Merge git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb

* git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (48 commits)
  V4L/DVB (8001): dib0070: fix dib0070_attach when !CONFIG_DVB_TUNER_DIB0070
  V4L/DVB (8000): tda827x: fix NULL pointer in tda827xa_lna_gain
  V4L/DVB (7990): Fix entry for PowerColor RA 330 and make it run with firmware version 2.7
  V4L/DVB (7983): tda18271_calc_rf_cal must return the return value of tda18271_lookup_map
  V4L/DVB (7978): cx18: explicitly test for XC2028 tuner
  V4L/DVB (7977): cx18: fix init order and remove duplicate open_on_first_use.
  V4L/DVB (7975): saa7134_empress
  V4L/DVB (7974): fix MEDIA_TUNER && FW_LOADER build error
  V4L/DVB (7972): or51132.c: unaligned
  V4L/DVB (7971): usb: unaligned
  V4L/DVB (7970): mix trivial endianness annotations
  V4L/DVB (7969): m920x: unaligned access
  V4L/DVB (7968): zoran: endianness annotations
  V4L/DVB (7967): bt8xx: unaligned access
  V4L/DVB (7966): cx18: direct dereferencing of iomem
  V4L/DVB (7965): annotate bcx_riscmem
  V4L/DVB (7964): cx18 iomem annotations
  V4L/DVB (7963): ivtv: trivial annotations
  V4L/DVB (7962): ttusb endianness annotations and fixes
  V4L/DVB (7961): fix endianness bug in dib0700_devices.c
  ...
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 9c93a03..118ca6e 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -327,6 +327,52 @@
 now, but you can do this to mark internal company procedures or just
 point out some special detail about the sign-off. 
 
+If you are a subsystem or branch maintainer, sometimes you need to slightly
+modify patches you receive in order to merge them, because the code is not
+exactly the same in your tree and the submitters'. If you stick strictly to
+rule (c), you should ask the submitter to rediff, but this is a totally
+counter-productive waste of time and energy. Rule (b) allows you to adjust
+the code, but then it is very impolite to change one submitter's code and
+make him endorse your bugs. To solve this problem, it is recommended that
+you add a line between the last Signed-off-by header and yours, indicating
+the nature of your changes. While there is nothing mandatory about this, it
+seems like prepending the description with your mail and/or name, all
+enclosed in square brackets, is noticeable enough to make it obvious that
+you are responsible for last-minute changes. Example :
+
+	Signed-off-by: Random J Developer <random@developer.example.org>
+	[lucky@maintainer.example.org: struct foo moved from foo.c to foo.h]
+	Signed-off-by: Lucky K Maintainer <lucky@maintainer.example.org>
+
+This practise is particularly helpful if you maintain a stable branch and
+want at the same time to credit the author, track changes, merge the fix,
+and protect the submitter from complaints. Note that under no circumstances
+can you change the author's identity (the From header), as it is the one
+which appears in the changelog.
+
+Special note to back-porters: It seems to be a common and useful practise
+to insert an indication of the origin of a patch at the top of the commit
+message (just after the subject line) to facilitate tracking. For instance,
+here's what we see in 2.6-stable :
+
+    Date:   Tue May 13 19:10:30 2008 +0000
+
+        SCSI: libiscsi regression in 2.6.25: fix nop timer handling
+
+        commit 4cf1043593db6a337f10e006c23c69e5fc93e722 upstream
+
+And here's what appears in 2.4 :
+
+    Date:   Tue May 13 22:12:27 2008 +0200
+
+        wireless, airo: waitbusy() won't delay
+
+        [backport of 2.6 commit b7acbdfbd1f277c1eb23f344f899cfa4cd0bf36a]
+
+Whatever the format, this information provides a valuable help to people
+tracking your trees, and to people trying to trouble-shoot bugs in your
+tree.
+
 
 13) When to use Acked-by: and Cc:
 
diff --git a/arch/mips/au1000/common/clocks.c b/arch/mips/au1000/common/clocks.c
index 46f8ee0..043429d 100644
--- a/arch/mips/au1000/common/clocks.c
+++ b/arch/mips/au1000/common/clocks.c
@@ -45,6 +45,7 @@
 {
 	return au1x00_clock;
 }
+EXPORT_SYMBOL(get_au1x00_speed);
 
 /*
  * The UART baud base is not known at compile time ... if
diff --git a/arch/mips/au1000/common/dbdma.c b/arch/mips/au1000/common/dbdma.c
index 42d5552..601ee91 100644
--- a/arch/mips/au1000/common/dbdma.c
+++ b/arch/mips/au1000/common/dbdma.c
@@ -216,6 +216,17 @@
 }
 EXPORT_SYMBOL(au1xxx_ddma_add_device);
 
+void au1xxx_ddma_del_device(u32 devid)
+{
+	dbdev_tab_t *p = find_dbdev_id(devid);
+
+	if (p != NULL) {
+		memset(p, 0, sizeof(dbdev_tab_t));
+		p->dev_id = ~0;
+	}
+}
+EXPORT_SYMBOL(au1xxx_ddma_del_device);
+
 /* Allocate a channel and return a non-zero descriptor if successful. */
 u32 au1xxx_dbdma_chan_alloc(u32 srcid, u32 destid,
        void (*callback)(int, void *), void *callparam)
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index cc02440..65e46a6 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -30,7 +30,6 @@
 obj-$(CONFIG_CPU_MIPS32)	+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_MIPS64)	+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R3000)		+= r2300_fpu.o r2300_switch.o
-obj-$(CONFIG_CPU_R4000)		+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R4300)		+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R4X00)		+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R5000)		+= r4k_fpu.o r4k_switch.o
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cb8b0e2..f9165d1 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -88,15 +88,17 @@
 #ifdef CONFIG_KALLSYMS
 	printk("\n");
 #endif
-#define IS_KVA01(a) ((((unsigned int)a) & 0xc0000000) == 0x80000000)
-	if (IS_KVA01(sp)) {
-		while (!kstack_end(sp)) {
-			addr = *sp++;
-			if (__kernel_text_address(addr))
-				print_ip_sym(addr);
+	while (!kstack_end(sp)) {
+		unsigned long __user *p =
+			(unsigned long __user *)(unsigned long)sp++;
+		if (__get_user(addr, p)) {
+			printk(" (Bad stack address)");
+			break;
 		}
-		printk("\n");
+		if (__kernel_text_address(addr))
+			print_ip_sym(addr);
 	}
+	printk("\n");
 }
 
 #ifdef CONFIG_KALLSYMS
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index 008fd82..fe2cac1 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -58,27 +58,8 @@
 static int mips_cpu_perf_irq;
 extern int cp0_perfcount_irq;
 
-DEFINE_PER_CPU(unsigned int, tickcount);
-#define tickcount_this_cpu __get_cpu_var(tickcount)
-static unsigned long ledbitmask;
-
 static void mips_timer_dispatch(void)
 {
-#if defined(CONFIG_MIPS_MALTA) || defined(CONFIG_MIPS_ATLAS)
-	/*
-	 * Yes, this is very tacky, won't work as expected with SMTC and
-	 * dyntick will break it,
-	 * but it gives me a nice warm feeling during debug
-	 */
-#define LEDBAR 0xbf000408
-	if (tickcount_this_cpu++ >= HZ) {
-		tickcount_this_cpu = 0;
-		change_bit(smp_processor_id(), &ledbitmask);
-		smp_wmb(); /* Make sure every one else sees the change */
-		/* This will pick up any recent changes made by other CPU's */
-		*(unsigned int *)LEDBAR = ledbitmask;
-	}
-#endif
 	do_IRQ(mips_cpu_timer_irq);
 }
 
diff --git a/arch/mips/mm/page.c b/arch/mips/mm/page.c
index d827d61..cab81f4 100644
--- a/arch/mips/mm/page.c
+++ b/arch/mips/mm/page.c
@@ -310,8 +310,8 @@
 	if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
 		uasm_i_lui(&buf, AT, 0xa000);
 
-	off = min(8, pref_bias_clear_store / cache_line_size) *
-	      cache_line_size;
+	off = cache_line_size ? min(8, pref_bias_clear_store / cache_line_size)
+	                        * cache_line_size : 0;
 	while (off) {
 		build_clear_pref(&buf, -off);
 		off -= cache_line_size;
@@ -454,12 +454,14 @@
 	if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
 		uasm_i_lui(&buf, AT, 0xa000);
 
-	off = min(8, pref_bias_copy_load / cache_line_size) * cache_line_size;
+	off = cache_line_size ? min(8, pref_bias_copy_load / cache_line_size) *
+	                        cache_line_size : 0;
 	while (off) {
 		build_copy_load_pref(&buf, -off);
 		off -= cache_line_size;
 	}
-	off = min(8, pref_bias_copy_store / cache_line_size) * cache_line_size;
+	off = cache_line_size ? min(8, pref_bias_copy_load / cache_line_size) *
+	                        cache_line_size : 0;
 	while (off) {
 		build_copy_store_pref(&buf, -off);
 		off -= cache_line_size;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 382738c..76da73a 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -224,8 +224,9 @@
 static void __cpuinit __maybe_unused build_tlb_probe_entry(u32 **p)
 {
 	switch (current_cpu_type()) {
-	/* Found by experiment: R4600 v2.0 needs this, too.  */
+	/* Found by experiment: R4600 v2.0/R4700 needs this, too.  */
 	case CPU_R4600:
+	case CPU_R4700:
 	case CPU_R5000:
 	case CPU_R5000A:
 	case CPU_NEVADA:
diff --git a/arch/mips/pci/ops-bridge.c b/arch/mips/pci/ops-bridge.c
index 1fa0992..b46b3e2 100644
--- a/arch/mips/pci/ops-bridge.c
+++ b/arch/mips/pci/ops-bridge.c
@@ -14,6 +14,22 @@
 #include <asm/sn/sn0/hub.h>
 
 /*
+ * Most of the IOC3 PCI config register aren't present
+ * we emulate what is needed for a normal PCI enumeration
+ */
+static u32 emulate_ioc3_cfg(int where, int size)
+{
+	if (size == 1 && where == 0x3d)
+		return 0x01;
+	else if (size == 2 && where == 0x3c)
+		return 0x0100;
+	else if (size == 4 && where == 0x3c)
+		return 0x00000100;
+
+	return 0;
+}
+
+/*
  * The Bridge ASIC supports both type 0 and type 1 access.  Type 1 is
  * not really documented, so right now I can't write code which uses it.
  * Therefore we use type 0 accesses for now even though they won't work
@@ -64,7 +80,7 @@
 	 * generic PCI code a chance to look at the wrong register.
 	 */
 	if ((where >= 0x14 && where < 0x40) || (where >= 0x48)) {
-		*value = 0;
+		*value = emulate_ioc3_cfg(where, size);
 		return PCIBIOS_SUCCESSFUL;
 	}
 
@@ -127,7 +143,7 @@
 	 * generic PCI code a chance to look at the wrong register.
 	 */
 	if ((where >= 0x14 && where < 0x40) || (where >= 0x48)) {
-		*value = 0;
+		*value = emulate_ioc3_cfg(where, size);
 		return PCIBIOS_SUCCESSFUL;
 	}
 
diff --git a/arch/mips/pci/pci-ip27.c b/arch/mips/pci/pci-ip27.c
index bb64828..a185169 100644
--- a/arch/mips/pci/pci-ip27.c
+++ b/arch/mips/pci/pci-ip27.c
@@ -47,6 +47,9 @@
 	static int num_bridges = 0;
 	bridge_t *bridge;
 	int slot;
+	extern int pci_probe_only;
+
+	pci_probe_only = 1;
 
 	printk("a bridge\n");
 
@@ -100,6 +103,11 @@
 	 */
 	bridge->b_wid_control |= BRIDGE_CTRL_IO_SWAP |
 	                         BRIDGE_CTRL_MEM_SWAP;
+#ifdef CONFIG_PAGE_SIZE_4KB
+	bridge->b_wid_control &= ~BRIDGE_CTRL_PAGE_SIZE;
+#else /* 16kB or larger */
+	bridge->b_wid_control |= BRIDGE_CTRL_PAGE_SIZE;
+#endif
 
 	/*
 	 * Hmm...  IRIX sets additional bits in the address which
diff --git a/arch/mips/sgi-ip27/ip27-init.c b/arch/mips/sgi-ip27/ip27-init.c
index 7093e7c..4a500e8 100644
--- a/arch/mips/sgi-ip27/ip27-init.c
+++ b/arch/mips/sgi-ip27/ip27-init.c
@@ -161,27 +161,6 @@
 	return NASID_TO_COMPACT_NODEID(get_nasid());
 }
 
-/* Extracted from the IOC3 meta driver.  FIXME.  */
-static inline void ioc3_sio_init(void)
-{
-	struct ioc3 *ioc3;
-	nasid_t nid;
-	long loops;
-
-	nid = get_nasid();
-	ioc3 = (struct ioc3 *) KL_CONFIG_CH_CONS_INFO(nid)->memory_base;
-
-	ioc3->sscr_a = 0;			/* PIO mode for uarta.  */
-	ioc3->sscr_b = 0;			/* PIO mode for uartb.  */
-	ioc3->sio_iec = ~0;
-	ioc3->sio_ies = (SIO_IR_SA_INT | SIO_IR_SB_INT);
-
-	loops=1000000; while(loops--);
-	ioc3->sregs.uarta.iu_fcr = 0;
-	ioc3->sregs.uartb.iu_fcr = 0;
-	loops=1000000; while(loops--);
-}
-
 static inline void ioc3_eth_init(void)
 {
 	struct ioc3 *ioc3;
@@ -234,7 +213,6 @@
 		panic("Kernel compiled for N mode.");
 #endif
 
-	ioc3_sio_init();
 	ioc3_eth_init();
 	per_cpu_init();
 
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index bf438d0..42cd109 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -33,10 +33,6 @@
 #define SLOT_PFNSHIFT           (SLOT_SHIFT - PAGE_SHIFT)
 #define PFN_NASIDSHFT           (NASID_SHFT - PAGE_SHIFT)
 
-#define SLOT_IGNORED		0xffff
-
-static short __initdata slot_lastfilled_cache[MAX_COMPACT_NODES];
-static unsigned short __initdata slot_psize_cache[MAX_COMPACT_NODES][MAX_MEM_SLOTS];
 static struct bootmem_data __initdata plat_node_bdata[MAX_COMPACT_NODES];
 
 struct node_data *__node_data[MAX_COMPACT_NODES];
@@ -267,51 +263,6 @@
 	return ((pfn_t)nasid << PFN_NASIDSHFT) | (slot << SLOT_PFNSHIFT);
 }
 
-/*
- * Return the number of pages of memory provided by the given slot
- * on the specified node.
- */
-static pfn_t __init slot_getsize(cnodeid_t node, int slot)
-{
-	return (pfn_t) slot_psize_cache[node][slot];
-}
-
-/*
- * Return highest slot filled
- */
-static int __init node_getlastslot(cnodeid_t node)
-{
-	return (int) slot_lastfilled_cache[node];
-}
-
-/*
- * Return the pfn of the last free page of memory on a node.
- */
-static pfn_t __init node_getmaxclick(cnodeid_t node)
-{
-	pfn_t	slot_psize;
-	int	slot;
-
-	/*
-	 * Start at the top slot. When we find a slot with memory in it,
-	 * that's the winner.
-	 */
-	for (slot = (MAX_MEM_SLOTS - 1); slot >= 0; slot--) {
-		if ((slot_psize = slot_getsize(node, slot))) {
-			if (slot_psize == SLOT_IGNORED)
-				continue;
-			/* Return the basepfn + the slot size, minus 1. */
-			return slot_getbasepfn(node, slot) + slot_psize - 1;
-		}
-	}
-
-	/*
-	 * If there's no memory on the node, return 0. This is likely
-	 * to cause problems.
-	 */
-	return 0;
-}
-
 static pfn_t __init slot_psize_compute(cnodeid_t node, int slot)
 {
 	nasid_t nasid;
@@ -404,13 +355,13 @@
 static void __init szmem(void)
 {
 	pfn_t slot_psize, slot0sz = 0, nodebytes;	/* Hack to detect problem configs */
-	int slot, ignore;
+	int slot;
 	cnodeid_t node;
 
 	num_physpages = 0;
 
 	for_each_online_node(node) {
-		ignore = nodebytes = 0;
+		nodebytes = 0;
 		for (slot = 0; slot < MAX_MEM_SLOTS; slot++) {
 			slot_psize = slot_psize_compute(node, slot);
 			if (slot == 0)
@@ -420,21 +371,20 @@
 			 * kernel text.
 			 */
 			nodebytes += (1LL << SLOT_SHIFT);
+
+			if (!slot_psize)
+				continue;
+
 			if ((nodebytes >> PAGE_SHIFT) * (sizeof(struct page)) >
-						(slot0sz << PAGE_SHIFT))
-				ignore = 1;
-			if (ignore && slot_psize) {
+						(slot0sz << PAGE_SHIFT)) {
 				printk("Ignoring slot %d onwards on node %d\n",
 								slot, node);
-				slot_psize_cache[node][slot] = SLOT_IGNORED;
 				slot = MAX_MEM_SLOTS;
 				continue;
 			}
 			num_physpages += slot_psize;
-			slot_psize_cache[node][slot] =
-					(unsigned short) slot_psize;
-			if (slot_psize)
-				slot_lastfilled_cache[node] = slot;
+			add_active_range(node, slot_getbasepfn(node, slot),
+					 slot_getbasepfn(node, slot) + slot_psize);
 		}
 	}
 }
@@ -442,18 +392,20 @@
 static void __init node_mem_init(cnodeid_t node)
 {
 	pfn_t slot_firstpfn = slot_getbasepfn(node, 0);
-	pfn_t slot_lastpfn = slot_firstpfn + slot_getsize(node, 0);
 	pfn_t slot_freepfn = node_getfirstfree(node);
-	struct pglist_data *pd;
 	unsigned long bootmap_size;
+	pfn_t start_pfn, end_pfn;
+
+	get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
 
 	/*
 	 * Allocate the node data structures on the node first.
 	 */
 	__node_data[node] = __va(slot_freepfn << PAGE_SHIFT);
 
-	pd = NODE_DATA(node);
-	pd->bdata = &plat_node_bdata[node];
+	NODE_DATA(node)->bdata = &plat_node_bdata[node];
+	NODE_DATA(node)->node_start_pfn = start_pfn;
+	NODE_DATA(node)->node_spanned_pages = end_pfn - start_pfn;
 
 	cpus_clear(hub_data(node)->h_cpus);
 
@@ -461,12 +413,12 @@
 			       sizeof(struct hub_data));
 
   	bootmap_size = init_bootmem_node(NODE_DATA(node), slot_freepfn,
-					slot_firstpfn, slot_lastpfn);
-	free_bootmem_node(NODE_DATA(node), slot_firstpfn << PAGE_SHIFT,
-			(slot_lastpfn - slot_firstpfn) << PAGE_SHIFT);
+					start_pfn, end_pfn);
+	free_bootmem_with_active_regions(node, end_pfn);
 	reserve_bootmem_node(NODE_DATA(node), slot_firstpfn << PAGE_SHIFT,
 		((slot_freepfn - slot_firstpfn) << PAGE_SHIFT) + bootmap_size,
 		BOOTMEM_DEFAULT);
+	sparse_memory_present_with_active_regions(node);
 }
 
 /*
@@ -515,16 +467,15 @@
 	pagetable_init();
 
 	for_each_online_node(node) {
-		pfn_t start_pfn = slot_getbasepfn(node, 0);
-		pfn_t end_pfn = node_getmaxclick(node) + 1;
+		pfn_t start_pfn, end_pfn;
 
-		zones_size[ZONE_NORMAL] = end_pfn - start_pfn;
-		free_area_init_node(node, NODE_DATA(node),
-				zones_size, start_pfn, NULL);
+		get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
 
 		if (end_pfn > max_low_pfn)
 			max_low_pfn = end_pfn;
 	}
+	zones_size[ZONE_NORMAL] = max_low_pfn;
+	free_area_init_nodes(zones_size);
 }
 
 void __init mem_init(void)
@@ -535,34 +486,10 @@
 	high_memory = (void *) __va(num_physpages << PAGE_SHIFT);
 
 	for_each_online_node(node) {
-		unsigned slot, numslots;
-		struct page *end, *p;
-
 		/*
 		 * This will free up the bootmem, ie, slot 0 memory.
 		 */
 		totalram_pages += free_all_bootmem_node(NODE_DATA(node));
-
-		/*
-		 * We need to manually do the other slots.
-		 */
-		numslots = node_getlastslot(node);
-		for (slot = 1; slot <= numslots; slot++) {
-			p = nid_page_nr(node, slot_getbasepfn(node, slot) -
-					      slot_getbasepfn(node, 0));
-
-			/*
-			 * Free valid memory in current slot.
-			 */
-			for (end = p + slot_getsize(node, slot); p < end; p++) {
-				/* if (!page_is_ram(pgnr)) continue; */
-				/* commented out until page_is_ram works */
-				ClearPageReserved(p);
-				init_page_count(p);
-				__free_page(p);
-				totalram_pages++;
-			}
-		}
 	}
 
 	totalram_pages -= setup_zero_pages();	/* This comes from node 0 */
diff --git a/arch/mips/sgi-ip27/ip27-smp.c b/arch/mips/sgi-ip27/ip27-smp.c
index f15fc93..ba5cdeb 100644
--- a/arch/mips/sgi-ip27/ip27-smp.c
+++ b/arch/mips/sgi-ip27/ip27-smp.c
@@ -176,11 +176,14 @@
 static void __cpuinit ip27_init_secondary(void)
 {
 	per_cpu_init();
-	local_irq_enable();
 }
 
 static void __cpuinit ip27_smp_finish(void)
 {
+	extern void hub_rt_clock_event_init(void);
+
+	hub_rt_clock_event_init();
+	local_irq_enable();
 }
 
 static void __init ip27_cpus_done(void)
diff --git a/arch/mips/sgi-ip27/ip27-timer.c b/arch/mips/sgi-ip27/ip27-timer.c
index 9cebc9e..8b4e854 100644
--- a/arch/mips/sgi-ip27/ip27-timer.c
+++ b/arch/mips/sgi-ip27/ip27-timer.c
@@ -160,10 +160,13 @@
 
 int rt_timer_irq;
 
+static DEFINE_PER_CPU(struct clock_event_device, hub_rt_clockevent);
+static DEFINE_PER_CPU(char [11], hub_rt_name);
+
 static irqreturn_t hub_rt_counter_handler(int irq, void *dev_id)
 {
-	struct clock_event_device *cd = dev_id;
 	unsigned int cpu = smp_processor_id();
+	struct clock_event_device *cd = &per_cpu(hub_rt_clockevent, cpu);
 	int slice = cputoslice(cpu);
 
 	/*
@@ -192,10 +195,7 @@
 #define NSEC_PER_CYCLE		800
 #define CYCLES_PER_SEC		(NSEC_PER_SEC / NSEC_PER_CYCLE)
 
-static DEFINE_PER_CPU(struct clock_event_device, hub_rt_clockevent);
-static DEFINE_PER_CPU(char [11], hub_rt_name);
-
-static void __cpuinit hub_rt_clock_event_init(void)
+void __cpuinit hub_rt_clock_event_init(void)
 {
 	unsigned int cpu = smp_processor_id();
 	struct clock_event_device *cd = &per_cpu(hub_rt_clockevent, cpu);
@@ -203,17 +203,16 @@
 	int irq = rt_timer_irq;
 
 	sprintf(name, "hub-rt %d", cpu);
-	cd->name		= "HUB-RT",
-	cd->features		= CLOCK_EVT_FEAT_ONESHOT,
+	cd->name		= name;
+	cd->features		= CLOCK_EVT_FEAT_ONESHOT;
 	clockevent_set_clock(cd, CYCLES_PER_SEC);
 	cd->max_delta_ns        = clockevent_delta2ns(0xfffffffffffff, cd);
 	cd->min_delta_ns        = clockevent_delta2ns(0x300, cd);
-	cd->rating		= 200,
-	cd->irq			= irq,
-	cd->cpumask		= cpumask_of_cpu(cpu),
-	cd->rating		= 300,
-	cd->set_next_event	= rt_next_event,
-	cd->set_mode		= rt_set_mode,
+	cd->rating		= 200;
+	cd->irq			= irq;
+	cd->cpumask		= cpumask_of_cpu(cpu);
+	cd->set_next_event	= rt_next_event;
+	cd->set_mode		= rt_set_mode;
 	clockevents_register_device(cd);
 }
 
@@ -261,6 +260,7 @@
 {
 	hub_rt_clocksource_init();
 	hub_rt_clock_event_global_init();
+	hub_rt_clock_event_init();
 }
 
 void __cpuinit cpu_time_init(void)
@@ -281,7 +281,6 @@
 
 	printk("CPU %d clock is %dMHz.\n", smp_processor_id(), cpu->cpu_speed);
 
-	hub_rt_clock_event_init();
 	set_c0_status(SRB_TIMOCLK);
 }
 
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index ac1e31b..1836337 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -6,15 +6,19 @@
 source "lib/Kconfig.debug"
 
 config NONPROMISC_DEVMEM
-	bool "Disable promiscuous /dev/mem"
+	bool "Filter access to /dev/mem"
 	help
-	  The /dev/mem file by default only allows userspace access to PCI
-	  space and the BIOS code and data regions. This is sufficient for
-	  dosemu and X and all common users of /dev/mem. With this config
-	  option, you allow userspace access to all of memory, including
-	  kernel and userspace memory. Accidental access to this is
-	  obviously disasterous, but specific access can be used by people
-	  debugging the kernel.
+	  If this option is left off, you allow userspace access to all
+	  of memory, including kernel and userspace memory. Accidental
+	  access to this is obviously disastrous, but specific access can
+	  be used by people debugging the kernel.
+
+	  If this option is switched on, the /dev/mem file only allows
+	  userspace access to PCI space and the BIOS code and data regions.
+	  This is sufficient for dosemu and X and all common users of
+	  /dev/mem.
+
+	  If in doubt, say Y.
 
 config EARLY_PRINTK
 	bool "Early printk" if EMBEDDED
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 90d20c6..215d186 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -278,7 +278,7 @@
 		    	return status;
 	}
 	/* Clear INTRQ latch */
-	status = ata_sff_check_status(ap);
+	status = ap->ops->sff_check_status(ap);
 	return status;
 }
 
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 680cdfc..24b97b0 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -397,6 +397,7 @@
 MODULE_PARM_DESC(max_part, "Maximum number of partitions per RAM disk");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
+MODULE_ALIAS("rd");
 
 #ifndef MODULE
 /* Legacy boot options - nonmodular */
diff --git a/drivers/mtd/maps/omap_nor.c b/drivers/mtd/maps/omap_nor.c
index 240b0e2..c12d805 100644
--- a/drivers/mtd/maps/omap_nor.c
+++ b/drivers/mtd/maps/omap_nor.c
@@ -110,7 +110,7 @@
 	err = parse_mtd_partitions(info->mtd, part_probes, &info->parts, 0);
 	if (err > 0)
 		add_mtd_partitions(info->mtd, info->parts, err);
-	else if (err < 0 && pdata->parts)
+	else if (err <= 0 && pdata->parts)
 		add_mtd_partitions(info->mtd, pdata->parts, pdata->nr_parts);
 	else
 #endif
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index fceb468..fe2bc7e 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1216,7 +1216,7 @@
 
 	clk_enable(info->clk);
 
-	return pxa3xx_nand_config_flash(info);
+	return pxa3xx_nand_config_flash(info, info->flash_info);
 }
 #else
 #define pxa3xx_nand_suspend	NULL
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index 3d44d04..ad81ab8 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -76,7 +76,7 @@
 	err = parse_mtd_partitions(&info->mtd, part_probes, &info->parts, 0);
 	if (err > 0)
 		add_mtd_partitions(&info->mtd, info->parts, err);
-	else if (err < 0 && pdata->parts)
+	else if (err <= 0 && pdata->parts)
 		add_mtd_partitions(&info->mtd, pdata->parts, pdata->nr_parts);
 	else
 #endif
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 8f0a570..cf4e07b 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -81,7 +81,7 @@
 	}
 
 	for (i = 0; (res = pnp_get_resource(dev, IORESOURCE_MEM, i)); i++) {
-		if (res->flags & IORESOURCE_DISABLED)
+		if (res->flags & (IORESOURCE_UNSET | IORESOURCE_DISABLED))
 			continue;
 
 		reserve_range(dev, res->start, res->end, 0);
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbb..f58e41d 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@
 			}
 		}
 	}
+
+	/* don't trust len bigger than ctx buffer */
+	if (*len > ctx->end - ctx->pointer)
+		return 0;
+
 	return 1;
 }
 
@@ -203,6 +208,10 @@
 	if (!asn1_length_decode(ctx, &def, &len))
 		return 0;
 
+	/* primitive shall be definite, indefinite shall be constructed */
+	if (*con == ASN1_PRI && !def)
+		return 0;
+
 	if (def)
 		*eoc = ctx->pointer + len;
 	else
@@ -389,6 +398,11 @@
 	unsigned long *optr;
 
 	size = eoc - ctx->pointer + 1;
+
+	/* first subid actually encodes first two subids */
+	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+		return 0;
+
 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
 	if (*oid == NULL)
 		return 0;
diff --git a/include/asm-frv/checksum.h b/include/asm-frv/checksum.h
index 9b16898..269da09 100644
--- a/include/asm-frv/checksum.h
+++ b/include/asm-frv/checksum.h
@@ -75,7 +75,7 @@
 	    : "=r" (sum), "=r" (iph), "=r" (ihl), "=r" (inc), "=&r"(tmp)
 	    : "0" (sum), "1" (iph), "2" (ihl), "3" (4),
 	    "m"(*(volatile struct { int _[100]; } *)iph)
-	    : "icc0", "icc1"
+	    : "icc0", "icc1", "memory"
 	    );
 
 	return (__force __sum16)~sum;
diff --git a/include/asm-mips/mach-au1x00/au1xxx_dbdma.h b/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
index ad17d7c..44a67bf 100644
--- a/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
+++ b/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
@@ -355,6 +355,7 @@
 u32 au1xxx_dbdma_put_dscr(u32 chanid, au1x_ddma_desc_t *dscr);
 
 u32 au1xxx_ddma_add_device(dbdev_tab_t *dev);
+extern void au1xxx_ddma_del_device(u32 devid);
 void *au1xxx_ddma_get_nextptr_virt(au1x_ddma_desc_t *dp);
 
 /*
diff --git a/include/asm-mips/mipsregs.h b/include/asm-mips/mipsregs.h
index aa17f65..a46f8e2 100644
--- a/include/asm-mips/mipsregs.h
+++ b/include/asm-mips/mipsregs.h
@@ -765,6 +765,9 @@
 #define read_c0_index()		__read_32bit_c0_register($0, 0)
 #define write_c0_index(val)	__write_32bit_c0_register($0, 0, val)
 
+#define read_c0_random()	__read_32bit_c0_register($1, 0)
+#define write_c0_random(val)	__write_32bit_c0_register($1, 0, val)
+
 #define read_c0_entrylo0()	__read_ulong_c0_register($2, 0)
 #define write_c0_entrylo0(val)	__write_ulong_c0_register($2, 0, val)
 
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index 2f597ee..6a0edf7 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -239,9 +239,10 @@
 static inline pte_t pte_mkyoung(pte_t pte)
 {
 	pte.pte_low |= _PAGE_ACCESSED;
-	if (pte.pte_low & _PAGE_READ)
+	if (pte.pte_low & _PAGE_READ) {
 		pte.pte_low  |= _PAGE_SILENT_READ;
 		pte.pte_high |= _PAGE_SILENT_READ;
+	}
 	return pte;
 }
 #else
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 20b6660..4ca3063 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -3,7 +3,7 @@
  *
  */
 
-#ifndef __ASM_RTLX_H
+#ifndef __ASM_RTLX_H_
 #define __ASM_RTLX_H_
 
 #include <irq.h>
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5daefad..7750c97 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -232,6 +232,11 @@
 			}
 		}
 	}
+
+	/* don't trust len bigger than ctx buffer */
+	if (*len > ctx->end - ctx->pointer)
+		return 0;
+
 	return 1;
 }
 
@@ -250,6 +255,10 @@
 	if (!asn1_length_decode(ctx, &def, &len))
 		return 0;
 
+	/* primitive shall be definite, indefinite shall be constructed */
+	if (*con == ASN1_PRI && !def)
+		return 0;
+
 	if (def)
 		*eoc = ctx->pointer + len;
 	else
@@ -434,6 +443,11 @@
 	unsigned long *optr;
 
 	size = eoc - ctx->pointer + 1;
+
+	/* first subid actually encodes first two subids */
+	if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+		return 0;
+
 	*oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
 	if (*oid == NULL) {
 		if (net_ratelimit())