ -198,7 +192,6 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                }
                BUG_ON(ctx->bank1.dma & ((1 << MFC_BANK1_ALIGN_ORDER) - 1));
        }
        return 0;
 }
@@ -449,8 +442,8 @@ static int s5p_mfc_set_enc_stream_buffer_v6(struct s5p_mfc_ctx *ctx,
        WRITEL(addr, S5P_FIMV_E_STREAM_BUFFER_ADDR_V6); /* 16B align */
        WRITEL(size, S5P_FIMV_E_STREAM_BUFFER_SIZE_V6);
-        mfc_debug(2, "stream buf addr: 0x%08lx, size: 0x%d",
+        mfc_debug(2, "stream buf addr: 0x%08lx, size: 0x%d\n",
-                addr, size);
+                  addr, size);
        return 0;
 }
@@ -463,8 +456,8 @@ static void s5p_mfc_set_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
        WRITEL(y_addr, S5P_FIMV_E_SOURCE_LUMA_ADDR_V6); /* 256B align */
        WRITEL(c_addr, S5P_FIMV_E_SOURCE_CHROMA_ADDR_V6);
-        mfc_debug(2, "enc src y buf addr: 0x%08lx", y_addr);
+        mfc_debug(2, "enc src y buf addr: 0x%08lx\n", y_addr);
-        mfc_debug(2, "enc src c buf addr: 0x%08lx", c_addr);
+        mfc_debug(2, "enc src c buf addr: 0x%08lx\n", c_addr);
 }
 static void s5p_mfc_get_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
@@ -479,8 +472,8 @@ static void s5p_mfc_get_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
        enc_recon_y_addr = READL(S5P_FIMV_E_RECON_LUMA_DPB_ADDR_V6);
        enc_recon_c_addr = READL(S5P_FIMV_E_RECON_CHROMA_DPB_ADDR_V6);
-        mfc_debug(2, "recon y addr: 0x%08lx", enc_recon_y_addr);
+        mfc_debug(2, "recon y addr: 0x%08lx\n", enc_recon_y_addr);
-        mfc_debug(2, "recon c addr: 0x%08lx", enc_recon_c_addr);
+        mfc_debug(2, "recon c addr: 0x%08lx\n", enc_recon_c_addr);
 }
 /* Set encoding ref & codec buffer */
@@ -497,7 +490,7 @@ static int s5p_mfc_set_enc_ref_buffer_v6(struct s5p_mfc_ctx *ctx)
        mfc_debug(2, "Buf1: %p (%d)\n", (void *)buf_addr1, buf_size1);
-        for (i = 0; i < ctx->dpb_count; i++) {
+        for (i = 0; i < ctx->pb_count; i++) {
                WRITEL(buf_addr1, S5P_FIMV_E_LUMA_DPB_V6 + (4 * i));
                buf_addr1 += ctx->luma_dpb_size;
                WRITEL(buf_addr1, S5P_FIMV_E_CHROMA_DPB_V6 + (4 * i));
@@ -520,7 +513,7 @@ static int s5p_mfc_set_enc_ref_buffer_v6(struct s5p_mfc_ctx *ctx)
        buf_size1 -= ctx->tmv_buffer_size;
        mfc_debug(2, "Buf1: %u, buf_size1: %d (ref frames %d)\n",
-                        buf_addr1, buf_size1, ctx->dpb_count);
+                        buf_addr1, buf_size1, ctx->pb_count);
        if (buf_size1 < 0) {
                mfc_debug(2, "Not enough memory has been allocated.\n");
                return -ENOMEM;
@@ -1431,8 +1424,8 @@ static inline int s5p_mfc_run_enc_frame(struct s5p_mfc_ctx *ctx)
        src_y_addr = vb2_dma_contig_plane_dma_addr(src_mb->b, 0);
        src_c_addr = vb2_dma_contig_plane_dma_addr(src_mb->b, 1);
-        mfc_debug(2, "enc src y addr: 0x%08lx", src_y_addr);
+        mfc_debug(2, "enc src y addr: 0x%08lx\n", src_y_addr);
-        mfc_debug(2, "enc src c addr: 0x%08lx", src_c_addr);
+        mfc_debug(2, "enc src c addr: 0x%08lx\n", src_c_addr);
        s5p_mfc_set_enc_frame_buffer_v6(ctx, src_y_addr, src_c_addr);
@@ -1522,22 +1515,6 @@ static inline int s5p_mfc_run_init_enc_buffers(struct s5p_mfc_ctx *ctx)
        struct s5p_mfc_dev *dev = ctx->dev;
        int ret;
-        ret = s5p_mfc_alloc_codec_buffers_v6(ctx);
-        if (ret) {
-                mfc_err("Failed to allocate encoding buffers.\n");
-                return -ENOMEM;
-        }
-        /* Header was generated now starting processing
-         * First set the reference frame buffers
-         */
-        if (ctx->capture_state != QUEUE_BUFS_REQUESTED) {
-                mfc_err("It seems that destionation buffers were not\n"
-                        "requested.MFC requires that header should be generated\n"
-                        "before allocating codec buffer.\n");
-                return -EAGAIN;
-        }
        dev->curr_ctx = ctx->num;
        s5p_mfc_clean_ctx_int_flags(ctx);
        ret = s5p_mfc_set_enc_ref_buffer_v6(ctx);
@@ -1582,7 +1559,7 @@ static void s5p_mfc_try_run_v6(struct s5p_mfc_dev *dev)
        mfc_debug(1, "Seting new context to %p\n", ctx);
        /* Got context to run in ctx */
        mfc_debug(1, "ctx->dst_queue_cnt=%d ctx->dpb_count=%d ctx->src_queue_cnt=%d\n",
-                ctx->dst_queue_cnt, ctx->dpb_count, ctx->src_queue_cnt);
+                ctx->dst_queue_cnt, ctx->pb_count, ctx->src_queue_cnt);
        mfc_debug(1, "ctx->state=%d\n", ctx->state);
        /* Last frame has already been sent to MFC
         * Now obtaining frames from MFC buffer */
@@ -1647,7 +1624,7 @@ static void s5p_mfc_try_run_v6(struct s5p_mfc_dev *dev)
                case MFCINST_GOT_INST:
                        s5p_mfc_run_init_enc(ctx);
                        break;
-                case MFCINST_HEAD_PARSED: /* Only for MFC6.x */
+                case MFCINST_HEAD_PRODUCED:
                        ret = s5p_mfc_run_init_enc_buffers(ctx);
                        break;
                default:
@@ -1730,7 +1707,7 @@ static int s5p_mfc_get_dspl_status_v6(struct s5p_mfc_dev *dev)
        return mfc_read(dev, S5P_FIMV_D_DISPLAY_STATUS_V6);
 }
-static int s5p_mfc_get_decoded_status_v6(struct s5p_mfc_dev *dev)
+static int s5p_mfc_get_dec_status_v6(struct s5p_mfc_dev *dev)
 {
        return mfc_read(dev, S5P_FIMV_D_DECODED_STATUS_V6);
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
index 6aa38a56aaf2..11d5f1dada32 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
@@ -50,19 +50,6 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
                goto err_p_ip_clk;
        }
-        pm->clock = clk_get(&dev->plat_dev->dev, dev->variant->mclk_name);
-        if (IS_ERR(pm->clock)) {
-                mfc_err("Failed to get MFC clock\n");
-                ret = PTR_ERR(pm->clock);
-                goto err_g_ip_clk_2;
-        }
-        ret = clk_prepare(pm->clock);
-        if (ret) {
-                mfc_err("Failed to prepare MFC clock\n");
-                goto err_p_ip_clk_2;
-        }
        atomic_set(&pm->power, 0);
 #ifdef CONFIG_PM_RUNTIME
        pm->device = &dev->plat_dev->dev;
@@ -72,10 +59,6 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
        atomic_set(&clk_ref, 0);
 #endif
        return 0;
-err_p_ip_clk_2:
-        clk_put(pm->clock);
-err_g_ip_clk_2:
-        clk_unprepare(pm->clock_gate);
 err_p_ip_clk:
        clk_put(pm->clock_gate);
 err_g_ip_clk:
@@ -86,8 +69,6 @@ void s5p_mfc_final_pm(struct s5p_mfc_dev *dev)
 {
        clk_unprepare(pm->clock_gate);
        clk_put(pm->clock_gate);
-        clk_unprepare(pm->clock);
-        clk_put(pm->clock);
 #ifdef CONFIG_PM_RUNTIME
        pm_runtime_disable(pm->device);
 #endif
@@ -98,7 +79,7 @@ int s5p_mfc_clock_on(void)
        int ret;
 #ifdef CLK_DEBUG
        atomic_inc(&clk_ref);
-        mfc_debug(3, "+ %d", atomic_read(&clk_ref));
+        mfc_debug(3, "+ %d\n", atomic_read(&clk_ref));
 #endif
        ret = clk_enable(pm->clock_gate);
        return ret;
@@ -108,7 +89,7 @@ void s5p_mfc_clock_off(void)
 {
 #ifdef CLK_DEBUG
        atomic_dec(&clk_ref);
-        mfc_debug(3, "- %d", atomic_read(&clk_ref));
+        mfc_debug(3, "- %d\n", atomic_read(&clk_ref));
 #endif
        clk_disable(pm->clock_gate);
 }
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index 0b32cc3f6a47..59a9deefb242 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -905,11 +905,11 @@ static int sh_veu_queue_setup(struct vb2_queue *vq,
                if (ftmp.fmt.pix.width != pix->width ||
                    ftmp.fmt.pix.height != pix->height)
                        return -EINVAL;
-                size = pix->bytesperline ? pix->bytesperline * pix->height :
+                size = pix->bytesperline ? pix->bytesperline * pix->height * fmt->depth / fmt->ydepth :
-                        pix->width * pix->height * fmt->depth >> 3;
+                        pix->width * pix->height * fmt->depth / fmt->ydepth;
        } else {
                vfmt = sh_veu_get_vfmt(veu, vq->type);
-                size = vfmt->bytesperline * vfmt->frame.height;
+                size = vfmt->bytesperline * vfmt->frame.height * vfmt->fmt->depth / vfmt->fmt->ydepth;
        }
        if (count < 2)
@@ -1033,8 +1033,6 @@ static int sh_veu_release(struct file *file)
        dev_dbg(veu->dev, "Releasing instance %p\n", veu_file);
-        pm_runtime_put(veu->dev);
        if (veu_file == veu->capture) {
                veu->capture = NULL;
                vb2_queue_release(v4l2_m2m_get_vq(veu->m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE));
@@ -1050,6 +1048,8 @@ static int sh_veu_release(struct file *file)
                veu->m2m_ctx = NULL;
        }
+        pm_runtime_put(veu->dev);
        kfree(veu_file);
        return 0;
@@ -1138,10 +1138,7 @@ static irqreturn_t sh_veu_isr(int irq, void *dev_id)
        veu->xaction++;
-        if (!veu->aborting)
+        return IRQ_WAKE_THREAD;
-                return IRQ_WAKE_THREAD;
-        return IRQ_HANDLED;
 }
 static int sh_veu_probe(struct platform_device *pdev)
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index eea832c5fd01..3a4efbdc7668 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -643,9 +643,9 @@ static int soc_camera_close(struct file *file)
                if (ici->ops->init_videobuf2)
                        vb2_queue_release(&icd->vb2_vidq);
-                ici->ops->remove(icd);
                __soc_camera_power_off(icd);
+                ici->ops->remove(icd);
        }
        if (icd->streamer == file)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index c0beee2fa37c..d529ba788f41 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -22,6 +22,7 @@ config RADIO_SI476X
        tristate "Silicon Laboratories Si476x I2C FM Radio"
        depends on I2C && VIDEO_V4L2
        depends on MFD_SI476X_CORE
+        depends on SND_SOC
        select SND_SOC_SI476X
        ---help---
          Choose Y here if you have this FM radio chip.
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 9430c6a29937..9dc8bafe6486 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -44,7 +44,7 @@
 #define FREQ_MUL (10000000 / 625)
-#define SI476X_PHDIV_STATUS_LINK_LOCKED(status) (0b10000000 & (status))
+#define SI476X_PHDIV_STATUS_LINK_LOCKED(status) (0x80 & (status))
 #define DRIVER_NAME "si476x-radio"
 #define DRIVER_CARD "SI476x AM/FM Receiver"
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 3fe207e038c7..d7ff3b9687c5 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -1159,6 +1159,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
                        regs[0x01] = 0x44; /* Select 24 Mhz clock */
                        regs[0x12] = 0x02; /* Set hstart to 2 */
                }
+                break;
+        case SENSOR_PAS202:
+                /* For some unknown reason we need to increase hstart by 1 on
+                   the sn9c103, otherwise we get wrong colors (bayer shift). */
+                if (sd->bridge == BRIDGE_103)
+                        regs[0x12] += 1;
+                break;
        }
        /* Disable compression when the raw bayer format has been selected */
        if (cam->cam_mode[gspca_dev->curr_mode].priv & MODE_RAW)
diff --git a/drivers/media/usb/pwc/pwc.h b/drivers/media/usb/pwc/pwc.h
index 7a6a0d39c2c6..81b017a554bc 100644
--- a/drivers/media/usb/pwc/pwc.h
+++ b/drivers/media/usb/pwc/pwc.h
@@ -226,7 +226,7 @@ struct pwc_device
        struct list_head queued_bufs;
        spinlock_t queued_bufs_lock; /* Protects queued_bufs */
-        /* Note if taking both locks v4l2_lock must always be locked first! */
+        /* If taking both locks vb_queue_lock must always be locked first! */
        struct mutex v4l2_lock;      /* Protects everything else */
        struct mutex vb_queue_lock;  /* Protects vb_queue and capt_file */
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index ebb8e48619a2..fccd08b66d1a 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1835,6 +1835,8 @@ bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
 {
        if (V4L2_CTRL_ID2CLASS(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
                return true;
+        if (V4L2_CTRL_ID2CLASS(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
+                return true;
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_MUTE:
        case V4L2_CID_AUDIO_VOLUME:
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index f81bda1a48ec..7658586fe5f4 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -243,7 +243,6 @@ static void v4l_print_format(const void *arg, bool write_only)
        const struct v4l2_vbi_format *vbi;
        const struct v4l2_sliced_vbi_format *sliced;
        const struct v4l2_window *win;
-        const struct v4l2_clip *clip;
        unsigned i;
        pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -253,7 +252,7 @@ static void v4l_print_format(const void *arg, bool write_only)
                pix = &p->fmt.pix;
                pr_cont(", width=%u, height=%u, "
                        "pixelformat=%c%c%c%c, field=%s, "
-                        "bytesperline=%u sizeimage=%u, colorspace=%d\n",
+                        "bytesperline=%u, sizeimage=%u, colorspace=%d\n",
                        pix->width, pix->height,
                        (pix->pixelformat & 0xff),
                        (pix->pixelformat >>  8) & 0xff,
@@ -284,20 +283,14 @@ static void v4l_print_format(const void *arg, bool write_only)
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                win = &p->fmt.win;
-                pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, "
+                /* Note: we can't print the clip list here since the clips
-                        "chromakey=0x%08x, bitmap=%p, "
+                 * pointer is a userspace pointer, not a kernelspace
-                        "global_alpha=0x%02x\n",
+                 * pointer. */
-                        win->w.width, win->w.height,
+                pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, chromakey=0x%08x, clipcount=%u, clips=%p, bitmap=%p, global_alpha=0x%02x\n",
-                        win->w.left, win->w.top,
+                        win->w.width, win->w.height, win->w.left, win->w.top,
                        prt_names(win->field, v4l2_field_names),
-                        win->chromakey, win->bitmap, win->global_alpha);
+                        win->chromakey, win->clipcount, win->clips,
-                clip = win->clips;
+                        win->bitmap, win->global_alpha);
-                for (i = 0; i < win->clipcount; i++) {
-                        printk(KERN_DEBUG "clip %u: wxh=%dx%d, x,y=%d,%d\n",
-                                        i, clip->c.width, clip->c.height,
-                                        clip->c.left, clip->c.top);
-                        clip = clip->next;
-                }
                break;
        case V4L2_BUF_TYPE_VBI_CAPTURE:
        case V4L2_BUF_TYPE_VBI_OUTPUT:
@@ -332,7 +325,7 @@ static void v4l_print_framebuffer(const void *arg, bool write_only)
        pr_cont("capability=0x%x, flags=0x%x, base=0x%p, width=%u, "
                "height=%u, pixelformat=%c%c%c%c, "
-                "bytesperline=%u sizeimage=%u, colorspace=%d\n",
+                "bytesperline=%u, sizeimage=%u, colorspace=%d\n",
                        p->capability, p->flags, p->base,
                        p->fmt.width, p->fmt.height,
                        (p->fmt.pixelformat & 0xff),
@@ -353,7 +346,7 @@ static void v4l_print_modulator(const void *arg, bool write_only)
        const struct v4l2_modulator *p = arg;
        if (write_only)
-                pr_cont("index=%u, txsubchans=0x%x", p->index, p->txsubchans);
+                pr_cont("index=%u, txsubchans=0x%x\n", p->index, p->txsubchans);
        else
                pr_cont("index=%u, name=%.*s, capability=0x%x, "
                        "rangelow=%u, rangehigh=%u, txsubchans=0x%x\n",
@@ -445,13 +438,13 @@ static void v4l_print_buffer(const void *arg, bool write_only)
                for (i = 0; i < p->length; ++i) {
                        plane = &p->m.planes[i];
                        printk(KERN_DEBUG
-                                "plane %d: bytesused=%d, data_offset=0x%08x "
+                                "plane %d: bytesused=%d, data_offset=0x%08x, "
                                "offset/userptr=0x%lx, length=%d\n",
                                i, plane->bytesused, plane->data_offset,
                                plane->m.userptr, plane->length);
                }
        } else {
-                pr_cont("bytesused=%d, offset/userptr=0x%lx, length=%d\n",
+                pr_cont(", bytesused=%d, offset/userptr=0x%lx, length=%d\n",
                        p->bytesused, p->m.userptr, p->length);
        }
@@ -504,6 +497,8 @@ static void v4l_print_streamparm(const void *arg, bool write_only)
                        c->capability, c->outputmode,
                        c->timeperframe.numerator, c->timeperframe.denominator,
                        c->extendedmode, c->writebuffers);
+        } else {
+                pr_cont("\n");
        }
 }
@@ -734,11 +729,11 @@ static void v4l_print_frmsizeenum(const void *arg, bool write_only)
                        p->type);
        switch (p->type) {
        case V4L2_FRMSIZE_TYPE_DISCRETE:
-                pr_cont(" wxh=%ux%u\n",
+                pr_cont(", wxh=%ux%u\n",
                        p->discrete.width, p->discrete.height);
                break;
        case V4L2_FRMSIZE_TYPE_STEPWISE:
-                pr_cont(" min=%ux%u, max=%ux%u, step=%ux%u\n",
+                pr_cont(", min=%ux%u, max=%ux%u, step=%ux%u\n",
                                p->stepwise.min_width,  p->stepwise.min_height,
                                p->stepwise.step_width, p->stepwise.step_height,
                                p->stepwise.max_width,  p->stepwise.max_height);
@@ -764,12 +759,12 @@ static void v4l_print_frmivalenum(const void *arg, bool write_only)
                        p->width, p->height, p->type);
        switch (p->type) {
        case V4L2_FRMIVAL_TYPE_DISCRETE:
-                pr_cont(" fps=%d/%d\n",
+                pr_cont(", fps=%d/%d\n",
                                p->discrete.numerator,
                                p->discrete.denominator);
                break;
        case V4L2_FRMIVAL_TYPE_STEPWISE:
-                pr_cont(" min=%d/%d, max=%d/%d, step=%d/%d\n",
+                pr_cont(", min=%d/%d, max=%d/%d, step=%d/%d\n",
                                p->stepwise.min.numerator,
                                p->stepwise.min.denominator,
                                p->stepwise.max.numerator,
@@ -807,8 +802,8 @@ static void v4l_print_event(const void *arg, bool write_only)
                        pr_cont("value64=%lld, ", c->value64);
                else
                        pr_cont("value=%d, ", c->value);
-                pr_cont("flags=0x%x, minimum=%d, maximum=%d, step=%d,"
+                pr_cont("flags=0x%x, minimum=%d, maximum=%d, step=%d, "
-                                " default_value=%d\n",
+                        "default_value=%d\n",
                        c->flags, c->minimum, c->maximum,
                        c->step, c->default_value);
                break;
@@ -845,7 +840,7 @@ static void v4l_print_freq_band(const void *arg, bool write_only)
        const struct v4l2_frequency_band *p = arg;
        pr_cont("tuner=%u, type=%u, index=%u, capability=0x%x, "
-                        "rangelow=%u, rangehigh=%u, modulation=0x%x\n",
+                "rangelow=%u, rangehigh=%u, modulation=0x%x\n",
                        p->tuner, p->type, p->index,
                        p->capability, p->rangelow,
                        p->rangehigh, p->modulation);
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index 66f599fcb829..e96497f7c3ed 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -205,7 +205,7 @@ static void v4l2_m2m_try_run(struct v4l2_m2m_dev *m2m_dev)
 static void v4l2_m2m_try_schedule(struct v4l2_m2m_ctx *m2m_ctx)
 {
        struct v4l2_m2m_dev *m2m_dev;
-        unsigned long flags_job, flags;
+        unsigned long flags_job, flags_out, flags_cap;
        m2m_dev = m2m_ctx->m2m_dev;
        dprintk("Trying to schedule a job for m2m_ctx: %p\n", m2m_ctx);
@@ -223,23 +223,26 @@ static void v4l2_m2m_try_schedule(struct v4l2_m2m_ctx *m2m_ctx)
                return;
        }
-        spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+        spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags_out);
        if (list_empty(&m2m_ctx->out_q_ctx.rdy_queue)) {
-                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock,
+                                        flags_out);
                spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags_job);
                dprintk("No input buffers available\n");
                return;
        }
-        spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+        spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags_cap);
        if (list_empty(&m2m_ctx->cap_q_ctx.rdy_queue)) {
-                spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+                spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock,
-                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+                                        flags_cap);
+                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock,
+                                        flags_out);
                spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags_job);
                dprintk("No output buffers available\n");
                return;
        }
-        spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+        spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags_cap);
-        spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+        spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags_out);
        if (m2m_dev->m2m_ops->job_ready
                && (!m2m_dev->m2m_ops->job_ready(m2m_ctx->priv))) {
@@ -372,6 +375,20 @@ int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
 EXPORT_SYMBOL_GPL(v4l2_m2m_dqbuf);
 /**
+ * v4l2_m2m_create_bufs() - create a source or destination buffer, depending
+ * on the type
+ */
+int v4l2_m2m_create_bufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+                         struct v4l2_create_buffers *create)
+{
+        struct vb2_queue *vq;
+        vq = v4l2_m2m_get_vq(m2m_ctx, create->format.type);
+        return vb2_create_bufs(vq, create);
+}
+EXPORT_SYMBOL_GPL(v4l2_m2m_create_bufs);
+/**
 * v4l2_m2m_expbuf() - export a source or destination buffer, depending on
 * the type
 */
@@ -486,8 +503,10 @@ unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
        if (m2m_ctx->m2m_dev->m2m_ops->unlock)
                m2m_ctx->m2m_dev->m2m_ops->unlock(m2m_ctx->priv);
-        poll_wait(file, &src_q->done_wq, wait);
+        if (list_empty(&src_q->done_list))
-        poll_wait(file, &dst_q->done_wq, wait);
+                poll_wait(file, &src_q->done_wq, wait);
+        if (list_empty(&dst_q->done_list))
+                poll_wait(file, &dst_q->done_wq, wait);
        if (m2m_ctx->m2m_dev->m2m_ops->lock)
                m2m_ctx->m2m_dev->m2m_ops->lock(m2m_ctx->priv);
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 7d833eefaf4e..e3bdc3be91e1 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -2014,7 +2014,8 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
        if (list_empty(&q->queued_list))
                return res | POLLERR;
-        poll_wait(file, &q->done_wq, wait);
+        if (list_empty(&q->done_list))
+                poll_wait(file, &q->done_wq, wait);
        /*
         * Take first buffer available for dequeuing.
diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index 6e8bc9d88c41..94d957d203a6 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -244,7 +244,7 @@ bnad_debugfs_lseek(struct file *file, loff_t offset, int orig)
                file->f_pos += offset;
                break;
        case 2:
-                file->f_pos = debug->buffer_len - offset;
+                file->f_pos = debug->buffer_len + offset;
                break;
        default:
                return -EINVAL;
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 9544cdc0d1af..e79e006eb9ab 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -811,6 +811,70 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
        return pcidev->irq;
 }
+static struct iosapic_info *first_isi = NULL;
+#ifdef CONFIG_64BIT
+int iosapic_serial_irq(int num)
+{
+        struct iosapic_info *isi = first_isi;
+        struct irt_entry *irte = NULL;  /* only used if PAT PDC */
+        struct vector_info *vi;
+        int isi_line;   /* line used by device */
+        /* lookup IRT entry for isi/slot/pin set */
+        irte = &irt_cell[num];
+        DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
+                irte,
+                irte->entry_type,
+                irte->entry_length,
+                irte->polarity_trigger,
+                irte->src_bus_irq_devno,
+                irte->src_bus_id,
+                irte->src_seg_id,
+                irte->dest_iosapic_intin,
+                (u32) irte->dest_iosapic_addr);
+        isi_line = irte->dest_iosapic_intin;
+        /* get vector info for this input line */
+        vi = isi->isi_vector + isi_line;
+        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
+        /* If this IRQ line has already been setup, skip it */
+        if (vi->irte)
+                goto out;
+        vi->irte = irte;
+        /*
+         * Allocate processor IRQ
+         *
+         * XXX/FIXME The txn_alloc_irq() code and related code should be
+         * moved to enable_irq(). That way we only allocate processor IRQ
+         * bits for devices that actually have drivers claiming them.
+         * Right now we assign an IRQ to every PCI device present,
+         * regardless of whether it's used or not.
+         */
+        vi->txn_irq = txn_alloc_irq(8);
+        if (vi->txn_irq < 0)
+                panic("I/O sapic: couldn't get TXN IRQ\n");
+        /* enable_irq() will use txn_* to program IRdT */
+        vi->txn_addr = txn_alloc_addr(vi->txn_irq);
+        vi->txn_data = txn_alloc_data(vi->txn_irq);
+        vi->eoi_addr = isi->addr + IOSAPIC_REG_EOI;
+        vi->eoi_data = cpu_to_le32(vi->txn_data);
+        cpu_claim_irq(vi->txn_irq, &iosapic_interrupt_type, vi);
+ out:
+        return vi->txn_irq;
+}
+#endif
 /*
 ** squirrel away the I/O Sapic Version
@@ -877,6 +941,8 @@ void *iosapic_register(unsigned long hpa)
                vip->irqline = (unsigned char) cnt;
                vip->iosapic = isi;
        }
+        if (!first_isi)
+                first_isi = isi;
        return isi;
 }
diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c
index 439c012be763..b63d534192e3 100644
--- a/drivers/scsi/bfa/bfad_debugfs.c
+++ b/drivers/scsi/bfa/bfad_debugfs.c
@@ -186,7 +186,7 @@ bfad_debugfs_lseek(struct file *file, loff_t offset, int orig)
                file->f_pos += offset;
                break;
        case 2:
-                file->f_pos = debug->buffer_len - offset;
+                file->f_pos = debug->buffer_len + offset;
                break;
        default:
                return -EINVAL;
diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
index adc1f7f471f5..85e1ffd0e5c5 100644
--- a/drivers/scsi/fnic/fnic_debugfs.c
+++ b/drivers/scsi/fnic/fnic_debugfs.c
@@ -174,7 +174,7 @@ static loff_t fnic_trace_debugfs_lseek(struct file *file,
                pos = file->f_pos + offset;
                break;
        case 2:
-                pos = fnic_dbg_prt->buffer_len - offset;
+                pos = fnic_dbg_prt->buffer_len + offset;
        }
        return (pos < 0 || pos > fnic_dbg_prt->buffer_len) ?
                          -EINVAL : (file->f_pos = pos);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index f63f5ff7f274..f525ecb7a9c6 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -1178,7 +1178,7 @@ lpfc_debugfs_lseek(struct file *file, loff_t off, int whence)
                pos = file->f_pos + off;
                break;
        case 2:
-                pos = debug->len - off;
+                pos = debug->len + off;
        }
        return (pos < 0 || pos > debug->len) ? -EINVAL : (file->f_pos = pos);
 }
diff --git a/drivers/staging/media/davinci_vpfe/Kconfig b/drivers/staging/media/davinci_vpfe/Kconfig
index 2e4a28b018e8..12f321dd2399 100644
--- a/drivers/staging/media/davinci_vpfe/Kconfig
+++ b/drivers/staging/media/davinci_vpfe/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_DM365_VPFE
        tristate "DM365 VPFE Media Controller Capture Driver"
-        depends on VIDEO_V4L2 && ARCH_DAVINCI_DM365 && !VIDEO_VPFE_CAPTURE
+        depends on VIDEO_V4L2 && ARCH_DAVINCI_DM365 && !VIDEO_DM365_ISIF
        select VIDEOBUF2_DMA_CONTIG
        help
          Support for DM365 VPFE based Media Controller Capture driver.
diff --git a/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c b/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
index b88e1ddce229..d8ce20d2fbda 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
@@ -639,7 +639,8 @@ static int vpfe_probe(struct platform_device *pdev)
        if (ret)
                goto probe_free_dev_mem;
-        if (vpfe_initialize_modules(vpfe_dev, pdev))
+        ret = vpfe_initialize_modules(vpfe_dev, pdev);
+        if (ret)
                goto probe_disable_clock;
        vpfe_dev->media_dev.dev = vpfe_dev->pdev;
@@ -663,7 +664,8 @@ static int vpfe_probe(struct platform_device *pdev)
        /* set the driver data in platform device */
        platform_set_drvdata(pdev, vpfe_dev);
        /* register subdevs/entities */
-        if (vpfe_register_entities(vpfe_dev))
+        ret = vpfe_register_entities(vpfe_dev);
+        if (ret)
                goto probe_out_v4l2_unregister;
        ret = vpfe_attach_irq(vpfe_dev);
diff --git a/drivers/staging/media/solo6x10/Kconfig b/drivers/staging/media/solo6x10/Kconfig
index df6569b997b8..34f3b6d02d2a 100644
--- a/drivers/staging/media/solo6x10/Kconfig
+++ b/drivers/staging/media/solo6x10/Kconfig
@@ -5,6 +5,7 @@ config SOLO6X10
        select VIDEOBUF2_DMA_SG
        select VIDEOBUF2_DMA_CONTIG
        select SND_PCM
+        select FONT_8x16
        ---help---
          This driver supports the Softlogic based MPEG-4 and h.264 codec
          cards.
diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
index 097dff9c08ad..bb91b4713ebd 100644
--- a/drivers/tty/serial/8250/8250_gsc.c
+++ b/drivers/tty/serial/8250/8250_gsc.c
@@ -30,6 +30,12 @@ static int __init serial_init_chip(struct parisc_device *dev)
        unsigned long address;
        int err;
+#ifdef CONFIG_64BIT
+        extern int iosapic_serial_irq(int cellnum);
+        if (!dev->irq && (dev->id.sversion == 0xad))
+                dev->irq = iosapic_serial_irq(dev->mod_index-1);
+#endif
        if (!dev->irq) {
                /* We find some unattached serial ports by walking native
                 * busses.  These should be silently ignored.  Otherwise,
@@ -51,7 +57,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
        memset(&uart, 0, sizeof(uart));
        uart.port.iotype        = UPIO_MEM;
        /* 7.272727MHz on Lasi.  Assumed the same for Dino, Wax and Timi. */
-        uart.port.uartclk       = 7272727;
+        uart.port.uartclk       = (dev->id.sversion != 0xad) ?
+                                        7272727 : 1843200;
        uart.port.mapbase       = address;
        uart.port.membase       = ioremap_nocache(address, 16);
        uart.port.irq   = dev->irq;
@@ -73,6 +80,7 @@ static struct parisc_device_id serial_tbl[] = {
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x00075 },
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x0008c },
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x0008d },
+        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x000ad },
        { 0 }
 };
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index d3eef01da648..0f4555b2a31b 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -110,6 +110,8 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                  struct v4l2_buffer *buf);
 int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                   struct v4l2_buffer *buf);
+int v4l2_m2m_create_bufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+                         struct v4l2_create_buffers *create);
 int v4l2_m2m_expbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                   struct v4l2_exportbuffer *eb);
diff --git a/mm/slab_common.c b/mm/slab_common.c
index ff3218a0f5e1..2d414508e9ec 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -373,8 +373,10 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)
 {
        int index;
-        if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))
+        if (size > KMALLOC_MAX_SIZE) {
+                WARN_ON_ONCE(!(flags & __GFP_NOWARN));
                return NULL;
+        }
        if (size <= 192) {
                if (!size)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bd8d46cca2b3..cccaf9c7a7bb 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -58,6 +58,7 @@ enum {
        CS420X_GPIO_23,
        CS420X_MBP101,
        CS420X_MBP81,
+        CS420X_MBA42,
        CS420X_AUTO,
        /* aliases */
        CS420X_IMAC27_122 = CS420X_GPIO_23,
@@ -346,6 +347,7 @@ static const struct hda_model_fixup cs420x_models[] = {
        { .id = CS420X_APPLE, .name = "apple" },
        { .id = CS420X_MBP101, .name = "mbp101" },
        { .id = CS420X_MBP81, .name = "mbp81" },
+        { .id = CS420X_MBA42, .name = "mba42" },
        {}
 };
@@ -361,6 +363,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
        SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
        SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
        SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+        SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
        SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
        {} /* terminator */
 };
@@ -414,6 +417,20 @@ static const struct hda_pintbl mbp101_pincfgs[] = {
        {} /* terminator */
 };
+static const struct hda_pintbl mba42_pincfgs[] = {
+        { 0x09, 0x012b4030 }, /* HP */
+        { 0x0a, 0x400000f0 },
+        { 0x0b, 0x90100120 }, /* speaker */
+        { 0x0c, 0x400000f0 },
+        { 0x0d, 0x90a00110 }, /* mic */
+        { 0x0e, 0x400000f0 },
+        { 0x0f, 0x400000f0 },
+        { 0x10, 0x400000f0 },
+        { 0x12, 0x400000f0 },
+        { 0x15, 0x400000f0 },
+        {} /* terminator */
+};
 static void cs420x_fixup_gpio_13(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -482,6 +499,12 @@ static const struct hda_fixup cs420x_fixups[] = {
                .chained = true,
                .chain_id = CS420X_GPIO_13,
        },
+        [CS420X_MBA42] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = mba42_pincfgs,
+                .chained = true,
+                .chain_id = CS420X_GPIO_13,
+        },
 };
 static struct cs_spec *cs_alloc_spec(struct hda_codec *codec, int vendor_nid)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 02e22b4458d2..403010c9e82e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3483,6 +3483,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05ca, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05cb, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05de, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x05e0, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05e9, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05ea, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05eb, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -3494,6 +3495,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05f8, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0606, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
        SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
@@ -3596,6 +3599,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC269_FIXUP_INV_DMIC, .name = "inv-dmic"},
        {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
        {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+        {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+        {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
        {}
 };
@@ -4275,6 +4280,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
        {.id = ALC662_FIXUP_ASUS_MODE7, .name = "asus-mode7"},
        {.id = ALC662_FIXUP_ASUS_MODE8, .name = "asus-mode8"},
        {.id = ALC662_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
        {}
 };
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 1a033177b83f..64952e2d3ed1 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -147,14 +147,32 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
                return -EINVAL;
        }
+        alts = &iface->altsetting[0];
+        altsd = get_iface_desc(alts);
+        /*
+         * Android with both accessory and audio interfaces enabled gets the
+         * interface numbers wrong.
+         */
+        if ((chip->usb_id == USB_ID(0x18d1, 0x2d04) ||
+             chip->usb_id == USB_ID(0x18d1, 0x2d05)) &&
+            interface == 0 &&
+            altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC &&
+            altsd->bInterfaceSubClass == USB_SUBCLASS_VENDOR_SPEC) {
+                interface = 2;
+                iface = usb_ifnum_to_if(dev, interface);
+                if (!iface)
+                        return -EINVAL;
+                alts = &iface->altsetting[0];
+                altsd = get_iface_desc(alts);
+        }
        if (usb_interface_claimed(iface)) {
                snd_printdd(KERN_INFO "%d:%d:%d: skipping, already claimed\n",
                                                dev->devnum, ctrlif, interface);
                return -EINVAL;
        }
-        alts = &iface->altsetting[0];
-        altsd = get_iface_desc(alts);
        if ((altsd->bInterfaceClass == USB_CLASS_AUDIO ||
             altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC) &&
            altsd->bInterfaceSubClass == USB_SUBCLASS_MIDISTREAMING) {
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index e5c7f9f20fdd..d5438083fd6a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -885,6 +885,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
        case USB_ID(0x046d, 0x0808):
        case USB_ID(0x046d, 0x0809):
+        case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
        case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
        case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
        case USB_ID(0x046d, 0x0991):