Merge commit 'v2.6.32-rc5' into perf/probes

Conflicts:
	kernel/trace/trace_event_profile.c

Merge reason: update to -rc5 and resolve conflict.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

48 files changed, 1073 insertions, 567 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss b/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss
index 0a92a7c93a62..4f29e5f1ebfa 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss
+++ b/Documentation/ABI/testing/sysfs-bus-pci-devices-cciss
@@ -31,3 +31,31 @@ Date:		March 2009
 Kernel Version: 2.6.30
 Contact:        iss_storagedev@hp.com
 Description:    A symbolic link to /sys/block/cciss!cXdY
+
+Where:          /sys/bus/pci/devices/<dev>/ccissX/rescan
+Date:           August 2009
+Kernel Version: 2.6.31
+Contact:        iss_storagedev@hp.com
+Description:    Kicks of a rescan of the controller to discover logical
+                drive topology changes.
+
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/lunid
+Date:           August 2009
+Kernel Version: 2.6.31
+Contact:        iss_storagedev@hp.com
+Description:    Displays the 8-byte LUN ID used to address logical
+                drive Y of controller X.
+
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/raid_level
+Date:           August 2009
+Kernel Version: 2.6.31
+Contact:        iss_storagedev@hp.com
+Description:    Displays the RAID level of logical drive Y of
+                controller X.
+
+Where:          /sys/bus/pci/devices/<dev>/ccissX/cXdY/usage_count
+Date:           August 2009
+Kernel Version: 2.6.31
+Contact:        iss_storagedev@hp.com
+Description:    Displays the usage count (number of opens) of logical drive Y
+                of controller X.
diff --git a/Documentation/ABI/testing/sysfs-class-usb_host b/Documentation/ABI/testing/sysfs-class-uwb_rc-wusbhc
index 46b66ad1f1b4..4e8106f7cfd9 100644
--- a/Documentation/ABI/testing/sysfs-class-usb_host
+++ b/Documentation/ABI/testing/sysfs-class-uwb_rc-wusbhc
@@ -1,4 +1,4 @@
-What:           /sys/class/usb_host/usb_hostN/wusb_chid
+What:           /sys/class/uwb_rc/uwbN/wusbhc/wusb_chid
 Date:           July 2008
 KernelVersion:  2.6.27
 Contact:        David Vrabel <david.vrabel@csr.com>
@@ -9,7 +9,7 @@ Description:
 
                 Set an all zero CHID to stop the host controller.
 
-What:           /sys/class/usb_host/usb_hostN/wusb_trust_timeout
+What:           /sys/class/uwb_rc/uwbN/wusbhc/wusb_trust_timeout
 Date:           July 2008
 KernelVersion:  2.6.27
 Contact:        David Vrabel <david.vrabel@csr.com>
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index b7f9d3b4bbf6..72651f788f4e 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -232,7 +232,7 @@ your e-mail client so that it sends your patches untouched.
 When sending patches to Linus, always follow step #7.
 
 Large changes are not appropriate for mailing lists, and some
-maintainers.  If your patch, uncompressed, exceeds 40 kB in size,
+maintainers.  If your patch, uncompressed, exceeds 300 kB in size,
 it is preferred that you store your patch on an Internet-accessible
 server, and provide instead a URL (link) pointing to your patch.
 
diff --git a/Documentation/arm/tcm.txt b/Documentation/arm/tcm.txt
new file mode 100644
index 000000000000..77fd9376e6d7
--- /dev/null
+++ b/Documentation/arm/tcm.txt
@@ -0,0 +1,147 @@
+ARM TCM (Tightly-Coupled Memory) handling in Linux
+----
+Written by Linus Walleij <linus.walleij@stericsson.com>
+
+Some ARM SoC:s have a so-called TCM (Tightly-Coupled Memory).
+This is usually just a few (4-64) KiB of RAM inside the ARM
+processor.
+
+Due to being embedded inside the CPU The TCM has a
+Harvard-architecture, so there is an ITCM (instruction TCM)
+and a DTCM (data TCM). The DTCM can not contain any
+instructions, but the ITCM can actually contain data.
+The size of DTCM or ITCM is minimum 4KiB so the typical
+minimum configuration is 4KiB ITCM and 4KiB DTCM.
+
+ARM CPU:s have special registers to read out status, physical
+location and size of TCM memories. arch/arm/include/asm/cputype.h
+defines a CPUID_TCM register that you can read out from the
+system control coprocessor. Documentation from ARM can be found
+at http://infocenter.arm.com, search for "TCM Status Register"
+to see documents for all CPUs. Reading this register you can
+determine if ITCM (bit 0) and/or DTCM (bit 16) is present in the
+machine.
+
+There is further a TCM region register (search for "TCM Region
+Registers" at the ARM site) that can report and modify the location
+size of TCM memories at runtime. This is used to read out and modify
+TCM location and size. Notice that this is not a MMU table: you
+actually move the physical location of the TCM around. At the
+place you put it, it will mask any underlying RAM from the
+CPU so it is usually wise not to overlap any physical RAM with
+the TCM.
+
+The TCM memory can then be remapped to another address again using
+the MMU, but notice that the TCM if often used in situations where
+the MMU is turned off. To avoid confusion the current Linux
+implementation will map the TCM 1 to 1 from physical to virtual
+memory in the location specified by the machine.
+
+TCM is used for a few things:
+
+- FIQ and other interrupt handlers that need deterministic
+  timing and cannot wait for cache misses.
+
+- Idle loops where all external RAM is set to self-refresh
+  retention mode, so only on-chip RAM is accessible by
+  the CPU and then we hang inside ITCM waiting for an
+  interrupt.
+
+- Other operations which implies shutting off or reconfiguring
+  the external RAM controller.
+
+There is an interface for using TCM on the ARM architecture
+in <asm/tcm.h>. Using this interface it is possible to:
+
+- Define the physical address and size of ITCM and DTCM.
+
+- Tag functions to be compiled into ITCM.
+
+- Tag data and constants to be allocated to DTCM and ITCM.
+
+- Have the remaining TCM RAM added to a special
+  allocation pool with gen_pool_create() and gen_pool_add()
+  and provice tcm_alloc() and tcm_free() for this
+  memory. Such a heap is great for things like saving
+  device state when shutting off device power domains.
+
+A machine that has TCM memory shall select HAVE_TCM in
+arch/arm/Kconfig for itself, and then the
+rest of the functionality will depend on the physical
+location and size of ITCM and DTCM to be defined in
+mach/memory.h for the machine. Code that needs to use
+TCM shall #include <asm/tcm.h> If the TCM is not located
+at the place given in memory.h it will be moved using
+the TCM Region registers.
+
+Functions to go into itcm can be tagged like this:
+int __tcmfunc foo(int bar);
+
+Variables to go into dtcm can be tagged like this:
+int __tcmdata foo;
+
+Constants can be tagged like this:
+int __tcmconst foo;
+
+To put assembler into TCM just use
+.section ".tcm.text" or .section ".tcm.data"
+respectively.
+
+Example code:
+
+#include <asm/tcm.h>
+
+/* Uninitialized data */
+static u32 __tcmdata tcmvar;
+/* Initialized data */
+static u32 __tcmdata tcmassigned = 0x2BADBABEU;
+/* Constant */
+static const u32 __tcmconst tcmconst = 0xCAFEBABEU;
+
+static void __tcmlocalfunc tcm_to_tcm(void)
+{
+        int i;
+        for (i = 0; i < 100; i++)
+                tcmvar ++;
+}
+
+static void __tcmfunc hello_tcm(void)
+{
+        /* Some abstract code that runs in ITCM */
+        int i;
+        for (i = 0; i < 100; i++) {
+                tcmvar ++;
+        }
+        tcm_to_tcm();
+}
+
+static void __init test_tcm(void)
+{
+        u32 *tcmem;
+        int i;
+
+        hello_tcm();
+        printk("Hello TCM executed from ITCM RAM\n");
+
+        printk("TCM variable from testrun: %u @ %p\n", tcmvar, &tcmvar);
+        tcmvar = 0xDEADBEEFU;
+        printk("TCM variable: 0x%x @ %p\n", tcmvar, &tcmvar);
+
+        printk("TCM assigned variable: 0x%x @ %p\n", tcmassigned, &tcmassigned);
+
+        printk("TCM constant: 0x%x @ %p\n", tcmconst, &tcmconst);
+
+        /* Allocate some TCM memory from the pool */
+        tcmem = tcm_alloc(20);
+        if (tcmem) {
+                printk("TCM Allocated 20 bytes of TCM @ %p\n", tcmem);
+                tcmem[0] = 0xDEADBEEFU;
+                tcmem[1] = 0x2BADBABEU;
+                tcmem[2] = 0xCAFEBABEU;
+                tcmem[3] = 0xDEADBEEFU;
+                tcmem[4] = 0x2BADBABEU;
+                for (i = 0; i < 5; i++)
+                        printk("TCM tcmem[%d] = %08x\n", i, tcmem[i]);
+                tcm_free(tcmem, 20);
+        }
+}
diff --git a/Documentation/auxdisplay/cfag12864b-example.c b/Documentation/auxdisplay/cfag12864b-example.c
index 1d2c010bae12..e7823ffb1ca0 100644
--- a/Documentation/auxdisplay/cfag12864b-example.c
+++ b/Documentation/auxdisplay/cfag12864b-example.c
@@ -194,7 +194,6 @@ static void cfag12864b_blit(void)
  */
 
 #include <stdio.h>
-#include <string.h>
 
 #define EXAMPLES        6
 
diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt
index 6eb1a97e88ce..0b33bfe7dde9 100644
--- a/Documentation/cgroups/cgroups.txt
+++ b/Documentation/cgroups/cgroups.txt
@@ -227,7 +227,14 @@ as the path relative to the root of the cgroup file system.
 Each cgroup is represented by a directory in the cgroup file system
 containing the following files describing that cgroup:
 
- - tasks: list of tasks (by pid) attached to that cgroup
+ - tasks: list of tasks (by pid) attached to that cgroup.  This list
+   is not guaranteed to be sorted.  Writing a thread id into this file
+   moves the thread into this cgroup.
+ - cgroup.procs: list of tgids in the cgroup.  This list is not
+   guaranteed to be sorted or free of duplicate tgids, and userspace
+   should sort/uniquify the list if this property is required.
+   Writing a tgid into this file moves all threads with that tgid into
+   this cgroup.
  - notify_on_release flag: run the release agent on exit?
  - release_agent: the path to use for release notifications (this file
    exists in the top cgroup only)
@@ -374,7 +381,7 @@ Now you want to do something with this cgroup.
 
 In this directory you can find several files:
 # ls
-notify_on_release tasks
+cgroup.procs notify_on_release tasks
 (plus whatever files added by the attached subsystems)
 
 Now attach your shell to this cgroup:
@@ -408,6 +415,26 @@ You can attach the current shell task by echoing 0:
 
 # echo 0 > tasks
 
+2.3 Mounting hierarchies by name
+--------------------------------
+
+Passing the name=<x> option when mounting a cgroups hierarchy
+associates the given name with the hierarchy.  This can be used when
+mounting a pre-existing hierarchy, in order to refer to it by name
+rather than by its set of active subsystems.  Each hierarchy is either
+nameless, or has a unique name.
+
+The name should match [\w.-]+
+
+When passing a name=<x> option for a new hierarchy, you need to
+specify subsystems manually; the legacy behaviour of mounting all
+subsystems when none are explicitly specified is not supported when
+you give a subsystem a name.
+
+The name of the subsystem appears as part of the hierarchy description
+in /proc/mounts and /proc/<pid>/cgroups.
+
+
 3. Kernel API
 =============
 
@@ -501,7 +528,7 @@ rmdir() will fail with it. From this behavior, pre_destroy() can be
 called multiple times against a cgroup.
 
 int can_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
-               struct task_struct *task)
+               struct task_struct *task, bool threadgroup)
 (cgroup_mutex held by caller)
 
 Called prior to moving a task into a cgroup; if the subsystem
@@ -509,14 +536,20 @@ returns an error, this will abort the attach operation.  If a NULL
 task is passed, then a successful result indicates that *any*
 unspecified task can be moved into the cgroup. Note that this isn't
 called on a fork. If this method returns 0 (success) then this should
-remain valid while the caller holds cgroup_mutex.
+remain valid while the caller holds cgroup_mutex. If threadgroup is
+true, then a successful result indicates that all threads in the given
+thread's threadgroup can be moved together.
 
 void attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
-            struct cgroup *old_cgrp, struct task_struct *task)
+            struct cgroup *old_cgrp, struct task_struct *task,
+            bool threadgroup)
 (cgroup_mutex held by caller)
 
 Called after the task has been attached to the cgroup, to allow any
 post-attachment activity that requires memory allocations or blocking.
+If threadgroup is true, the subsystem should take care of all threads
+in the specified thread's threadgroup. Currently does not support any
+subsystem that might need the old_cgrp for every thread in the group.
 
 void fork(struct cgroup_subsy *ss, struct task_struct *task)
 
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index 23d1262c0775..b871f2552b45 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -179,6 +179,9 @@ The reclaim algorithm has not been modified for cgroups, except that
 pages that are selected for reclaiming come from the per cgroup LRU
 list.
 
+NOTE: Reclaim does not work for the root cgroup, since we cannot set any
+limits on the root cgroup.
+
 2. Locking
 
 The memory controller uses the following hierarchy
@@ -210,6 +213,7 @@ We can alter the memory limit:
 NOTE: We can use a suffix (k, K, m, M, g or G) to indicate values in kilo,
 mega or gigabytes.
 NOTE: We can write "-1" to reset the *.limit_in_bytes(unlimited).
+NOTE: We cannot set limits on the root cgroup any more.
 
 # cat /cgroups/0/memory.limit_in_bytes
 4194304
@@ -375,7 +379,42 @@ cgroups created below it.
 
 NOTE2: This feature can be enabled/disabled per subtree.
 
-7. TODO
+7. Soft limits
+
+Soft limits allow for greater sharing of memory. The idea behind soft limits
+is to allow control groups to use as much of the memory as needed, provided
+
+a. There is no memory contention
+b. They do not exceed their hard limit
+
+When the system detects memory contention or low memory control groups
+are pushed back to their soft limits. If the soft limit of each control
+group is very high, they are pushed back as much as possible to make
+sure that one control group does not starve the others of memory.
+
+Please note that soft limits is a best effort feature, it comes with
+no guarantees, but it does its best to make sure that when memory is
+heavily contended for, memory is allocated based on the soft limit
+hints/setup. Currently soft limit based reclaim is setup such that
+it gets invoked from balance_pgdat (kswapd).
+
+7.1 Interface
+
+Soft limits can be setup by using the following commands (in this example we
+assume a soft limit of 256 megabytes)
+
+# echo 256M > memory.soft_limit_in_bytes
+
+If we want to change this to 1G, we can at any time use
+
+# echo 1G > memory.soft_limit_in_bytes
+
+NOTE1: Soft limits take effect over a long period of time, since they involve
+       reclaiming memory for balancing between memory cgroups
+NOTE2: It is recommended to set the soft limit always below the hard limit,
+       otherwise the hard limit will take precedence.
+
+8. TODO
 
 1. Add support for accounting huge pages (as a separate controller)
 2. Make per-cgroup scanner reclaim not-shared pages first
diff --git a/Documentation/connector/cn_test.c b/Documentation/connector/cn_test.c
index 1711adc33373..b07add3467f1 100644
--- a/Documentation/connector/cn_test.c
+++ b/Documentation/connector/cn_test.c
@@ -34,7 +34,7 @@ static char cn_test_name[] = "cn_test";
 static struct sock *nls;
 static struct timer_list cn_test_timer;
 
-static void cn_test_callback(struct cn_msg *msg)
+static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
         pr_info("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n",
                 __func__, jiffies, msg->id.idx, msg->id.val,
diff --git a/Documentation/connector/connector.txt b/Documentation/connector/connector.txt
index 81e6bf6ead57..78c9466a9aa8 100644
--- a/Documentation/connector/connector.txt
+++ b/Documentation/connector/connector.txt
@@ -23,7 +23,7 @@ handling, etc...  The Connector driver allows any kernelspace agents to use
 netlink based networking for inter-process communication in a significantly
 easier way:
 
-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
+int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
 void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask);
 
 struct cb_id
@@ -53,15 +53,15 @@ struct cn_msg
 Connector interfaces.
 /*****************************************/
 
-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
+int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
 
  Registers new callback with connector core.
 
  struct cb_id *id               - unique connector's user identifier.
                                   It must be registered in connector.h for legal in-kernel users.
  char *name                     - connector's callback symbolic name.
- void (*callback) (void *)      - connector's callback.
-                                  Argument must be dereferenced to struct cn_msg *.
+ void (*callback) (struct cn..) - connector's callback.
+                                  cn_msg and the sender's credentials
 
 
 void cn_del_callback(struct cb_id *id);
diff --git a/Documentation/crypto/async-tx-api.txt b/Documentation/crypto/async-tx-api.txt
index 9f59fcbf5d82..ba046b8fa92f 100644
--- a/Documentation/crypto/async-tx-api.txt
+++ b/Documentation/crypto/async-tx-api.txt
@@ -54,20 +54,23 @@ features surfaced as a result:
 
 3.1 General format of the API:
 struct dma_async_tx_descriptor *
-async_<operation>(<op specific parameters>,
-                  enum async_tx_flags flags,
-                  struct dma_async_tx_descriptor *dependency,
-                  dma_async_tx_callback callback_routine,
-                  void *callback_parameter);
+async_<operation>(<op specific parameters>, struct async_submit ctl *submit)
 
 3.2 Supported operations:
-memcpy       - memory copy between a source and a destination buffer
-memset       - fill a destination buffer with a byte value
-xor          - xor a series of source buffers and write the result to a
-               destination buffer
-xor_zero_sum - xor a series of source buffers and set a flag if the
-               result is zero.  The implementation attempts to prevent
-               writes to memory
+memcpy  - memory copy between a source and a destination buffer
+memset  - fill a destination buffer with a byte value
+xor     - xor a series of source buffers and write the result to a
+          destination buffer
+xor_val - xor a series of source buffers and set a flag if the
+          result is zero.  The implementation attempts to prevent
+          writes to memory
+pq      - generate the p+q (raid6 syndrome) from a series of source buffers
+pq_val  - validate that a p and or q buffer are in sync with a given series of
+          sources
+datap   - (raid6_datap_recov) recover a raid6 data block and the p block
+          from the given sources
+2data   - (raid6_2data_recov) recover 2 raid6 data blocks from the given
+          sources
 
 3.3 Descriptor management:
 The return value is non-NULL and points to a 'descriptor' when the operation
@@ -80,8 +83,8 @@ acknowledged by the application before the offload engine driver is allowed to
 recycle (or free) the descriptor.  A descriptor can be acked by one of the
 following methods:
 1/ setting the ASYNC_TX_ACK flag if no child operations are to be submitted
-2/ setting the ASYNC_TX_DEP_ACK flag to acknowledge the parent
-   descriptor of a new operation.
+2/ submitting an unacknowledged descriptor as a dependency to another
+   async_tx call will implicitly set the acknowledged state.
 3/ calling async_tx_ack() on the descriptor.
 
 3.4 When does the operation execute?
@@ -119,30 +122,42 @@ of an operation.
 Perform a xor->copy->xor operation where each operation depends on the
 result from the previous operation:
 
-void complete_xor_copy_xor(void *param)
+void callback(void *param)
 {
-        printk("complete\n");
+        struct completion *cmp = param;
+
+        complete(cmp);
 }
 
-int run_xor_copy_xor(struct page **xor_srcs,
-                     int xor_src_cnt,
-                     struct page *xor_dest,
-                     size_t xor_len,
-                     struct page *copy_src,
-                     struct page *copy_dest,
-                     size_t copy_len)
+void run_xor_copy_xor(struct page **xor_srcs,
+                      int xor_src_cnt,
+                      struct page *xor_dest,
+                      size_t xor_len,
+                      struct page *copy_src,
+                      struct page *copy_dest,
+                      size_t copy_len)
 {
         struct dma_async_tx_descriptor *tx;
+        addr_conv_t addr_conv[xor_src_cnt];
+        struct async_submit_ctl submit;
+        addr_conv_t addr_conv[NDISKS];
+        struct completion cmp;
+
+        init_async_submit(&submit, ASYNC_TX_XOR_DROP_DST, NULL, NULL, NULL,
+                          addr_conv);
+        tx = async_xor(xor_dest, xor_srcs, 0, xor_src_cnt, xor_len, &submit)
 
-        tx = async_xor(xor_dest, xor_srcs, 0, xor_src_cnt, xor_len,
-                       ASYNC_TX_XOR_DROP_DST, NULL, NULL, NULL);
-        tx = async_memcpy(copy_dest, copy_src, 0, 0, copy_len,
-                          ASYNC_TX_DEP_ACK, tx, NULL, NULL);
-        tx = async_xor(xor_dest, xor_srcs, 0, xor_src_cnt, xor_len,
-                       ASYNC_TX_XOR_DROP_DST | ASYNC_TX_DEP_ACK | ASYNC_TX_ACK,
-                       tx, complete_xor_copy_xor, NULL);
+        submit->depend_tx = tx;
+        tx = async_memcpy(copy_dest, copy_src, 0, 0, copy_len, &submit);
+
+        init_completion(&cmp);
+        init_async_submit(&submit, ASYNC_TX_XOR_DROP_DST | ASYNC_TX_ACK, tx,
+                          callback, &cmp, addr_conv);
+        tx = async_xor(xor_dest, xor_srcs, 0, xor_src_cnt, xor_len, &submit);
 
         async_tx_issue_pending_all();
+
+        wait_for_completion(&cmp);
 }
 
 See include/linux/async_tx.h for more information on the flags.  See the
diff --git a/Documentation/debugging-via-ohci1394.txt b/Documentation/debugging-via-ohci1394.txt
index 59a91e5c6909..611f5a5499b1 100644
--- a/Documentation/debugging-via-ohci1394.txt
+++ b/Documentation/debugging-via-ohci1394.txt
@@ -64,14 +64,14 @@ be used to view the printk buffer of a remote machine, even with live update.
 
 Bernhard Kaindl enhanced firescope to support accessing 64-bit machines
 from 32-bit firescope and vice versa:
-- ftp://ftp.suse.de/private/bk/firewire/tools/firescope-0.2.2.tar.bz2
+- http://halobates.de/firewire/firescope-0.2.2.tar.bz2
 
 and he implemented fast system dump (alpha version - read README.txt):
-- ftp://ftp.suse.de/private/bk/firewire/tools/firedump-0.1.tar.bz2
+- http://halobates.de/firewire/firedump-0.1.tar.bz2
 
 There is also a gdb proxy for firewire which allows to use gdb to access
 data which can be referenced from symbols found by gdb in vmlinux:
-- ftp://ftp.suse.de/private/bk/firewire/tools/fireproxy-0.33.tar.bz2
+- http://halobates.de/firewire/fireproxy-0.33.tar.bz2
 
 The latest version of this gdb proxy (fireproxy-0.34) can communicate (not
 yet stable) with kgdb over an memory-based communication module (kgdbom).
@@ -178,7 +178,7 @@ Step-by-step instructions for using firescope with early OHCI initialization:
 
 Notes
 -----
-Documentation and specifications: ftp://ftp.suse.de/private/bk/firewire/docs
+Documentation and specifications: http://halobates.de/firewire/
 
 FireWire is a trademark of Apple Inc. - for more information please refer to:
 http://en.wikipedia.org/wiki/FireWire
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index fa75220f8d34..04e6c819b28a 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -354,14 +354,6 @@ Who:  Krzysztof Piotr Oledzki <ole@ans.pl>
 
 ---------------------------
 
-What:   fscher and fscpos drivers
-When:   June 2009
-Why:    Deprecated by the new fschmd driver.
-Who:    Hans de Goede <hdegoede@redhat.com>
-        Jean Delvare <khali@linux-fr.org>
-
----------------------------
-
 What:   sysfs ui for changing p4-clockmod parameters
 When:   September 2009
 Why:    See commits 129f8ae9b1b5be94517da76009ea956e89104ce8 and
@@ -459,3 +451,33 @@ Why:	OSS sound_core grabs all legacy minors (0-255) of SOUND_MAJOR
         will also allow making ALSA OSS emulation independent of
         sound_core.  The dependency will be broken then too.
 Who:    Tejun Heo <tj@kernel.org>
+
+----------------------------
+
+What:   Support for VMware's guest paravirtuliazation technique [VMI] will be
+        dropped.
+When:   2.6.37 or earlier.
+Why:    With the recent innovations in CPU hardware acceleration technologies
+        from Intel and AMD, VMware ran a few experiments to compare these
+        techniques to guest paravirtualization technique on VMware's platform.
+        These hardware assisted virtualization techniques have outperformed the
+        performance benefits provided by VMI in most of the workloads. VMware
+        expects that these hardware features will be ubiquitous in a couple of
+        years, as a result, VMware has started a phased retirement of this
+        feature from the hypervisor. We will be removing this feature from the
+        Kernel too. Right now we are targeting 2.6.37 but can retire earlier if
+        technical reasons (read opportunity to remove major chunk of pvops)
+        arise.
+
+        Please note that VMI has always been an optimization and non-VMI kernels
+        still work fine on VMware's platform.
+        Latest versions of VMware's product which support VMI are,
+        Workstation 7.0 and VSphere 4.0 on ESX side, future maintainence
+        releases for these products will continue supporting VMI.
+
+        For more details about VMI retirement take a look at this,
+        http://blogs.vmware.com/guestosguide/2009/09/vmi-retirement.html
+
+Who:    Alok N Kataria <akataria@vmware.com>
+
+----------------------------
diff --git a/Documentation/filesystems/9p.txt b/Documentation/filesystems/9p.txt
index 6208f55c44c3..57e0b80a5274 100644
--- a/Documentation/filesystems/9p.txt
+++ b/Documentation/filesystems/9p.txt
@@ -18,11 +18,11 @@ the 9p client is available in the form of a USENIX paper:
 
 Other applications are described in the following papers:
         * XCPU & Clustering
-                http://www.xcpu.org/xcpu-talk.pdf
+                http://xcpu.org/papers/xcpu-talk.pdf
         * KVMFS: control file system for KVM
-                http://www.xcpu.org/kvmfs.pdf
-        * CellFS: A New ProgrammingModel for the Cell BE
-                http://www.xcpu.org/cellfs-talk.pdf
+                http://xcpu.org/papers/kvmfs.pdf
+        * CellFS: A New Programming Model for the Cell BE
+                http://xcpu.org/papers/cellfs-talk.pdf
         * PROSE I/O: Using 9p to enable Application Partitions
                 http://plan9.escet.urjc.es/iwp9/cready/PROSE_iwp9_2006.pdf
 
@@ -48,6 +48,7 @@ OPTIONS
                                 (see rfdno and wfdno)
                         virtio  - connect to the next virtio channel available
                                 (from lguest or KVM with trans_virtio module)
+                        rdma    - connect to a specified RDMA channel
 
   uname=name    user name to attempt mount as on the remote server.  The
                 server may override or ignore this value.  Certain user
@@ -59,16 +60,22 @@ OPTIONS
   cache=mode    specifies a caching policy.  By default, no caches are used.
                         loose = no attempts are made at consistency,
                                 intended for exclusive, read-only mounts
+                        fscache = use FS-Cache for a persistent, read-only
+                                cache backend.
 
   debug=n       specifies debug level.  The debug level is a bitmask.
-                        0x01 = display verbose error messages
-                        0x02 = developer debug (DEBUG_CURRENT)
-                        0x04 = display 9p trace
-                        0x08 = display VFS trace
-                        0x10 = display Marshalling debug
-                        0x20 = display RPC debug
-                        0x40 = display transport debug
-                        0x80 = display allocation debug
+                        0x01  = display verbose error messages
+                        0x02  = developer debug (DEBUG_CURRENT)
+                        0x04  = display 9p trace
+                        0x08  = display VFS trace
+                        0x10  = display Marshalling debug
+                        0x20  = display RPC debug
+                        0x40  = display transport debug
+                        0x80  = display allocation debug
+                        0x100 = display protocol message debug
+                        0x200 = display Fid debug
+                        0x400 = display packet debug
+                        0x800 = display fscache tracing debug
 
   rfdno=n       the file descriptor for reading with trans=fd
 
@@ -100,6 +107,10 @@ OPTIONS
                         any   = v9fs does single attach and performs all
                                 operations as one user
 
+  cachetag      cache tag to use the specified persistent cache.
+                cache tags for existing cache sessions can be listed at
+                /sys/fs/9p/caches. (applies only to cache=fscache)
+
 RESOURCES
 =========
 
@@ -118,7 +129,7 @@ and export.
 A Linux version of the 9p server is now maintained under the npfs project
 on sourceforge (http://sourceforge.net/projects/npfs).  The currently
 maintained version is the single-threaded version of the server (named spfs)
-available from the same CVS repository.
+available from the same SVN repository.
 
 There are user and developer mailing lists available through the v9fs project
 on sourceforge (http://sourceforge.net/projects/v9fs).
@@ -126,7 +137,8 @@ on sourceforge (http://sourceforge.net/projects/v9fs).
 A stand-alone version of the module (which should build for any 2.6 kernel)
 is available via (http://github.com/ericvh/9p-sac/tree/master)
 
-News and other information is maintained on SWiK (http://swik.net/v9fs).
+News and other information is maintained on SWiK (http://swik.net/v9fs)
+and the Wiki (http://sf.net/apps/mediawiki/v9fs/index.php).
 
 Bug reports may be issued through the kernel.org bugzilla 
 (http://bugzilla.kernel.org)
diff --git a/Documentation/filesystems/ext3.txt b/Documentation/filesystems/ext3.txt
index 570f9bd9be2b..05d5cf1d743f 100644
--- a/Documentation/filesystems/ext3.txt
+++ b/Documentation/filesystems/ext3.txt
@@ -123,10 +123,18 @@ resuid=n		The user ID which may use the reserved blocks.
 
 sb=n                    Use alternate superblock at this location.
 
-quota
-noquota
-grpquota
-usrquota
+quota                   These options are ignored by the filesystem. They
+noquota                 are used only by quota tools to recognize volumes
+grpquota                where quota should be turned on. See documentation
+usrquota                in the quota-tools package for more details
+                        (http://sourceforge.net/projects/linuxquota).
+
+jqfmt=<quota type>      These options tell filesystem details about quota
+usrjquota=<file>        so that quota information can be properly updated
+grpjquota=<file>        during journal replay. They replace the above
+                        quota options. See documentation in the quota-tools
+                        package for more details
+                        (http://sourceforge.net/projects/linuxquota).
 
 bh              (*)     ext3 associates buffer heads to data pages to
 nobh                    (a) cache disk block mapping information
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
index 18b5ec8cea45..bf4f4b7e11b3 100644
--- a/Documentation/filesystems/ext4.txt
+++ b/Documentation/filesystems/ext4.txt
@@ -282,9 +282,16 @@ stripe=n		Number of filesystem blocks that mballoc will try
                         to use for allocation size and alignment. For RAID5/6
                         systems this should be the number of data
                         disks *  RAID chunk size in file system blocks.
-delalloc        (*)     Deferring block allocation until write-out time.
-nodelalloc              Disable delayed allocation. Blocks are allocation
-                        when data is copied from user to page cache.
+
+delalloc        (*)     Defer block allocation until just before ext4
+                        writes out the block(s) in question.  This
+                        allows ext4 to better allocation decisions
+                        more efficiently.
+nodelalloc              Disable delayed allocation.  Blocks are allocated
+                        when the data is copied from userspace to the
+                        page cache, either via the write(2) system call
+                        or when an mmap'ed page which was previously
+                        unallocated is written for the first time.
 
 max_batch_time=usec     Maximum amount of time ext4 should wait for
                         additional filesystem operations to be batch
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index b5aee7838a00..2c48f945546b 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1113,7 +1113,6 @@ Table 1-12: Files in /proc/fs/ext4/<devname>
 ..............................................................................
  File            Content                                        
  mb_groups       details of multiblock allocator buddy cache of free blocks
- mb_history      multiblock allocation history
 ..............................................................................
 
 
diff --git a/Documentation/filesystems/sharedsubtree.txt b/Documentation/filesystems/sharedsubtree.txt
index 736540045dc7..23a181074f94 100644
--- a/Documentation/filesystems/sharedsubtree.txt
+++ b/Documentation/filesystems/sharedsubtree.txt
@@ -4,7 +4,7 @@ Shared Subtrees
 Contents:
         1) Overview
         2) Features
-        3) smount command
+        3) Setting mount states
         4) Use-case
         5) Detailed semantics
         6) Quiz
@@ -41,14 +41,14 @@ replicas continue to be exactly same.
 
         Here is an example:
 
-        Lets say /mnt has a mount that is shared.
+        Let's say /mnt has a mount that is shared.
         mount --make-shared /mnt
 
-        note: mount command does not yet support the --make-shared flag.
-        I have included a small C program which does the same by executing
-        'smount /mnt shared'
+        Note: mount(8) command now supports the --make-shared flag,
+        so the sample 'smount' program is no longer needed and has been
+        removed.
 
-        #mount --bind /mnt /tmp
+        # mount --bind /mnt /tmp
         The above command replicates the mount at /mnt to the mountpoint /tmp
         and the contents of both the mounts remain identical.
 
@@ -58,8 +58,8 @@ replicas continue to be exactly same.
         #ls /tmp
         a b c
 
-        Now lets say we mount a device at /tmp/a
-        #mount /dev/sd0  /tmp/a
+        Now let's say we mount a device at /tmp/a
+        # mount /dev/sd0  /tmp/a
 
         #ls /tmp/a
         t1 t2 t2
@@ -80,21 +80,20 @@ replicas continue to be exactly same.
 
         Here is an example:
 
-        Lets say /mnt has a mount which is shared.
-        #mount --make-shared /mnt
+        Let's say /mnt has a mount which is shared.
+        # mount --make-shared /mnt
 
-        Lets bind mount /mnt to /tmp
-        #mount --bind /mnt /tmp
+        Let's bind mount /mnt to /tmp
+        # mount --bind /mnt /tmp
 
         the new mount at /tmp becomes a shared mount and it is a replica of
         the mount at /mnt.
 
-        Now lets make the mount at /tmp; a slave of /mnt
-        #mount --make-slave /tmp
-        [or smount /tmp slave]
+        Now let's make the mount at /tmp; a slave of /mnt
+        # mount --make-slave /tmp
 
-        lets mount /dev/sd0 on /mnt/a
-        #mount /dev/sd0 /mnt/a
+        let's mount /dev/sd0 on /mnt/a
+        # mount /dev/sd0 /mnt/a
 
         #ls /mnt/a
         t1 t2 t3
@@ -104,9 +103,9 @@ replicas continue to be exactly same.
 
         Note the mount event has propagated to the mount at /tmp
 
-        However lets see what happens if we mount something on the mount at /tmp
+        However let's see what happens if we mount something on the mount at /tmp
 
-        #mount /dev/sd1 /tmp/b
+        # mount /dev/sd1 /tmp/b
 
         #ls /tmp/b
         s1 s2 s3
@@ -124,12 +123,11 @@ replicas continue to be exactly same.
 
 2d) A unbindable mount is a unbindable private mount
 
-        lets say we have a mount at /mnt and we make is unbindable
+        let's say we have a mount at /mnt and we make is unbindable
 
-        #mount --make-unbindable /mnt
-         [ smount /mnt  unbindable ]
+        # mount --make-unbindable /mnt
 
-         Lets try to bind mount this mount somewhere else.
+         Let's try to bind mount this mount somewhere else.
          # mount --bind /mnt /tmp
          mount: wrong fs type, bad option, bad superblock on /mnt,
                 or too many mounted file systems
@@ -137,149 +135,15 @@ replicas continue to be exactly same.
         Binding a unbindable mount is a invalid operation.
 
 
-3) smount command
+3) Setting mount states
 
-        Currently the mount command is not aware of shared subtree features.
-        Work is in progress to add the support in mount ( util-linux package ).
-        Till then use the following program.
+        The mount command (util-linux package) can be used to set mount
+        states:
 
-        ------------------------------------------------------------------------
-        //
-        //this code was developed my Miklos Szeredi <miklos@szeredi.hu>
-        //and modified by Ram Pai <linuxram@us.ibm.com>
-        // sample usage:
-        //              smount /tmp shared
-        //
-        #include <stdio.h>
-        #include <stdlib.h>
-        #include <unistd.h>
-        #include <string.h>
-        #include <sys/mount.h>
-        #include <sys/fsuid.h>
-
-        #ifndef MS_REC
-        #define MS_REC          0x4000  /* 16384: Recursive loopback */
-        #endif
-
-        #ifndef MS_SHARED
-        #define MS_SHARED               1<<20   /* Shared */
-        #endif
-
-        #ifndef MS_PRIVATE
-        #define MS_PRIVATE              1<<18   /* Private */
-        #endif
-
-        #ifndef MS_SLAVE
-        #define MS_SLAVE                1<<19   /* Slave */
-        #endif
-
-        #ifndef MS_UNBINDABLE
-        #define MS_UNBINDABLE           1<<17   /* Unbindable */
-        #endif
-
-        int main(int argc, char *argv[])
-        {
-                int type;
-                if(argc != 3) {
-                        fprintf(stderr, "usage: %s dir "
-                        "<rshared|rslave|rprivate|runbindable|shared|slave"
-                        "|private|unbindable>\n" , argv[0]);
-                        return 1;
-                }
-
-                fprintf(stdout, "%s %s %s\n", argv[0], argv[1], argv[2]);
-
-                if (strcmp(argv[2],"rshared")==0)
-                        type=(MS_SHARED|MS_REC);
-                else if (strcmp(argv[2],"rslave")==0)
-                        type=(MS_SLAVE|MS_REC);
-                else if (strcmp(argv[2],"rprivate")==0)
-                        type=(MS_PRIVATE|MS_REC);
-                else if (strcmp(argv[2],"runbindable")==0)
-                        type=(MS_UNBINDABLE|MS_REC);
-                else if (strcmp(argv[2],"shared")==0)
-                        type=MS_SHARED;
-                else if (strcmp(argv[2],"slave")==0)
-                        type=MS_SLAVE;
-                else if (strcmp(argv[2],"private")==0)
-                        type=MS_PRIVATE;
-                else if (strcmp(argv[2],"unbindable")==0)
-                        type=MS_UNBINDABLE;
-                else {
-                        fprintf(stderr, "invalid operation: %s\n", argv[2]);
-                        return 1;
-                }
-                setfsuid(getuid());
-
-                if(mount("", argv[1], "dontcare", type, "") == -1) {
-                        perror("mount");
-                        return 1;
-                }
-                return 0;
-        }
-        -----------------------------------------------------------------------
-
-        Copy the above code snippet into smount.c
-        gcc -o smount smount.c
-
-
-        (i) To mark all the mounts under /mnt as shared execute the following
-        command:
-
-                smount /mnt rshared
-                the corresponding syntax planned for mount command is
-                mount --make-rshared /mnt
-
-            just to mark a mount /mnt as shared, execute the following
-            command:
-                smount /mnt shared
-                the corresponding syntax planned for mount command is
-                mount --make-shared /mnt
-
-        (ii) To mark all the shared mounts under /mnt as slave execute the
-        following
-
-             command:
-                smount /mnt rslave
-                the corresponding syntax planned for mount command is
-                mount --make-rslave /mnt
-
-            just to mark a mount /mnt as slave, execute the following
-            command:
-                smount /mnt slave
-                the corresponding syntax planned for mount command is
-                mount --make-slave /mnt
-
-        (iii) To mark all the mounts under /mnt as private execute the
-        following command:
-
-                smount /mnt rprivate
-                the corresponding syntax planned for mount command is
-                mount --make-rprivate /mnt
-
-            just to mark a mount /mnt as private, execute the following
-            command:
-                smount /mnt private
-                the corresponding syntax planned for mount command is
-                mount --make-private /mnt
-
-              NOTE: by default all the mounts are created as private. But if
-              you want to change some shared/slave/unbindable  mount as
-              private at a later point in time, this command can help.
-
-        (iv) To mark all the mounts under /mnt as unbindable execute the
-        following
-
-             command:
-                smount /mnt runbindable
-                the corresponding syntax planned for mount command is
-                mount --make-runbindable /mnt
-
-            just to mark a mount /mnt as unbindable, execute the following
-            command:
-                smount /mnt unbindable
-                the corresponding syntax planned for mount command is
-                mount --make-unbindable /mnt
+        mount --make-shared mountpoint
+        mount --make-slave mountpoint
+        mount --make-private mountpoint
+        mount --make-unbindable mountpoint
 
 
 4) Use cases
@@ -350,7 +214,7 @@ replicas continue to be exactly same.
                 mount --rbind / /view/v3
                 mount --rbind / /view/v4
 
-                and if /usr has a versioning filesystem mounted, than that
+                and if /usr has a versioning filesystem mounted, then that
                 mount appears at /view/v1/usr, /view/v2/usr, /view/v3/usr and
                 /view/v4/usr too
 
@@ -390,7 +254,7 @@ replicas continue to be exactly same.
 
                 For example:
                         mount --make-shared /mnt
-                        mount --bin /mnt /tmp
+                        mount --bind /mnt /tmp
 
                 The mount at /mnt and that at /tmp are both shared and belong
                 to the same peer group. Anything mounted or unmounted under
@@ -558,7 +422,7 @@ replicas continue to be exactly same.
         then the subtree under the unbindable mount is pruned in the new
         location.
 
-        eg: lets say we have the following mount tree.
+        eg: let's say we have the following mount tree.
 
                 A
               /   \
@@ -566,7 +430,7 @@ replicas continue to be exactly same.
              / \ / \
              D E F G
 
-             Lets say all the mount except the mount C in the tree are
+             Let's say all the mount except the mount C in the tree are
              of a type other than unbindable.
 
              If this tree is rbound to say Z
@@ -683,13 +547,13 @@ replicas continue to be exactly same.
         'b' on mounts that receive propagation from mount 'B' and does not have
         sub-mounts within them are unmounted.
 
-        Example: Lets say 'B1', 'B2', 'B3' are shared mounts that propagate to
+        Example: Let's say 'B1', 'B2', 'B3' are shared mounts that propagate to
         each other.
 
-        lets say 'A1', 'A2', 'A3' are first mounted at dentry 'b' on mount
+        let's say 'A1', 'A2', 'A3' are first mounted at dentry 'b' on mount
         'B1', 'B2' and 'B3' respectively.
 
-        lets say 'C1', 'C2', 'C3' are next mounted at the same dentry 'b' on
+        let's say 'C1', 'C2', 'C3' are next mounted at the same dentry 'b' on
         mount 'B1', 'B2' and 'B3' respectively.
 
         if 'C1' is unmounted, all the mounts that are most-recently-mounted on
@@ -710,7 +574,7 @@ replicas continue to be exactly same.
         A cloned namespace contains all the mounts as that of the parent
         namespace.
 
-        Lets say 'A' and 'B' are the corresponding mounts in the parent and the
+        Let's say 'A' and 'B' are the corresponding mounts in the parent and the
         child namespace.
 
         If 'A' is shared, then 'B' is also shared and 'A' and 'B' propagate to
@@ -759,11 +623,11 @@ replicas continue to be exactly same.
                 mount --make-slave /mnt
 
                 At this point we have the first mount at /tmp and
-                its root dentry is 1. Lets call this mount 'A'
+                its root dentry is 1. Let's call this mount 'A'
                 And then we have a second mount at /tmp1 with root
-                dentry 2. Lets call this mount 'B'
+                dentry 2. Let's call this mount 'B'
                 Next we have a third mount at /mnt with root dentry
-                mnt. Lets call this mount 'C'
+                mnt. Let's call this mount 'C'
 
                 'B' is the slave of 'A' and 'C' is a slave of 'B'
                 A -> B -> C
@@ -794,7 +658,7 @@ replicas continue to be exactly same.
 
         Q3 Why is unbindable mount needed?
 
-                Lets say we want to replicate the mount tree at multiple
+                Let's say we want to replicate the mount tree at multiple
                 locations within the same subtree.
 
                 if one rbind mounts a tree within the same subtree 'n' times
@@ -803,7 +667,7 @@ replicas continue to be exactly same.
                 mounts. Here is a example.
 
                 step 1:
-                   lets say the root tree has just two directories with
+                   let's say the root tree has just two directories with
                    one vfsmount.
                                     root
                                    /    \
@@ -875,7 +739,7 @@ replicas continue to be exactly same.
                 Unclonable mounts come in handy here.
 
                 step 1:
-                   lets say the root tree has just two directories with
+                   let's say the root tree has just two directories with
                    one vfsmount.
                                     root
                                    /    \
diff --git a/Documentation/filesystems/vfat.txt b/Documentation/filesystems/vfat.txt
index b58b84b50fa2..eed520fd0c8e 100644
--- a/Documentation/filesystems/vfat.txt
+++ b/Documentation/filesystems/vfat.txt
@@ -102,7 +102,7 @@ shortname=lower|win95|winnt|mixed
                  winnt: emulate the Windows NT rule for display/create.
                  mixed: emulate the Windows NT rule for display,
                         emulate the Windows 95 rule for create.
-                 Default setting is `lower'.
+                 Default setting is `mixed'.
 
 tz=UTC        -- Interpret timestamps as UTC rather than local time.
                  This option disables the conversion of timestamps
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index f49eecf2e573..623f094c9d8d 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -536,6 +536,7 @@ struct address_space_operations {
         /* migrate the contents of a page to the specified target */
         int (*migratepage) (struct page *, struct page *);
         int (*launder_page) (struct page *);
+        int (*error_remove_page) (struct mapping *mapping, struct page *page);
 };
 
   writepage: called by the VM to write a dirty page to backing store.
@@ -694,6 +695,12 @@ struct address_space_operations {
         prevent redirtying the page, it is kept locked during the whole
         operation.
 
+  error_remove_page: normally set to generic_error_remove_page if truncation
+        is ok for this address space. Used for memory failure handling.
+        Setting this implies you deal with pages going away under you,
+        unless you have them locked or reference counts increased.
+
+
 The File Object
 ===============
 
diff --git a/Documentation/flexible-arrays.txt b/Documentation/flexible-arrays.txt
index 84eb26808dee..cb8a3a00cc92 100644
--- a/Documentation/flexible-arrays.txt
+++ b/Documentation/flexible-arrays.txt
@@ -1,5 +1,5 @@
 Using flexible arrays in the kernel
-Last updated for 2.6.31
+Last updated for 2.6.32
 Jonathan Corbet <corbet@lwn.net>
 
 Large contiguous memory allocations can be unreliable in the Linux kernel.
@@ -40,6 +40,13 @@ argument is passed directly to the internal memory allocation calls.  With
 the current code, using flags to ask for high memory is likely to lead to
 notably unpleasant side effects.
 
+It is also possible to define flexible arrays at compile time with:
+
+    DEFINE_FLEX_ARRAY(name, element_size, total);
+
+This macro will result in a definition of an array with the given name; the
+element size and total will be checked for validity at compile time.
+
 Storing data into a flexible array is accomplished with a call to:
 
     int flex_array_put(struct flex_array *array, unsigned int element_nr,
@@ -76,16 +83,30 @@ particular element has never been allocated.
 Note that it is possible to get back a valid pointer for an element which
 has never been stored in the array.  Memory for array elements is allocated
 one page at a time; a single allocation could provide memory for several
-adjacent elements.  The flexible array code does not know if a specific
-element has been written; it only knows if the associated memory is
-present.  So a flex_array_get() call on an element which was never stored
-in the array has the potential to return a pointer to random data.  If the
-caller does not have a separate way to know which elements were actually
-stored, it might be wise, at least, to add GFP_ZERO to the flags argument
-to ensure that all elements are zeroed.
-
-There is no way to remove a single element from the array.  It is possible,
-though, to remove all elements with a call to:
+adjacent elements.  Flexible array elements are normally initialized to the
+value FLEX_ARRAY_FREE (defined as 0x6c in <linux/poison.h>), so errors
+involving that number probably result from use of unstored array entries.
+Note that, if array elements are allocated with __GFP_ZERO, they will be
+initialized to zero and this poisoning will not happen.
+
+Individual elements in the array can be cleared with:
+
+    int flex_array_clear(struct flex_array *array, unsigned int element_nr);
+
+This function will set the given element to FLEX_ARRAY_FREE and return
+zero.  If storage for the indicated element is not allocated for the array,
+flex_array_clear() will return -EINVAL instead.  Note that clearing an
+element does not release the storage associated with it; to reduce the
+allocated size of an array, call:
+
+    int flex_array_shrink(struct flex_array *array);
+
+The return value will be the number of pages of memory actually freed.
+This function works by scanning the array for pages containing nothing but
+FLEX_ARRAY_FREE bytes, so (1) it can be expensive, and (2) it will not work
+if the array's pages are allocated with __GFP_ZERO.
+
+It is possible to remove all elements of an array with a call to:
 
     void flex_array_free_parts(struct flex_array *array);
 
diff --git a/Documentation/hwmon/coretemp b/Documentation/hwmon/coretemp
index dbbe6c7025b0..92267b62db59 100644
--- a/Documentation/hwmon/coretemp
+++ b/Documentation/hwmon/coretemp
@@ -4,7 +4,9 @@ Kernel driver coretemp
 Supported chips:
   * All Intel Core family
     Prefix: 'coretemp'
-    CPUID: family 0x6, models 0xe, 0xf, 0x16, 0x17
+    CPUID: family 0x6, models 0xe (Pentium M DC), 0xf (Core 2 DC 65nm),
+                              0x16 (Core 2 SC 65nm), 0x17 (Penryn 45nm),
+                              0x1a (Nehalem), 0x1c (Atom), 0x1e (Lynnfield)
     Datasheet: Intel 64 and IA-32 Architectures Software Developer's Manual
                Volume 3A: System Programming Guide
                http://softwarecommunity.intel.com/Wiki/Mobility/720.htm
diff --git a/Documentation/hwmon/fscher b/Documentation/hwmon/fscher
deleted file mode 100644
index 64031659aff3..000000000000
--- a/Documentation/hwmon/fscher
+++ /dev/null
@@ -1,169 +0,0 @@
-Kernel driver fscher
-====================
-
-Supported chips:
-  * Fujitsu-Siemens Hermes chip
-    Prefix: 'fscher'
-    Addresses scanned: I2C 0x73
-
-Authors:
-        Reinhard Nissl <rnissl@gmx.de> based on work
-        from Hermann Jung <hej@odn.de>,
-        Frodo Looijaard <frodol@dds.nl>,
-        Philip Edelbrock <phil@netroedge.com>
-
-Description
------------
-
-This driver implements support for the Fujitsu-Siemens Hermes chip. It is
-described in the 'Register Set Specification BMC Hermes based Systemboard'
-from Fujitsu-Siemens.
-
-The Hermes chip implements a hardware-based system management, e.g. for
-controlling fan speed and core voltage. There is also a watchdog counter on
-the chip which can trigger an alarm and even shut the system down.
-
-The chip provides three temperature values (CPU, motherboard and
-auxiliary), three voltage values (+12V, +5V and battery) and three fans
-(power supply, CPU and auxiliary).
-
-Temperatures are measured in degrees Celsius. The resolution is 1 degree.
-
-Fan rotation speeds are reported in RPM (rotations per minute). The value
-can be divided by a programmable divider (1, 2 or 4) which is stored on
-the chip.
-
-Voltage sensors (also known as "in" sensors) report their values in volts.
-
-All values are reported as final values from the driver. There is no need
-for further calculations.
-
-
-Detailed description
---------------------
-
-Below you'll find a single line description of all the bit values. With
-this information, you're able to decode e. g. alarms, wdog, etc. To make
-use of the watchdog, you'll need to set the watchdog time and enable the
-watchdog. After that it is necessary to restart the watchdog time within
-the specified period of time, or a system reset will occur.
-
-* revision
-  READING & 0xff = 0x??: HERMES revision identification
-
-* alarms
-  READING & 0x80 = 0x80: CPU throttling active
-  READING & 0x80 = 0x00: CPU running at full speed
-
-  READING & 0x10 = 0x10: software event (see control:1)
-  READING & 0x10 = 0x00: no software event
-
-  READING & 0x08 = 0x08: watchdog event (see wdog:2)
-  READING & 0x08 = 0x00: no watchdog event
-
-  READING & 0x02 = 0x02: thermal event (see temp*:1)
-  READING & 0x02 = 0x00: no thermal event
-
-  READING & 0x01 = 0x01: fan event (see fan*:1)
-  READING & 0x01 = 0x00: no fan event
-
-  READING & 0x13 ! 0x00: ALERT LED is flashing
-
-* control
-  READING & 0x01 = 0x01: software event
-  READING & 0x01 = 0x00: no software event
-
-  WRITING & 0x01 = 0x01: set software event
-  WRITING & 0x01 = 0x00: clear software event
-
-* watchdog_control
-  READING & 0x80 = 0x80: power off on watchdog event while thermal event
-  READING & 0x80 = 0x00: watchdog power off disabled (just system reset enabled)
-
-  READING & 0x40 = 0x40: watchdog timebase 60 seconds (see also wdog:1)
-  READING & 0x40 = 0x00: watchdog timebase  2 seconds
-
-  READING & 0x10 = 0x10: watchdog enabled
-  READING & 0x10 = 0x00: watchdog disabled
-
-  WRITING & 0x80 = 0x80: enable "power off on watchdog event while thermal event"
-  WRITING & 0x80 = 0x00: disable "power off on watchdog event while thermal event"
-
-  WRITING & 0x40 = 0x40: set watchdog timebase to 60 seconds
-  WRITING & 0x40 = 0x00: set watchdog timebase to  2 seconds
-
-  WRITING & 0x20 = 0x20: disable watchdog
-
-  WRITING & 0x10 = 0x10: enable watchdog / restart watchdog time
-
-* watchdog_state
-  READING & 0x02 = 0x02: watchdog system reset occurred
-  READING & 0x02 = 0x00: no watchdog system reset occurred
-
-  WRITING & 0x02 = 0x02: clear watchdog event
-
-* watchdog_preset
-  READING & 0xff = 0x??: configured watch dog time in units (see wdog:3 0x40)
-
-  WRITING & 0xff = 0x??: configure watch dog time in units
-
-* in*     (0: +5V, 1: +12V, 2: onboard 3V battery)
-  READING: actual voltage value
-
-* temp*_status   (1: CPU sensor, 2: onboard sensor, 3: auxiliary sensor)
-  READING & 0x02 = 0x02: thermal event (overtemperature)
-  READING & 0x02 = 0x00: no thermal event
-
-  READING & 0x01 = 0x01: sensor is working
-  READING & 0x01 = 0x00: sensor is faulty
-
-  WRITING & 0x02 = 0x02: clear thermal event
-
-* temp*_input   (1: CPU sensor, 2: onboard sensor, 3: auxiliary sensor)
-  READING: actual temperature value
-
-* fan*_status   (1: power supply fan, 2: CPU fan, 3: auxiliary fan)
-  READING & 0x04 = 0x04: fan event (fan fault)
-  READING & 0x04 = 0x00: no fan event
-
-  WRITING & 0x04 = 0x04: clear fan event
-
-* fan*_div (1: power supply fan, 2: CPU fan, 3: auxiliary fan)
-        Divisors 2,4 and 8 are supported, both for reading and writing
-
-* fan*_pwm   (1: power supply fan, 2: CPU fan, 3: auxiliary fan)
-  READING & 0xff = 0x00: fan may be switched off
-  READING & 0xff = 0x01: fan must run at least at minimum speed (supply: 6V)
-  READING & 0xff = 0xff: fan must run at maximum speed (supply: 12V)
-  READING & 0xff = 0x??: fan must run at least at given speed (supply: 6V..12V)
-
-  WRITING & 0xff = 0x00: fan may be switched off
-  WRITING & 0xff = 0x01: fan must run at least at minimum speed (supply: 6V)
-  WRITING & 0xff = 0xff: fan must run at maximum speed (supply: 12V)
-  WRITING & 0xff = 0x??: fan must run at least at given speed (supply: 6V..12V)
-
-* fan*_input   (1: power supply fan, 2: CPU fan, 3: auxiliary fan)
-  READING: actual RPM value
-
-
-Limitations
------------
-
-* Measuring fan speed
-It seems that the chip counts "ripples" (typical fans produce 2 ripples per
-rotation while VERAX fans produce 18) in a 9-bit register. This register is
-read out every second, then the ripple prescaler (2, 4 or 8) is applied and
-the result is stored in the 8 bit output register. Due to the limitation of
-the counting register to 9 bits, it is impossible to measure a VERAX fan
-properly (even with a prescaler of 8). At its maximum speed of 3500 RPM the
-fan produces 1080 ripples per second which causes the counting register to
-overflow twice, leading to only 186 RPM.
-
-* Measuring input voltages
-in2 ("battery") reports the voltage of the onboard lithium battery and not
-+3.3V from the power supply.
-
-* Undocumented features
-Fujitsu-Siemens Computers has not documented all features of the chip so
-far. Their software, System Guard, shows that there are a still some
-features which cannot be controlled by this implementation.
diff --git a/Documentation/hwmon/ltc4215 b/Documentation/hwmon/ltc4215
index 2e6a21eb656c..c196a1846259 100644
--- a/Documentation/hwmon/ltc4215
+++ b/Documentation/hwmon/ltc4215
@@ -22,12 +22,13 @@ Usage Notes
 -----------
 
 This driver does not probe for LTC4215 devices, due to the fact that some
-of the possible addresses are unfriendly to probing. You will need to use
-the "force" parameter to tell the driver where to find the device.
+of the possible addresses are unfriendly to probing. You will have to
+instantiate the devices explicitly.
 
 Example: the following will load the driver for an LTC4215 at address 0x44
 on I2C bus #0:
-$ modprobe ltc4215 force=0,0x44
+$ modprobe ltc4215
+$ echo ltc4215 0x44 > /sys/bus/i2c/devices/i2c-0/new_device
 
 
 Sysfs entries
diff --git a/Documentation/hwmon/ltc4245 b/Documentation/hwmon/ltc4245
index bae7a3adc5d8..02838a47d862 100644
--- a/Documentation/hwmon/ltc4245
+++ b/Documentation/hwmon/ltc4245
@@ -23,12 +23,13 @@ Usage Notes
 -----------
 
 This driver does not probe for LTC4245 devices, due to the fact that some
-of the possible addresses are unfriendly to probing. You will need to use
-the "force" parameter to tell the driver where to find the device.
+of the possible addresses are unfriendly to probing. You will have to
+instantiate the devices explicitly.
 
 Example: the following will load the driver for an LTC4245 at address 0x23
 on I2C bus #1:
-$ modprobe ltc4245 force=1,0x23
+$ modprobe ltc4245
+$ echo ltc4245 0x23 > /sys/bus/i2c/devices/i2c-1/new_device
 
 
 Sysfs entries
diff --git a/Documentation/i2c/instantiating-devices b/Documentation/i2c/instantiating-devices
index c740b7b41088..e89490270aba 100644
--- a/Documentation/i2c/instantiating-devices
+++ b/Documentation/i2c/instantiating-devices
@@ -188,7 +188,7 @@ segment, the address is sufficient to uniquely identify the device to be
 deleted.
 
 Example:
-# echo eeprom 0x50 > /sys/class/i2c-adapter/i2c-3/new_device
+# echo eeprom 0x50 > /sys/bus/i2c/devices/i2c-3/new_device
 
 While this interface should only be used when in-kernel device declaration
 can't be done, there is a variety of cases where it can be helpful:
diff --git a/Documentation/infiniband/user_mad.txt b/Documentation/infiniband/user_mad.txt
index 744687dd195b..8a366959f5cc 100644
--- a/Documentation/infiniband/user_mad.txt
+++ b/Documentation/infiniband/user_mad.txt
@@ -128,8 +128,8 @@ Setting IsSM Capability Bit
   To create the appropriate character device files automatically with
   udev, a rule like
 
-    KERNEL="umad*", NAME="infiniband/%k"
-    KERNEL="issm*", NAME="infiniband/%k"
+    KERNEL=="umad*", NAME="infiniband/%k"
+    KERNEL=="issm*", NAME="infiniband/%k"
 
   can be used.  This will create device nodes named
 
diff --git a/Documentation/infiniband/user_verbs.txt b/Documentation/infiniband/user_verbs.txt
index f847501e50b5..afe3f8da9018 100644
--- a/Documentation/infiniband/user_verbs.txt
+++ b/Documentation/infiniband/user_verbs.txt
@@ -58,7 +58,7 @@ Memory pinning
   To create the appropriate character device files automatically with
   udev, a rule like
 
-    KERNEL="uverbs*", NAME="infiniband/%k"
+    KERNEL=="uverbs*", NAME="infiniband/%k"
 
   can be used.  This will create device nodes named
 
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index aafca0a8f66a..947374977ca5 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -135,6 +135,7 @@ Code	Seq#	Include File		Comments
                                         <http://mikonos.dia.unisa.it/tcfs>
 'l'     40-7F   linux/udf_fs_i.h        in development:
                                         <http://sourceforge.net/projects/linux-udf/>
+'m'     00-09   linux/mmtimer.h
 'm'     all     linux/mtio.h            conflict!
 'm'     all     linux/soundcard.h       conflict!
 'm'     all     linux/synclink.h        conflict!
diff --git a/Documentation/isdn/INTERFACE.CAPI b/Documentation/isdn/INTERFACE.CAPI
index 686e107923ec..5fe8de5cc727 100644
--- a/Documentation/isdn/INTERFACE.CAPI
+++ b/Documentation/isdn/INTERFACE.CAPI
@@ -60,10 +60,9 @@ open() operation on regular files or character devices.
 
 After a successful return from register_appl(), CAPI messages from the
 application may be passed to the driver for the device via calls to the
-send_message() callback function. The CAPI message to send is stored in the
-data portion of an skb. Conversely, the driver may call Kernel CAPI's
-capi_ctr_handle_message() function to pass a received CAPI message to Kernel
-CAPI for forwarding to an application, specifying its ApplID.
+send_message() callback function. Conversely, the driver may call Kernel
+CAPI's capi_ctr_handle_message() function to pass a received CAPI message to
+Kernel CAPI for forwarding to an application, specifying its ApplID.
 
 Deregistration requests (CAPI operation CAPI_RELEASE) from applications are
 forwarded as calls to the release_appl() callback function, passing the same
@@ -142,6 +141,7 @@ u16  (*send_message)(struct capi_ctr *ctrlr, struct sk_buff *skb)
         to accepting or queueing the message. Errors occurring during the
         actual processing of the message should be signaled with an
         appropriate reply message.
+        May be called in process or interrupt context.
         Calls to this function are not serialized by Kernel CAPI, ie. it must
         be prepared to be re-entered.
 
@@ -154,7 +154,8 @@ read_proc_t *ctr_read_proc
         system entry, /proc/capi/controllers/<n>; will be called with a
         pointer to the device's capi_ctr structure as the last (data) argument
 
-Note: Callback functions are never called in interrupt context.
+Note: Callback functions except send_message() are never called in interrupt
+context.
 
 - to be filled in before calling capi_ctr_ready():
 
@@ -171,14 +172,40 @@ u8 serial[CAPI_SERIAL_LEN]
         value to return for CAPI_GET_SERIAL
 
 
-4.3 The _cmsg Structure
+4.3 SKBs
+
+CAPI messages are passed between Kernel CAPI and the driver via send_message()
+and capi_ctr_handle_message(), stored in the data portion of a socket buffer
+(skb).  Each skb contains a single CAPI message coded according to the CAPI 2.0
+standard.
+
+For the data transfer messages, DATA_B3_REQ and DATA_B3_IND, the actual
+payload data immediately follows the CAPI message itself within the same skb.
+The Data and Data64 parameters are not used for processing. The Data64
+parameter may be omitted by setting the length field of the CAPI message to 22
+instead of 30.
+
+
+4.4 The _cmsg Structure
 
 (declared in <linux/isdn/capiutil.h>)
 
 The _cmsg structure stores the contents of a CAPI 2.0 message in an easily
-accessible form. It contains members for all possible CAPI 2.0 parameters, of
-which only those appearing in the message type currently being processed are
-actually used. Unused members should be set to zero.
+accessible form. It contains members for all possible CAPI 2.0 parameters,
+including subparameters of the Additional Info and B Protocol structured
+parameters, with the following exceptions:
+
+* second Calling party number (CONNECT_IND)
+
+* Data64 (DATA_B3_REQ and DATA_B3_IND)
+
+* Sending complete (subparameter of Additional Info, CONNECT_REQ and INFO_REQ)
+
+* Global Configuration (subparameter of B Protocol, CONNECT_REQ, CONNECT_RESP
+  and SELECT_B_PROTOCOL_REQ)
+
+Only those parameters appearing in the message type currently being processed
+are actually used. Unused members should be set to zero.
 
 Members are named after the CAPI 2.0 standard names of the parameters they
 represent. See <linux/isdn/capiutil.h> for the exact spelling. Member data
@@ -190,18 +217,19 @@ u16         for CAPI parameters of type 'word'
 
 u32         for CAPI parameters of type 'dword'
 
-_cstruct    for CAPI parameters of type 'struct' not containing any
-            variably-sized (struct) subparameters (eg. 'Called Party Number')
+_cstruct    for CAPI parameters of type 'struct'
             The member is a pointer to a buffer containing the parameter in
             CAPI encoding (length + content). It may also be NULL, which will
             be taken to represent an empty (zero length) parameter.
+            Subparameters are stored in encoded form within the content part.
 
-_cmstruct   for CAPI parameters of type 'struct' containing 'struct'
-            subparameters ('Additional Info' and 'B Protocol')
+_cmstruct   alternative representation for CAPI parameters of type 'struct'
+            (used only for the 'Additional Info' and 'B Protocol' parameters)
             The representation is a single byte containing one of the values:
-            CAPI_DEFAULT: the parameter is empty
-            CAPI_COMPOSE: the values of the subparameters are stored
-            individually in the corresponding _cmsg structure members
+            CAPI_DEFAULT: The parameter is empty/absent.
+            CAPI_COMPOSE: The parameter is present.
+            Subparameter values are stored individually in the corresponding
+            _cmsg structure members.
 
 Functions capi_cmsg2message() and capi_message2cmsg() are provided to convert
 messages between their transport encoding described in the CAPI 2.0 standard
@@ -297,3 +325,26 @@ char *capi_cmd2str(u8 Command, u8 Subcommand)
         be NULL if the command/subcommand is not one of those defined in the
         CAPI 2.0 standard.
 
+
+7. Debugging
+
+The module kernelcapi has a module parameter showcapimsgs controlling some
+debugging output produced by the module. It can only be set when the module is
+loaded, via a parameter "showcapimsgs=<n>" to the modprobe command, either on
+the command line or in the configuration file.
+
+If the lowest bit of showcapimsgs is set, kernelcapi logs controller and
+application up and down events.
+
+In addition, every registered CAPI controller has an associated traceflag
+parameter controlling how CAPI messages sent from and to tha controller are
+logged. The traceflag parameter is initialized with the value of the
+showcapimsgs parameter when the controller is registered, but can later be
+changed via the MANUFACTURER_REQ command KCAPI_CMD_TRACE.
+
+If the value of traceflag is non-zero, CAPI messages are logged.
+DATA_B3 messages are only logged if the value of traceflag is > 2.
+
+If the lowest bit of traceflag is set, only the command/subcommand and message
+length are logged. Otherwise, kernelcapi logs a readable representation of
+the entire message.
diff --git a/Documentation/kbuild/kbuild.txt b/Documentation/kbuild/kbuild.txt
index f3355b6812df..bb3bf38f03da 100644
--- a/Documentation/kbuild/kbuild.txt
+++ b/Documentation/kbuild/kbuild.txt
@@ -65,6 +65,22 @@ INSTALL_PATH
 INSTALL_PATH specifies where to place the updated kernel and system map
 images. Default is /boot, but you can set it to other values.
 
+INSTALLKERNEL
+--------------------------------------------------
+Install script called when using "make install".
+The default name is "installkernel".
+
+The script will be called with the following arguments:
+    $1 - kernel version
+    $2 - kernel image file
+    $3 - kernel map file
+    $4 - default install path (use root directory if blank)
+
+The implmentation of "make install" is architecture specific
+and it may differ from the above.
+
+INSTALLKERNEL is provided to enable the possibility to
+specify a custom installer when cross compiling a kernel.
 
 MODLIB
 --------------------------------------------------
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index d76cfd8712e1..71c602d61680 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -18,6 +18,7 @@ This document describes the Linux kernel Makefiles.
            --- 3.9 Dependency tracking
            --- 3.10 Special Rules
            --- 3.11 $(CC) support functions
+           --- 3.12 $(LD) support functions
 
         === 4 Host Program support
            --- 4.1 Simple Host Program
@@ -435,14 +436,14 @@ more details, with real examples.
         The second argument is optional, and if supplied will be used
         if first argument is not supported.
 
-    ld-option
-        ld-option is used to check if $(CC) when used to link object files
+    cc-ldoption
+        cc-ldoption is used to check if $(CC) when used to link object files
         supports the given option.  An optional second option may be
         specified if first option are not supported.
 
         Example:
                 #arch/i386/kernel/Makefile
-                vsyscall-flags += $(call ld-option, -Wl$(comma)--hash-style=sysv)
+                vsyscall-flags += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
 
         In the above example, vsyscall-flags will be assigned the option
         -Wl$(comma)--hash-style=sysv if it is supported by $(CC).
@@ -570,6 +571,19 @@ more details, with real examples.
                         endif
                 endif
 
+--- 3.12 $(LD) support functions
+
+    ld-option
+        ld-option is used to check if $(LD) supports the supplied option.
+        ld-option takes two options as arguments.
+        The second argument is an optional option that can be used if the
+        first option is not supported by $(LD).
+
+        Example:
+                #Makefile
+                LDFLAGS_vmlinux += $(call really-ld-option, -X)
+
+
 === 4 Host Program support
 
 Kbuild supports building executables on the host for use during the
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6fa7292947e5..9107b387e91f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -671,6 +671,7 @@ and is between 256 and 4096 characters. It is defined in the file
         earlyprintk=    [X86,SH,BLACKFIN]
                         earlyprintk=vga
                         earlyprintk=serial[,ttySn[,baudrate]]
+                        earlyprintk=ttySn[,baudrate]
                         earlyprintk=dbgp[debugController#]
 
                         Append ",keep" to not disable it when the real console
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 6d03487ef1c7..aafcaa634191 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -199,18 +199,22 @@ kind to allow it (and it often doesn't!).
 
 Not all bits in the mask can be modified.  Not all bits that can be
 modified do anything.  Not all hot keys can be individually controlled
-by the mask.  Some models do not support the mask at all, and in those
-models, hot keys cannot be controlled individually.  The behaviour of
-the mask is, therefore, highly dependent on the ThinkPad model.
+by the mask.  Some models do not support the mask at all.  The behaviour
+of the mask is, therefore, highly dependent on the ThinkPad model.
+
+The driver will filter out any unmasked hotkeys, so even if the firmware
+doesn't allow disabling an specific hotkey, the driver will not report
+events for unmasked hotkeys.
 
 Note that unmasking some keys prevents their default behavior.  For
 example, if Fn+F5 is unmasked, that key will no longer enable/disable
-Bluetooth by itself.
+Bluetooth by itself in firmware.
 
-Note also that not all Fn key combinations are supported through ACPI.
-For example, on the X40, the brightness, volume and "Access IBM" buttons
-do not generate ACPI events even with this driver.  They *can* be used
-through the "ThinkPad Buttons" utility, see http://www.nongnu.org/tpb/
+Note also that not all Fn key combinations are supported through ACPI
+depending on the ThinkPad model and firmware version.  On those
+ThinkPads, it is still possible to support some extra hotkeys by
+polling the "CMOS NVRAM" at least 10 times per second.  The driver
+attempts to enables this functionality automatically when required.
 
 procfs notes:
 
@@ -255,18 +259,11 @@ sysfs notes:
                 1: does nothing
 
         hotkey_mask:
-                bit mask to enable driver-handling (and depending on
+                bit mask to enable reporting (and depending on
                 the firmware, ACPI event generation) for each hot key
                 (see above).  Returns the current status of the hot keys
                 mask, and allows one to modify it.
 
-                Note: when NVRAM polling is active, the firmware mask
-                will be different from the value returned by
-                hotkey_mask.  The driver will retain enabled bits for
-                hotkeys that are under NVRAM polling even if the
-                firmware refuses them, and will not set these bits on
-                the firmware hot key mask.
-
         hotkey_all_mask:
                 bit mask that should enable event reporting for all
                 supported hot keys, when echoed to hotkey_mask above.
@@ -279,7 +276,8 @@ sysfs notes:
                 bit mask that should enable event reporting for all
                 supported hot keys, except those which are always
                 handled by the firmware anyway.  Echo it to
-                hotkey_mask above, to use.
+                hotkey_mask above, to use.  This is the default mask
+                used by the driver.
 
         hotkey_source_mask:
                 bit mask that selects which hot keys will the driver
@@ -287,9 +285,10 @@ sysfs notes:
                 based on the capabilities reported by the ACPI firmware,
                 but it can be overridden at runtime.
 
-                Hot keys whose bits are set in both hotkey_source_mask
-                and also on hotkey_mask are polled for in NVRAM.  Only a
-                few hot keys are available through CMOS NVRAM polling.
+                Hot keys whose bits are set in hotkey_source_mask are
+                polled for in NVRAM, and reported as hotkey events if
+                enabled in hotkey_mask.  Only a few hot keys are
+                available through CMOS NVRAM polling.
 
                 Warning: when in NVRAM mode, the volume up/down/mute
                 keys are synthesized according to changes in the mixer,
@@ -525,6 +524,7 @@ compatibility purposes when hotkey_report_mode is set to 1.
 0x2305          System is waking up from suspend to eject bay
 0x2404          System is waking up from hibernation to undock
 0x2405          System is waking up from hibernation to eject bay
+0x5010          Brightness level changed/control event
 
 The above events are never propagated by the driver.
 
@@ -532,7 +532,6 @@ The above events are never propagated by the driver.
 0x4003          Undocked (see 0x2x04), can sleep again
 0x500B          Tablet pen inserted into its storage bay
 0x500C          Tablet pen removed from its storage bay
-0x5010          Brightness level changed (newer Lenovo BIOSes)
 
 The above events are propagated by the driver.
 
@@ -621,6 +620,8 @@ For Lenovo models *with* ACPI backlight control:
 2. Do *NOT* load up ACPI video, enable the hotkeys in thinkpad-acpi,
    and map them to KEY_BRIGHTNESS_UP and KEY_BRIGHTNESS_DOWN.  Process
    these keys on userspace somehow (e.g. by calling xbacklight).
+   The driver will do this automatically if it detects that ACPI video
+   has been disabled.
 
 
 Bluetooth
@@ -1459,3 +1460,8 @@ Sysfs interface changelog:
 0x020400:       Marker for 16 LEDs support.  Also, LEDs that are known
                 to not exist in a given model are not registered with
                 the LED sysfs class anymore.
+
+0x020500:       Updated hotkey driver, hotkey_mask is always available
+                and it is always able to disable hot keys.  Very old
+                thinkpads are properly supported.  hotkey_bios_mask
+                is deprecated and marked for removal.
diff --git a/Documentation/i2c/chips/eeprom b/Documentation/misc-devices/eeprom
index f7e8104b5764..f7e8104b5764 100644
--- a/Documentation/i2c/chips/eeprom
+++ b/Documentation/misc-devices/eeprom
diff --git a/Documentation/i2c/chips/max6875 b/Documentation/misc-devices/max6875
index 10ca43cd1a72..1e89ee3ccc1b 100644
--- a/Documentation/i2c/chips/max6875
+++ b/Documentation/misc-devices/max6875
@@ -42,10 +42,12 @@ General Remarks
 
 Valid addresses for the MAX6875 are 0x50 and 0x52.
 Valid addresses for the MAX6874 are 0x50, 0x52, 0x54 and 0x56.
-The driver does not probe any address, so you must force the address.
+The driver does not probe any address, so you explicitly instantiate the
+devices.
 
 Example:
-$ modprobe max6875 force=0,0x50
+$ modprobe max6875
+$ echo max6875 0x50 > /sys/bus/i2c/devices/i2c-0/new_device
 
 The MAX6874/MAX6875 ignores address bit 0, so this driver attaches to multiple
 addresses.  For example, for address 0x50, it also reserves 0x51.
diff --git a/Documentation/networking/pktgen.txt b/Documentation/networking/pktgen.txt
index c6cf4a3c16e0..61bb645d50e0 100644
--- a/Documentation/networking/pktgen.txt
+++ b/Documentation/networking/pktgen.txt
@@ -90,6 +90,11 @@ Examples:
  pgset "dstmac 00:00:00:00:00:00"    sets MAC destination address
  pgset "srcmac 00:00:00:00:00:00"    sets MAC source address
 
+ pgset "queue_map_min 0" Sets the min value of tx queue interval
+ pgset "queue_map_max 7" Sets the max value of tx queue interval, for multiqueue devices
+                         To select queue 1 of a given device,
+                         use queue_map_min=1 and queue_map_max=1
+
  pgset "src_mac_count 1" Sets the number of MACs we'll range through.  
                          The 'minimum' MAC is what you set with srcmac.
 
@@ -101,6 +106,9 @@ Examples:
                               IPDST_RND, UDPSRC_RND,
                               UDPDST_RND, MACSRC_RND, MACDST_RND 
                               MPLS_RND, VID_RND, SVID_RND
+                              QUEUE_MAP_RND # queue map random
+                              QUEUE_MAP_CPU # queue map mirrors smp_processor_id()
+
 
  pgset "udp_src_min 9"   set UDP source port min, If < udp_src_max, then
                          cycle through the port range.
diff --git a/Documentation/networking/timestamping/timestamping.c b/Documentation/networking/timestamping/timestamping.c
index 43d143104210..a7936fe8444a 100644
--- a/Documentation/networking/timestamping/timestamping.c
+++ b/Documentation/networking/timestamping/timestamping.c
@@ -381,7 +381,7 @@ int main(int argc, char **argv)
         memset(&hwtstamp, 0, sizeof(hwtstamp));
         strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
         hwtstamp.ifr_data = (void *)&hwconfig;
-        memset(&hwconfig, 0, sizeof(&hwconfig));
+        memset(&hwconfig, 0, sizeof(hwconfig));
         hwconfig.tx_type =
                 (so_timestamping_flags & SOF_TIMESTAMPING_TX_HARDWARE) ?
                 HWTSTAMP_TX_ON : HWTSTAMP_TX_OFF;
diff --git a/Documentation/scsi/hptiop.txt b/Documentation/scsi/hptiop.txt
index a6eb4add1be6..9605179711f4 100644
--- a/Documentation/scsi/hptiop.txt
+++ b/Documentation/scsi/hptiop.txt
@@ -3,6 +3,25 @@ HIGHPOINT ROCKETRAID 3xxx/4xxx ADAPTER DRIVER (hptiop)
 Controller Register Map
 -------------------------
 
+For RR44xx Intel IOP based adapters, the controller IOP is accessed via PCI BAR0 and BAR2:
+
+     BAR0 offset    Register
+            0x11C5C Link Interface IRQ Set
+            0x11C60 Link Interface IRQ Clear
+
+     BAR2 offset    Register
+            0x10    Inbound Message Register 0
+            0x14    Inbound Message Register 1
+            0x18    Outbound Message Register 0
+            0x1C    Outbound Message Register 1
+            0x20    Inbound Doorbell Register
+            0x24    Inbound Interrupt Status Register
+            0x28    Inbound Interrupt Mask Register
+            0x30    Outbound Interrupt Status Register
+            0x34    Outbound Interrupt Mask Register
+            0x40    Inbound Queue Port
+            0x44    Outbound Queue Port
+
 For Intel IOP based adapters, the controller IOP is accessed via PCI BAR0:
 
      BAR0 offset    Register
@@ -93,7 +112,7 @@ The driver exposes following sysfs attributes:
 
 
 -----------------------------------------------------------------------------
-Copyright (C) 2006-2007 HighPoint Technologies, Inc. All Rights Reserved.
+Copyright (C) 2006-2009 HighPoint Technologies, Inc. All Rights Reserved.
 
   This file is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index f1708b79f963..4c7f9aee5c4e 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -209,6 +209,7 @@ AD1884A / AD1883 / AD1984A / AD1984B
   laptop        laptop with HP jack sensing
   mobile        mobile devices with HP jack sensing
   thinkpad      Lenovo Thinkpad X300
+  touchsmart    HP Touchsmart
 
 AD1884
 ======
@@ -358,6 +359,7 @@ STAC9227/9228/9229/927x
   5stack-no-fp  D965 5stack without front panel
   dell-3stack   Dell Dimension E520
   dell-bios     Fixes with Dell BIOS setup
+  volknob       Fixes with volume-knob widget 0x24
   auto          BIOS setup (default)
 
 STAC92HD71B*
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 1458448436cc..62682500878a 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -96,13 +96,16 @@ handles that the Linux kernel will allocate. When you get lots
 of error messages about running out of file handles, you might
 want to increase this limit.
 
-The three values in file-nr denote the number of allocated
-file handles, the number of unused file handles and the maximum
-number of file handles. When the allocated file handles come
-close to the maximum, but the number of unused file handles is
-significantly greater than 0, you've encountered a peak in your 
-usage of file handles and you don't need to increase the maximum.
-
+Historically, the three values in file-nr denoted the number of
+allocated file handles, the number of allocated but unused file
+handles, and the maximum number of file handles. Linux 2.6 always
+reports 0 as the number of free file handles -- this is not an
+error, it just means that the number of allocated file handles
+exactly matches the number of used file handles.
+
+Attempts to allocate more file descriptors than file-max are
+reported with printk, look for "VFS: file-max limit <number>
+reached".
 ==============================================================
 
 nr_open:
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index b3d8b4922740..a028b92001ed 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -22,6 +22,7 @@ show up in /proc/sys/kernel:
 - callhome                   [ S390 only ]
 - auto_msgmni
 - core_pattern
+- core_pipe_limit
 - core_uses_pid
 - ctrl-alt-del
 - dentry-state
@@ -135,6 +136,27 @@ core_pattern is used to specify a core dumpfile pattern name.
 
 ==============================================================
 
+core_pipe_limit:
+
+This sysctl is only applicable when core_pattern is configured to pipe core
+files to user space helper a (when the first character of core_pattern is a '|',
+see above).  When collecting cores via a pipe to an application, it is
+occasionally usefull for the collecting application to gather data about the
+crashing process from its /proc/pid directory.  In order to do this safely, the
+kernel must wait for the collecting process to exit, so as not to remove the
+crashing processes proc files prematurely.  This in turn creates the possibility
+that a misbehaving userspace collecting process can block the reaping of a
+crashed process simply by never exiting.  This sysctl defends against that.  It
+defines how many concurrent crashing processes may be piped to user space
+applications in parallel.  If this value is exceeded, then those crashing
+processes above that value are noted via the kernel log and their cores are
+skipped.  0 is a special value, indicating that unlimited processes may be
+captured in parallel, but that no waiting will take place (i.e. the collecting
+process is not guaranteed access to /proc/<crahing pid>/).  This value defaults
+to 0.
+
+==============================================================
+
 core_uses_pid:
 
 The default coredump filename is "core".  By setting
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index e6fb1ec2744b..a6e360d2055c 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/vm:
 - legacy_va_layout
 - lowmem_reserve_ratio
 - max_map_count
+- memory_failure_early_kill
+- memory_failure_recovery
 - min_free_kbytes
 - min_slab_ratio
 - min_unmapped_ratio
@@ -53,7 +55,6 @@ Currently, these files are in /proc/sys/vm:
 - vfs_cache_pressure
 - zone_reclaim_mode
 
-
 ==============================================================
 
 block_dump
@@ -275,6 +276,44 @@ e.g., up to one or two maps per allocation.
 
 The default value is 65536.
 
+=============================================================
+
+memory_failure_early_kill:
+
+Control how to kill processes when uncorrected memory error (typically
+a 2bit error in a memory module) is detected in the background by hardware
+that cannot be handled by the kernel. In some cases (like the page
+still having a valid copy on disk) the kernel will handle the failure
+transparently without affecting any applications. But if there is
+no other uptodate copy of the data it will kill to prevent any data
+corruptions from propagating.
+
+1: Kill all processes that have the corrupted and not reloadable page mapped
+as soon as the corruption is detected.  Note this is not supported
+for a few types of pages, like kernel internally allocated data or
+the swap cache, but works for the majority of user pages.
+
+0: Only unmap the corrupted page from all processes and only kill a process
+who tries to access it.
+
+The kill is done using a catchable SIGBUS with BUS_MCEERR_AO, so processes can
+handle this if they want to.
+
+This is only active on architectures/platforms with advanced machine
+check handling and depends on the hardware capabilities.
+
+Applications can override this setting individually with the PR_MCE_KILL prctl
+
+==============================================================
+
+memory_failure_recovery
+
+Enable memory failure recovery (when supported by the platform)
+
+1: Attempt recovery.
+
+0: Always panic on a memory failure.
+
 ==============================================================
 
 min_free_kbytes:
diff --git a/Documentation/vm/.gitignore b/Documentation/vm/.gitignore
index 33e8a023df02..09b164a5700f 100644
--- a/Documentation/vm/.gitignore
+++ b/Documentation/vm/.gitignore
@@ -1 +1,2 @@
+page-types
 slabinfo
diff --git a/Documentation/vm/ksm.txt b/Documentation/vm/ksm.txt
index 72a22f65960e..262d8e6793a3 100644
--- a/Documentation/vm/ksm.txt
+++ b/Documentation/vm/ksm.txt
@@ -52,15 +52,15 @@ The KSM daemon is controlled by sysfs files in /sys/kernel/mm/ksm/,
 readable by all but writable only by root:
 
 max_kernel_pages - set to maximum number of kernel pages that KSM may use
-                   e.g. "echo 2000 > /sys/kernel/mm/ksm/max_kernel_pages"
+                   e.g. "echo 100000 > /sys/kernel/mm/ksm/max_kernel_pages"
                    Value 0 imposes no limit on the kernel pages KSM may use;
                    but note that any process using MADV_MERGEABLE can cause
                    KSM to allocate these pages, unswappable until it exits.
-                   Default: 2000 (chosen for demonstration purposes)
+                   Default: quarter of memory (chosen to not pin too much)
 
 pages_to_scan    - how many present pages to scan before ksmd goes to sleep
-                   e.g. "echo 200 > /sys/kernel/mm/ksm/pages_to_scan"
-                   Default: 200 (chosen for demonstration purposes)
+                   e.g. "echo 100 > /sys/kernel/mm/ksm/pages_to_scan"
+                   Default: 100 (chosen for demonstration purposes)
 
 sleep_millisecs  - how many milliseconds ksmd should sleep before next scan
                    e.g. "echo 20 > /sys/kernel/mm/ksm/sleep_millisecs"
@@ -70,7 +70,8 @@ run              - set 0 to stop ksmd from running but keep merged pages,
                    set 1 to run ksmd e.g. "echo 1 > /sys/kernel/mm/ksm/run",
                    set 2 to stop ksmd and unmerge all pages currently merged,
                          but leave mergeable areas registered for next run
-                   Default: 1 (for immediate use by apps which register)
+                   Default: 0 (must be changed to 1 to activate KSM,
+                               except if CONFIG_SYSFS is disabled)
 
 The effectiveness of KSM and MADV_MERGEABLE is shown in /sys/kernel/mm/ksm/:
 
@@ -86,4 +87,4 @@ pages_volatile embraces several different kinds of activity, but a high
 proportion there would also indicate poor use of madvise MADV_MERGEABLE.
 
 Izik Eidus,
-Hugh Dickins, 30 July 2009
+Hugh Dickins, 24 Sept 2009
diff --git a/Documentation/vm/locking b/Documentation/vm/locking
index f366fa956179..25fadb448760 100644
--- a/Documentation/vm/locking
+++ b/Documentation/vm/locking
@@ -80,7 +80,7 @@ Note: PTL can also be used to guarantee that no new clones using the
 mm start up ... this is a loose form of stability on mm_users. For
 example, it is used in copy_mm to protect against a racing tlb_gather_mmu
 single address space optimization, so that the zap_page_range (from
-vmtruncate) does not lose sending ipi's to cloned threads that might 
+truncate) does not lose sending ipi's to cloned threads that might
 be spawned underneath it and go to user mode to drag in pte's into tlbs.
 
 swap_lock
diff --git a/Documentation/vm/page-types.c b/Documentation/vm/page-types.c
index 3eda8ea00852..3ec4f2a22585 100644
--- a/Documentation/vm/page-types.c
+++ b/Documentation/vm/page-types.c
@@ -2,9 +2,13 @@
  * page-types: Tool for querying page flags
  *
  * Copyright (C) 2009 Intel corporation
- * Copyright (C) 2009 Wu Fengguang <fengguang.wu@intel.com>
+ *
+ * Authors: Wu Fengguang <fengguang.wu@intel.com>
+ *
+ * Released under the General Public License (GPL).
  */
 
+#define _LARGEFILE64_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -13,12 +17,33 @@
 #include <string.h>
 #include <getopt.h>
 #include <limits.h>
+#include <assert.h>
 #include <sys/types.h>
 #include <sys/errno.h>
 #include <sys/fcntl.h>
 
 
 /*
+ * pagemap kernel ABI bits
+ */
+
+#define PM_ENTRY_BYTES      sizeof(uint64_t)
+#define PM_STATUS_BITS      3
+#define PM_STATUS_OFFSET    (64 - PM_STATUS_BITS)
+#define PM_STATUS_MASK      (((1LL << PM_STATUS_BITS) - 1) << PM_STATUS_OFFSET)
+#define PM_STATUS(nr)       (((nr) << PM_STATUS_OFFSET) & PM_STATUS_MASK)
+#define PM_PSHIFT_BITS      6
+#define PM_PSHIFT_OFFSET    (PM_STATUS_OFFSET - PM_PSHIFT_BITS)
+#define PM_PSHIFT_MASK      (((1LL << PM_PSHIFT_BITS) - 1) << PM_PSHIFT_OFFSET)
+#define PM_PSHIFT(x)        (((u64) (x) << PM_PSHIFT_OFFSET) & PM_PSHIFT_MASK)
+#define PM_PFRAME_MASK      ((1LL << PM_PSHIFT_OFFSET) - 1)
+#define PM_PFRAME(x)        ((x) & PM_PFRAME_MASK)
+
+#define PM_PRESENT          PM_STATUS(4LL)
+#define PM_SWAP             PM_STATUS(2LL)
+
+
+/*
  * kernel page flags
  */
 
@@ -47,7 +72,9 @@
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
+#define KPF_KSM                 21
 
 /* [32-] kernel hacking assistances */
 #define KPF_RESERVED            32
@@ -94,7 +121,9 @@ static char *page_flag_names[] = {
         [KPF_COMPOUND_TAIL]     = "T:compound_tail",
         [KPF_HUGE]              = "G:huge",
         [KPF_UNEVICTABLE]       = "u:unevictable",
+        [KPF_HWPOISON]          = "X:hwpoison",
         [KPF_NOPAGE]            = "n:nopage",
+        [KPF_KSM]               = "x:ksm",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",
@@ -126,6 +155,11 @@ static int		nr_addr_ranges;
 static unsigned long    opt_offset[MAX_ADDR_RANGES];
 static unsigned long    opt_size[MAX_ADDR_RANGES];
 
+#define MAX_VMAS        10240
+static int              nr_vmas;
+static unsigned long    pg_start[MAX_VMAS];
+static unsigned long    pg_end[MAX_VMAS];
+
 #define MAX_BIT_FILTERS 64
 static int              nr_bit_filters;
 static uint64_t         opt_mask[MAX_BIT_FILTERS];
@@ -133,9 +167,15 @@ static uint64_t		opt_bits[MAX_BIT_FILTERS];
 
 static int              page_size;
 
-#define PAGES_BATCH     (64 << 10)      /* 64k pages */
+static int              pagemap_fd;
 static int              kpageflags_fd;
-static uint64_t         kpageflags_buf[KPF_BYTES * PAGES_BATCH];
+
+static int              opt_hwpoison;
+static int              opt_unpoison;
+
+static char             *hwpoison_debug_fs = "/debug/hwpoison";
+static int              hwpoison_inject_fd;
+static int              hwpoison_forget_fd;
 
 #define HASH_SHIFT      13
 #define HASH_SIZE       (1 << HASH_SHIFT)
@@ -158,6 +198,11 @@ static uint64_t 	page_flags[HASH_SIZE];
         type __min2 = (y);                      \
         __min1 < __min2 ? __min1 : __min2; })
 
+#define max_t(type, x, y) ({                    \
+        type __max1 = (x);                      \
+        type __max2 = (y);                      \
+        __max1 > __max2 ? __max1 : __max2; })
+
 static unsigned long pages2mb(unsigned long pages)
 {
         return (pages * page_size) >> 20;
@@ -173,6 +218,74 @@ static void fatal(const char *x, ...)
         exit(EXIT_FAILURE);
 }
 
+int checked_open(const char *pathname, int flags)
+{
+        int fd = open(pathname, flags);
+
+        if (fd < 0) {
+                perror(pathname);
+                exit(EXIT_FAILURE);
+        }
+
+        return fd;
+}
+
+/*
+ * pagemap/kpageflags routines
+ */
+
+static unsigned long do_u64_read(int fd, char *name,
+                                 uint64_t *buf,
+                                 unsigned long index,
+                                 unsigned long count)
+{
+        long bytes;
+
+        if (index > ULONG_MAX / 8)
+                fatal("index overflow: %lu\n", index);
+
+        if (lseek(fd, index * 8, SEEK_SET) < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+
+        bytes = read(fd, buf, count * 8);
+        if (bytes < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+        if (bytes % 8)
+                fatal("partial read: %lu bytes\n", bytes);
+
+        return bytes / 8;
+}
+
+static unsigned long kpageflags_read(uint64_t *buf,
+                                     unsigned long index,
+                                     unsigned long pages)
+{
+        return do_u64_read(kpageflags_fd, PROC_KPAGEFLAGS, buf, index, pages);
+}
+
+static unsigned long pagemap_read(uint64_t *buf,
+                                  unsigned long index,
+                                  unsigned long pages)
+{
+        return do_u64_read(pagemap_fd, "/proc/pid/pagemap", buf, index, pages);
+}
+
+static unsigned long pagemap_pfn(uint64_t val)
+{
+        unsigned long pfn;
+
+        if (val & PM_PRESENT)
+                pfn = PM_PFRAME(val);
+        else
+                pfn = 0;
+
+        return pfn;
+}
+
 
 /*
  * page flag names
@@ -221,29 +334,39 @@ static char *page_flag_longname(uint64_t flags)
  * page list and summary
  */
 
-static void show_page_range(unsigned long offset, uint64_t flags)
+static void show_page_range(unsigned long voffset,
+                            unsigned long offset, uint64_t flags)
 {
         static uint64_t      flags0;
+        static unsigned long voff;
         static unsigned long index;
         static unsigned long count;
 
-        if (flags == flags0 && offset == index + count) {
+        if (flags == flags0 && offset == index + count &&
+            (!opt_pid || voffset == voff + count)) {
                 count++;
                 return;
         }
 
-        if (count)
-                printf("%lu\t%lu\t%s\n",
+        if (count) {
+                if (opt_pid)
+                        printf("%lx\t", voff);
+                printf("%lx\t%lx\t%s\n",
                                 index, count, page_flag_name(flags0));
+        }
 
         flags0 = flags;
         index  = offset;
+        voff   = voffset;
         count  = 1;
 }
 
-static void show_page(unsigned long offset, uint64_t flags)
+static void show_page(unsigned long voffset,
+                      unsigned long offset, uint64_t flags)
 {
-        printf("%lu\t%s\n", offset, page_flag_name(flags));
+        if (opt_pid)
+                printf("%lx\t", voffset);
+        printf("%lx\t%s\n", offset, page_flag_name(flags));
 }
 
 static void show_summary(void)
@@ -320,6 +443,62 @@ static uint64_t well_known_flags(uint64_t flags)
         return flags;
 }
 
+static uint64_t kpageflags_flags(uint64_t flags)
+{
+        flags = expand_overloaded_flags(flags);
+
+        if (!opt_raw)
+                flags = well_known_flags(flags);
+
+        return flags;
+}
+
+/*
+ * page actions
+ */
+
+static void prepare_hwpoison_fd(void)
+{
+        char buf[100];
+
+        if (opt_hwpoison && !hwpoison_inject_fd) {
+                sprintf(buf, "%s/corrupt-pfn", hwpoison_debug_fs);
+                hwpoison_inject_fd = checked_open(buf, O_WRONLY);
+        }
+
+        if (opt_unpoison && !hwpoison_forget_fd) {
+                sprintf(buf, "%s/renew-pfn", hwpoison_debug_fs);
+                hwpoison_forget_fd = checked_open(buf, O_WRONLY);
+        }
+}
+
+static int hwpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_inject_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison inject");
+                return len;
+        }
+        return 0;
+}
+
+static int unpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_forget_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison forget");
+                return len;
+        }
+        return 0;
+}
 
 /*
  * page frame walker
@@ -352,73 +531,124 @@ static int hash_slot(uint64_t flags)
         exit(EXIT_FAILURE);
 }
 
-static void add_page(unsigned long offset, uint64_t flags)
+static void add_page(unsigned long voffset,
+                     unsigned long offset, uint64_t flags)
 {
-        flags = expand_overloaded_flags(flags);
-
-        if (!opt_raw)
-                flags = well_known_flags(flags);
+        flags = kpageflags_flags(flags);
 
         if (!bit_mask_ok(flags))
                 return;
 
+        if (opt_hwpoison)
+                hwpoison_page(offset);
+        if (opt_unpoison)
+                unpoison_page(offset);
+
         if (opt_list == 1)
-                show_page_range(offset, flags);
+                show_page_range(voffset, offset, flags);
         else if (opt_list == 2)
-                show_page(offset, flags);
+                show_page(voffset, offset, flags);
 
         nr_pages[hash_slot(flags)]++;
         total_pages++;
 }
 
-static void walk_pfn(unsigned long index, unsigned long count)
+#define KPAGEFLAGS_BATCH        (64 << 10)      /* 64k pages */
+static void walk_pfn(unsigned long voffset,
+                     unsigned long index,
+                     unsigned long count)
 {
+        uint64_t buf[KPAGEFLAGS_BATCH];
         unsigned long batch;
-        unsigned long n;
+        unsigned long pages;
         unsigned long i;
 
-        if (index > ULONG_MAX / KPF_BYTES)
-                fatal("index overflow: %lu\n", index);
+        while (count) {
+                batch = min_t(unsigned long, count, KPAGEFLAGS_BATCH);
+                pages = kpageflags_read(buf, index, batch);
+                if (pages == 0)
+                        break;
+
+                for (i = 0; i < pages; i++)
+                        add_page(voffset + i, index + i, buf[i]);
+
+                index += pages;
+                count -= pages;
+        }
+}
 
-        lseek(kpageflags_fd, index * KPF_BYTES, SEEK_SET);
+#define PAGEMAP_BATCH   (64 << 10)
+static void walk_vma(unsigned long index, unsigned long count)
+{
+        uint64_t buf[PAGEMAP_BATCH];
+        unsigned long batch;
+        unsigned long pages;
+        unsigned long pfn;
+        unsigned long i;
 
         while (count) {
-                batch = min_t(unsigned long, count, PAGES_BATCH);
-                n = read(kpageflags_fd, kpageflags_buf, batch * KPF_BYTES);
-                if (n == 0)
+                batch = min_t(unsigned long, count, PAGEMAP_BATCH);
+                pages = pagemap_read(buf, index, batch);
+                if (pages == 0)
                         break;
-                if (n < 0) {
-                        perror(PROC_KPAGEFLAGS);
-                        exit(EXIT_FAILURE);
+
+                for (i = 0; i < pages; i++) {
+                        pfn = pagemap_pfn(buf[i]);
+                        if (pfn)
+                                walk_pfn(index + i, pfn, 1);
                 }
 
-                if (n % KPF_BYTES != 0)
-                        fatal("partial read: %lu bytes\n", n);
-                n = n / KPF_BYTES;
+                index += pages;
+                count -= pages;
+        }
+}
+
+static void walk_task(unsigned long index, unsigned long count)
+{
+        const unsigned long end = index + count;
+        unsigned long start;
+        int i = 0;
+
+        while (index < end) {
 
-                for (i = 0; i < n; i++)
-                        add_page(index + i, kpageflags_buf[i]);
+                while (pg_end[i] <= index)
+                        if (++i >= nr_vmas)
+                                return;
+                if (pg_start[i] >= end)
+                        return;
 
-                index += batch;
-                count -= batch;
+                start = max_t(unsigned long, pg_start[i], index);
+                index = min_t(unsigned long, pg_end[i], end);
+
+                assert(start < index);
+                walk_vma(start, index - start);
         }
 }
 
+static void add_addr_range(unsigned long offset, unsigned long size)
+{
+        if (nr_addr_ranges >= MAX_ADDR_RANGES)
+                fatal("too many addr ranges\n");
+
+        opt_offset[nr_addr_ranges] = offset;
+        opt_size[nr_addr_ranges] = min_t(unsigned long, size, ULONG_MAX-offset);
+        nr_addr_ranges++;
+}
+
 static void walk_addr_ranges(void)
 {
         int i;
 
-        kpageflags_fd = open(PROC_KPAGEFLAGS, O_RDONLY);
-        if (kpageflags_fd < 0) {
-                perror(PROC_KPAGEFLAGS);
-                exit(EXIT_FAILURE);
-        }
+        kpageflags_fd = checked_open(PROC_KPAGEFLAGS, O_RDONLY);
 
         if (!nr_addr_ranges)
-                walk_pfn(0, ULONG_MAX);
+                add_addr_range(0, ULONG_MAX);
 
         for (i = 0; i < nr_addr_ranges; i++)
-                walk_pfn(opt_offset[i], opt_size[i]);
+                if (!opt_pid)
+                        walk_pfn(0, opt_offset[i], opt_size[i]);
+                else
+                        walk_task(opt_offset[i], opt_size[i]);
 
         close(kpageflags_fd);
 }
@@ -446,20 +676,22 @@ static void usage(void)
 "            -r|--raw                  Raw mode, for kernel developers\n"
 "            -a|--addr    addr-spec    Walk a range of pages\n"
 "            -b|--bits    bits-spec    Walk pages with specified bits\n"
-#if 0 /* planned features */
 "            -p|--pid     pid          Walk process address space\n"
+#if 0 /* planned features */
 "            -f|--file    filename     Walk file address space\n"
 #endif
 "            -l|--list                 Show page details in ranges\n"
 "            -L|--list-each            Show page details one by one\n"
 "            -N|--no-summary           Don't show summay info\n"
+"            -X|--hwpoison             hwpoison pages\n"
+"            -x|--unpoison             unpoison pages\n"
 "            -h|--help                 Show this usage message\n"
 "addr-spec:\n"
 "            N                         one page at offset N (unit: pages)\n"
 "            N+M                       pages range from N to N+M-1\n"
 "            N,M                       pages range from N to M-1\n"
 "            N,                        pages range from N to end\n"
-"            ,M                        pages range from 0 to M\n"
+"            ,M                        pages range from 0 to M-1\n"
 "bits-spec:\n"
 "            bit1,bit2                 (flags & (bit1|bit2)) != 0\n"
 "            bit1,bit2=bit1            (flags & (bit1|bit2)) == bit1\n"
@@ -496,21 +728,53 @@ static unsigned long long parse_number(const char *str)
 
 static void parse_pid(const char *str)
 {
+        FILE *file;
+        char buf[5000];
+
         opt_pid = parse_number(str);
-}
 
-static void parse_file(const char *name)
-{
+        sprintf(buf, "/proc/%d/pagemap", opt_pid);
+        pagemap_fd = checked_open(buf, O_RDONLY);
+
+        sprintf(buf, "/proc/%d/maps", opt_pid);
+        file = fopen(buf, "r");
+        if (!file) {
+                perror(buf);
+                exit(EXIT_FAILURE);
+        }
+
+        while (fgets(buf, sizeof(buf), file) != NULL) {
+                unsigned long vm_start;
+                unsigned long vm_end;
+                unsigned long long pgoff;
+                int major, minor;
+                char r, w, x, s;
+                unsigned long ino;
+                int n;
+
+                n = sscanf(buf, "%lx-%lx %c%c%c%c %llx %x:%x %lu",
+                           &vm_start,
+                           &vm_end,
+                           &r, &w, &x, &s,
+                           &pgoff,
+                           &major, &minor,
+                           &ino);
+                if (n < 10) {
+                        fprintf(stderr, "unexpected line: %s\n", buf);
+                        continue;
+                }
+                pg_start[nr_vmas] = vm_start / page_size;
+                pg_end[nr_vmas] = vm_end / page_size;
+                if (++nr_vmas >= MAX_VMAS) {
+                        fprintf(stderr, "too many VMAs\n");
+                        break;
+                }
+        }
+        fclose(file);
 }
 
-static void add_addr_range(unsigned long offset, unsigned long size)
+static void parse_file(const char *name)
 {
-        if (nr_addr_ranges >= MAX_ADDR_RANGES)
-                fatal("too much addr ranges\n");
-
-        opt_offset[nr_addr_ranges] = offset;
-        opt_size[nr_addr_ranges] = size;
-        nr_addr_ranges++;
 }
 
 static void parse_addr_range(const char *optarg)
@@ -630,6 +894,8 @@ static struct option opts[] = {
         { "list"      , 0, NULL, 'l' },
         { "list-each" , 0, NULL, 'L' },
         { "no-summary", 0, NULL, 'N' },
+        { "hwpoison"  , 0, NULL, 'X' },
+        { "unpoison"  , 0, NULL, 'x' },
         { "help"      , 0, NULL, 'h' },
         { NULL        , 0, NULL, 0 }
 };
@@ -641,7 +907,7 @@ int main(int argc, char *argv[])
         page_size = getpagesize();
 
         while ((c = getopt_long(argc, argv,
-                                "rp:f:a:b:lLNh", opts, NULL)) != -1) {
+                                "rp:f:a:b:lLNXxh", opts, NULL)) != -1) {
                 switch (c) {
                 case 'r':
                         opt_raw = 1;
@@ -667,6 +933,14 @@ int main(int argc, char *argv[])
                 case 'N':
                         opt_no_summary = 1;
                         break;
+                case 'X':
+                        opt_hwpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
+                case 'x':
+                        opt_unpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
                 case 'h':
                         usage();
                         exit(0);
@@ -676,15 +950,17 @@ int main(int argc, char *argv[])
                 }
         }
 
+        if (opt_list && opt_pid)
+                printf("voffset\t");
         if (opt_list == 1)
-                printf("offset\tcount\tflags\n");
+                printf("offset\tlen\tflags\n");
         if (opt_list == 2)
                 printf("offset\tflags\n");
 
         walk_addr_ranges();
 
         if (opt_list == 1)
-                show_page_range(0, 0);  /* drain the buffer */
+                show_page_range(0, 0, 0);  /* drain the buffer */
 
         if (opt_no_summary)
                 return 0;
diff --git a/Documentation/vm/pagemap.txt b/Documentation/vm/pagemap.txt
index 600a304a828c..df09b9650a81 100644
--- a/Documentation/vm/pagemap.txt
+++ b/Documentation/vm/pagemap.txt
@@ -57,7 +57,9 @@ There are three components to pagemap:
     16. COMPOUND_TAIL
     16. HUGE
     18. UNEVICTABLE
+    19. HWPOISON
     20. NOPAGE
+    21. KSM
 
 Short descriptions to the page flags:
 
@@ -86,9 +88,15 @@ Short descriptions to the page flags:
 17. HUGE
     this is an integral part of a HugeTLB page
 
+19. HWPOISON
+    hardware detected memory corruption on this page: don't touch the data!
+
 20. NOPAGE
     no page frame exists at the requested address
 
+21. KSM
+    identical memory pages dynamically shared between one or more processes
+
     [IO related page flags]
  1. ERROR     IO error occurred
  3. UPTODATE  page has up-to-date data
diff --git a/Documentation/w1/masters/ds2482 b/Documentation/w1/masters/ds2482
index 9210d6fa5024..299b91c7609f 100644
--- a/Documentation/w1/masters/ds2482
+++ b/Documentation/w1/masters/ds2482
@@ -24,8 +24,8 @@ General Remarks
 
 Valid addresses are 0x18, 0x19, 0x1a, and 0x1b.
 However, the device cannot be detected without writing to the i2c bus, so no
-detection is done.
-You should force the device address.
+detection is done. You should instantiate the device explicitly.
 
-$ modprobe ds2482 force=0,0x18
+$ modprobe ds2482
+$ echo ds2482 0x18 > /sys/bus/i2c/devices/i2c-0/new_device